Chapter - 7 Electronic Payment Systems The Basics Implementation of electronic payment systems is in its infancy and still evolving. The technical, cultural and legal components of electronic payment systems are not fully understood. One thing on which everyone agrees is: electronic payments are far cheaper than using the dead-tree method of mailing out paper invoices, and then later processing received payments. David Samuel, Vice-president of customer care at BEC Energy's Boston Edison (with more than 640,000 customers), says that electronic billing and payments systems is a win-win situation; It is convenient for customers and it saves the company a lot of money. Estimates indicate that the cost of billing one person varies between $1 and $1.50. Sending bills and receiving payments over the' Internet promises to drop the billing/paying cost to an average of 50 cents per bill. The total savings is huge when you multiply the unit cost times the number of customers that could use electronic payment. In the case of BEC-Energy, the company could save over 50 cents. Per customer- more than $320,000 every billing cycle. If that does not convince you, then think about environmental conservation. John Dodge, a columnist for the Wall Street Journal Interactive edition, wrote that "GTE sends out 53.5 million bills annually, consuming 1.6 million pounds of paper, that is 2073 trees". Payment is an important component in e-commerce. In day-today commercial dealings there are many more modes of payment, each with its own advantages and disadvantages. The most common payment, especially for low value purchases, is by cash. Credit cards are preferred by customers for higher value purchases (though not all merchants).
If a customer is a trusted party, merchants normally accept checks. Payment for services such as telephone bills, electricity bills, etc. and settlement of bills between businesses is normally by check. In e-commerce also we need systems, which are equivalent to these three modes of payment. Credit and Charge Cards Currently, online shoppers use credit and charge cards for a majority of their Internet purchases. A credit card, such as a Visa or Master card, has a preset spending limit based on the user's credit limit; a user can payoff the entire credit card balance or pay a minimum amount each billing period. Credit card issuers charge interest on any unpaid balance. A charge card, such as one from American Express, carries no preset spending limit, and the entire mount charged to that card is due at the end of the billing period. Charge cards do not involve lines of credit and do not accumulate interest charges. Credit and charge cards are collectively termed payment cards. There are four parties involved in these transactions. They re: the customer who owns a credit card, merchants who accept credit card (typically a merchant would accept credit cards of several companies such as VISA, MASTERCARD, etc.), a bank which issues credit cards to customers, guarantees payments to merchants and collects payments from its customers and lastly an acquirer which is financial institution that establishes an account with a merchant and validates card information presented by a merchant and authorizes sale based on customer's credit status. A customer presents a credit card to a merchant after purchasing goods. The merchant reads information contained in the credit card's magnetic strip using a terminal and enters the transaction amount. The information goes to the acquirer via a private telephone line. The acquirer's computer checks the validity of the card, credit available to the customer and sends an OK authorizing transaction, provided card and credit are OK.
The merchant takes the signature of the customer on the authorization slip, compares the signature with that in the card and delivers the goods. The acquirer pays the merchant and collects the money from the appropriate issuing bank. The bank sends a monthly statement to the customer and collects the outstanding amount. The card transaction is validated using the physical card and customer signature on the card. But unfortunately or fortunately there is no physical contact between the merchant and the customer. This makes it impossible to verify a physical signature. Another point to be noted is that it is necessary for the merchant to verify the genuineness of the customer. Also it is necessary for the customer to be assured that he is not dealing with a fake merchant. Hence to reveal the credit.card number and details on the Internet would be dangerous on the part of the customer as the merchant might be a fake. There is another danger lurking on the Internet and that is of the eavesdropper. The numbers might be stolen by an eavesdropper on still daring an act would be for a hacker who could access the merchant's data base and steal credit card numbers. There have been number of cases about the theft of credit card numbers by hackers as well as disgruntled employees of merchants. Thus the credit card number is not revealed to a merchant but only to the acquirer who authorizes sale based on the credit card validity and the available credit. Also the bank need not know what is bought by a customer to protect the privacy of customers. The process of credit card processing is different on the Internet. Process prohibits the merchant from accepting payment card credits to their account until the products are shipped. Until they pack and ship your merchandise to you, Internet stores can not charge your payment card.
Open and Closed Loop Systems Banks and other financial institutions serve as a broker in some cases between card users and the merchants accepting the cards. Such types of arrangements are called closed loop systems. So no other local bank or any clearing house is involved in the transaction such types of arrangements are called closed loop systems. Examples of closed loop systems are discover Card and American Express because there is exactly one franchise of each of these systems. Open loop systems usually involve three or more parties suppose an Internet shopper uses his Visa card issued by the Bank If Travancore to purchase an item from' Amazon, whose merchant account is at the Syndicate Bank. Besides the two banks - the customer's bank and the merchant's -a third party, called the.enquiring bank, is involved in an open loop system. The acquiring bank authorization requests from Amazon to the bank of Tranvacore (in this case) to obtain authorization for the credit purchase from the customer's bank. Merchant Account A bank that does business with merchants (both Internet and not-internet) that want to accept payment cards is called a merchant's bank or acquiring bank. An online merchant must set up a merchant account in order to process payment cards. Merchants get a numbered account. They deposit accumulated card sales total into his account. A business must provide a potential merchant bank certain business information before the bank will provide an account. Secure Electronic Transaction (SET) Protocol Secure Electronic Transaction or SET is secure protocol jointly designed by MasterCard and Visa with the backing of Netscape, Microsoft, IBM, GTE, SAIC and other companies. SET's main purpose is to provide security for card payment as it traverse the Internet between merchants sites and processing banks.
Though the secure socket layers (SSL) protocol transmits payment data and other sensitive information securely between merchants and consumers, SSL does not verify that the consumer is the payment holder who owns the payment card. The SET's specification uses public key cryptography and digital certificates for validating both consumers and merchants. The SET's protocol provides secrecy, user and merchant authentication and data integrity. To use the SET protocol for credit card transactions it is assumed that: A public key encryption system (such as RSA) is used by both customers and merchants. Thus each of the parties involved in e- commerce transactions have a pair of keys a private key and a public key. All parties have their public keys certified by a certification authority and these certificates accompany requests for service sent by them. This is to assure both customers and merchants that they are dealing with genuine parties. A standard hashing algorithm is used to create message digests for digitally signing purchase order. We summarize the procedure below Step 1 - Customer fills purchase order, amount payable and credit card number in his PC. A software in the PC strips it into two parts; purchase order with amount and credit card number with amount. Let us call them POA and CCA. POA is encrypted using merchant's public key and CCA with the bank's public key. Both are sent to the merchant along with CCD and dual signature (DS). Merchant verifies signature and proceeds further if signature is OK. Step 2 Merchant forwards encrypted CCA, POD and DS to acquirer who forwards it to the customer's bank.
Step 3 The bank decrypts CCA with its private key, checks the validity of the credit card and available balance in the credit card account. If it is OK and the customer's digital signature is OK, it authorizes the acquirer to proceed with the transaction. Step 4 The acquirer in turn OKs transaction to the merchant and credits his account. Step 5 The merchant accepts the customer's purchase order and informs him about delivery details. Step 6 At the end of the month the bank issuing the credit card sends a consolidated bill to the customer. It should be remembered that all the operations are carried out by software stored in the respective computers and affected by clicks of a mouse button. Observe that the customer cannot repudiate his purchase order as it has been signed by him and deposited with the bank. The merchant also cannot substitute a customer's purchase order with some 'other purchase order as the signature contains a unique digest of the customer's purchase order deposited with the bank. Electronic Cheque Payment Hardware encryption of signatures is, Secure as it will be,difficult for hackers to steal keys stored by certification agencies. It is also assumed that banks have trusted relationship 'among them and the clearing house which settles, cheque payments (in India, Reserve Bank of India is the clearing house and all scheduled banks use RBI's services and a private secure network. The transaction proceeds as follows: Step 1 Purchaser fills a purchase form, attaches a payment advice (electronic cheque), signs it with his private key (using his signature hardware), attaches his public key certificate, encrypts it using the vendor's public key and sends it to the vendor.
Step 2 The vendor decrypts the information using his private key,.checks purchaser's certificates, signature and cheque, attaches his deposit slip, and endorses the deposit attaching his public key certificates. This is encrypted and sent to his bank. Step 3 The vendor's bank checks the signatures and certificates and sends the cheque for clearance. The banks and clearing house normally have a private secure data network. Step 4 When the cheque is cleared the amount is credited to the vendor's account and a credit advice is sent to him. Step 5 The purchaser gets a consolidated debit advice periodically. Electronic Cash We normally use cash for many transactions, particularly, lowvalue transactions. The currency system as we know it today evolved over centuries and is time tested. The major advantages of cash are: It is guaranteed by the government and does not normally lose its value in the short range (except when there is hyperinflation!). It is universally recognized as having value and accepted as legal tender. It can be carried around. Any person having cash can exchange it for goods or services without the help of a third party such as a bank. It is anonymous traders cannot normally say who gave a particular currency note. Privacy of transactions is ensured because of anonymity. The major disadvantages of cash are: It is not safe. If you lose your purse you will be lucky to get your cash back. It is bulky. Governments do not normally print large denomination currency notes to prevent criminals from stealthily
transporting large amount of cash. Government of India only recently started printing Rs. l,ooo currency notes. Ten years ago the largest denomination was only Rs. 100 to reduce black money transaction. This applies even to Internet purchases. Low-valued purchases are not profitable for payment. Hence the question arises is whether there is any on. Line market for small purchases on the Internet, for example below Rs. 5. There is obviously a way and that is electronic cash. It has very low fixed costs. Electronic cash provides the promise of allowing users to spend a value as low as Rs. 5 for a coke. There has been many failures in the introduction of electronic cash in the last few years. But the idea of electronic cash just refuses to pass by. Companies like Compaq and IBM see a great future in it. They believe that electronic cash holds sufficient promise for the future. Electronic cash is attractive in the sale of goods and services less than Rs. 10 - the lower threshold for credit card payments. Internet payments for items costing Rs.1 or less are called micro payments. Micro payment champions see lots of applications for such small transactions, such as paying 25 paise for an article reprint or 75 paise for a complicated literature search. All electronic payment schemes have some issue or other that must be solved satisfactorily so as to rid consumer's fears and give them confidence in the methodology. As consumers will leave the technology no matter how bright its future. The concerns about electronic payment methods are portability, independence, privacy and security, divisibility and convenience. These gain an important standing with regard to electronic cash. The most important concerns plaguing the consumer's mind are privacy and security. Typically a consumer wants to know "can my electronic currency be copied or forged?" if the answer to these questions is 'yes' then consumers will not use the system and the system will die a slow death.
Electronic cash brings with it unique security problems. Electronic cash should have two important characteristics in common with real currency. First, it must be possible to spend electronic cash only once, just as with real currency. Second, electronic cash ought to be anonymous, just as real currency is. That is, security procedures should be in place to guarantee. that the entire electronic cash transaction occurs between two parties such that the recipient knows that the electronic currency being received is not counterfeit or being used in two different transactions. In addition, the consumer (and sometimes the seller) should be able to use electronic cash to avoid revealing who he or she is - for a variety of completely legitimate reasons. Anonymity also prevents the seller from collecting information about individual or group spending habits. Electronic cash is also called e-cash or digital cash, and is independent and unrelated to any network or storage device. Electronic cash is really not free floating currency if its existence depends on a particular proprietary storage mechanism or 'cash box' that is specially designed to hold one type of electronic cash. Electronic cash must be able to pass transparently across international borders and be automatically converted to the recipient country's currency. Electronic cash portability means that it must be freely transferable between any two parties in all forms of peer-topeer transactions. Electronic cash can cross national boundaries at lightning speed. Anonymous e-cash will be difficult to trace. If there is no limit set on e-cash transaction amount, large amounts of flow with ease and law enforcement officials will be unable to trace the money. Thus governments may ultimately set a limit (for example Rs. 5000/ -) on individual e-cash transaction. In contrast, credit cards do not possess this property of portability of transferability between every combination of two parties. In a credit card transaction, the credit card payment recipient must already have a merchant account established with a bank - a condition that is not required with electronic cash.
Electronic cash differs from real currency in the fact that it has a property of divisibility. Divisibility determines the size of payment units. Independent of real currency the number of different electronic cash units and their values can be defined. For example, parties to electronic cash transaction in the United States might decide that the smallest electronic cash unit that they want to deal with is $1. The next denomination might be $1.40 and so on. The denominations are not limite4 to the typical break-down of a real cash system. They are up to the definers. Perhaps the most important characteristic of cash is convenience. If electronic cash requires special hardware, software, or finely honed expertise, then it will not be convenient for people to use. Chances are good that people will cast a virtual no-confidence voted for any difficult to use electronic cash system and quickly cause demise of the system. The purpose of electronic cash (abbreviated, e-cash) is to mimic cash transactions with all its advantages without its disadvantages. The major problems, however, are: Who will issue e-cash? If it is a private agency like a bank, who will guarantee the safety of one's e-cash? Deposits in scheduled banks are normally insured by Reserve Bank (up to a specified limit). Will anonymity of e-cash transactions be ensured? Should it be ensured? Will e-cash issued by a private agency be universally acceptable? Can two individuals exchange e-cash without the issuing party entering into a transaction? How will it be possible to detect forgery? A person who 'buys' e-cash should not be able to spend the same cash again. Once it is exchanged for a service it must lose its value or be taken out of circulation.
Holding Electronic Cash There are mainly two approaches to holding cash today: online storage and off-line storage. The consumer does not personally have possession of electronic cash in case of on-line cash storage. On the other hand, a trusted third party that is an on-line bank is involved in all transfer of electronic cash. It holds the consumers' cash accounts. In on-line systems, merchants have to contact the consumer's bank to receive payment for a consumer's purchase. This has an advantage. The advantage is that it helps prevent fraud by determining if the consumers' cash is valid. This is similar to the process of checking with a consumer's bank to ensure that credit card is still valid and the consumer's name on the credit card. Offline cash storage is similar to keeping money in your wallet. The customer holds it, and no trusted third party is involved in the transaction. Protection against fraud is still a concern, so either hardware or software must prevent double or fraudulent spending. Smart cards are the" hardware solution to storing electronic money. Encrypted, and thus tamper-proof, methods are the software solution to prevent double spending. Double spending is spending a particular piece of electronic cash twice by simply submitting the same electronic currency to two different vendors. By the time the same electronic currency clears the bank for a second time, it is too late to prevent the fraudulent act. Advantages and disadvantages of Electronic cash The major advantage of electronic cash is that electronic cash transactions are more efficient than other methods and hence should lead to more business. This means that it indirectly leads to lower prices for consumers. Transferring electronic cash on the Internet costs less than processing credit card transaction.
Conventional money exchange systems require banks, bank branches, clerks, automated teller machines, and a parallel electronic transaction system to manage, transfer, and dispense cash. That is expensive. On the other hand, electronic cash transfers occur across an existing infrastructure, the l'1ternet, and through existing computer systems. So the fixed cost of hardware to handle electronic cash is near zero. Because the Internet spans the globe, there is no sense of distance that an electronic transaction must travel. When considering moving physical cash and checks, distance and cost are proportional - the greater the distance that the currency has to go, the more it costs to move it. Surprisingly moving electronic currency from Tokyo to Washington costs the same as moving it from Bombay to Calcutta. There is no restriction that who can use electronic cash. In business to-business relationship, merchants' can pay other merchants' by electronic cash. One advantage over credit card transaction is that electronic cash does not, require that one party have any special authorization. Electronic cash along with its advantages has many disadvantages. The idea of a Internet tax continues to be, a hot debate. It is merely the other side of the electronic 'commerce co in the lack of taxation (sales taxes, for example, for out-of-state purchases) for Internet purchases is, an advantage for both consumer and merchants. The concept of an Internet tax poses many problems and questions. Can a seller positioned' in India charge Internet tax on cargo sold to a person for Hong Kong? Also, using electronic cash to pay any taxes provides no audit trail. As electronic cash and real cash cannot be traced a far bigger problem rises - money laundering. This problem of money laundering can occur through purchase of goods and services with electronic ash. Goods can be purchased in another country which leads to complicated legislative and jurisdiction issues. Just like its real world currency counterpart, electronic cash is susceptible to forgery.
How does Electronic cash work? To start out with, the consumer goes in person to open an count with a bank. He has to show proof to establish identity. The consumer can withdraw electronic cash through the Internet after Dividing proof of identity. One example of digital proof of identity is a certificate issued by a certification Authority. After the bank identifies the consumer's identity, it issues the consumer a particular amount of electronic cash and deducts the same amount from the consumer's account. In addition, the bank may charge a small processing fee (proportionate to the amount.of electronic cash due). The consumer stores the electronic cash in a wallet on his her computer's hard disk, or on a smart card. Consumers are free spend their electronic cash at their wish and will. But all shops do not accept electronic cash. So whenever they locate electronic commerce site that accept electronic cash for payment the consumer use his electronic cash to buy the goods. Then, the merchant validates the electronic cash (checks to certain it is not forged and it belongs to the consumer). Only on the goods or services are shipped to the consumer then merchant can present the electronic cash to the issuing bank for Deposit. It is primarily intended for small cash transactions. T~ procedure is as follows. Step 1 A customer withdraws 'cash' in various denominations from the issuing bank (or financial institution) and stores it in his PC. The withdrawal takes place by the customer giving a unique identification number and denomination of each coin and requesting the bank to digitally sign it. The bank signs a coin by encrypting (id#, denomination with its private key. The signed coins are of the form id#, denomination, bank's signature. Step 2 The customer pays a vendor for goods ordered using the signed e-coins. Step 3. The vendor sends the e-coin to the issuing bank for authorization.
Step 4 The bank checks whether the e-coin is signed by it and whether it has not been already spent. If it is a valid e-coin, it OKs the transaction and credits the amount to the vendor's account. It puts the e-coin details in a spent e-coin database so that if the coin is presented again it can dishonor it. The communication between customer, vendor and the bank are also encrypted as the Internet is used. As the amounts involved are small, symmetric cryptography is used for these communications as it is faster. There are two points, which need clarification. The first is the cost of servicing e-coins. Normally banks will charge a commission for the service from vendors. Second is whether vendor who receives an e-coin from a customer can use it to purchase goods from another vendor. This is not possible as the suing bank has to authenticate the e-coin and while doing it, it larks the coin as 'spent'. Thus it is not really like good old cash! The sample protocol used above does not preserve the anonymity of cash. The bank will know which customer and vendor re involved in the cash transaction and can link the two. There is another protocol called transaction blinding in which it is possible a customer to get e-coins issued by a bank without revealing his entity. The protocol called Chau's building protocol is complicated, and as of now, not used widely. Security for Electronic Cash One major problem with electronic cash is its potential for double spending. There are many complicated cryptographic algorithms which are the keys to creating tamper-proof electronic cash that can be traced back to its origin.' A complicated two-part ok, which provides anonymous security, also signals when someone is attempting to double spend cash. Say, a second transaction takes place for the same electronic cash. Then we may, se the complicated process mentioned above that reveals the identity of the original electronic cash holder. In other cases, when is not double spending, it maintains the user's anonymity.
What is important is that there is a procedure available both D protect the anonymity of electronic cash users and to simultaneously provide built-in-safeguards to prevent double pending. Double spending can neither be detected nor prevented with truly anonymous electronic cash. Anonymous electronic cash is electronic cash that, like bills and coins, cannot be traced back to he person who spent it. One way to be able to trace electronic cash to prevent money laundering, for example) is to attach a, serial number to each electronic cash transaction. That way, cash can be positively associated with a particular consumer. This does not however, solve the double-spending problem. While a single issuing bank can detect if two deposits of the same electronic cash are about to occur, it is impossible to ascertain who is at fault- the consumer or the merchant. Electronic Wallets On the one hand, shoppers are becoming more enthusiastic about online shopping, while on the other, they have begun to tire of repeatedly entering their shipping and payment information each time a purchase is made. This problem needs to be solved and the solution is electronic wallet. An electronic wallet, serving a similar function to a physical wallet, holds credit cards; electronic cash, owner identification, and owner address information and provide that information at an electronic commerce site's checkout counter. Occasionally, an electronic wallet contains an "address book too. Electronic wallets make shopping more efficient. When consumers click on items to purchase, they can then click on their electronic wallet to order the item quickly. Electronic wallets are indispensable: shoppers often shopping and filling their electronic shopping carts go towards the checkout counter to confirm their choices. But unfortunately, there is a serious problem here.
They have to fill up a one or two page form into which they have to enter their name, credit card numbers, address and other related information. The filling of these forms have had a very high cost on the electronic industry. Millions of dollars have been lost because many people find the forms threatening and this in turn leads them to abandon their electronic shopping carts at the checkout counter. Additionally, the Transaction study found that consumers appreciated the advantages of shopping on the Internet versus shopping at brick-and-mortar stores, but consumers were concerned about the security of online shopping. One of the first ecommerce sites to recognize this difficulty and to come up with a solution is Amazon.com. They stopped filling out the name, address and other information. Now customers have to fill a form only once. Once I-click is activated for a consumer, he can click one button to automatically fill in all the information and finish the transaction. There is a marked difference between digital wallet and similar single-click systems. The difference is that the single click systems each work in a particular store. Electronic wallet's work at all merchant stores wherever the merchant accepts the system. The next question that arises is how to determine whether a particular wallet is accepted by a merchant or not. The answer to this problem is that wallets will display a list of sites that accept the electronic wallets. What is a Smart Card? A smart card is a plastic card with an embedded microchip containing a broad range of information about you. Credit, debit, and charge cards currently store limited information about you on a magnetic stripe. And, unlike a smart card, a credit card does not contain cash it only contains a number of an account that can be charged. A smart card can store over 100 times more information has a magnetic striped plastic card. A smart card contains private user information such as financial facts, private encryption keys, account information, credit card numbers, health insurance information, and so on.
Smart cards are better protected from misuse than, say, conventional credit, cards, because the smart card information is encrypted. For example, conventional credit cards clearly show your account number on the face of the card. The card number along with a forged signature is all that a thief needs to purchase items and charge them against your card. With a smart card, credit theft practically impossible because a key to unlock the encrypted information is required, and there is no external number that a thief can identify and no physical signature that a thief can forge. In addition, smart cards provide the advantages of portability and convenience. Smart cards have been since ten years. It is popular in Europe, Australia and Japan. But they have been unsuccessful in the United States. Smart cards are used for the use of pay phones and pay television in Europe and Japan.' The reason for slowing down smart card marketing and acceptance in U.S. are their banking regulations. Micro-payment for Information Goods Micro-payment is a small payment of fractions of a rupee or a dollar when 'information goods' are delivered via the Internet. By information goods we mean music files, video entertainment or text file (for example, works of fiction, software, technical information). The main features of this payment system are: The customer is charged only after the information is delivered. The vendor is guaranteed payment when the information is delivered. The customer deposits an amount which is debited when information is delivered to him.