Next week an estimated 180 000 Easy Pay customers will receive an email offering money back rewards on all their EasyPay transactions. This is part of EasyPay’s strategy to restore credibility and regain customers’ confidence after the site was hit by credit card fraud two months ago.

EasyPay will also carry the full liability of any fraudulent transactions says EasyPay CEO Serge Belamount who is that confident of the new security features which have been built into the site.

EasyPay is one of South Africa’s largest third party payment system which allows consumers to use their credit cards to pay their bills including Telkom, municipality bills and traffic fines either through its website or pay points like PicknPay.

It also allowed consumers to buy airtime and prepaid electricity online and it was these products that were targeted in September by a crime syndicate which had obtained a list of credit card numbers which they used to buy airtime and electricity as well as buy pre-paid gift cards.

The reaction by Absa, who found that one in three transactions were fraudulent, was to temporarily prevent their cardholders from transacting on the site until EasyPay removed the high risk products from its site and some banks continue to have limits on the amount of EasyPay transactions they allow.

Walter Volker CEO of the Payment Association of South Africa (PASA) says that EasyPay had nothing to do with the release of the credit card details. An investigation is underway to determine how the syndicate obtained the credit card details which resulted in millions of rands of losses and it is still to be determined which banks will carry the liability.

Serge Belamount, CEO of Net1 which owns EasyPay has cried foul stating that EasyPay has been unfairly targeted by the banks as it is not responsible for the breach and it is only because of the high volumes, the site does four to five million transactions a month, that made it attractive to fraudsters.

EasyPay processes R120 million worth of payments a month and according to Belamount the new site is growing at a rate of 10% a month. This makes the online payments system a force to be reckoned with and Belamount argues a target for competition. By preventing their customers from using their credit cards on the site, the banks can effectively destroy EasyPay.

Volker argues that EasyPay does carry some responsibility. He says that any merchant, especially those offering cash- like services such as airtime and pre-paid electricity which can be on sold for cash, has to have additional risk measures in place to manage and monitor the transactions for trends or anomalies. One of the principles of the payment system is that any entity that introduces risk into the system is responsible for managing that risk. Therefore EasyPay needed to be proactive and in this case it failed to do so effectively forcing the banks to take action.

Volker says it was the banks’ own risk monitoring systems which picked up the problem and they followed a risk mitigation process of limiting access to the site to stem the fraud. The banks also requested that EasyPay close down the three cash-like products which were being targeted until the site had a system in place that could lower the risk.

Volker says online credit card transactions are a problem globally and work is being done on improving the security around card not present (CNP) transactions which have seen a significant increase in fraudulent activity. While chip and pin cards have reduced the incident of card fraud at point of sale, syndicates are still able to obtain credit card details and transact online where a PIN is not required.

He says however that whatever solution is used, it will have to be globally applicable as crime syndicates work across all geographical areas, therefore it will form part of the global standards for card payment systems such as EMV and 3d Secure.

Belamount says his site meets all the banks’ security measures and is as secure as their own internet banking. In response to this attack he is introducing security measures that banks have not put in place which will ensure that no fraud is possible. He is so confident of this new system that he is prepared to guarantee all payments. In other words if you claim it was not your transaction, he will not ask for proof, he will simply refund the payment.

This is quite a significant promise as he is re-introducing the high risk products such as airtime as well as new products. It is not clear how Net1 would meet this promise if a similar situation occurs again.

“We believe that once we have launched our new product, the site will grow substantially as the new solution removes so many existing barriers to entry and also eliminates fraud. Our incentive programme is cash based and thus is far more transparent and usable when compared to other point based systems,” says Belamount who argues that the greatest security breaches come from within the banks themselves and yet he is paying the price.

Brand attack

Although EasyPay has met the banks’ requirements and only processes third party bill payments the banks remain highly cautious and this is having an impact on the EasyPay brand and could be construed as an attempt to drive payment away from the site.

FNB only allows the card holders to make one EasyPay transaction a day and Standard Bank is contacting its customers each time they use the site which is creating negativity around the EasyPay brand.

Jacques Celliers, CEO FNB Credit Card  says that although only one transaction can happen through EasyPay per day per FNB customer, multiple accounts can be paid in that one transaction.

Customers tend to use EasyPay as it allows them to earn loyalty points on their credit cards. Belamount says FNB has already approached him to see if there is a way to incorporate EasyPay into its internet banking site so that customers can have the security of the FNB site while still earning Ebucks. “There is no better way than giving FNB customers the opportunity to do everything on one site.  It’s just pure convenience” says Celliers.

Clearly reward points are a significant driver of behaviour which is why EasyPay will be looking to pay a percentage of its fee back to customers. Although the full details are still to be provided, Belamount says the refund will be in the region of 0.3% to 0.5% of the transaction and will be paid in cold hard cash, not loyalty points.

This article by Maya Fisher-French was first published in the Mail&Guardian