Riding a technology wave that helps attract more customers and generate more revenue sounds appealing enough — but with contactless payments, there isn't always a clear upgrade path for stores that have relied on older terminals.
Even though the coronavirus pandemic has forced consumers and businesses alike to consider converting to contactless or mobile payments, it hasn't been an automatic shift in the retail world to devices that accept those types of payments.
Two months ago, in its
Those numbers could advance quickly because of consumers' desire to stop touching cash or payment terminals when possible. While the study also pointed out that no clear evidence from health experts exists about COVID-19 being transmitted through cash or credit cards, retailers were still seeking ways to assure safety for customers.
That translates to more contactless-ready terminals — if merchants can overcome the complexities and issues that occur when implementing contactless technology in a store.
"On the hardware side, you need a device that supports contactless by having the antenna that produces the fields that power the contactless card and allows communication, and you also need the correct software to communicate to that card," said Andrew Jamieson, technology and security director at Underwriters Laboratories.
UL works with terminal manufacturers to assure contactless technology works, doing so through security labs that test functionality. UL testers also introduce bugs to terminal software to assess the terminal's ability to thwart or halt those bugs prior to certifying devices as ready for the marketplace.
"We probably process about up to half of the terminals deployed around the world," said Jamieson.
In addition to having communication technology in place, merchants also have to be aware of specific software that each card brand requires so that kernels, or computer system cores, can "talk to the cards," Jamieson added. "Then the payment application has to be aware of certain things to make the best use of a contactless card, and to finally set up the customer interaction."
From a consumer perspective, contactless payments can be a relatively easy and highly secure payment option, Jamieson noted, but merchants have to educate customers on how to use the technology and the best place on the terminal to hold or tap a card.
Mobile devices bring their own level of complexity, through a tokenized personal account number and a different cryptographic key to authenticate a transaction. All of that has to transfer through various layers of an operating system to the hardware, where Near Field Communication integrates to communicate to the terminal.
"One thing we do in countries rolling out mobile payments in our tech labs is to determine if the terminals need a different configuration to change the timing of a transaction a little," Jamieson explained. "When making a payment on a phone, the phone can be doing other things at that time, like downloading something or going through an update, and all sorts of other things. Timing definitely has an effect on a payment network response."
At this time in payments technology, it has become easy for merchants to become confused about the differences between NFC, a contactless antenna or RFID (radio frequency identification).
RFID operates as an interface, such as a contactless bar code, designed to handle a small amount of digits to identify a transaction. It works at different frequencies and can do so over a long distance.
NFC is a bi-directional interface, allowing devices to "talk" to payment cards and other devices.
On the other hand, contactless payment cards are based on ISO standards that provide an interface to communicate with a powering device like a terminal with an antenna. The contactless card has no power field itself, but operates when brought into a field generated by a phone or terminal. In that regard, the card "talks" through that interface.
It is easy to see why retailers are increasingly confused about what to do next at a time when consumers have all sorts of payment options — and leaning toward contactless more than ever, said Maria Arminio, president of Avenue B Consulting Inc., a Redondo Beach, Calif.-based payments management consulting firm.
"It is difficult to reconfigure a terminal to support a contactless chip or even a contact chip," Arminio said. "It's very complicated and most merchants are not willing to invest the time needed to make the change, especially if they are not seeing a whole lot of transactions coming out of that environment."
Because converting to contactless or NFC technology is expensive and demands a time commitment, merchants might be inclined to find an easier and less expensive option such as supporting QR codes, which don't call for as many configuration changes, Arminio added.
"What it comes down to is, how many methods can you configure into your device to be able to support all of the options available to consumers now?" Arminio asked. "There are a lot of old terminals out there, and merchants want to hold onto their terminals forever because they take payments and they work."
In a larger setting, it even goes beyond the POS terminal facing the consumer. How a merchant connects terminals to a back-end system for payments becomes even more crucial in a contactless environment.
"Quite often in a larger store, you have the POS being driven by an in-store controller or a back-end controller that links up a number of stores," UL's Jamieson said. "It sends direct communication to that POS to send commands and process transactions."
But that setup can cause delays in processing payments if the software kernel is located in a back-end controller. "Perhaps that kernel doesn't understand contactless or some other features," he said.
One of the values of mobile payments is that the user can authenticate to the terminal through the phone, either through biometrics or a PIN, Jamieson added. "The terminal has to understand that, or the back-end kernel has to, and these things can get hung up when not properly set up through a complex infrastructure to support it."
Terminal manufacturers can fix those potential stumbling blocks through UL's Identity Management Security Division and be better prepared to ride a wave that indicates contactless technology could take hold in many global markets in the coming months.
"We will see a rapid change, and not just for in-store terminals," Jamieson said. "If you look at contactless success stories, like in Australia, where the vast majority of transactions are contactless, they are not just happening with credit card payments; it is with all transactions. And that is where we are headed to."
