Risk and Privacy Implications of Consumer Payment Innovation in the Connected Age

Then consider the case of Sofortüberweisung, a controversial entrant to the payment market in Germany. Its name means “instant payment,” and its service has taken off rapidly in the past 2-3 years. Branded as Sofort (Instant), this service provides merchants with a low-cost payment service for online shopping. It is promoted by some large sites (such as airlines) by exempting users from the surcharges normally made for credit card payments. So far so good. What might be of interest to regulators is how Sofort managed to break the payment-card cartel. When a German bank customer clicks to pay at a website, Sofort asks for her bank account number, then goes to her bank’s website and impersonates her. The bank asks for a PIN and a TAN (a one-time code, typically mailed to the customer); Sofort in turn questions the customer. If her responses lead to a successful logon, Sofort checks her available funds and uses her funds transfer facility to pay for the purchase directly from her account. In effect, Sofort is doing a middleman attack on her bank account in order to deprive the bank of card transaction fees. The merchant typically pays 75 basis points plus 10 cents per transaction rather than 250 or more for online credit card payment. Analysts estimate that Sofort had 1.2 billion euros of the 20-billion euro market for online payments in 2009.