Near Field Communication
Safeguarding the Mobile Marketplace
Our speakers
• Larry Collins
Head of e-Solutions
Zurich Services Corporation
• Christopher O’Donnell, CPCU ARM
Administrative Vice President
Director of Corporate Insurance & Risk
M&T Bank
Conducting business online in an
increasingly mobile society
• Cyber security was named one of the top five
global risks for companies in 2012 at the
World Economic Forum in Davos, Switzerland
• Companies that have traditionally had little
data about their customers now must become
accustomed with data privacy and security
laws, and protect their customers’ personal
information
What is Near Field Communication
(NFC)?
• “A wireless technology that has a range of only
a few inches. It is based on the magnetic field
induction between readers and tags in a radio
frequency identification (RFID) system.
Adhering to the ISO 14443 international
standard for smart cards, near field
communication (NFC) is compatible with the
countless ID card terminals in use around the
world.” (PC Mag)
How big is the market?
Juniper Networks
How the Technology Works
1) Coil in the first smart phone sets up a current that is picked up a
second smart phone or reader.
2) The second smart phone receives the “induced current” from the first,
recognizes it as a valid signal and offers a connection.
3) The first cell phone accepts the connection and begins the transaction.
How the Technology Works
1) Coil in the smart phone sets up a current that is picked up by the smart
tag
2) The smart tag receives the “induced current” from the cell phone,
recognizes it as a valid signal and offers a connection to the cell phone.
3) The cell phone accepts the connection and begins the transaction
Users of NFC-enabled devices can:
• Make payments or use coupons via devices,
instead of credit or debit cards
• Transfer files and share documents
• Download information about objects, services
or places from “smart posters”
• Display electronic identity documents, like air
travel boarding passes
What are some examples of the
technology?
What are the risks?
• Privacy
– What data is being captured, processed or stored?
– Information Privacy and security rules apply!
– How does a customer opt-out?
• Security
– If you capture store or process data, you have to protect it.
– Lost smart phones are now an exposure. Can you shut them down
remotely?
• Sentinel Hacking
– A hacker can establish a “sentinel” tag, fixed in one place, to receive
and download information from passing smart phones.
– Any NPI on the smart phone can then be down loaded
– Loss of privacy
– Loss of financial info – credit card #s
Businesses that rely on NFC to share
company information can:
• Automatically shut-off of an employee’s smart
phone if it’s lost, so information can’t be
accessed by unauthorized parties.
• Enlist the company’s telecommunications and
information technology department to limit
the content that employees can download or
store.
• Enforce a password requirement.
• Encrypt data so it can’t be easily read.
Businesses that rely on NFC to acquire
customer information can:
• Use transmitted data for the purpose it was collected: If a customer
shared personal information solely to pay for something, don’t then
use that data for targeted marketing.
• Secure collected data with encryption, passwords and by restricting
access.
• Determine how long data should be stored; create a data purging
cycle.
• An educated team, aware of global privacy laws, should be in place.
• Limit data-reading devices’ power, allowing them to receive data
only from short distances. Limit the content that devices display
during transactions.
• Implement the electronic security measures that a near field
system requires.
Risk management in practice:
M&T Bank
• Our risk management process involves a
number of “moving parts” including:
– Corporate Risk Management
– Corporate Insurance
– New Products & Services Committee
– Corporate Operational Risk Committee
– Management Group
Risk management in practice:
M&T Bank
• We are in the process currently to review
“alternative channels” of banking service.
• The following slides will take us through a
view of how we vet the risks associated with
these “alternative channels.”
Benefits
Measurable Benefits
• Reduce telecom costs due to deflection from the IVR to mobile channel - $336M
• Account acquisition – $5.75MM
• Mobile financial service capabilities are more impactful in a consumer's decision to
select a bank than availability of online banking, access to ATMs, or nearby
branches. Additionally, banks offering mobile financial services should anticipate
as much as a sixty percent increase in sales lift*
Other Benefits
• Provides the bank with a competitive advantage
• Establishes a credible presence in mobile banking
• Creates infrastructure that can be leveraged for Commercial and Business Banking
• Lays the foundation for alerts, mobile check deposit and P2P
*Source: Mercatus
15
Competitive Analysis
Company
SMS
Mobile Web
Application
iPhone App
Bank of America




BB&T









Capital One
Citibank


Comerica

Fifth Third
First Horizon
Huntington Bank

Key Bank

M&I Bank

PNC

Regions Financial

Sun Trust

Synovus

U.S. Bancorp




Wells Fargo




USAA






Zions
16

Business Initiative Risks
Operational Risks
• External fraud
• Authenticity of the mobile application
• Technology failure
• Vendor failure
• Ability to handle customer service inquiries
• Vulnerability of transmitting data wirelessly
Legal/Compliance Risk
• Patent Infringement – Some cases related to mobile banking exist
• Legal / FDIC disclosures on mtb.com and in the mobile banking
application
Strategic Risks
• Failure to create a credible mobile banking channel that will attract new
customers
17
Business Initiative Risks
Reputational Risks
• Patent infringement lawsuits
• Compromise of customer data
• Failure of technology
Controls
• Timeouts
• Apple store
• ClairMail controls and contract
• Gradual migration
• Secure transactions
• Process controls: use of Web Banking User ID and passcode, no reset
from mobile device, user agent string capture
• Information Security is assessing the risk of each mobile feature
18
Loss Scenarios
•
Worst Case Loss Scenario
• Patent infringement lawsuit, external fraud or data breach at the customer
level. The risks would be reputational in nature.
•
Likely Loss Scenario
• Mistaken internal transfer between a user’s account
• Unintended bill payment to an existing payee
19
Mobile Banking Enrollment*
90,000
Total Unique Mobile Users: 128,854, or 21% of active Web Banking**
80,000
76,895 Mobile Web Users
12% of active Web Banking
63,296 Mobile Text Users
70,000
10% of active Web Banking
Enrolled Customers
60,000
50,000
Mobile Text
Mobile WAP
40,000
iPhone App
Profile of Mobile Customer***
30,000
20,000
*71% of users are under the age of 36; about 26% are
between the ages of 36-55.
*Users are profitable. They have high balances & cross-sell.
*Users have a higher CQI than non-users.
*A disproportionately high share of mobile users are in the
Baltimore region.
24,957 App
Downloads
10,000
0
0
30
60
90
120
150
180
210
Number of Days
*Reporting through 1/12/2010
**Web Banking Active Users: 628,541
***DataMart
20
240
270
300
330
360
Current Environment
Industry Trends
1980
2000
Today
– Chat
– Video
– Facebook
– Twitter
• Alternative Channels growing in transaction, sales, and research
activities
• Forrester predicts that one-third of all checking sales will come via the
Internet by 2013
• 2009 survey by the American Bankers Association finds that customers
under the age of 55 prefer to bank online
Small Business Owners Use
Smartphones
Small Business Adoption
Outpaces Consumer
While only 17% of Americans own
smartphones…49% of small
business owners are reported to
own smartphones.
Source: Forrester, September 2010
22
Current Environment
Industry Transaction Trends
• Mobile and Online transactions will grow at a significantly higher rate than other
transactions over the next 3 years (TowerGroup)
• More than 1.5B check deposit transactions will shift from the branch to mobile check
deposit by 2014 (Mercatus’ Remote Deposit Capture Adoption Research Study, 2/2012)
• According to Nielsen, by the middle of 2011 over 50% of mobile phones sold in the U.S.
are expected to be smart phones, or other all in one device
Source: TowerGroup
Q&A