MoneyGram loses ground after breach

October 8, 2024 2:15 PM

Worldline and Stash make executive moves, while Australia looks to make businesses more responsible for data branches that occur on their watch. Here's what's happening in the world of payments.

Chris Ratcliffe/Bloomberg

MoneyGram's cyber attack upends a U.K. contract negotiation

What was supposed to be a routine renewal between MoneyGram and the U.K.'s Post Office has turned into a war of words that demonstrates the importance of managing cybersecurity risks.

The postal service on Sept. 30 notified MoneyGram that it was suspending service, one day before an existing payment contract was set to expire. Both sides had been negotiating a 12-month extension since June. The postal service cited a recent MoneyGram data breach as a reason for the lack of renewal.

MoneyGram in late September said it had suffered an outage. The extent of the outage was unclear, though TechCrunch reported it impacted the U.K. postal service and the Bank of Jamaica. MoneyGram, which has users in more than 200 countries and territories, did not respond to a request for comment.

In a release on Tuesday, MoneyGram said that on Sept. 27, it determined an unauthorized third party accessed personal information of an undisclosed number of consumers between Sept. 20 and Sept. 22. The company's investigation is in the early stages and all systems are back online, MoneyGram said. The types of information accessed include names, contact information such as phone numbers, email and postal addresses, Social Security numbers, national identification numbers, copies of government identification documents, payment information, and in some cases information about fraud investigations.

The U.K. postal service referred questions about the matter to a letter that it sent to MoneyGram.

"The contracting process was in the final stages when, unfortunately, MoneyGram suffered the cyber attack," the postal service said, adding it offered to extend the current contract for a shorter period to enable both parties to prioritize service renewal. "This short extension would have also enabled us to understand any longer-term impact of MoneyGram's cyber incident for our customers, postmasters, and partners as this challenging situation continues, Unfortunately, MoneyGram has not accepted our offer, and therefore our contract with them will end," the postal service said, adding it was still committed to continuing the partnership.

MoneyGram told ComputerWeekly, which broke news of the U.K. contract dispute, that it is "disappointed to see how the UK Post [Office] has portrayed the situation … our cyber security experts have determined that the incident has no effect on our agents' systems. It is unfortunate that the Post Office has taken this stance after our trusting partnership of over 25 years. We sincerely hope that we further the dialogue with the Post Office and can work with [subpostmasters] in the future."

It is unusual that the Post Office went public with its reasons for terminating the contract, according to Aaron McPherson, principal at AFM Consulting. "These things are usually handled more discreetly. It depends on how severe the cybersecurity incident was, and how easy it would be to secure another vendor … it does show the importance of handling cybersecurity incidents well. Evidently, MoneyGram really angered the Post Office with its response to provoke such a public reaction." —John Adams

JCB adds Google Pay in Japan

While Google suffered a setback this week as a judge ordered the company to open its app store to other payment providers, the technology giant did pick up at least one victory on the business front.

Japanese payment network JCB has enabled Google Pay, giving the mobile wallet a major distribution channel in Japan. Android phones have a nearly 52% market share in Japan, according to Statista, with iOS controlling most of the rest of the market.

JCB also supports Apple Pay, giving it coverage of the entire Japanese mobile payments market. Google Pay, Google's payments app, is tied to Google Wallet, which stores user credentials.

As Google battles Apple Pay in dozens of countries, it has made several updates over the past year to both Google Pay and Google Wallet. Google has expanded how consumers receive and consider incentive marketing, access buy now/pay later lending and use biometric authentication.

Apple's updates include a collaboration with payment technology company Evolve that makes it easier for merchants to access Apple's digital wallet. —John Adams

Swift expands CBDC tests

Global payments messaging organization Swift has enabled central banks and commercial banks in more than 200 countries covering more than four billion accounts to test digital currency payments.

The pilots are part of Swift's strategy to enable central bank digital currencies in different countries to execute cross-border payments. Swift estimates there are central bank digital currency projects underway in more than 130 countries, contending the number of projects has created a fractured network that doesn't easily work together.

"As new forms of value emerge, our intention is to continue offering our community the ability to seamlessly make and track transactions of all kinds of assets, using the same secure and resilient infrastructure that is integral to their operations today," said Tom Zschach, chief innovation officer at Swift, in a release.

Progress on CBDCs has been slow. Most projects are pilot tests or research phases. In the U.S., the future of a digital dollar is stalled due to regulatory uncertainty and central banks in other major economies such as Canada and Australia have said CBDCs lack enough of a use case to pursue. —John Adams

Mastercard partners with fintech on Mexican financial inclusion

London-based Paysend is using a Mastercard money movement service to introduce a remittance product that uses mobile phone numbers as a way to execute transactions.

Called Paysend Libre, the payments will be available to the recipient in real time, using digital channels to reach consumers in areas that lack the physical agent locations that usually provide access to remittances. Paysend, which has a similar partnership with Visa, is using Mastercard Move, a card network service specializing in supporting payments in underserved areas.

Mastercard Move is a set of money management tools such as peer-to-peer transfers, which covers remittances; business payments; disbursements and other transactions. While Mexico is one of the world's largest remittance markets, Paysend is betting that most bank-led remittance products and traditional money transfer firms use brick-and-mortar locations to reach recipients.

Paysend launched in the U.K. in 2017 and the United States in 2020. It operates development hubs in London, Dublin, Edinburgh and Miami, and has an existing partnership with Mastercard that aids cross-border payments for small businesses. —John Adams

EU gives fintechs a boost

The European Investment Bank will increase investment in financial startups to offset a decline in private fintech investment in the European Union over the past two years.

The EIB, the lending arm of the EU that specializes in funding companies that support financial inclusion and environmentally focused technology, is also concerned about increasing competition from fintechs in China and the U.S., where the downturn in fintech investment has not been as pronounced as in other regions.

Its proposals to boost investment in local fintechs includes expanding a Tech Champions program that adds funds to locally based unicorns. The EIB also hopes to encourage existing firms to hire staff or to avoid downsizing. —John Adams

Canadian fintech looks to go global

Toronto-based Kort Payments has named Hiep Tran chief strategy officer and board member and Daniel Kornitzer as a board member as the company plots an international expansion.

Tran, who will oversee Kort's U.S. rollout, is the founder of Meritus Payments, which sold itself to Paysafe in 2014. He later was a senior executive at Paysafe and has experience in digital payments technology and risk management.

Kornitzer has also held management positions at Paysafe and is an adviser to fintech companies. Kort sells technology that enables businesses to connect to payment processing, risk management and compliance. —John Adams

Australia moves to increase corporate responsibility for fraud

Australian regulators have proposed a Scams Prevention Network that will require banks, mobile network operators and social media companies to reimburse victims of fraud.

The provision, which will be introduced as a bill in the Australian parliament in November, includes standards to vet identity of users and advertisers, and to gauge corporate obligations compared to consumer risk.

The move comes as the national treasury reports that Australians reported more than $3 billion lost to scams in 2023. —John Adams

Worldline names new merchant services head

Payment technology company and processor Worldline has appointed Paul Marriott-Clarke as head of the firm's merchant services business.

Marriott-Clarke's career includes stints at Barclays UK, where he helped lead digital payment strategies, and as CEO of PayPal Europe, overseeing projects such as the payment company's expansion in Europe, the Middle East and Africa.

"I am confident that Paul's extensive experience in digital transformation of the financial services industry and in online payments in particular will be instrumental in driving our focus on becoming a customer-driven company," said Marc-Henri Desportes, CEO of Worldline, in a release. —John Adams

Consumer finance firm Stash brings founders back as Co-CEOs

Consumer-finance startup Stash named its co-founders as co-chief executives.

Brandon Krieg and Ed Robinson are taking the reins of the New York-based company, succeeding Liza Landsman, who is leaving the company and plans to volunteer for Kamala Harris' presidential campaign, a Stash spokesperson said. Landsman succeeded Krieg as Stash CEO in February 2023.

Stash, which has 1.5 million active users and more than $3.5 billion in assets under management, said it's launching an artificial intelligence-powered platform known as Money Coach that's designed to provide personalized support to customers.

"The future of money and financial guidance is in generative AI," Krieg said in an emailed statement. "We will continue to push the boundaries of democratizing access to financial services for our customers."

Stash — last valued at $1.4 billion, according to PitchBook — counts Todd Boehly's Eldridge Industries, LendingTree, Coatue Management, Union Square Ventures, Goodwater, Valar Ventures and funds advised by T. Rowe Price among its investors.

The startup says it has saved its users more than $206 million in overdraft fees, and its Stock-Back Card — which aims to facilitate stock ownership for more of the U.S. population — offers rewards in the form of shares if a customer uses it to pay for goods or services from merchants including Netflix, Spotify Technology, Tesla, Starbucks and Amazon.com. —Gillian Tan, Bloomberg