This article appears in the April 16, 2009, edition of ISO&Agent Weekly.
HomeATMePayment Solutions, which has developed a way for shoppers to useplug-in card readers with their home computers to make PIN-debitpurchases online, is hoping to expand the number of merchants andconsumers that use its product through ISO sales channels.

TheMontreal-based company is "unveiling" its product and price points toISOs at this month's Electronic Transactions Association Annual Meetingand Expo in Las Vegas, says Mitchell Cobrin, HomeATM chief operatingofficer. 

As profit margins decrease and competition increasesin the payments industry, many ISOs are seeking value-add products andservices to earn additional revenue. Cobrin believes ISOs can yieldadditional revenue and increased merchant loyalty by outfittingmerchants and their clients with the ability to accept PIN-debitpayments online.

Unknown is whether merchants and consumers will accept and use the device, according to analysts.

"Wesee same-store sales are declining. They're being cannibalized byWeb-based transactions," says Cobrin. Selling online PIN-debitcapability "will open doors to the ISO community to ensure theirlongevity and new product innovation," he says.
ISOs earn a flat feeon the sale of a terminal and a per-transaction fee, Cobrin says,declining specify the fee amounts. HomeATM also earns revenue onhardware sales and per transaction, he says.

HomeATM produces apersonal card-swipe device and PIN pad that consumers plug directlyinto a PC's USB port and use for online PIN-debit payments. Merchantsalso can use the device for point-of-sale transactions atbrick-and-mortar locations.

Merchants can purchase theterminals to distribute to their consumer clients or use at retaillocations. Consumers also can purchase the terminals directly for theirpersonal use.

The system requires no installation or softwarefor use with consumers' home computers. When consumers check out at aparticipating merchant's Web site, the site prompts them to use thedevice to swipe their card and enter their PIN to complete atransaction.

The device is compliant with the Payment Card Industry Data Security Standard.
HomeATMhas a relationship with Brookfield, Wis.-based transaction processoreFunds Inc., which is owned by Jacksonville, Fla.-based FidelityNational Information Services Inc., to switch the transactions.

Cobrin did not reveal the names of any merchants using the device.

Device Distribution

HomeATMhas a "two-pronged approach" to getting devices in the market, saysCobrin. "There is the e-commerce ISO… [and] then there is thebrick-and-mortar ISO," he says. The first approach is to have ISOs sellthe device as a point-of-sale terminal for retailers that want toaccept PIN and signature-debit payments.

HomeATM had not completed its pricing model for the devices at the time of its interview with ISO&Agent Weekly. "We're trying to get it under $100," says Cobrin.
The second approach is to get brick-and-mortar shoppers to make online purchases using the device.

GenerationTechnologies Inc. has found success selling HomeATM's product toInternet retailers under the MiniTeller brand, says Hish Derby,director of technologies with the Burlington, Mass.-based ISO.

"Wehave been able to get out 35,000 units into the U.S." working with 12online merchants, says Derby. The number of devices in the market "isgrowing weekly," he says.

The merchants interested in thedevice typically have recurring monthly business from customers, suchas online pharmaceutical companies, says Derby.
Most of themerchants that work with Generation Technologies purchase the devicesfrom the ISO and provide them to customers to enable them to makeonline purchases, says Jay Srivasan, Generation senior account manager.However, some consumers have purchased them directly from GenerationTechnologies, he says.

Merchant Benefits

Less-expensiveinterchange rates should entice merchants to distribute the devices totheir customers, contends Kenneth Mages, HomeATM chairman and CEO.
Merchantscan save more than 75 basis points on card-present transactionscompared with card-not-present, according to a merchant-services guideSan Francisco-based Wells Fargo & Co. released last year. Forexample, swiped card transactions can save merchants $7.50 per $1,000,says John B. Frank, HomeATM executive advisor.

"To put it inperspective, that's a $7.5 million dollar interchange savings for a $1billion retailer converting its customers to a card-presentenvironment," he says.
"The discounted rates and fees are a lot less than credit card transactions, agrees Derby.

Merchantsthat provide the devices to their customers can boost client retention,adds Srivasan. "A merchant may decided to send recurring customers afree one after a couple of months, and that locks a customer in," hesays. "It helps retain customers."

While it may be easy toconvince merchants of the benefits of using the online PIN-debitdevice, consumer adoption of HomeATM's payment device may be difficultto achieve, says Adil Moussa, an analyst at Boston-based Aite GroupLLC. He believes consumers may be unwilling to use such a device.

"Peoplewant easier and simpler things to use," he says. "Asking people to haveanother device on their desk for their online shopping is not really away to achieve that."

Consumer and merchant adoption willdetermine HomeATM's success, says Avivah Litan, vice president ofGartner Inc., a Stamford, Conn.-based consultancy.

"It'salways the chicken-and-egg problem," Litan says. "Consumers will notstart using these devices until merchants accept them, and merchantswill not accept them unless there are huge incentives."

Dueling Online PIN-Debit Systems

WhileHomeATM ePayment Solutions is hoping consumers will embrace InternetPIN-debit purchases using card readers that plug into personalcomputers, multiple electronic funds transfer networks are testing asoftware-based system.

Atlanta-based Acculynk Inc. is planning apilot of its PaySecure product with the Pulse EFT network.Accel/Exchange and NYCE are two other EFT networks piloting PaySecure.Acculynk plans to announce a fourth network soon, says Ashish Bahl,Acculynk CEO.

Acculynk's PaySecure product enables PIN-debitpurchases online by integrating its PaySecure software into amerchant's online-checkout system. Cardholders use their computer'smouse to enter their four-digit PIN into an Acculynk virtual PIN padthat appears on the computer's monitor.

Montreal-based HomeATMproduces a personal card-swipe device and PIN pad that consumers plugdirectly into a PC's USB port and use for online PIN-debit payments.

Hardware Versus Software

Securityand privacy analyst Avivah Litan is against any software or Web-basedPIN-entry products. "The holy grail for criminals is PINs and ATMcards," says Litan, vice president of Stamford, Conn.-based GartnerInc. 

"I would highly recommend [to any consumer] not enteringtheir PIN anywhere on the Internet unless it was hardware-based," Litansays.

Montreal-based HomeATM claims using hardware is saferbecause "it's dually authenticated like it is at the brick-and-mortarstores," says Kenneth Mages, HomeATM chairman and CEO.

HomeATM'sdevice uses secure socket layer encryption between a personal computer,HomeATM's data center, the merchant, and a virtual private networkbetween the company's data center and processor. Secure socket layerencryption establishes a private communication channel that enablesencryption of data during transmission, according to VeriSign Inc.

HomeATM acts as the downstream processor, Mages says.

"We also encrypt the track 2 data, which is not done at the retail level," Mages says.
However,hardware-distribution may be a greater hurdle for HomeATM ePaymentSolutions to overcome than consumer acceptance as it seeks to expandbusiness for its plug-in card readers that enable shoppers to makePIN-debit purchases online from their home computers, according toBruce Cundiff, Javelin director of payments research and consulting.

"Ithink there is viability in the market for both" on-screen PIN-debitInternet-acceptance technology like Acculynk's PaySecure product anddevice-based products like HomeATM's to succeed, he says. "But I seethe issue [for hardware-based technology] being more logistics thanconsumer acceptance," says Cundiff.

"The distribution of anyhardware associated with a method of payment for online transactionshasn't really succeeded in any instance," says Cundiff, citing AmericanExpress' distribution failure in 1999 of a chip card reader forconsumers who had the first versions of its smart card-enabled BlueCard. "The Blue Card was a marketing success, but the technology partof it was a resounding failure, so I am very skeptical of any solutionthat requires the distribution of hardware to consumers" he says. 

PaySecure Survey

Asurvey Javelin Strategy & Research conducted reveals 80% ofparticipants would use Acculynk's PaySecure Internet PIN-debit productif a trusted merchant presents it.

Pleasanton, Calif.-basedJavelin surveyed 500 debit card users who made online purchases duringthe last year. Participants used PaySecure for a mock online purchaseand then answered questions about their experience using the product.Acculynk and Pulse commissioned the study. 

Sixty-five percentof participants said they would feel safer buying on the Internet usingPaySecure, while 48% would buy more often on the Internet if they couldpay using the product. "That 65% is a very strong number from ourvantage point versus what a lot of people could have thought" in theaftermath of recent security breaches, Bahl says.

The survey is the first of several research steps the company will conduct regarding the product, an Acculynk spokesperson says.

HomeATM ePayment Solutions, which offers a system that lets people make online purchases with PIN debit cards, is now promoting its technology for remittances and online banking.

The Montreal company said last month that its SafeTPIN device meets the Payment Card Industry data security standard, and Ken Mages, HomeATM's chairman and chief executive, said last week that his company had signed a deal with a foreign remittance company that plans to distribute 250,000 of the devices to U.S. consumers, who could use them to send money to their home countries. He would not name the remittance company or say where it is based.

"Once those units are out there, they do us a lot of good because they can be used for any merchant who wants to use our payment method," Mages said.

The SafeTPIN devices incorporate both a card reader and PIN pad; they plug into a computer's USB port.

Participating Web sites prompt users s to swipe their debit cards and enter their PIN to complete the transaction.

John B. Frank, HomeATM's executive adviser, said the PCI certification could make online merchants more willing to accept the device since HomeATM would be liable for any breach linked to a SafeTPIN.

The device is also easy to use in sending remittances, he said.

A dedicated Web site prompts the sender to enter his name and e-mail address, the recipient's name and e-mail address and the amount. The sender also selects a security question, the answer to which is known by both parties.

The sender then swipes his or her card and enters the PIN to complete the transaction. (Senders can also use credit cards by using the same PIN that they already use for automated teller machine withdrawals.)

Both the sender and recipient receive a confirmation by e-mail. To claim the money, the recipient visits the Web site, answers the security question and swipes his or her debit card through a SafeTPIN device and enters a PIN. The funds are instantly transferred to the recipient's checking account.

"It's user-friendly," Frank said. "Consumers know how to go to a retailer, swipe their card and enter a PIN."

Mages said his company has not yet set a price for the SafeTPIN devices; he expects merchants and banks to take the lead in distributing them to consumers.

HomeATM will also offer the device to banks as a tool to authenticate online banking customers.

SafeTPIN is more secure than the user name-password combination widely used today, Mages said. "If someone puts malware on your computer and they are keylogging the strokes or they phished you to a third party, they are going to be able to read your bank account."

Paul Turgeon, a senior consultant at the research firm Payments and Processing Consultants, in Chicago, said the consumers' online banking passwords can be hacked but that a hardware device offers strong security.

Turgeon formerly worked at Metavante Technologies Inc.'s NYCE Payments Network LLC debit unit, where he helped develop a similar card reader for consumers, SafeDebit.

He said HomeATM's device is a "reasonably affordable and very good" product but that the technology is not an issue. Merchants and banks that would consider offering the devices to consumers need to believe it is worth the investment.

Merchants will wonder "how many consumers is it going to get for me," he said, and banks will ask "what is the interchange rate." Any kind of Internet PIN-debit product will face challenges until something can "get enough mass to get both parties interested."

Turgeon also said the Federal Financial Institutions Examination Council has required two-factor authorization for online banking for some time "and no one I know is doing it very well."

Nowthat its personal card-swipe device and PIN pad have receivedcertification from the Payment Card Industry Security Council, HomeATMePayment Solutions plans to target the person-to-person funds transferand online banking authentication markets.

The Montreal-basedcompany recently signed a deal with a foreign remitter that wouldenable consumers to wire funds from the U.S. to their home countriesusing its SafeTPIN device. The remitter is set to distribute 250,000devices, according to Kenneth Mages, HomeATM chairman and CEO. Magesdeclined to reveal the foreign remitter or where it is based.

 "Oncethose [250,000] units are out there, they do us a lot of good becausethey can be used for any merchant who wants to use our payment method,"Mages says.
HomeATM's device plugs directly into a PC's USB port.The system requires no installation or software. If used in anonline-merchant environment, the Web site prompts consumers to use thedevice to swipe their card and enter their PIN to complete atransaction (ADN, 2/12).

"The [PCI] certificationremoves the merchant from the scope of [Payment Card Industry DataSecurity Standard compliance] since the device is already certified,"says John B. Frank, HomeATM executive advisor. If a breach occurs withSafeTPIN, the responsibility is on HomeATM, not the merchant, becausethe device is certified.
Last week, HomeATM visited SourceMedia'sChicago office to demonstrate the person-to-person funds-transfercapabilities of the company's device.

When prompted at adedicated Web site, the sender enters his name, e-mail address and therecipient's name and e-mail address. The sender then selects a securityquestion, the answer to which both parties know. An amount is entered,and the sender can choose between an instant transfer or one scheduledfor sending later.

After the sender fills in the requiredfields, the Web site asks to confirm the security question answer andthe recipient's e-mail address. The sender then selects a paymenttype–credit or debit–and is prompted to swipe his card through hisreader and enter a PIN. A screen then appears to show the transactionis complete.

Both the sender and recipient receive an e-mailmessage about the transaction. The recipient clicks the hyperlinkincluded in the e-mail and is transferred to a Web site to complete thetransaction. The recipient enters the security question answer and thenswipes his card through his own reader and enters a PIN. The fundsinstantly are transferred to the recipient's checking account.

The process takes less than five minutes.

"It's user friendly," Frank says. "Consumers know how to go to a retailer, swipe their card and enter a PIN."

Magessays the company has not determined how much the devices will costmerchants and financial institutions, but it will be on them todistribute SafeTPIN to consumers.

HomeATM will display anddemonstrate the device at this month's Electronic TransactionsAssociation trade show in Las Vegas. The company will share a boothwith Brookfield, Wis.-based transaction processor eFunds Inc., a unitof Jacksonville, Fla.-based Fidelity National Information Services Inc.

Mages' hope is financial institutions will realize SafeTPIN isthe only secure method to log into an online banking environment. "Ifsomeone puts malware on your computer and they are keylogging thestrokes or they phished you to a third party, they are going to be ableto read your bank account," he says.

Paul Turgeon, who helpedcreated NYCE's original SafeDebit product, agrees with Mages. TheFederal Financial Institutions Examination Council has requiredtwo-factor authorization for online banking for some time and "almostno one is doing it," Turgeon claims. "And no one I know is doing itvery well," he adds.

Login credentials required for online banking can be hacked, Turgeon says.
Turgeonbelieves HomeATM's device is a "reasonably affordable and very good"product, but the technology is not the issue. Merchants and financialinstitutions that would ship the devices to consumers want to know ifthey are making a good investment. "[For merchants] how many consumersis it going to get for me and [banks will ask] what is the interchangerate," Turgeon says.

He adds any kind of Internet PIN-debitproduct will face challenges until "some vehicle [comes along] to getenough mass to get both parties interested."

HomeATM's PCIcertification comes at a time when the Accel/Exchange electronic fundstransfer network is piloting its own software-based Internet PIN-debitproduct. That system enable consumers to enter their PINs on a virtualPIN pad that appears on the computer monitor during checkout (ADN,11/20).While Morris Plains, N.J.-based Accel/Exchange contends its product issecure, HomeATM disagrees and has cited a number of studies to supportits position.

Since 2001, 72% of all data breaches in NorthAmerican occurred via point-of-sale software, while 23% occurredthrough online shopping carts, according to a report by Chicago-baseddata-security company Trustwave. About 1% of breaches occur because ofa hardware breach.

Mages and Frank both say they are concernedwith what happens with a software-based system because of what a breachwould mean for HomeATM's prospects. "It's not so much that we arejealous of [Atlanta-based] Acculynk [Inc.] (which is partnering withAccel/Exchange), for lack of a better word," Frank says. "We'reconcerned if a breach occurs, then the whole ecosystem gets messed upand that affects us."

A breach on a software or hardwareInternet PIN-debit product would be "very damaging" from the consumerpoint of view, Turgeon says. "If it were to get hacked, then I wouldthink the merchant community would ask what's the upside to [InternetPIN-debit]," he adds. ATM

Heightenedattention to data breaches tied to point-of-sale software and onlineshopping carts is bolstering a security-engineering company's argumentthat the use of PINs on the Internet can be done securely only using apayment card terminal that attaches to consumers' personal computers.HomeATM ePayment Solutions, which is based in Montreal, is close topiloting a personal card-swipe device and PIN pad that consumers plugdirectly into a PC's USB port. The system requires no installation orsoftware. When consumers check out at a participating merchant's Website, the site prompts them to use the device to swipe their card andenter their PIN to complete a transaction. If a retailer conducts asuccessful pilot, the hardware will provide peace of mind for theconsumer while turning card-not-present interchange rates to cheapercard-present rates for merchants, contends Kenneth Mages, HomeATMchairman and CEO. The company has an agreement with a major electronicfunds network to begin the pilot, but first HomeATM wants to secureparticipation from a large, Tier 1 merchant, Mages says. Tier 1, orLevel 1, merchants process more than 6 million transactions per year.The company is considering several merchants, including a majorU.S.-based airline, which Mages declined to name. The device, calledSafeTPIN, received Payment Card Industry Data Security Standardcertification two weeks ago.