UNIT III E-COMMERCE SECURITY AND PAYMENT SYSTEMS

5.0 OBJECTIVES
For electronic commerce to have a chance to meet the soaring expectations set in the
press with regards to the Internet, efficient and effective payment services need to be
established and accepted by businesses and consumers alike.

After going through this lesson, you will be able to:

 Describe the concept of Electronic Payment System

 Define various types of Electronic Payment System
 Explore various dimensions of Electronic Payment System
 Identify security issues in Elect+ronic Payment System
 Explore the managerial issues in Electronic Payment System
 Explore the future of Electronic Payment System in India

5.1 INTRODUCTION
Electronic payment systems are central to on-line business process as companies look for
ways to serve customers faster and at lower cost. Emerging innovations in the payment
for goods and services in electronic commerce promise to offer a wide range of new
business opportunities.

Electronic payment systems and e-commerce are highly linked given that on-line
consumers must pay for products and services. Clearly, payment is an integral part of the
mercantile process and prompt payment is crucial. If the claims and debits of the various
participants (consumers, companies and banks) are not balanced because of payment
delay, then the entire business chain is disrupted. Hence an important aspect of e-
commerce is prompt and secure payment, clearing, and settlement of credit or debit
claims.

The current state of on-line electronic payments is in many ways reminiscent of the
medieval ages. The merchants of Asia and Europe faced a similar problem while trying to
unlock the commercial potential of the expanding marketplace. Those ancient traders

1
 faced a number of obstacles (e.g., conflicting local laws and customs regarding
commercial practices and incompatible and nonconvertible currencies) that restricted
trade. To circumvent some of these problems, traders invented various forms of payment
instruments. The merchants also developed commercial law surrounding the use of these

instruments that proved to be one of the turning points in the history of trade and
commerce. We are on the verge of a similar sort of development today, but one that is
unlikely to take anywhere near the centuries it took for the traditional payment system to
evolve.

Everyone agrees that the payment and settlement process is a potential bottleneck in the
fast-moving electronic commerce environment if we rely on conventional payment
methods such as cash, checks, bank drafts, or bills of exchange. Electronic replicas of
these conventional instruments are not well suited for the speed required in e-commerce
purchase processing. For instance, payments of small denominations (micropayments)
must be made and accepted by vendors in real time for snippets of information.
Conventional instruments are too slow for micropayments and the high transaction costs
involved in processing them add greatly to the overhead. Therefore new methods of
payment are needed to meet the emerging demands of e-commerce. These neo-payment
instruments must be secure, have a low processing cost, and be accepted widely as global
currency tender.

Electronic Payment Systems

Electronic payment systems are becoming central to on-line business transactions
nowadays as companies look for various methods to serve customers faster and more cost
effectively. Electronic commerce brings a wide range of new worldwide business
opportunities. There is no doubt that electronic payment systems are becoming more and
more common and will play an important role in the business world. Electronic payment
always involves a payer and a payee who exchange money for goods or services. At least
one financial institution like a bank will act as the issuer (used by the payer) and the
acquirer (used by the payee).

2
Awareness of risks Electronic Payment Systems
Security, legal certainty and trust are important elements, influencing the acceptance of
commerce by both individuals and businesses. Furthermore, sociological and cost factors
play a significant role.

Several reports on awareness of risks are related to the non-transparent legal background
for both companies and consumers. In this context, e-commerce reluctance appears to be
more pronounced in firms than in customers. The main reason for firms to be reluctant
may be insecurity caused by the lack of legal rules determining when a transaction is
legally binding. For customers, in addition to this, the security of on-line payment
methods may be decisive. An important issue is credit card acceptance by retailers in
Europe. The credit cards were offered to merchants originally on the grounds, that
authorized transactions would be honoured. Now the system is established, banks in some
countries charge traders for fraudulent transactions, which causes tensions. Some large
retailers still refuse to take credit cards because of the terms of business. The result has
been a move towards debit cards - which use the same infrastructure but have different
contractual terms.

In general, there seems to be no consensus on whether companies and customers clearly

distinguish between secured and unsecured methods of payment and whether they would
not accept the latter because of the risks involved. Some parties believe that companies
and customers clearly distinguish between secured and unsecured methods. However,
others maintain that only companies clearly distinguish between secured and unsecured
methods. Customers’ awareness of risks on the other hand is most probably based on
perception rather than on facts, and is therefore less analytical. If both partners in
ecommerce (banks and merchants) are reliable and offer convenient payment schemes,
customers will make use of them.

The general public remains unaware of the risk issue. The main concern of the average
consumer seems to be confidentiality about credit card numbers exchanged on the
Internet. Some experts share the view that the perceived lack of security in on-line
electronic payments is largely exaggerated and not justified at all by the actual threat. The
average consumer does not yet realize that the risk of compromising his card number is
3
 far greater in conventional face-to-face transactions than on the Internet. This is partly the
result of ignorance and unfamiliarity, as well as a mistaken belief in the security of

traditional payment systems. In this respect, the difficulty of generalizing about the
security aspects of all systems should be stressed. There is a wide variety of payment
systems with different security features and thus with varying security level.

Many other issues affect the security of electronic payments perhaps even more
importantly: e.g. the physical, procedural and personnel security procedures operated at
the ends of any telecommunications link (whether via a PC, smart card or mobile phone).
It is also fairly well known that most security failures are caused by “insider” threats
rather than by external hackers (or crackers).

Confidence in the reliable operation of the terminal equipment(s) is essential.

5.2 TYPES OF ELECTRONIC PAYMENT SYSTEMS

Conventional Payment Process
A conventional process of payment and settlement involves a buyer-to-seller transfer of
cash or payment information (e.g. credit card or check). The actual settlement of payment
takes place in the financial processing network. A cash payment requires a buyer's
withdrawal from his bank account, a transfer of cash to the seller, and the seller's deposit
of the payment to his/her account. Non-cash payment mechanisms are settled by
adjusting, i.e. crediting and debiting, the appropriate accounts between the banks based
on payment information conveyed via check or credit card. Figure 5.1 is a simplified
diagram for both cash and non-cash transactions. Cash moves from the buyer's bank to
the seller's bank through face-to-face exchanges in the market. If a buyer uses a non-cash
method of payment, payment information instead of cash flows from the buyer to the
seller, and ultimately payments are settled between affected banks who notationally
adjust accounts based on the payment information. In real markets, this clearing process
involves some type of intermediaries such as credit card services or check clearing
companies. Schematically then most payment systems are based on similar processes.
The 'information' conveyed to settle payments can be one of the following: information
about the identities of the seller and the buyer and some instruction to settle payments

4
without revealing financial information [payment clearing systems financial information

5
such as credit card or bank accounts numbers (including checks and debit cards) actual
values represented by digital currency

Figure 5.1: A Cheque simplified model of transaction

Type 1: Payment Through an Intermediary - Payment Clearing Services

When face-to-face purchase is replaced with on-line commerce, many aspects of a
transaction occur instantly, under which various processes of a normal business
interaction are subsumed. For example, a typical purchase involves stages of locating a
seller, selecting a product, asking a price quote, making an offer, agreeing over payment
means, checking the identity and validity of the payment mechanism, transferring of
goods and receipts. In order to be used as a substitute for face-to-face payments, online
payment systems must incorporate all or some of these stages within their payment
functions. The lack of face-to-face interaction also leads to more secure methods of
payment being developed for electronic commerce, to deal with the security problems for
sensitive information and uncertainty about identity. Consequently, electronic commerce
transactions require intermediaries to provide security, identification, and authentication
as well as payment support.

Figure 5.2 shows a stylized transaction for online commerce using an intermediary. In
this model, the intermediary not only settles payments, it also takes care of such needs as
confirming seller and buyer identities, authenticating and verifying ordering and payment

6
information and other transactional requirements lacking in virtual interactions. In the
figure, two boxes delineate online purchasing and secure or off-line payment clearing
processes. Payment settlement in this figure follows the example of the traditional
electronic funds transfer model which uses secured private value networks. The
intermediary contributes to market efficiency by resolving uncertainties about security
and identity and relieving vendors of the need to set up duplicative hardware and
software to handle the online payment clearing process. The payment information
transmitted by the buyer may be one of three types. First, it may contain only customer
order information such as the identity of the buyer and seller, name of the product,
amount of payment, and other sale conditions but no payment information such as credit
card numbers or checking account numbers. In this case, the intermediary acts as a
centralized commerce enabler maintaining membership and payment information for
both sellers and buyers. A buyer need only send the seller his identification number
assigned by the intermediary. Upon receiving the purchase order, the intermediary
verifies it with both the buyer and seller and handles all sensitive payment information on
behalf of both.

Figure 5.2: Transactions with an intermediary

7
 The key benefit of this payment clearing system is that it separates sensitive and non-
sensitive information and only non-sensitive information is exchanged online. This
alleviates the concern with security that is often seen as a serious barrier to online
commerce. In fact, First Virtual does not even rely on encryption for messages between
buyers and sellers. A critical requisite for this system to work is the users' trust in the
intermediaries.

Type 2: Payment Based on EFT - Notational Funds Transfer

The second type of payment systems does not depend on a central processing
intermediary. Instead, sensitive payment information (such as credit card or bank account
number) is transmitted along with orders, which is in effect an open Internet
implementation of financial electronic data interchange (EDI) (see Figure 5.3). An
electronic funds transfer (EFT) is a financial application of EDI, which sends credit card
numbers or electronic checks via secured private networks between banks and major
corporations. To use EFTs to clear payments and settle accounts, an online payment
service will need to add capabilities to process orders, accounts and receipts. In its
simplest form, payment systems may use digital checks —simply an image of a check—
and rely on existing payment clearing networks. The Secure Electronic Transaction
(SET) protocol - a credit card based system supported by Visa and MasterCard - uses
digital certificates, which are digital credit cards. We call this type of payment system as
notational funds transfer system since it resembles traditional electronic fund transfers
and wire transfers which settle notational accounts of buyers and sellers.

8
 Figure 5.3: Notational funds transfer system

Notational funds transfer systems differ from payment clearing services in that the
'payment information' transferred online contains sensitive financial information. Thus, if
it is intercepted by a third party, it may be abused like stolen credit cards or debit cards. A
majority of proposed electronic payment systems fall into this second type of payment
systems. The objective of these systems is to extend the benefit and convenience of EFT
to consumers and small businesses. However, unlike EFTs, the Internet is open and not as
secure as private value added networks (VANs). The challenge to these systems is how to
secure the integrity of the payment messages being transmitted and to ensure the
interoperability between different sets of payment protocols.

Type 3: Payment Based on Electronic Currency

The third type of payment systems transmit not payment information but a digital product
representing values: electronic currency. The nature of digital currency mirrors that of
paper money as a means of payment. As such, digital currency payment systems have the
same advantages as paper currency payment, namely anonymity and convenience. As in
other electronic payment systems, here too security during transmission and storage is a
concern, although from a different perspective, for digital currency systems doubles
pending, counterfeiting, and storage become critical issues whereas eavesdropping and

9
the issue of liability (when charges are made without authorization) are important for
notational funds transfers. Figure 5.4 shows a digital currency payment scheme.

Figure 5.4: Digital Currency Payment Scheme

The only difference from Figure is that the intermediary in Figure 5.4 acts as an
electronic bank which converts outside money, into inside money (e.g. tokens or e-cash)
which is circulated within online markets. However, as a private monetary system, digital
currency will have wide ranging impact on money and monetary system with
implications extending far beyond mere transactional efficiency. Already digital currency
has spawned many types of new businesses: software vendors for currency server
systems; hardware vendors for smart card readers and other interface devices; technology
firms for security, encryption and authentication; and new banking services interfacing
accounts in digital currency and conventional currency.

5.3 DIMENSIONS OF ELECTRONIC PAYMENT SYSTEM

Electronic payment systems can be considered to be merely the next - albeit significant -
step in a long line of changes in payment clearing systems. The electronic settling of
accounts, for example, has long been an integral part of payment systems using credit
cards, debit cards, automatic teller machines, and prepaid cards. What enables any
payment mechanism to be processed electronically is the fact that unlike currency, bills,
or coins which carry monetary values, non-cash mechanisms are promises or contracts of

10
payments. Based on the information transmitted or characteristics following a transaction,
the appropriate accounts representing notational money are adjusted between banks and
financial institutions. The difference between the various types of Electronic payments
systems discussed in section 5.2 can be shown by the table 5.1

Table 5.1: DIMENSIONS OF ELECTRONIC PAYMENT SYSTEM

Dimension Cash Personal Credit Stored Accumulat
Check Card Value -ing
(Debit Balance
Card)
Instantly convertible without Yes No No No No
intermediation
Low transaction cost for small Yes No No No Yes
transactions
Low transaction cost for large No Yes Yes Yes Yes
transactions
Low fixed costs for merchant Yes Yes No No No
Refutable (able to be repudiated) No Yes Yes No Yes
(usually)
Financial risk for consumer Yes No Yes Limited No
Financial risk for merchant No Yes Yes No Yes
Anonymous for consumer Yes No No No No
Anonymous for merchant Yes No No No No
Immediately respendable Yes No No No No
Security against unauthorized use No Some Some Some Some
Tamper-resistant Yes No Yes Yes Yes
Requires authentication No Yes Yes Yes Yes
Special hardware required No No Yes – by Yes – by Yes – by
merchant merchant merchant
Buyers keeps float No Yes Yes No Yes
Account required No Yes Yes Yes Yes
Has immediate monetary value Yes No No Yes No
Source: Adapted from Mackie-Mason and White,1996

11
5.4 TRADITIONAL PAYMENT SYSTEMS VS ELECTRONIC PAYMENTSYSTEMS

 Offline versus Online Offline payments involve no contact with a third party
during payment: The transaction involves only the payer and payee. The obvious
problem with offline payments is that it is difficult to prevent payers from
spending more money than they actually possess. In a purely digital world, a
dishonest payer can easily reset the local state of his system to a prior state after
each payment. Online payments involve an authorization server (usually as part of
the issuer or acquirer) in each payment. Online systems obviously require more
communication. In general, they are considered more secure than offline systems.
Most proposed Internet payment systems are online. All proposed payment
systems based on electronic hardware, including Mondex and CAFE (Conditional
Access for Europe), are offline systems. Mondex is the only system that enables
offline transferability: The payee can use the amount received to make a new
payment himself/herself, without having to go to the bank in between. However,
this seems to be a politically unpopular feature. CAFE is the only system that
provides strong payer anonymity and un-traceability. Both systems offer payers
an electronic wallet, preventing fake-terminal attacks on the payer’s PIN. CAFE
also provides loss tolerance, which allows the payer to recover from coin losses
(but at the expense of some anonymity in case of loss). Mondex and CAFE are
multicurrency purses capable of handling different currencies simultaneously. All
these systems can be used for Internet payments,and there are several plans for so
doing, but none is actually being used at the time of this writing. The main
technical obstacle is that they require a smart card reader attached to the payer’s
computer. Inexpensive PCMCIA smart card readers and standardized infrared
interfaces on notebook computers will solve this connectivity problem. Another
system being developed along these lines is the FSTC (Financial Services
Technology Consortium) Electronic Check Project, which uses a tamper-resistant
PCMCIA card and implements a check-like payment model. Instead of tamper-
resistant hardware, offline authorization could be given via preauthorization: The
payee is known to the payer in advance, and the payment is already authorized
during withdrawal, in a way similar to a certified bank check.

12
 Trusted hardware Offline payment systems that seek to prevent (not merely
detect) double spending require tamper-resistant hardware at the payer end. The
smart card is an example. Tamper-resistant hardware may also be used at the
payee end. An example is the security modules of point-of-sale (POS) terminals.
This is mandatory in the case of shared-key systems and in cases where the payee
does not forward individual transactions but the total volume of transactions. In a
certain sense, tamper-resistant hardware is a “pocket branch” of a bank and must
be trusted by the issuer. Independent of the issuer’s security considerations, it is in
the payer’s interest to have a secure device that can be trusted to protect his secret
keys and to perform the necessary operations. Initially, this could be simply a
smart card. But in the long run, it should become a smart device of a different
form factor with secure access to a minimal keyboard and display. This is often
called an electronic wallet. Without such a secure device, the payers’ secrets and
hence their money are vulnerable to anybody who can access his computer. This
is obviously a problem in multiuser environments. It is also a problem even on
single-user computers that may be accessed directly or indirectly by others. A
virus, for example, installed on a computer could steal PINs and passwords as
they are entered. Even when a smart card is available to store keys, a virus
program may directly ask the smart card to make a payment to an attacker’s
account. Thus for true security, trusted input/output channels between the user
and the smart card must exist.

 Cryptography A wide variety of cryptographic techniques have been developed

for user authentication, secret communication, and nonrepudiation. They are
essential tools in building secure payment systems over open networks that have
little or no physical security. There are also excellent reference works on
cryptography.

 “Cryptofree” systems Using no cryptography at all means relying on out-band

security: Goods ordered electronically are not delivered until a fax arrives from
the payer confirming the order. First Virtual is a cryptofree system. A user has an

13
 account and receives a password in exchange for a credit card number, but the
password is not protected as it traverses the Internet. Such a system is vulnerable
to eavesdropping. First Virtual achieves some protection by asking the payer for
an acknowledgment of each payment via email, but the actual security of the
system is based on the payer’s ability to revoke each payment within a certain
period. In other words, there is no definite authorization during payment. Until the
end of this period, the payee assumes the entire risk.

 Generic payment switch A payment switch is an online payment system that

implements both the prepaid and pay-later models, as exemplified by the
OpenMarket payment switch. OpenMarket’s architecture supports several
authentication methods, depending on the payment method chosen. The methods
range from simple, unprotected PIN-based authentication to challenge-response-
based systems, in which the response is computed, typically by a smart card.
Actually, OpenMarket uses passwords and optionally two types of devices for
response generation: Secure Net Key and SecureID. User authentication therefore
is based on shared-key cryptography. However, authorization is based on public-
key cryptography: the OpenMarket payment switch digitally signs an
authorization message, which is forwarded to the payee. The payment switch is
completely trusted by users who use shared-key cryptography.

 Shared-key cryptography Authentication based on shared-key cryptography

requires that the prover (the payer) and a verifier (the issuer) both have a shared
secret. A DES key is one example of a shared secret; a password and PIN are
other examples. Because both sides have exactly the same secret information,
shared-key cryptography does not provide nonrepudiation. If payer and issuer
disagree about a payment, there is no way to decide if the payment was initiated
by the payer or by an employee of the issuer. Authenticating a transfer order on
the basis of shared keys is therefore not appropriate if the payer bears the risk of
forged payments.4 If authentication is to be done offline, each payer payee pair
needs a shared secret. In practice this means that some sort of master key is

14
 present at each payee end, to enable the payee to derive the payer’s key. Tamper-
resistant security modules in point-of-sale terminals protect the master key. Most
offline systems Danmont / Visa and the trial version of Mondex) and online
systems (NetBill, and the 2KP variant of iKP) use a shared secret between payer
and issuer for authentication.

 Public-key digital signatures Authentication based on public-key cryptography

requires that the prover have a secret signing key and a certificate for its
corresponding public signature verification key. The certificate is issued by a
well-known authority. Most systems now use RSA encryption, but there are
several alternatives. Digital signatures can provide nonrepudiation— disputes
between sender and receiver can be resolved. Digital signatures should be
mandatory if the payer bears the risk of forged payments. A rather general
security scheme that uses publickey signatures is Secure Socket Layer. SSL is a
socketlayer communication interface that allows two parties to communicate
securely over the Internet. It is not a payment technology per se, but has been
proposed as a means to secure payment messages. SSL does not support
nonrepudiation. Complete payment systems using public-key cryptography
include e-cash, NetCash, CyberCash, the 3KP variant of iKP, and Secure
Electronic Transactions (SET). The protocol ideas themselves are much older.
The use of digital signatures for both online and offline payments, anonymous
accounts with digitally signed transfer orders, and anonymous electronic cash
were all introduced during the 1980s.

 Payer anonymity Payers prefer to keep their everyday payment activities private.
Certainly they do not want unrelated third parties to observe and track their
payments. Often, they prefer the payees (shops, publishers, and the like) and in
some cases even banks to be incapable of observing and tracking their payments.
Some payment systems provide payer anonymity and un-traceability. Both are
considered useful for cash-like payments since cash is also anonymous and
untraceable. Whereas anonymity simply means that the payer’s identity is not

15
 used in payments, un-traceability means that, in addition, two different payments
by the same payer cannot be linked. By encrypting all flows between payer and
payee, all payment systems could be made untraceable by outsiders. Payer
anonymity with respect to the payee can be achieved by using pseudonyms
instead of real identities. Some electronic payment systems are designed to
provide anonymity or even un-traceability with respect to the payee (iKP, for
example, offers this as an option). Currently, the only payment systems mentioned
here that provide anonymity and un-traceability against payee and issuer are e-
cash (online) and CAFE (offline). Both are based on public-key cryptography, a
special form of signatures called blind signatures. A blind signature on some
message is made in such a way that the signer does not know the exact content of
the message. DigiCash’s e-cash, which is also based on the concept of blind
signatures, is a cash-like payment system providing high levels of anonymity and
un-traceability. In an e-cash system, users can withdraw e-cash coins from a bank
and use them to pay other users. Each e-cash coin has a serial number. To
withdraw e-cash coins, a user prepares a “blank coin” that has a randomly
generated serial number, blinds it, and sends it to the bank. If the user is
authorized to withdraw the specified amount of e-cash, the bank signs the blind
coin and returns it to the user. The user then unblinds it to extract the signed coin.
The signed coin can now be used to pay any other e-cash user. When a payee
deposits an e-cash coin, the bank records its serial number to prevent double-
spending. However, because the bank cannot see the serial number when it signs
the coin, it cannot relate the deposited coin to the earlier withdrawal by the payer.
NetCash and anonymous credit cards also provide anonymity and un-traceability.
But they are based on the use of trusted “mixes” that change electronic money of
one representation into another representation, without revealing the relation.
Neither e-cash nor CAFÉ assume the existence of such trusted third parties.

5.5 ELECTRONIC PAYMENTS AND PROTOCOLS

16
 There are many protocols that are currently employed to allow money to change hands in
cyberspace. But the most important open protocols used for payments on the Web are
SSL/TLS, SET, and IOTP.

SSL and TLS

The Secure Sockets Layer (SSL) protocol was designed by Netscape as a method for
secure client-server communications over the Internet. Using public key cryptography
and certificates, SSL offers a mechanism so that clients and servers can authenticate each
other and then engage in secure communication. During an initial handshaking phase, the
client and server select a secret key crypto scheme to use and then the client sends the
secret key to the server using the server’s public key from the server’s certificate. From
that point on, the information exchanged between the client and server is encrypted.

FIGURE 5.5: SSL/TLS messages exchanged between client and server.

17
SSL/TLS is an intermediate protocol layer that sits between TCP and a higher-layer
application. SSL/TLS can be employed by any application layer protocol running over
the Transmission Control Protocol (TCP), including Hypertext Transfer Protocol
(HTTP), File Transfer Protocol (FTP), Telnet, and the e-mail protocols (Simple Mail
Transfer Protocol — SMTP, Post Office Protocol — POP3, and Internet Message Access
Protocol — IMAP4). Indeed, the most widely known and widely used application of
SSL/TLS is for securing HTTP communication, denoted by the https:// in URLs and use
of TCP port 443.

At its heart, SSL/TLS is not a payment protocol at all. SSL’s goal is to provide a secure
connection between two parties and its application for electronic commerce is to provide
a secure communications channel over which a customer and business can exchange
private information. In fact, the processing of payments - such as the seller obtaining
credit card approval - continues to use the same mechanisms that are employed today by
businesses, such as the use of a private business-to-bank network or use of card swipe
machines at the business.

Secure communications in SSL/TLS relies on secret key cryptography (SKC) to ensure

privacy and public key cryptography (PKC) for key exchange and authentication. The
exact SKC and PKC algorithms, as well as key sizes, are negotiated on a per-session
basis between the client and server. In general, the client tells the server what crypto
algorithms it can support and lists them in preference order; the server selects the crypto
scheme that it supports that is highest on the client’s list. The client then creates an SKC
session key and sends it to the server.

One of the criticisms and concerns about SSL/TLS is that only the server provides a
certificate for authentication prior to securing the communication channel. The buyer is
authenticated when the seller checks the buyer’s credit card and determines that it is
valid, but this takes place after the communication channel is secured. The risk, of course,
is that the credit card could be stolen and then used by the thief to make on-line
purchases. Use of a client-side certificate would make this much more difficult.

18
 As the SSL/TLS protocol handshaking in Figure 5.1 shows, however, the protocol
provides the messages and procedures so that a certificate could be provided by both
client and server. This feature is not widely used today largely because the market hasn’t
demanded it. Recall that prior to the introduction of SSL in the mid-1990s, many people
were actually conducting business by sending credit card information in unencrypted e-
mails. To require users to obtain certificates for secure transactions would have been a
serious impediment to e-commerce due to the relative lack of sophistication of most users
and the lack of a user-oriented certificate mechanism. In any case, users today either
appear to be willing to accept the risks associated with not having a client certificate in
exchange for the convenience, or they are unaware of the risks and have not demanded
something different.

TLS continues the evolution started by SSL. Market acceptance and user confidence in
the protocol is extremely high and its use will clearly continue. It is worth noting that
SSL/TLS is sufficiently secure for the vast majority of consumers who use it today to
guard everything from credit card transactions and electronic banking to voting their
proxy shares and applying to college. Furthermore, we don’t hear about attackers stealing
users’ credit card numbers by grabbing packets off of the Internet and breaking the
encryption; the attackers instead break into the server and grab tens of thousands of
unencrypted credit card numbers!

TLS is also the basis for the Wireless Application Protocol (WAP) Forum‘s Wireless
TLS (WTLS) specification. WTLS is functionally similar to TLS 1.0 and provides
authentication, privacy, and data integrity between two applications communicating over
a wireless network. WTLS is optimized for the relatively low bandwidth and high latency
characteristics of this environment by incorporating such additional features as datagram
support, streamlined protocol handshaking, and dynamic key refreshing.

SET
Despite SSL’s popularity, MasterCard, Visa, and several other companies developed the
Secure Electronic Transaction (SET) protocol specifically to handle electronic payments.

19
SET version 1.0 was released in May 1997. Today, interoperability testing is in full
swing-many products, such as Cybercash’s popular merchant software, are already SET
compliant.

Fraud prevention is a primary motivator behind SET. Visa and Mastercard claim that
online credit card frauds closely track offline rates, which they estimate to be less than
one-tenth of one percent. That would seem to indicate that the current model of using
SSL to protect transactions is adequate. However, some recent studies have suggested
that merchants are experiencing fraud rates as high as 40% in certain segments of the
electronic marketplace-items such as airline tickets, computers, and downloadable
software carry the greatest risk. SET has the potential to reduce the chance of fraud by
providing rigorous authentication measures in addition to encrypting transactions.

The SET approach to cryptography is similar to SSL’s, employing a combination of of

the DES secret key and RSA public key schemes. A unique facet of SET’s RSA
implementation is that participants use two public/private key pairs: one for key exchange
and another for digital signatures. Digital certificates form the basis of SET security. In
addition to merchants possessing server-side certificates, customers are required to obtain
certificates so that their identities as legitimate cardholders can be verified. Payment
gateways interfacing between the Internet merchant and the traditional payment network
are also required to have certificates.

One of the biggest differences between SET and SSL is in scope. SET has several
components which communicate securely end-to-end across the Internet. Cardholders
interact with merchants who process order information and pass payment information to
payment gateways. In contrast, SSL is essentially point-to-point between buyer and
seller, and makes no explicit provisions for involving financial institutions.

20
SET only appears on the scene at the end of a purchase. All cryptographic schemes add
processing delay, so product selections are generally made without encryption to improve
performance, while registration, ordering, and other interactions involving personal
information take place using another secure protocol such as SSL.

After completing the order process, the customer clicks a button on the website’s
payment page to activate a wallet application. A reference number is generated by the
merchant software and sent to the customer software along with a summary of the order.
The cardholder selects the appropriate credit card in the digital wallet and clicks on a
payment button, invoking SET and beginning the payment process. An exchange of SET
messages over the Internet-between the cardholder and the merchant, and between the
merchant and the payment gateway-completes the transaction. Connections between the
payment gateway and banks use the existing payment network, and are thus are not part
of the SET specification.

SET provides a high degree of privacy for customers by encrypting payment information
so that only the bank can see it. Customer software sends a purchase request to the
merchant containing the following (Figure 5.6): unencrypted order information and a dual
signature, intended for the merchant; payment instructions and a dual signature, both
encrypted and intended for the payment gateway; and the cardholder’s digital certificate
to be used by the merchant and the payment gateway for authentication. Lacking the
payment gateway’s private key, the e-commerce site can only read the order information.
The merchant passes payment instructions in an authorization request to the gateway.
SET, then, eliminates the merchant as a vulnerability in the credit card chain; because the
merchant does not require access to the credit card account information, it is neither
processed nor stored it in their databases!

21
 FIGURE 5. 6: SET Purchase Request.

The order details and the account information are unequivocally associated through a
“dual signature” mechanism. The SET client software first combines a hash of the order
information with a hash of the payment instructions. The result is then hashed, thus
linking the order and payment together such that nobody can deny the bond. This second
hash value is signed by encrypting it with the customer’s secret key, tying the customer to
the purchase.

22
 The greatest weakness is on the consumer side. For SET to be of any real security benefit,
end user authentication has to be a part of the transaction. However, requiring the average
surfer to obtain a certificate is a dicey proposition, partially proven by the continued use
of SSL and server-only authentication. To promote migration, there are provisions to
allow for optional customer certificates in the short-term. Generating certificates involves
new user behavior, potentially complicating the customer’s shopping experience and
thereby discouraging purchases. To promote adoption of SET, the specification allows
for optional customer certificates-whether to require them is at the card issuer’s
discretion.

IOTP
Whereas SSL is a secure communications protocol that can be used by a consumer to
forward payment information and SET is a protocol specifically designed for credit card
transactions, the Internet Open Trading Protocol (IOTP) provides an interoperable
framework for consumer-to-business Internet-based electronic commerce. As a
commerce framework specification, IOTP is designed to replicate the "real" world of
transactions where consumers choose their product, choose their vendor, choose their
form of payment (in conjunction with their vendor), arrange delivery, and, periodically,
even return products. The designers of IOTP intend that this protocol will be the lingua
franca of Internet commerce just as EDI has become the standard document language for
"real" commerce; any two parties conducting Internet-based e-commerce in a way that
conforms to the IOTP specifications will be able to complete their transactions securely.

23
FIGURE 5.7: The flow of IOTP messages clearly indicates that the protocol can support
the entire shopping process and all parties to buying, selling, paying, and delivering
products and goods.

Figure 5.7 shows the general flow of an IOTP-based purchase. Note that it might be more
proper to refer to IOTP as a shopping protocol rather than a payment protocol since it
attempts to capture the entire online shopping cycle and shopping is more than merely
paying for stuff. And just as you might wander through the stores of a new mall in the
real world, IOTP is optimized for those cases where the buyer and merchant do not have
an a priori relationship.

The Selection and Offer step is a particularly good example of mapping e-commerce to
realspace. In this step, the user selects amongst payment mechanisms the way they might
in a "real" store. I might select a credit card, for example, because of an award that I may
get for using the card or perhaps because of a discount offer made by the store.
Alternatively, I may use one currency over another for some other perceived benefits.
IOTP maintains payment-system independence and can be used to encapsulate and

24
 support payment systems such as CyberCoin, e-cash, GeldKarte, MilliCent, Mondex,
SET, and others. Note also that IOTP procedures can be employed by the customer for
communication with the merchant, payment handler, and shipper which may be one, two,
or three different entities.

But while IOTP will support the familiar models of business that we have today, it also
has to support the new models that only the Internet has made viable. Individual very
low-value transactions don’t even exist in the real world because they use currency that
doesn’t "exist"! New product delivery models will also appear. Consider today’s Internet
market where the value of a product might be is irretrievably transferred to the customer
upon downloading a file; in this case, an item must be proved delivered before payment is
rendered but payment must be forthcoming upon delivery and nonrefundable.

Clearly, cryptography is an important part of the security associated with IOTP. Although
IOTP does not call out for specific algorithms, it does provide the flexibility that any
given transaction may employ symmetric (secret key), asymmetric (public key), or both
types of crypto schemes. Furthermore, depending upon transaction type, digital
certificates may or may not be employed. Again, the overhead and cost of the security
must be balanced with the needs of the buyer and the seller on a per-transaction basis.
Use of XML (eXtensible Markup Language) as the data representation language provides
flexibility and extensibility, and facilitates the development of a broad range of IOTP-
aware applications.

5.6 SECURITY REQUIREMENTS IN ELECTRONIC PAYMENT SYSTEMS

The concrete security requirements of electronic payment systems vary, depending both
on their features and the trust assumptions placed on their operation. In general, however,
electronic payment systems must exhibit integrity, authorization, confidentiality,
availability, and reliability.

Integrity and authorization

25
 A payment system with integrity allows no money to be taken from a user without
explicit authorization by that user. It may also disallow the receipt of payment without
explicit consent, to prevent occurrences of things like unsolicited bribery. Authorization
constitutes the most important relationship in a payment system. Payment can be
authorized in three ways: via out-band authorization, passwords, and signature.

Out-band authorization
In this approach, the verifying party (typically a bank) notifies the authorizing party (the
payer) of a transaction. The authorizing party is required to approve or deny the payment
using a secure, out-band channel (such as via surface mail or the phone). This is the
current approach for credit cards involving mail orders and telephone orders: Anyone
who knows a user’s credit card data can initiate transactions, and the legitimate user must
check the statement and actively complain about unauthorized transactions. If the user
does not complain within a certain time (usually 90 days), the transaction is considered
“approved” by default.

Password authorization
A transaction protected by a password requires that every message from the authorizing
party include a cryptographic check value. The check value is computed using a secret
known only to the authorizing and verifying parties. This secret can be a personal
identification number, a password, or any form of shared secret. In addition, shared
secrets that are short - like a six-digit PIN - are inherently susceptible to various kinds of
attacks. They cannot by themselves provide a high degree of security. They should only
be used to control access to a physical token like a smart card (or a wallet) that performs
the actual authorization using secure cryptographic mechanisms, such as digital
signatures.

Signature authorization
In this type of transaction, the verifying party requires a digital signature of the
authorizing party. Digital signatures provide nonrepudiation of origin: Only the owner of

26
 the secret signing key can “sign” messages (whereas everybody who knows the
corresponding public verification key can verify the authenticity of signatures.)

Confidentiality
Some parties involved may wish confidentiality of transactions. Confidentiality in this
context means the restriction of the knowledge about various pieces of information
related to a transaction: the identity of payer/payee, purchase content, amount, and so on.
Typically, the confidentiality requirement dictates that this information be restricted only
to the participants involved. Where anonymity or un-traceability are desired, the
requirement may be to limit this knowledge to certain subsets of the participants only, as
described later.

Availability and reliability

All parties require the ability to make or receive payments whenever necessary. Payment
transactions must be atomic: They occur entirely or not at all, but they never hang in an
unknown or inconsistent state. No payer would accept a loss of money (not a significant
amount, in any case) due to a network or system crash. Availability and reliability
presume that the underlying networking services and all software and hardware
components are sufficiently dependable. Recovery from crash failures requires some sort
of stable storage at all parties and specific resynchronization protocols. These fault
tolerance issues are not discussed here, because most payment systems do not address
them explicitly.

5.7 ELECTRONIC PAYMENTS AND CONSUMER EMPOWERMENT

Electronic payments empower the consumer in several fundamental ways that cash and
cheques cannot. One of the clearest ways is the security that dispute resolution provides,
offering consumers a form of insurance against purchases of faulty goods or services that
are not delivered or lower in quality than expected. Insurance against lost, stolen or
otherwise unauthorized use allows consumers to quickly shield themselves from liability,
at zero cost in some markets, unlike lost cash or cheques. Electronic payments also
provide the ability to control payment for goods and services over time by allowing

27
buyers to pay now, pay later, or prepay. Credit cards provide liquidity through pre-
approved credit availability, something that transaction-specific loans cannot do. This
works favorably for consumers, merchants, and banks because the process facilitates
current period sales while minimising the cost of obtaining credit. Debit cards offer
convenient and immediate access to funds on deposit. Globally branded electronic
payments have the ubiquitous and interoperable features that lend themselves to
immediate acceptability by consumers and businesses. Despite the value that consumers
place on electronic payments, and the benefits that extend to economies from the
underlying system, concerns are sometimes raised about abuse of credit and erosion of
consumer wealth. Often these concerns are raised in the context of new regulations that
would raise barriers to consumer access to credit and are based on an implicit assertion
that expanded credit availability and use produces widespread harm to consumers.
However, with the application of an objective analysis quite a different picture emerges.
An in-depth study of consumer behavior in Australia provides some insights into the
level and sophistication of payment usage and clearly shows that consumers have a high
level of understanding of payments and responsibly manage revolving credit.

5.8 DESIRABLE PROPERTIES OF DIGITAL CURRENCY

Developers of digital currency have a wide range of options to implement strong safety
requirements of transmitting values over the network. For example, a secure digital
currency can be implemented by using strong encryption algorithms, by employing
tamper-resistant hardware, or by securing the network communication. Although physical
specifications of digital coins and tokens may vary, the following properties are
fundamental to any digital currency payment system.

 Monetary Value To be used as a monetary unit, digital currency must have value
that can be exchanged for other goods and services, be used to pay fiduciary
obligations, or be transferred to another person. Since digital currency is
essentially a file, it does not have an intrinsic value, but must be linked to other
system of value. The most common implementation is to base the value of digital
currency on bank deposits, credits, or prepayments using outside money. Once a

28
 digital currency is convertible to dollars, the next step is for it to be accepted in
the market as a monetary token. Once accepted and trusted, a digital currency can
establish related properties such as exchangeability and transferability.

 Convenience Convenience has been the biggest factor in the growth of notational
currencies such as checks, which are scalable and easy to transport. Similarly,
digital currencies must be convenient to use, store, access, and transport. As a
digital file, it may allow remote access to money via telephone, modem, or
Internet connection. Electronic storage and transfer devices or network
capabilities will be needed. To gain wide acceptance, digital cash also must be
convenient in terms of scalability and interoperability so that users need not carry
multiple denominations or multiple versions for each operating system.

 Security To secure physical money and coins, one needs to store them in wallets,
safes or other private places. If digital currencies are stored in hard drives
connected to an open network, theoretically anybody can snoop and tamper with
the money. Encryption is used to protect digital currency against tampering. Some
proposals using smart cards, e.g. Mondex, store digital currency in tamper-
resistant hardware that can be maintained offline. Ecash relies on the security of
Ecach client software residing on users' computers. At the same time, digital
currencies must be resistant to accidents by owners. Rupee bills are printed on
strong paper that withstands many adverse treatments, such as washing. To
achieve similar security, adequate protection standards are needed both in
physical specifications of digital coins and in policy matters for legal and
commercial liabilities.

 Authentication Authentication of money is done by visually inspecting bills and

coins. Although further tests could weighing, chemical analysis, and contacting
the authorities, authentication is usually a simple matter for physical currency.
Digital currency, however, cannot be visually inspected, and it is difficult to
distinguish the original and a counterfeit. Because of this, inspection of digital

29
 currency depends on authenticating secondary information that accompanies the
bills or coins such as the digital signatures of banks or payers attached to the
currency (serial number). A more rigid system will require contacting a third
party each time a transaction is made. Although this system is more secure, the
transaction costs may be too high for small-value purchases. A hardware based
system like Mondex relies on software and hardware and does not require
authentication for each transfer of values. Other systems will have to strengthen
their client software or introduce hardware protection to allow peer-to-peer
transactions.

 Non-refutability Acknowledging payment and receipt is a basic property required

of a payment system. In cash transactions, simple receipt is enough to establish
non-refutability. A similar exchange of digital receipts can be used for digital
transactions. An alternative is to append all transaction records into the digital
currency itself. In this system, digital coins accumulate information about all
parties involved in past transactions. These are called identified tokens compared
to anonymous tokens, which do not reveal information about users.

 Accessibility and Reliability One advantage of digital currency over cash is its
capability to be transported over the network. Therefore, users can store digital
money at home but access it remotely via telephone or modem, the same network
used to clear payments. Because of this crucial role, digital payment systems must
provide continuous, fast, and reliable connections.

 Anonymity Unlike checks and cards, cash transactions are anonymous. An

anonymous payment system is needed to protect against revealing purchase
patterns and other consumer information, although untraceable transactions are
opposed by the government in view of possible criminal uses. Nevertheless, the
need will persist, and anonymity is perhaps the single most important property of
cash transactions. Digital currency can be equipped with varying degree of
anonymity masking the user identity to the bank, the payee, or both. Strong

30
 anonymity guarantees un-traceability while a weaker version allows the user's
identity to be traced when the need arises. While the issue of anonymity invokes
debates about tax evasion, money laundering and other criminal uses of digital
currency, the economic rationale for simple, anonymous digital coins is that they
reduce transaction costs by eliminating third parties and protect consumer
information that could be used to price-discriminate among consumers.

5.9 PROSPECTS OF ELECTRONIC PAYMENT SYSTEMS

As the volume of Electronic Commerce becomes larger, the role of secure and
economical online payments on the Internet will, accordingly, become more important.
At the moment, the credit card payment for B2C trades with SSL protocol is the most
widely adopted. However, SET protocol tailored to credit card payment may become one
of the next generation standards. For micro payment, smart-card-based e-cash will
become popular and will be recharged through the Internet from the cyber-banks, which
will revitalize the benefit of cyber-banks.

As B2B occupies the major portion of Electronic Commerce, more economical payment
methods like Internet-based funds transfer equipped with the benefit of check systems
will become the major medium for large-amount payments. The credit card fee seems too
high to transfer large amounts among credible corporations. This prospective trend
should envision opportunities to payment businesses and corporate finance managers.

5.10 MANAGERIAL ISSUES IN ELECTRONIC PAYMENT SYSTEMS

Managerial issues for electronic payment systems vary depending upon the business
position.

 Security solution providers can cultivate the opportunity of providing solutions

for secure electronic payment systems. Typical ones include authentication,
encryption, integrity, and nonrepudiation.

 Electronic payment systems solution providers can offer various types of

31
 electronic payment systems to e-stores and banks. The SET solution of having the
certificate on the smart card is an emerging issue to be resolved.

 Electronic stores should select an appropriate set of electronic payment systems.

Until electronic payment methods become popular among customers, it is
necessary to offer traditional payment methods as well.

 Banks need to develop cyber-banks compatible with the various electronic

payment systems (credit card, debit card, stored-value card, and e-check) that will
be used by customers at e-stores. Watch for the development of consistent
standards in certificates and stored-value-card protocols.

 Credit card brand companies need to develop standards like SET and watch 'the
acceptance by customers. It is necessary to balance security with efficiency.
Careful attention is needed to determine when the SSL-based solution will be
replaced by the SET -based solution and whether to combine the credit card with
the open or closed stored-value card.

 Smart card brands should develop a business model in cooperation with

application sectors (like transportation and pay phones) and banks. Having
standards is the key to expand interoperable applications. In designing business
models, it is important to consider the adequate number of smart cards from the
customer’s point of view.

 Certificate authorities need to identify all types of certificates to be provided.

Banks and credit card companies need to consider whether they should become a
clearing agent.

5.11 ELECTRONIC PAYMENT SYSTEM IN INDIA

The primary goal of any national payment system is to enable the circulation of money in
its economy. It is recognized world wide that an efficient and secure payment system is

32
an enabler of economic activity. It provides the conduit essential for effecting payments
and transmission of monetary policy. Payment systems have encountered many
challenges and are constantly adapting to the rapidly changing payments landscape. More
recently, the proliferation of electronic payment mechanisms, the increase in the number
of players in the financial arena and the payment crises in quite a few countries and
regions in the 1990s have focused attention on public policy issues related to the
organisation and operation of payment systems. Three main areas of public policy have
guided payments system development and reform: protecting the rights of users of
payment systems, enhancing efficiency and competition, and ensuring a safe, secure and
sound payments system.

Electronic commerce and finance are growing rapidly. New payments mechanisms
designed to aid electronic commerce have become routine. Predictions abound about the
capabilities of the information and communication technology to bring forth important
tools for conducting electronic commerce and payments. We are in the midst of a wave of
innovation and change.

In a dynamic economy, markets need to play a key role in guiding the development of
infrastructure, including mechanisms like payments systems. This means that innovation
and competition will be central to the future development of the payments system - as
they are in other areas of the economy. Strategic planning and investments by market
participants will be shaped by views about the future. Public policy should assist them in
shaping their views by pronouncing its vision and intentions clearly and well in advance
so that the market participants can face the challenges and take advantage of
opportunities. This Vision helps in charting out a course to purposeful and orderly
change.

For such policy pronouncements, a country can opt for a strategic approach, where the
state of the payment system is established, its weaknesses and strengths determined and a
way forward charted, giving due regard to the country’s environment and the strategic
direction of the payment technologies and practices. This approach enables one to have a

33
 holistic vision of the entire payment system, and leads to the development of a Strategic
Implementation Plan that is well structured, appropriately phased, properly sequenced
and convergent in perspective.

India adopted this approach in the year 2001 when it came out with its “Payment Systems
– Vision Document” with four major components. These are Safety, Security, Soundness
and Efficiency. Called the ‘Triple-S + E’ principle in short, each of the principles, which
have a synergistic inter-relationship, would specifically address the following:

 Safety will relate to addressing risk, so as to make the systems risk free or with
minimal risk
 Security will address the issues relating to confidence, with specific reference to
the users of these systems
 Soundness will be aimed at ensuring that the systems are built on strong edifices
and that they stand the test of time
 Efficiency will represent the measures aimed at efficiencies in terms of costs so
as to provide optimal and cost effective solutions.

Current Status
There are diverse payment systems functioning in the country, ranging from the paper
based systems where the instruments are physically exchanged and settlements worked
out manually to the most sophisticated electronic fund transfer system which are fully
secured and settle transactions on a gross, real time basis. They cater to both low value
retail payments and large value payments relating to the settlement of inter-bank money
market, Government securities and forex transactions.

The retail payment systems in the country comprise both paper based as well as
electronic based systems. They typically handle transactions which are low in value, but
very large in number, relating to individuals firms and corporates. These transactions
relate mainly to settlement of obligations arising from purchase of goods and services. In
India there are about 1050 cheques clearing houses. These clearing houses clear and settle

34
transactions relating to various types of paper based instruments like cheques, drafts,
payment orders, interest / dividend warrants, etc. In 40 of these clearing houses, cheque
processing centres (CPCs) using MICR technology have been set up. At 14 more clearing
houses, MICR cheque processing systems are proposed to be set up. The clearing houses
at 16 places including the 4 metros are managed by the Reserve Bank which also
functions as the settlement banker at these places. In other places the clearing houses are
managed by the State Bank of India and certain other public sector banks and the
settlement bank functions are also performed by the respective banks. The clearing
houses are voluntary bodies set up by the participating banks and post offices and they
function in an autonomous manner. The Reserve Bank has issued the Uniform
Regulations and Rules for Bankers’ Clearing Houses (URRBCH) which have been
adopted by all the clearing houses. These regulations and rules relate to the criteria for
membership / sub-membership, withdrawal / removal / suspension from membership and
the procedures for conducting of clearing as well as settlement of claims between
members.

There are various types of electronic clearing systems functioning in the retail payments
area in the country. Electronic Clearing System (ECS), both for Credit and Debit
operations, functions from 46 places (15 managed by Reserve Bank and the rest by the
State Bank of India and one by State Bank of Indore). The ECS is the Indian version of
the Automated Clearing Houses (ACH) for catering to bulk payments. The Electronic
Funds Transfer (EFT) System is operated by the Reserve Bank at 15 places. This is
typically for individual / single payments. These systems are governed by their own
respective rules. A variant of the EFT, called the Special Electronic Funds Transfer
(SEFT) System is also operated by the Reserve Bank to provide nation-wide coverage for
EFT. All these electronic fund transfer systems settle on deferred net settlement basis.

There are a few large value payment systems functioning in the country. These are the
Inter-Bank Cheques Clearing Systems (the Inter-bank Clearing), the High Value Cheques
Clearing System (the High Value Clearing), the Government Securities Clearing System
(the G-Sec Clearing), the Foreign Exchange Clearing System (the Forex Clearing) and

35
the Real Time Gross Settlement (RTGS) System. All these systems except the High
Value Clearings are electronic based systems. These mostly relate to inter-bank / inter-
financial institutional transactions except the High Value Clearing where high value
customer cheques are cleared. The Inter-bank Clearing functions in 7 places and the High
Value Clearing in 15 places - both are managed by the Reserve Bank. The G-Sec
Clearing and the Forex Clearing are managed by the Clearing Corporation of India
Limited (CCIL). The RTGS System is operated by the Reserve Bank. All these are
deemed to be Systemically Important Payment Systems (SIPS) and therefore the Reserve
Bank has, in line with the international best practices in this regard, moved them (except
the Inter-bank Clearings at places other than Mumbai and the High Value Clearings) to
either secure and guaranteed systems or the RTGS System.

5.12 FUTURE OF ELECTRONIC PAYMENTS SYSTEMS

The critical reasons in acceptance of electronic payment instruments and their niche in
the payments environment are:

1. The cost savings are substantial, and businesses and consumers will not be able to
ignore that fact once other issues are resolved.
2. The exponential growth of electronic commerce, online financial services,
electronic bill presentment and payment products, and new financial
communication networks will demand greater velocity in the movement of value
which are efficient and instantaneous.
3. The proliferation of business-to-business ("B2B") electronic commerce will force
payments systems to adapt to even greater speeds and standards of efficiency.
4. The adults of the future will not be wed to bricks and mortar, checkbooks or
passbooks or even ATM cards.

But we should not be fooled into thinking that 21st century electronic payments products
will totally replace checks, credit and debit cards, or cash. They will simply find their
niche in the financial products landscape like very other product did in the 20th century.

36
Legal Considerations
There are a variety of policy, operational and legal considerations confronting any
entrepreneur who attempts to tackle the challenge of creating a new form of value or a
new way to transmit it. Because most current banking and payments systems laws and
regulations have been constructed to deal with more traditional payment mechanisms,
they often do not provide a clear picture of whether and how they apply to new payment
vehicles or systems. That creates a sense of uncertainty that is not helpful to developing
markets. If the government does anything in the near future, it should foster legal
predictability in this area.

Jurisdictional Considerations
Money and payments systems are by their vary nature, multi-jurisdictional products. If
there is one thing that is meant to be in commerce, it is money. Thus the creation of new
global electronic payment instruments and systems raises a threshold issue. Whose laws
apply? While today, there is a well worn path of understanding regarding the application
of check clearing, ACH, credit card, FedWire and other traditional payments systems
rules, the development of new forms of money and new payments systems that are based
in Cyberspace necessarily raise jurisdictional questions. Which state or country will
regulate the activities of the entity or the movement of the electronic value it creates?

State Banking Laws

The creation of a new electronic payment product raises the possibility that it may
unknowingly conflict with banking laws in the states. To the extent that a non-bank
creates a payment product that is linked to an “account,” that entity may be engaging in
the business of banking without a license under state law. It may also have established an
illegal deposit relationship with its customers that subjects it to criminal penalties under
federal law. .
Who Should Facilitate Electronic Payments?
In a similar vein, there are intriguing legal, regulatory and policy questions that must be
answered when it comes to the question of who may mint, distribute, circulate and

37
transmit electronic payments? While most systems really aren't creating money in the
technical legal sense, in the economic and practical sense, they may be. If the medium of
exchange is trusted and the scale of acceptability is large, several critical questions arise:

1. Do electronic payment products affect the money supply?

2. Should non-regulated companies be permitted to mint, distribute, circulate and
transmit electronic money?
3. What protections should be constructed to deal with the failure of companies that
create, distribute or clear electronic money and liquidity crises in the resulting
electronic payments markets?
4. How should new electronic payments systems be protected, regulated and made
safe and secure?
5. Who provides the ultimate liquidity and stability that makes these new money and
payments systems work?

Most governments do not generally allow anyone but governmental entities to create
money. While private entities are able to create and distribute substitute money products
such as travelers checks, generally, they are viewed as special purpose instruments and
are not used in the same frequency, volume or scale as traditional money. Indeed, if one
form of electronic money offered by a private company or consortium of companies,
became ubiquitous, there would be economic downsides to consider alongside the
economic benefits it might confer. For example, if most Americans used electronic
money on smart cards, any hint that the sponsor of the system was in financial difficulty
or that the security of the system had been broken could result in a "run" on that form of
money. Merchants might refuse to accept the card. Card holders would rapidly retreat to
the bank whose name was co-branded on the smart card and demand "real money" in
exchange for their electronic money. If on the way to their bank, they passed an off-line
vending machine that accepted the card, they might use it to purchase a car load of sodas
to wipe out the value on the card, thus shifting the risk of loss to the owner of the vending
machine. While regulators are well equipped to handle bank failures, the collapse of a
form of currency is another matter altogether.

38
Similarly, the emerging area of electronic bill payment and presentment raises new issues
for payments systems. Today, a growing number of consumers pay their bills
electronically (electronic bill payment) without writing a check, finding an envelope or
licking a stamp. They may also receive their bills electronically (electronic bill
presentment) without ever receiving a paper bill in the mail. This system potentially
offers enormous cost savings to both consumers and billers. Yet, it also raises new issues
as to who bears responsibility should payments not be made. As the system has evolved
to date, the third party processors that facilitate electronic bill payment and presentment,
and through which a consumer. s funds may travel, typically are not insured financial
institutions. Once value leaves the insured banking system and becomes the property of
such processor, even overnight, the failure of such entity raises significant financial
issues for businesses and consumers, each of whom would assert a claim to the funds. In
short, new products, players and systems implicate new rules of management and risk.

5.13 SUMMARY
Although there is a plethora of disparate payment systems offered for electronic
commerce, many firms are reluctant to expand into online commerce because of the
perceived lack of suitable payment mechanisms. Widely different technical specifications
make it difficult to choose an appropriate payment method. In this chapter, instead of
focusing on the technical specifications of proposed electronic payment systems, we have
distinguished electronic payment methods based on what is being transmitted over the
network. Since consumers are familiar with credit card payment methods, they may
accept its electronic versions as the standard for electronic commerce. Nevertheless,
Web-based information trading cannot be adequately supported by existing payment
methods that have been developed for relatively high-value transactions. A cost effective
micropayment system is essential for transactions of extremely small value just as cash is
still the preferred payment method for these transactions. Anonymity is only one aspect
of cash transaction but it has received a disproportionate, often sensational, attention in
the press and by regulatory agencies while the economic need for a cash-like payment
system in electronic commerce is largely ignored. Factors such as micropayments and
peer-to-peer transfers in electronic commerce-especially for the information market-seem

39
to indicate a healthy market for digital currency or small-value digital checks or credit
cards. In terms of the regulatory and monetary impact, private digital monies clearly
present both problems and opportunities. But, as with any digital product, the future of
digital currency will be determined by the market demand and supply. Consequently, it is
more than likely that each of the payment methods we reviewed will find a niche market
and consumers will selectively use an appropriate payment method depending on whether
one prefers convenience, costs, privacy, or the advantage of credit extension. The
usefulness of digital currency, however, has to be emphasized in terms of what the Web-
based information economy would mean for the future of electronic commerce and the
Internet. With a suitable payment method, the age of information will manifest itself on
the Internet, albeit in a commercial form.

5.14 KEYWORDS
EPS: Electronic Payment System, the payment mechanism adopted on internet
ACH: Automated Clearing House, a clearing house on internet
EFT: Electronic Fund Transfer, Mechanism to transfer money electronically
SET: Secure Electronic Transaction (SET) protocol specifically designed to handle
electronic payments
SSL: The Secure Sockets Layer (SSL) protocol is used for secure client-server
communications over the Internet.
IOTP: Internet Open Trading Protocol (IOTP) provides an interoperable framework for
consumer-to-business Internet-based electronic commerce.

5.15 SELF ASSESSMENT QUESTION

1. What are the different types of Electronic Payment Systems? Explain each of
them.
2. Discuss various security issues involved in Electronic Payment Systems.
3. What is SET?
4. Explain various protocols used in making online payments.
5. If you are given the responsibility to design Electronic Payment systems, what
actors will you consider the most important?

40
6. Differentiate between credit card and debit card.
7. “The banking industry is facing an increasing volume of cheque transaction,
rowing competitive pressure and shrinking profit margins.” What is the solution
or this? Has India taken any lead to solve this problem and if yes, in what wa?
Differentiate between traditional payment system and electronic payment system.
8. Who Should Facilitate Electronic Payments?

5.16 SUGGESTED READINGS

 Kalakota, Ravi and Whinston, Andrew B. “Electronic Commerce – A Manager’s
Guide”, Pearson Education, Inc.
 Kalakota, Ravi and Whinston, Andrew B. “Frontiers of Electronic Commerce”,
Pearson Education, Inc.
 Rich, Jason R. “Starting an E-Commerce Business”. IDG Books, Delhi, 2000.
 Samantha Shurety. “E-business with Net Commerce”, Addison Wesley,
Singapore, 2001.
 Turban et al. “Electronic Commerce: A Managerial Perspective”, Pearson
Education, Inc.

****************

41
6.0 MANAGEMENT ISSUES IN ONLINE BANKING
Technology has thrown new challenges in the banking sector and new issues have
started cropping up which are going to pose certain problems in the near future. The
new entrants in the banking are with computer background. However, over a period of
time they would acquire banking experience. Whereas the middle and senior level
people have rich banking experience but their computer literacy is at a low level.
Therefore, they feel handicapped in this regard since technology has become an
indispensable tool in banking. Foreign banks and the new private sector banks have
embraced technology right from the inception of their operations and therefore, they
have adapted themselves to the changes in the technology easily.

The proliferation of technology-based systems offers tremendous opportunities for

banks to communicate with and serve their customers. At the same time, the major
challenge facing the banking industry is the optimum use of technology to provide
customers with new financial products for satisfying their continually changing
financial needs. Banks must deliver high quality products at the customers’
convenience with high-tech, high-touch personal and affordable service taking into
consideration the five key values: simplicity, customized service, convenience, quality,
and price. In this competitive online banking environment, banks have to be willing to
take risk and make strategic decisions about the products and services offered online,
and about exploiting the service attributes that build customer retention for profitable
customers.

The performance that customers believe is an excellent service, banks can and should
deliver, is the true standard for assessing service quality. Therefore, gaining a good
understanding of customers’ service expectations, as well as variations in those
expectations across different customer segments, are essential issues for the
management of banks for improving service quality. Consistently delivering superior
service quality is much more a matter of meeting and exceeding customers’
expectations rather than simply conforming to banks defined specifications. One of
the biggest shortcomings of service banks is a failure to understand accurately what is
important to customers. Hence for the realization of the full potential of banking
financial services following key points have to be considered:

 Attractive financial products and services have to be developed

42
  Terminals at an affordable price are required for customers
 Untapped needs of customers and new market segments have to be explored
 Service quality on the part of banks has to be established for the customers
6.5.1. Differentiation between financial products and services strategies
The changing market structure requires the banks and software companies to take the
strategic decisions to differentiate their products in the competitive online banking
industry and exploit the service attributes that build customer retention for profitable
customers.

The proliferation of internet web sites means there may be a substantial advantage for
banks able to distinguish their products from those of other banks i.e. to engage in
“branding”. Doing so requires significant resources for advertising and marketing, a
fact that is likely to work to the advantage of large firms. The internet provides a very
effective searching device for consumers to choose the “best of breed” producers of
specialized services. Intermediaries may play a role in helping users locate the “best”
product given their individual preferences for quality, convenience, and price. These
factors boost both the pace and scope of consolidation in the banking industry.

There are several significant strategic considerations that should be weighed in

determining plans for developing an e-banking service and the type of services that
should be offered.

1. Bank management must evaluate the degree to which current and future
market demand for e-banking services warrant a change in their e-banking
plans. The breakthrough in consumer usage of online banking may depend on
developing new and better services rather than reducing the price of standard
banking products. It also suggests that low demand for e-banking may be
responsible for the “wait and see” posture of some banks toward offering e-
banking.
2. Another consideration for banks in determining when, and how deep, to
plunge into e-banking is the likely future competitive pressure generated by
the development of the Internet. Banks face competition not only from their
traditional rivals within the banking industry, but may increasingly find their
market share threatened by banks from new, distant locations. In addition,
non-bank firms (financial and non-financial) will increasingly contest banks
for their most valuable customers.

43
 3. A third strategic consideration in developing internet plans is the question of
whether there are “early adopter” advantages. Some analysts point to the high

market concentration of e-banking customers in a few large banks as evidence

that there will be a few big winners and those laggards will have difficulty
catching up. The early-adopter-advantage-view also argue that e-banking will
increase the extent to which economies of scale and scope can be realized, and
that early adopters will better position themselves to exploit them.

Further, because of the rapid pace and broad scope of technological change in banking
and payments, today’s early adopter advantage in capturing customers using the
current set of e-banking options may suddenly be undermined by the introduction of a
new technology.

6.5.2. Pricing Issues in Online Banking

One of the most crucial areas of decision making for banking is financial product
pricing. E-banking is a significant non-interest expense at banks today. There are
cases of many banks whose annual costs for e-banking are higher than those for their
core systems. Many banks signed their original e-banking and bill-pay contracts
several years ago when usage volumes were quite low and many vendors were still
incurring high development costs. These contracts included some kind of per-account
charge, activity-based pricing e.g. per bill paid, or a combination of the two.

Now, as products have matured and volumes have increased significantly, those same
pricing schedules no longer make sense. In fact, many banks have been so successful
that the earlier pricing structure is now punitive. Limited use of a cash management
product for higher-end business customers can be included, with some limit on the
number of customers.

As customer is not interested in paying per month subscription for a service that is
already consumed by him at no price, it is much expensive to implement and operate
online banking services. However, once a user confronts high connect charges, high
subscription fees or both, shows interest in online banking services though customers
are very price sensitive. Pricing affects online banking at three levels:

1. Initial software pricing: Banks have to design strategies through which they
can occupy a bigger market share and gain masses of customers. One way of
44
 achieving can be through bundling of personal finance products and services
in the form of software services with new PCs for the potential customers.
2. Financial product pricing: The development costs (associated with the
design, implementation, and commercialization of a financial product),
marketing costs (including costs of launching and maintaining financial
products throughout its initial stage), and support costs (including the costs of
providing and delivering the product, and maintaining it via back office
systems) are the three major costs which have to be balanced.
3. Usage pricing: The volume of transactions in the bank decides this form of
pricing. Banks have to offer incentives to attract customers to the service. If
the target customers find new products costly, they will resist adopting them.

Pricing is a complex issue that has both long-term implications in terms of cost
recovery and profitability, and short-term implications in terms of market penetration.
While designing the pricing strategies for the financial products and services, banks
must have to consider the above mentioned issues and make a balance between the
costs incurred in providing, delivering, maintaining and promoting their financial
products and services.

6.5.3. Marketing issues: Attracting customers and keeping customers

While winning customers may be hard, keeping them is even harder. Customers really
want quick response, instant information, and solutions to their problems. They want
exceptional customer service. No organization can afford to lose customers because of
poor service, but many do. Customers remember how they have been treated and
spread the news. In today’s high tech and demanding consumer market, customer
service is mission critical. When customers are pleased, they are likely to spend more
on product or service and will call again.

Customer expectations are higher than ever, particularly when it comes to online
banking services. Bank operations need to become highly customer-centric in the area
of Internet banking to ensure that the services they are delivering are the ones their
users will actually use. Customers want access to their accounts anytime, from
anywhere, using their preferred device or channel. They expect data that is accurate,
up-to-date, and consistent across all channels. They take for granted that they will
receive informed and timely support whenever they need it. In short, they want online

45
banking to make managing their accounts and satisfying their financial needs simple
and easy. The applications that serve them must be visually appealing, easy to use and
learn, and support user personalization that meets individual customer requirements.
If an application is difficult to navigate or understand, customers simply would not
use it, and may take their business elsewhere.

Additionally, as enterprise customer relationship management evolves, e-banking

solutions need to complement and integrate with a banks’ customer relationship
management strategy. It is no longer acceptable for channels to be independent of one
another. A system or solutions must integrate with back-end systems, scale to meet
the needs of a growing user population, and contribute to a customer relationship
management strategy that will increase customer retention, revenue per customer, and
subsequently overall bank revenues.

While meeting demanding customer expectations, banks also need to nurture their
own bottom line by building on the profitable relationships they have. They must be
able to identify and serve their most profitable customers well, and take advantage of
opportunities to offer additional products and services to targeted customers at the
most appropriate time. To compete with aggressive competitors, banks and other
financial institutions need to be able to:

 Provide services tailored to meet the needs of specific, high-profit market

segments, such as businesses. Business customers are often a bank’s most
profitable customers. The need to attract and retain these customers is critical
to a financial institution’s healthy bottom line.
 Use the data that they have to identify customer segments and present targeted
cross-sell messages when appropriate.
 Consolidate information about a customer so that a customer receives
informed, timely, and relevant service regardless of the channel that they use.
 Quickly bring new services to market without disruption to existing services.
 Keep up with emerging technologies while maximizing return on investment.
 Minimize total cost of ownership.

6.5.4. Managing financial supply chains in online banking

46
The financial supply chain parallels the physical supply chain and represents all
transaction activities related to the flow of cash, from the buyer’s initial order through
reconciliation and payment to the seller. Until recently, the financial supply chain
went virtually unnoticed. The amount of time required to process transactions was
unthinkably long because the manufacturing supply chain itself was fraught with
inefficiencies.

The supply chain financial flow is at a critical threshold of evolution. Current trends
in supply chain and financial flow management clearly favor the use of automated
payment solutions. Continued expansion in this area offers high potential for reducing
significantly purchasing processing costs, accelerating payment and invoice
reconciliation, reducing collections costs significantly, creating greater processing
efficiencies in the procurement of goods, and enhancing visibility, which means less
uncertainty in accounts receivable (A/R) and accounts payable (A/P) and a reduction
in working capital needs. As the adoption of new automation solutions for financial
flows becomes more widespread, the superior efficiencies gained from electronic
payment technologies are becoming more measurable and substantial.
Today the typical financial supply chain remains somewhat fragmented, complex and
not integrated with the physical supply chain. Goods move faster than money, and
disparate parties are involved. Moreover, even in today’s world, the financial supply
chain is partially composed of paper-based processes. To stay competitive, “just-in-
time” working capital management should be the goal. Financial supply chain
solutions enable CFOs and treasury managers to accurately manage their receivables
or payables, forecast their company’s financial future, and reduce their working
capital needs. By optimizing financial supply chains, banks can:

 Reduce their working capital needs by using better inventory control and cash
flow management, potentially representing significant annual savings
 Lower financing rates on required working capital through more effective
management of their current asset position
 Reduce the costs of risk management through greater cash flow predictability
 Gain early warning into problems with any document in a commercial trade
transaction that will likely cause payment to be delayed, then take corrective
action to reconcile exceptions
 Improve customers relations

47
In this money-spinning market, to gain advantage, banks have to follow three
strategies:
1. Powerful technology infrastructure, strong information architecture and
lucrative online financial products and services have to be developed
2. Form partnership to link customers, intermediaries, banks, and third-party
service providers in the online financial supply chain.
3. Banks have to shift from mass production orientation to mass customization of
financial products and services so as to capture the loyalty of the customers by
providing simple, convenient, and customer-centered approach for services to
the customers.

6.1 SUMMARY
For redistributing capital from areas of excess to areas of scarcity, the most strategic
option are the banks and this is the interest of governments of all the countries to
watch closely and regulate the financial services in order to control redistribution of
capital. Many regulatory reforms have come in to action in the recent years for
removing the competitive protections that banks enjoyed for a long time. To survive
in the increasing competition from mutual funds, brokerage firms, and insurance
companies, banks have to provide complete financial services.

The decade of 90s has witnessed a sea change in the way of doing banking.
‘Anywhere banking’ and ‘Anytime banking’ have become a reality. There is no
specific online banking region to which the transactions are limited. Bookkeeping is
simplified and automated and so is tax computation. Bills are paid with a minimum of
effort. E-banking offers a wider outreach for banking institutions. E-banking is most
useful when it saves the consumer time and money.

In the last decades of the 20th century, computer technology transformed the banking
industry. The wide distribution of automated teller machines (ATMs) by the mid-
1980s gave customers 24-hour access to cash and account information. On-line
banking through the Internet and banking through automated phone systems now
allow for electronic payment of bills, money transfers, and loan applications without
entering a bank branch.

48
Electronic banking is using electronic means to transfer funds directly from one
account to another. Electronic banking is a system that enables bank customers to
access accounts and general information on bank products and services through a
personal computer or other intelligent device. E-banking makes use of electronic
currency. Check cards or debit cards, smart cards or stored-value cards, digital cash
and digital checks are the different types of electronic currency. If anyone uses a
check card to make purchases, the funds are transferred immediately from his/her
account to the company's account.

With the development of technologies in the banking industry, there has been a major
change in the banking system and in the way banks strive for increased profitability.
In this changing environment, consumers’ requirements are changing substantially.
Now Customers want to access account related information, download account data
for use with personal finance software products, transfer funds between accounts, and
pay bills electronically.

The main aim of e-banking through the optimization of the branch networks is to
tighten internal financial controls, reduce compliance costs, improve operational
efficiency and organizational effectiveness, better capital management for significant
savings of cash reserves, reduce capital costs from better risk management, improve
strategic decision making, enhance perception and reputation among investor and
client communities, and provide more flexibility.

With the entry of private banks, the competitive landscape changed

significantly over the last few years. There has been one pervasive goal among the
banks to increase market share. Banks are employing multiple ways such as
increasing the number of branches, installing ATMs, and providing telephone and
internet banking.

The proliferation of technology-based systems offers tremendous opportunities for

banks to communicate with and serve their customers. At the same time, the major
challenge facing the banking industry is the optimum use of technology to provide
customers with new financial products for satisfying their continually changing
financial needs. Banks must deliver high quality products at the customers’
convenience with high-tech, high-touch personal and affordable service taking into

49
consideration the five key values: simplicity, customized service, convenience, quality,
and price. The changing market structure requires the banks and software companies
to take the strategic decisions to differentiate their products in the competitive online
banking industry and exploit the service attributes that build customer retention for
profitable customers.

One of the most crucial areas of decision making for banking is financial product
pricing. E-banking is a significant non-interest expense at banks today. There are
cases of many banks whose annual costs for e-banking are higher than those for their
core systems. Many banks signed their original e-banking and bill-pay contracts
several years ago when usage volumes were quite low and many vendors were still
incurring high development costs. These contracts included some kind of per-account
charge, activity-based pricing e.g. per bill paid, or a combination of the two.

While winning customers may be hard, keeping them is even harder. Customers really
want quick response, instant information, and solutions to their problems. They want
exceptional customer service. No organization can afford to lose customers because of
poor service, but many do. Customers remember how they have been treated and
spread the news. In today’s high tech and demanding consumer market, customer
service is mission critical. When customers are pleased, they are likely to spend more
on product or service and will call again.

6.2 KEYWORDS
E-banking: e-banking involves the collection, storage, transfer and processing of
information assets
BI: Business Intelligence, a method where organizations keep an eye on the activities
of their competitors
CRM: Customer Relationship Management
ATM: Automated Teller Machine
SFNB: The first internet bank to provide banking services electronically to internet
users was Security First Network Bank (SFNB)

6.3 SELF ASSESSMENT QUESTIONS

1. What is Electronic Commerce?
2. Discuss the role of technology in the banking industry.

50
IT8005 – E-Commerce Department of IT 2021-2022

3. Give a broad classification of home banking in historical manner.

4. Suggest some strategic considerations that should be weighed in determining
plans for developing an e-banking service.
5. Differentiate between Online banking and Electronic banking.
6. Describe some of the marketing strategies for attracting and maintaining the
customers in e-banking.

6.4 SUGGESTED READINGS

 Kalakota, Ravi and Whinston, Andrew B. “Electronic Commerce – A
Manager’s Guide”, Pearson Education, Inc.
 Kalakota, Ravi and Whinston, Andrew B. “Frontiers of Electronic
Commerce”, Pearson Education, Inc.
 Rich, Jason R. “Starting an E-Commerce Business”. IDG Books, Delhi, 2000.
 Samantha Shurety. “E-business with Net Commerce”, Addison Wesley,
Singapore, 2001.
 Turban et al. “Electronic Commerce: A Managerial Perspective”, Pearson
Education, Inc.

****************

DEPT OF IT