Security Solution for MasterCard PayPass™ NFC Phone

The challenge

Proxama has been working with MasterCard's Centre of Excellence for Mobile developing mobile phone NFC products since 2005. Security is a major concern for issuing banks looking at using NFC for contactless payments. In particular, in EMV markets management of the card risk parameters is a key requirement.

When an offline payment is made with a contactless card, the risk management counters on the card are updated. When the counters reach a threshold predefined by the issuer, the cardholder is required to carry out an online Chip & PIN transaction. This allows the issuer to confirm the registered cardholder is still in possession of the card. At the same time the authorisation system updates the card and resets the counters. In practice, this means cards can authorise a total of say, £50, before needing to go online.

However, when the payment application is on a phone rather than a card, a different solution is needed. Because the phone does not fit into a chip card reader, the counter reset needs to take advantage of the phone's user interface and connectivity.

Our approach

Having documented MasterCard's business requirements, we drew up a set of technical options. These were then evaluated for impact on issuer, cardholder and merchant. We were looking for the best end-to-end payment experience. We then recommended the most appropriate solution and built a prototype system. Using our existing NFC framework, originally designed for smart poster applications, we were able to rapidly build an application to sit on the mobile handset and manage the user experience.

Results

Our solution consisted of a J2ME MIDlet user application for a Nokia 6131 mobile phone which pops up a branded transaction screen when the customer makes an offline payment. In the background, the application interacts with the payment application on the phone's secure element comparing it against configured settings. When the predefined limit is reached, the application informs the customer that a security check is required and the phone goes online to request issuer authorisation as with a standard EMV transaction. The process takes a matter of seconds and allows issuers to provide additional value-added services using the online channel.

MasterCard has used this solution to develop specifications that will allow EMV issuers to run NFC payment pilots.