In June this year, the European Payments Council (EPC) published the final version of the Standardisation of Quick-Response (QR) codes for mobile initiated SEPA (instant) credit transfers (MSCTs) document. EPC wanted to find out more by interviewing the two co-chairs of the multi-stakeholder group on mobile-initiated SEPA (Instant) credit transfers (MSG MSCT) namely Dag-Inge Flatraaker, Senior Vice President at DNB Bank, and Pascal Spittler, P2P Process Development Leader at IKEA INGKA Group.
The European payments market is characterised by multiple local solutions for mobile account-based payments that rely on QR-codes. Most of these solutions are domestic and stop at national borders, creating a fragmented European mobile payments landscape.
This prompted the MSG MSCT to produce a document on the standardisation of QR-codes for MSCTs to facilitate pan-European interoperability and foster the harmonisation of these types of payments, covering both payee- and payer-presented QR-codes.
Likewise, the usage of the standardised payer-presented QR-codes for MSCTs will enable a merchant to scan this QR-code while the foreign consumer authenticates the transaction through their own ‘local’ mobile payment solution.
These standardised QR-codes would be the most effective way to achieve interoperability of mobile account-based payments across SEPA. This would support the mobile lifestyle of consumers while enabling transaction authentication directly on their mobile devices via the mobile payments solution with which they are familiar. It would offer merchants opportunities to enlarge their customer base and to provide value-added services (e.g. couponing, loyalty, etc.), while also leading to a reduction in the investment costs needed to accept mobile payments from all over Europe. At the same time, the availability of standardised QR-codes should also enhance the uptake of this proximity technology for mobile payments.
A QR-code may contain both sensitive and non-sensitive payment data that can be used by different entities involved in the processing of the MSCT transaction.
Tampering with QR-code data may lead to fraudulent transactions or data leakage, so the sensitive payment data in the QR-code should be adequately protected while the integrity of the data elements in the QR-code should also be secure to avoid any service disruptions. For example, if the payer identification data is not adequately protected in the payer-presented QR-code, this could result in impersonation attacks, or the manipulation of the IBAN in a payee-presented QR-code might lead to a funds transfer to the wrong payee (e.g. an attacker).
The next step is to develop a generic version of the document on the Standardisation of QR-codes for (instant) credit transfers for submission through a ‘fast-track procedure’ to the International Standardisation Organization (ISO), specifically the ISO Technical Committee TC 68 on Financial services.
The MSG MSCT also started to further analyse the interoperability of MSCTs based on other proximity technologies to exchange transaction-related data between the payer and the payee to enable the initiation of an MSCT and to identify possible standardisation opportunities. The goal is to first address Near Field Communication (NFC) both in a uni- and bi-directional way between the payer’s mobile device and the payee’s payment infrastructure (e.g. POI, mobile device), then by Bluetooth Low Energy (BLE).
The full interview here
Banking 4.0 – „how was the experience for you”
„So many people are coming here to Bucharest, people that I see and interact on linkedin and now I get the change to meet them in person. It was like being to the Football World Cup but this was the World Cup on linkedin in payments and open banking.”
Many more interesting quotes in the video below:
