Mondex International: Reengineering Money

London Business School
CRIM CS97/2

Mondex International:
Reengineering Money [ftn 1]

Blake Ives, LSU Centre for Virtual Systems, USA
Michael Earl, London Business School, UK

Introduction

The Mondex Card

The Electronic Wallet [Images used with permission of Hitachi]

In five years the Mondex Electronic Purse had gone from an idea, through a municipality-wide pilot, to a global alternative to cash. Many issues now confronted the senior management of the newly incorporated Mondex International Ltd (MXI). Among these were establishing an infrastructure to support, and policies to coordinate, the international banking consortiums that had joined the Mondex scheme, forging a migration path into the world of Internet based payments, and deciding what role MXI would play in new markets.

Electronic Purses vs. Cash

In the fall of 1996 there was widespread interest in alternative payment schemes, particularly in the emerging internet marketplace. The Mondex electronic purse appeared to have considerable potential as an engine of electronic commerce. It might also transform traditional cash payments.

The purse was a smart card alternative to cash. With 90% of worldwide payments paid in cash, a majority of which were under $10, cash remained a popular payment alternative. While the credit card or debit card involved money being leant by the financial institution or retrieved from an account -- the Mondex purse, a self-standing value store, required no remote approval of individual transactions. Rather, Mondex value equivalent to cash was stored in the card's microchip as were secure programs for manipulating that value and for interfacing with other Mondex cards or terminals. Thus, a customer could provide his or her card to a merchant's point of sale device and authorize transferal of a certain amount of value (see Exhibit 1 [in pdf format]). That amount would then be electronically deducted from the chip inside the customer's card and added to the amount on the retailer's chip. All this was accomplished without accessing the customer's bank balance or checking his or her credit worthiness.

The most significant advantage of Mondex was in its use for very small transactions. Customer convenience was another feature. Value could be loaded on the card either from an ATM machine or from a phone. It could then be transferred from one card to another via a special, password protected, electronic wallet. An electronic keychain let card holders check their balances. The first implementation supported up to five different currencies, each separately accounted for by the card. Just like cash, if the card is lost or stolen, the cardholder has lost real money. However, to safeguard cardholders, Mondex developed a unique feature which allowed cardholders to lock the value on the card with a four digit personal number thereby safeguarding the value held on the card.

We were looking for the next paradigm shift in banking.

Electronic Wallet with Modem Interface

Mondex Tele- phone Adapter

Origins of Mondex

Mondex had been invented by Tim Jones and Graham Higgins of National Westminster Bank (NWB) in 1991. But their attempts to develop a stored value card had initially failed as Tim Jones, Mondex's first Chief Executive, explained:

We were looking for the next paradigm shift in banking. We had watched, almost from the sidelines, the introduction of the credit card and had struggled to control the development of the debit card into English banking. The next time we wanted to be on the leading edge. We began looking at stored value cards, but couldn't make the business case. The need to account for every transaction was holding us back. We eventually concluded that the answer was RSA [ftn 2], cryptography in a smart card, with no settlement for individual transactions [ftn 3]. The economics of a transaction model with no settlements was very desirable - the lack of computing and communications overhead [ftn 4] would permit transaction payments of a fraction of a cent. It might also provide a new mechanism for management control within the firm. Rather than managing to budgets, all expenses within the firm, no matter how small, could be immediately settled in cash. This was the kind of concept breakthrough that we had been looking for. Graham Higgins, co-inventor of Mondex, had been a banker for 28 years. In the summer of 1996 he served as Senior Executive, of the NatWest Development Team (NWDT). He felt that the Mondex concept ran well ahead of established banking practice: Cashiers, whether in banks or retail establishments, have to take responsibility for cash in their till each morning, serve their customers, and balance the till each evening. This new scheme, though not eliminating the need for double entry book keeping, does alleviate the burden of counting, storing, as well as the security associated with, physical cash. The significance of the initiative was realized by NWB and initial funding was agreed. A small team was assembled. Tightly cloaked in secrecy until the official announcement in December of 1993, the NWDT began to work closely with major industry players such as Dai Nippon Printing, Hitachi, Matsushita Electric, and Oki Electric on the development of the necessary cards and devices.

The development team's challenge was developing a new global infrastructure for electronic payments The electronic wallet, one element of that infrastructure, had provided engineering challenges. Oki Electric had been asked in 1991 to produce a wallet weighing less than 100 grams, a third the weight of their current capacity. By 1995, Oki Electric had delivered a wallet weighing less than 90 grams. But technical challenges remained. In the summer of 1995 Dr. David Everett, Technical Director of the NatWest Development team, explained:

Mass transit, such as the London Underground, requires payment clearances of less than a second. Ever faster chips will help. So too might use of infrared, which would require no physical handling of the card. Early on our market research people told us that people demanded physical handling of the card - money after all is serious stuff. Now we are beginning to look again at Infrared technology. By the summer of 1996 the Mondex Team had grown to 80 members, with the core technology being developed by a separate 55 strong team - the NatWest Development Team (see Exhibit 2 - in pdf format - for organization chart). But five years previously, the Bank's support for Mondex had been modest and, for a time, at risk. During the winter of 91-92, recession had struck the UK banking business. Work on Mondex slowed. In December of 1991 Tim Jones, was appointed as head of IT strategy for NatWest Group with a mandate to focus on reengineering the retail banking business. He would learn later that the Mondex budgets had come close to being canceled during this period. But neither the reappointment nor budget cut stopped the Mondex project. Senior executives within NatWest had intervened to keep the project alive with Jones at the helm.

Amongst the Mondex champions within the senior leadership of the bank was Bert Morris, then Deputy Chief Executive. In the fall of 1996 he recalled his role as a Mondex Champion.

We presented it to the board as a project that might eventually cost as much as 100 million pounds.

The idea was initially Tim's, and Derek Wanless Group Chief Executive in 1993 supported it as a radical banking proposition. I saw it as desirable technology for the bank. We presented it to the board as a project that might eventually cost as much as 100 million pounds. By early 1995 NWB and our business partners had already invested 56 million pounds. But the project had strong supporters on the board and I provided the tenacity. In October of 1994, when my retirement was coming along, I recruited NatWest's Chief Financial Officer, Richard Goeltz as my replacement to serve as the Mondex guardian. He since went on to American Express as Vice Chairman and recently thanked me for providing him with such a great learning experience. Mondex International

Mondex International, according to Richard Fletcher, Head of Strategy & Planning, provided the core brand, while ensuring technical interoperability, enforcing security, and undertaking product development . And, it would support Mondex's global partners as the card was rolled out worldwide. There would also be consulting opportunities for Mondex's global partners as well as their customers.

Mondex UK

The first regional consortium to buy into the Mondex scheme consisted of NatWest and Midland Bank, working with British Telecom. The subsequent merger of Midland and Hong Kong & Shanghai Banking Corporation brought the latter group into the Mondex circle. They were granted franchise rights for Mondex in Hong Kong, and a variety of other Asian countries including China, India, Indonesia, Macau, Singapore, and Thailand. Another bank, the Bank of Scotland also eventually joined the UK consortium, but the cost of membership and a new emerging standard of security for card payment schemes in the UK, initiated in 1994, temporarily dulled interest from others in the UK banking community.

Although Mondex International had worked closely with suppliers in establishing specifications and production standards for the technology, there were still many problems for the Mondex UK team to overcome. According to one of NatWest's business partners,

We didn't just buy a product off the shelf. Tim Jones and his team were dealing with Hitachi, Texas Instruments, and the other suppliers, but there was still lots of work to do. There was an extraordinary amount of work left undone on the pilot, regulations, and the technological interface. Mondex International, at least from our perspective, was engaged in an ambitious process of global sell down. The virtual project team was further expanded by the need to reach closure on regulatory issues. At the urging of Roy Pratt, Chief Executive of Mondex UK in 1994, the Bank of England assembled a project team to begin to examine the implications of the electronic purse on such things as balance sheets, money supplies, and payment systems.

Improving the Concept

Mondex Pilot Sites:

Swindon
Exeter University
York Univeristy
San Francisco
Guelph
Hong Kong
New Zealand

Cashless ATM

Electronic Cash Register

Mondex Telephone

Mondex Keyring Value Checker

PC Interface

The electronic purse was first implemented as "The Byte" card, in March of 1992. Byte was distributed to 6,000 employees for use in a NatWest lunchroom which served as a proving ground for the technology. Having demonstrated viability in a retail setting, a second trial was conducted by Mondex UK as a municipality-wide roll out in Swindon, England, a town of 156,000 inhabitants 70 kms south-west of London.

The Swindon Trial

Swindon was selected as the pilot site based on a number of factors identified in Exhibit 3. The test began on 3 July, 1995 and was scheduled to last for two years. Media from throughout the world attended a briefing conducted in the Mondex shop on the Swindon high street. Later, outside the shop, reporters witnessed the first official use of the card and then used the Mondex card to shop in nearby stores. Swindonís role, was in part, to act as a global showcase for Mondex technology to aid the global selldown, Mondex executives estimated that the launch PR activity had generated more than £3.2 million pounds worth of equivalent free advertising for Mondex worldwide.

Local preparations for the test started months before. One month before its opening the unidentified Mondex shop had been gaily decorated to attract the curious. Over a thousand people visited the store on opening day, with 5,000 over the next five weeks expressing interest in the card. Each was later sent an application form. Additional promotional activities continued after the roll out, including discounts on merchandise purchased with the card.

The Mondex store was an information center for prospective customers and retailers, a center for special promotions, a training facility for merchants, and a demonstration center for prospective franchisees. Visitors, particularly from the Far East, were frequent. They were hosted by personnel from Midland, NWB, Mondex UK, and Mondex International depending on the nature of the visit and who was available. The many overseas visitors, sometimes accompanied by camera wielding reporters, occasionally inconvenienced customers visiting neighboring stores. Generally, however, the residents of Swindon seemed proud of the worldwide attention the test generated.

The test required implementation of new payments infrastructure within Swindon. In addition to consumer cards, wallets, and card balance reading key chains, the two banks provided 20 Mondex enabled cash machines. In September of 1995, twelve Mondex ticket machines were installed in 6 car parks. Four months later, card readers were installed in 80 metropolitan buses that, in May 1996, offered reduced fares for Mondex users. BT installed 150 pay phones in October 1995 and intended to distribute 2,000 Mondex screen phones during the pilot. The Mondex trial also overlapped with BT's own interests in experimenting with screen phones and with smart card activated pay phones. The latter were, in the summer of 1996, being rolled out throughout the UK. Both hardware and software changes, however, would be required to make them Mondex compatible.

Initial Results from Swindon Test

The card had initially been targeted at NatWest and Midland's strong customer base. On opening day 1,000 cards were in operation. By May of 1996 there were over 10,000 cards in circulation, a penetration rate of 24% of the banks' 43,000 local customers. If extended to the two bank's nationwide customer base this would represent 2.5 million consumers. Although some press coverage suggested growth of the scheme was slower than anticipated, Ron Clark, Chief Executive, of Mondex UK found the results very satisfactory:

The figures that are coming out of Swindon are well ahead of what was achieved with cash dispensers, [and] credit cards ... at the same stage... Typical value loading transfers from bank accounts to the card had risen from £10 in July of 95 to between £25 and £30 by May 1996 - roughly the same as a typical ATM withdrawal. Most purchases were for less than £5. Supermarkets were the site of the highest value use, followed by department stores and petrol stations. Except for occasional operator errors and the need to rekey the final sales total into the Mondex terminal, the use of the card at retail was analogous to cash. Moreover time was saved as there was no need to count the money or authorize a credit or debit card transaction.

The test had revealed some enhancement opportunities. Consumer research led to developing a device near retailer tills so card users without Mondex wallets could lock and unlock their cards. The early pay phones proved difficult to use and were confusing in the way in which money was transferred between the phone and the card. In June of 1996 a decision was made not to charge for use of the pay phones for downloading Mondex value onto cards.

Card wallets were heavy and, for some customers, difficult to use. Customers also wanted to be able to see the last amount tendered on their key chains as well as the account balance. The car park ticket machines had experienced some failures prior to Christmas of 1995; Mondex had sent an apology to customers. Throughout the spring of 1996, Mondex personnel checked parking machines daily to ensure they were operating. Also, the separate Mondex terminal at the point of purchase required double keying and additional counter space. Already, however, one major retailer had begun taking steps to integrate Mondex card processing into their normal till.

The Value of Mondex

Mondex represented rather different value propositions for customers, retailers, and banks.

The Customer Value Proposition

Mondex sold the concept to Swindon consumers based on convenience, control, flexibility, and security. A promotional video praised the elimination of needed change for the car park. The cards PIN controlled locking mechanism and the ability to transfer money from one individual to another were highlighted, as was the ability, using the optional wallet, to examine the last ten transactions. The ability to use the phone to securely download a cash equivalent value was another strong selling point.

Mondex had initially proven to be more popular with women than expected, and was particularly appealing to people who used debit or credit cards. The initial focus on Midland and NatWest's own customers as well as a Bank of England requirement that card holders have bank accounts, limited penetration in some segments. Mondex had used its relationship with the local football club and various public gatherings to promote the scheme to a wider segment of the Swindon populace. Still, the Bank of Englandís requirement for cardholders to have a bank account had triggered some complaints from union officials that Mondex was encouraging a two class society.

Some retailers already wanted to sell "disposable" Mondex cards , similar to telephone calling cards. Two nondisposable cards had been approved by the Bank of England. The "linked card," allowed its user to transfer money between a bank and the card. For the Swindon test, the card's value was limited to £500 per day and was technically limited to £2,000. The "associated card" could only be used to make payments or to receive Mondex value from other cards. Upon initial receipt, Mondex cards were always of the latter type. Only when the user registered the card and picked up his or her pin number was the card linked. Users of the Mondex wallet received two additional associated cards. A majority of cards were linked.

According to Julian Harding, Scheme Development Manager for NWB's Mondex UK unit, "the challenge lay not so much in getting people to use the card, it's getting the card in their hands." But Harding felt that the consumer proposition was maturing:

Initially our logo was 'Mondex is Cash is Mondex is Cash...' Today, the consumer needs a richer understanding of the features of the card. The card is more than cash but it is also different than either a credit or debit card. According to one of NatWest UK's business partners, the Swindon trial revealed some early misconceptions about the customer uptake.

Nationwide roll out will take closer to 10 years than 10 months.

The consumer proposition is more complicated than we thought; first, a nationwide roll out will take closer to 10 years than 10 months. Second it is not viable to have NatWest and Midland drive it alone; it needs a payments association or more banks. Third, this is not about point of sale and big retailers, but rather purchases where you use small coins. If we are going to create an environment where this will capture consumer interest we need to do a rethink. Swindon consumers did value use of the card in unattended point-of-sale (U-POS) applications such as for car park tickets, telephones, and a self-photo machine installed in a Swindon post office. But, the Swindon pilot had largely ignored other forms of unattended vending. In July of 1996, MXI announced an agreement with Mars Electronics International "to develop compatible payment products for vending and other U-POS applications". There was considerable variation from country to country, however, in the acceptance of unattended vending.

The Retailer Value Proposition

The proposition to retailers appeared more tangible, as demonstrated by a consortium of British retailer's enthusiastic endorsement of the Swindon pilot. Over 700 retailers joined the scheme in Swindon, about 70% of Swindon's retail population. Many ran promotions, reducing prices for Mondex users. Retailers valued the speed, convenience, and security this new technology provided. Transactions could be completed in as little as three seconds and without a phone connection. Errors in making change were eliminated as were signatures, authorizations, and delays in clearing funds. Mondex electronic value could be transported to the bank via phone lines at the retailer's convenience. There were also hygienic implications for food retailers. A recent spurt of counterfeit currency had further increased interest. Eventually, the card might be used with retailer loyalty programs. One of the card's five ledgers, currently used to store five different national currencies, could be reassigned to accumulate loyalty points.

A chain restaurant store manager became a vocal proponent of the technology, promoting it enthusiastically within his own chain and the restaurant industry. His store was willing to provide cash in exchange for Mondex value. Other Swindon retailers were enthusiastic about Mondex . By May of 1996, 1,800 point-of-sale devices had been installed. Almost all major chains represented in Swindon were participating (Exhibit 4). So too were many small retailers. Newsstands, bakeries, and pubs, participated, as did a tattoo artist, a karate instructor, and the Swindon Town football club. Users could use the card to buy Lottery tickets and to pay their taxes. A local bingo parlor, forbidden by law from accepting credit or debit cards, accepted Mondex. Although Mondex had stopped actively recruiting retailers in the winter of 1996, they were still signing up in the spring of 1996. As one Swindon observer reported, "you can survive in here today without cash," though perhaps with long hair and riding the bus. Hair dressers and taxi drivers were two groups that had reacted with less enthusiasm to the scheme.

The Value Proposition for the Banks

Initial plans were to consider charging both retailers and customers a monthly fee for the Mondex services half way through the test. The slow roll out of some elements of the payment's infrastructure led management to forgo the fee. Instead, the service was justified based on its long run potential cost savings and, in the near term, as an additional element of the banks' customer service portfolio. It was also expected to be a valued element of customer service for both consumers and retailers. One significant potential long term benefit was the reduction in cash handling expense, a bank's most expensive transaction cost.

Exporting Mondex

Mondex had first been conceived and piloted in the UK, but the target market was always a global one. A pilot had been initiated in July of 1995 in San Francisco where Wells Fargo employees used Mondex cards in 22 local retail outlets. Later that fall, Canada's two largest banks joined Bell Canada in announcing their intention to run a one-year pilot in Guelph, Ontario starting late in the second half of 1996. Another pilot was rolled out in Hong Kong in October, 1996 involving 400 merchants and Hong Kongís leading banks. Another pilot was initiated in bank cafeterias in Christchurch, New Zealand. In the UK, NatWest in October of 1996, rolled out the NatWest University Card, a variation of the Mondex Card, to 11,000 members of the University of Exeter community. Midland bank announced at the same time a similar program with the University of York, involving 1,600 first year students.

It was becoming increasingly clear that the Mondex proposition varied considerably from market to market. In Canada the seamless interoperability for customers traveling or doing business across the border was a strong selling point. Australia bankers seemed to value more the potential for lowering internal operating costs, and improving customer service. North American participants seemed keen on its use within the emerging data highway. Maintaining a global brand and interoperabiilty within the constraints of local requirements presented a big challenge.

Supporting an Emerging Electronic Marketplace

Mondex International had recently beefed up its implementation consulting arm with both technical and commercial specialists. They would help diffuse the scheme into other environments, working with local personnel to modify the scheme to local conditions while maintaining security, interoperability, and a consistent brand identify (see Exhibit 5 for recent position announcements for Mondex International.) Education was a key requirement for Mondex International as David Braddock, Head of Technical Development and Services at Mondex, explained:

The benefits of the electronic purse are relatively quickly seen by commercial people. Technically gearing up to achieve it is much more difficult. There is a significant need for education, particularly within our customer's technology departments. The amount of support and assistance required from the territories is considerable. To meet this need Mondex international had developed an Implementation Support Program (ISP). The ISP included a number of training courses and a tool kit to assist in sizing the pilot, identifying the target customer base, acquiring retail participants, and developing technical infrastructure. Mondex frequently brought representatives of its "Global Founders" to Swindon.

Mondex International and its global partners would also require sophisticated information technology support. Mondex' site on the World Wide Web provided information on the Swindon roll out, descriptions of the technology and security considerations, and short video clips promoting the technology. Mondex USA had established a similar web site. But, as of July of 1996, there was still relatively modest use of the Internet technologies within MXI. Chris Potts, Head of Commercial Development and Marketing for MXI, explained the need for greater internal integration.

We sometimes know more about events in offices in Tokyo than we do of developments in our own offices in the UK.

We are, on one hand, a small start up while, on the other, we are a major global player in this industry. Ours is a truly global market. What is happening in Tokyo yesterday matters in San Francisco tomorrow. Already we sometimes know more about events in offices in Tokyo than we do of developments in our own offices in the UK. However we must be careful in our own use of IT. Whatever we create must be in keeping with our image as a secure provider of electronic payments. Nevertheless, there is an overwhelming need for a sophisticated IT infrastructure.

Regulatory and Security Issues

rsa_logo

Up until the 1860s individual banks in the United States printed their own currency.

Mondex was more than just a subtle variation on a credit card. It was essentially, a private enterprise entering into a business that for many years had been the sole province of government - the issuance of cash. But this, according to Robert Caplehorn, Mondex's Company Secretary and General Counsel, was a relatively new phenomenon in some markets. Up until the 1860s individual banks in the United States printed their own currency. In the interests of national commerce, the government eventually stepped in. Today, history is repeating itself as private enterprise begins to issue a tiny portion of currency in the form of electronic units. Recognizing that future economies were likely to rest on these new technologies, western governments seemed willing or resigned to permit some experimentation. But, regulatory hurdles still had to be overcome.

Regulation

The Mondex scheme faced unique regulatory hurdles in each market it sought to enter. According to Caplehorn:

Mondex cannot be readily categorized into existing regulatory schemes. It is not a deposit. If it were viewed as a deposit, the liquidity and capital requirements of the central banks would be difficult to apply. Working through the European Monetary Institute, the central banks have begun to fashion a relatively unified approach for much of Europe. Essentially they are restricting the issuance of stored value purses to banks. Canada and US regulators thus far have assumed a more laissez faire attitude, thus opening the door for nonbank participants. Essentially, the ability to deliver cash is the last bastion of branch banking. Planning was necessary, for instance, for what might happen in the unlikely case that systems security was broken and forged value accepted by retailers. Depending on local regulations the loss might be to the retailer, the bank, or the shareholders of the originator that created the stored value. In the UK regulatory context, it would be the shareholders of the originator that would be responsible. But, according to Caplehorn, "we recognize that the regulatory and commercial environment varies from country to country, so the same approaches may not be appropriate in each country."

Security

Two issues that worried issuing banks, regulators and other participants in Mondex were the possibility that criminals would figure out how to counterfeit electronic purse value or would use the cards for money laundering. A variety of controls and secure technologies were intended to reduce and manage those risks.

John Beric, head of Security for Mondex, described the framework used in the design of the card's security scheme.

Essentially, we are presenting the criminal with the problem of turning the beef burger back into the cow.

Hitachi Microchip

Value Control and Mgmt System

Mondex Multi- Card Value Box

Security is about judging and managing risk. There is some element of risk in all activities and the job of the business is to manage the technology so that the risk in a product can be priced and hence sold at a profit. I go to the business people and say, this is how big the risk is and this is how we can change that risk by investing in a particular technology - say cryptography. That risk must then be balanced against the perceived business value. For instance, what is the value of our being able to provide a payment mechanism for transactions as small as a penny [£.01] ? How does that value compare with the cost attached to the risk of offering that service? . Essentially, we are presenting the criminal with the problem of turning the beef burger back into the cow - it is easy to go one way, but very expensive to go the other. Our security strategy is to present the criminal with a business case for him that loses him money. We estimate it will cost some amount, say £x million, to get through the security system. We then have this number externally audited. So suppose a criminal decides that if they spend that £x million they can recover £100x million. They are probably going to try. But, suppose I demonstrate that I can detect fraud of £x/1000 and can shut my system down before I have lost £x/100. In that scenario it is not reasonable for people to try to break the system. Thus, we build barriers but don't expect them to be 100% effective. It is simply not possible to achieve this; perfect prevention barriers do not exist. Instead we rely on prevention mechanism working in harmony with detection and recovery mechanisms to provide us with a secure and resilient overall system. Good security, according to Beric, required three components - prevention, detection, and recovery - all contributing synergistically so the overall effect was greater than the sum of the parts.

In some systems, such as with credit card fraud, the emphasis had been on detection and recovery. It was common knowledge for instance, that counterfeit credit cards could be created using equipment that was easily available. Therefore the prevention barriers were not that strong , but the strength of the supporting infrastructure provided detection and recovery. Therefore, the criminals' business case could be restricted.

One element of Mondex prevention was the cryptography built into the microprocessor chip. The cryptographic process assumes that the transmission media is hostile and that previous legitimate transmissions could have been recorded and then played back again for illegitimate gain. This latter possibility requires that each transaction has to be unique. Cryptography was required for each message exchanged between payee and payer. These included the following:

The payee requests the payer for money
The payer sends a certificate saying that I have decreased my account by £5
The payee sends a message saying that the money was received.

The information being transmitted was similar to an electronic check. It included a transaction number of the payee, the payee's electronic purse ID number, the amount of the transaction, the payer transaction number, the payer's purse ID and a unique cryptographic seal. The latter was the most sensitive element of the data in the transaction - data that it was essential to protect the integrity of. In addition to the transmission, three areas of vulnerability had to be considered. First, the card had to be tamper resistant such that any attempt to invade the card would result in the destruction of the data. Second, the chip's operating system could not be interrogated by criminals. Third, the software applications that used the chip, had to be demonstrated to be fit for purpose.

Beric described one approach to tamper resistance:

This is like designing a safe such that if you break the wall down you destroy its contents..

This is like designing a safe such that if you break the wall down you destroy its contents. A chip is not a safe, but it is a physical device. Its tamper resistance strength can be measured just like a safe's strength can be assessed. We believe modern day high security micro-controllers are properly tested for the purpose of being used as components to build a secure Mondex System. We are continually reviewing that assertion. It is important to appreciate that, given unlimited time and resource, all chips must be assumed to be breakable. This is rather like observing that girders given enough load will bend and twist. This does not mean that engineers cannot build bridges. Rather, the girders need to fit the planned load of the bridge but are not completely resistant to stress. Equally, even though chips are only tamper resistant, properly tested they can be demonstrated to be fit for the purpose for which they will be used by Mondex. Detection of fraud was another element of security. Auditing would be one element, but confined to 100% of certain high value purses and statistical sampling for others. Retailers selling items with high transaction values - such as off sale liquor [ftn 5], were to be more carefully watched. The philosophy, according to Beric, was to maximize the value derived from each bit of data collected.

Recovery was the third leg of security. Recovery included stemming the loss with minimum disruption to service. Building modular systems that were renewable was an important lesson Mondex had learned. Beric explained,

On early systems we just built a system. When the cryptography system wore out we started over. Now we know that security has to be designed to be easily upgraded because no security solution will last forever. The security in the Mondex card is all in the chip. The terminal and wallet are interface devices and essentially transparent to the security process. When you install new security you replace the chip but keep the terminal. Thus, the till might last for 10 or 12 years, but not the chip, which might last perhaps six months. Economics drive renewability. Chips decline in cost at the same rate as microprocessors in the PC market. With each new generation, more powerful security procedures become economically feasible. The Mondex card already had two security solutions programmed within it. If there was reason to believe the existing scheme has been compromised or was getting increasingly risky, cards in bank ATM's can be switched (or migrated) from solution A to solution B. From then on any card inserted in the ATM machines will have their A solution disabled and their B solution activated. Those cards then, when used in retailer's terminals, will deactivate solution A and activate B in the terminal. This change would cascade rapidly through the entire system. The B solution itself would be deactivated by seamless introduction of BC cards during normal planned chip renewal which would in effect replace the customer and terminal card. For retail terminals it would often be feasible to have several generations of cards mounted in slots, ready to be activated as necessary and at little or no disruption. Consumer cards, as with credit cards, would be replaced on a regular renewable cycle.

Mondex and the Internet

Useful Links

Digital Cash Links
VISA's SET Page

Mondex International expected purchases on the Internet to exceed US$200 billion by the year 2000, most for amounts of less than $10. Mondex had attractive features for use in electronic markets. One of the more compelling was the lack of transaction costs associated with an individual purchase. Thus very small purchases, say 20 cents for an article or case study, 5 cents for an astrology reading, or a penny for the punch line of a joke, could be viable.

Mondex card holders wishing to use the card for Internet purchases would require a special card reader attached to their computer, perhaps just a slot in the keyboard. Once confirmation was received that another valid Mondex device existed at the other end, value could be transferred between the two cards -using the particular currency chosen by the purchaser and acceptable to the provider. As of October of 1996, these technologies were being trialed by Mondex franchisees and supplier companies.

The emergence of standards for electronic payments presented challenges for MXI as Richard Fletcher, Head of Strategy & Planning, explained:

When you go into a retail shop, you understand the basic business protocol of the transaction. You have understood since childhood that you select your purchase, take it to the cashier, agree how to pay, make payment then leave with your goods & receipt. But with electronic commerce the comparable protocols have not yet fully evolved. Visa and MasterCard have produced the defacto SET (secure electronic transaction) standards for credit card transactions [ftn 6], but these only cover part of the business protocol. Broader industry consortiums such as Commerce Net and the WWW Consortium are now trying to set standards for other payment methods - including the electronic purse. Mondex is another payment mechanism, but on its own does not solve the whole problem. We are developing a set of trading protocol for the Internet to wrap-around the payment itself. To gain acceptance for these protocols requires a two pronged approach. First, we can leverage the commercial interests of our customers to influence the evolving standards. Second, we can go to the equipment manufacturers. Through education we shall convince them of the benefit of adopting our protocols. To further encourage their adoption the protocols are ëopení in that multiple payment methods can be supported, including SET as well as Mondex, and in theory other electronic cash schemes also.

Competition

Electronic Cash Links:

VISA Cash
DigiCash
Mark Twain Banks and ecash
CyberCash

MicroPayment Schemes

CyberCoin
Digital's Millicent

Competition for Mondex would come from many quarters. The large payments associations, such as Visa and MasterCard, were interested in the electronic purse. Representing 19,000 and 22,000 member financial institutions, respectively, and almost 750,000,000 cards, Visa and MasterCard represented a powerful distribution arm. But the size of the banking constituency they served could be an impediment to rapid change. In the summer of 1996 both Visa and MasterCard had trials underway. MasterCard had been experimenting with a cash card in Australia, while Visa had put together a global brand, VISA Cash, involving both disposable and reusable cards. The Visa brand, though global, was backed up by programs licensed in various nations [ftn 7]. Interoperability among these national programs would require further technical integration. Mondex, by contrast, had a global specification ensuring that the technologies employed in trials were compatible and interoperable. According to at least one source [ftn 8] , an alliance between Visa, MasterCard, and Europay to establish a common specifications for stored chip card applications (the so called EMV project), was "partly an attempt to shut out Mondex." In one early implementation of EMV, Visa had teamed up with two of NatWest and Midland's competitors in the UK - Barclays and Lloyds in what one banker descried as Visa, "adding its badge to anything that moves as a spoiling tactic against Mondex. [ftn 9]"

There were also over two dozen single country implementations of the electronic purse in place or planned. Among the early successes were programs in Belgium and Denmark. The Danish program, Danmont, had introduced nearly one half million cards since 1992 and began introducing rechargeable cards in August of 1995. Danmont, which by 1996 had spread to 60 towns and cities, was tightly linked to the government. According to Michael Keegan, Deputy Chief Executive of Mondex in July of 1996, "we think the end game here has to be global." Moreover, most of the competitive schemes relied on use of a network to fully accounting for each transaction. This limited the technology to purchases of a certain size and increased costs if the network expanded to deal with international transactions. Some countries stood to benefit less from global interoperability but required the more forgiving communications infrastructure that Mondex operated under. China's Golden Card project, for instance, involved 12 pilot sites with applications including social security benefits, telephone access, and the purchase of electric power as required. With telephones rapidly expanding in both China and India, it seemed quite possible to leapfrog such intermediate technologies as ATM machines [ftn 10].

On the Internet, a number of payment options were already operational while others were under development. DigiCash, a seller of a variety of electronic cash products, in October of 1994 launched a trial of its ecash product. Two years later 30,000 trial participants had received $100 cyber bucks, which could be used to buy various items from electronic shops. Although the electronic money could not be converted to real currency, the goods and services available, coupled with its relative scarcity, gave the currency value. A privacy feature made it impossible for the bank to be able to identify who had made what purchase from whom. Banks began using the DigiCash software and scheme to exchange real cash for ecash. For instance, in October of 1995, Mark Twain Banks of St. Louis, began offering a sliding fee payment ecash service with no transaction fees for electronic payments. In May of 1996 Deutsche Bank in Germany began a similar ecash trial. Another payments option on the Internet was Cybercash, founded in April of 1995. CyberCash' initial offering to retailers was secure credit card payments. By October of 1996 they had also announced their intention to provide and electronic check and CyberCoin, a cash payment service for micro payments of 25¢ or greater. Each of these products required authorization from the payer's bank.