Decoding PBOC’s Move against QR Code Mobile Payments; Central Bank Mulls Tough Rules for Third-Party Payment Firms

03.17.2014 18:45
Closer Look: Decoding PBOC’s Move against QR Code Mobile Payments
The technology used by Alipay and Tencent is unsafe, the central bank says, a move that has to have executives at UnionPay smiling
By staff reporter Qin Min
(Beijing) – The central bank has said handling payments by scanning quick response (QR) codes is not safe and should be stopped.
The order regarding QR codes – those blotches of black and white that can be scanned using a phone’s camera – came in a document the bank sent to third-party payment handler Alipay on March 13.

The central bank’s order shocked Net firms like Zhejiang Alibaba E-commerce Co., which runs Alipay, and Tencent Holdings Ltd., whose popular messaging app WeChat was just beginning to handle payments using QR codes. Companies have invested heavily to get offline businesses to handle QR code payments.
The move by the People’s bank of China raises two questions. First, are QR code payments safe? Second, who is the winner in the PBOC’s decision?
Letting consumers make payments with mobile devices linked to phone cards is not new to China. China UnionPay is the dominant banking card industry association in the country. Its network of ATMs and card readers is used for millions of transactions every day.
It also handles mobile payments via near field communication (NFC) technology. This allows consumers to make payments by waving their smartphones near a point of sale (POS) reader.
Qiao Xin, an executive at state-owned telecom company China Potevio Co. Ltd., says NFC and QR technologies are simply ways to send data. Whether or not they are safe depends on the software used to encrypt the data.
In fact, the encryption models for all mobile payment technologies – UnionPay’s NFC or the QR code method preferred by Alibaba and Tencent – are similar, Qiao said. Hence, both methods are only as safe as their encryption software.
A source in the payment industry echoes this, saying neither technology is immune to fraud. The only real difference between the QR and NFC methods, the source said, is that the former is preferred by Net companies who have not settled on standards for transmitting information, but this in itself is not a security flaw.
Regulators should really focus their attention on pointing out the safety problems to the industry and spurring it to set standards.
Which brings us to the second question: Who wins? The short answer is UnionPay and the state-run banks it represents.
One very good way to improve the safety of mobile payments is to add chips to smartphones, but the readers they would connect with are in UnionPay’s territory.
UnionPay, which was established in 2002, has worked hard to see its NFC technology adopted in recent years, and had 1.47 million NFC-capable POS readers in use by the beginning of the year.
Qiao says it is doubtful UnionPay will give Internet companies permission to develop chips compatible with its POS terminals. Last year, Alipay tried to develop its own POS services by collaborating with banks to process payments, skipping UnionPay and the commission it charges. But Alipay abandoned the idea, and UnionPay was seen as defending its turf.
The QR code method of payment has been growing faster than the NFC version because users like it better, partly because users do not have to open an app like their have to do with the latter.
Businesses also like the QR code method because they do not have to pay commissions to UnionPay for each transaction. This is a significant loss of revenue for UnionPay, Qiao said.
Alipay also charges a commission that it splits with banks, but it is less than what UnionPay charges.
Because of the better user experience and lower costs, analysts had said the future of QR codes was bright. While the central bank’s move has ensured UnionPay and its banking partners their profits, it has also thrown the mobile payment industry into disarray.

03.17.2014 19:27
Central Bank Mulls Tough Rules for Third-Party Payment Firms
Measures would limit how much can be spent using Alipay accounts and restrict money transfers to e-investments like Yu E Bao
By staff reporter Yang Lu
(Beijing) – The central bank is mulling tough measures that analysts say would choke third-party payment companies including Alipay, which are expanding from online to offline payment services, an area dominated by state-backed China UnionPay.
The People’s Bank of China released a draft policy last week to major banks for consultation. The policy would ban payment companies from handling offline transactions.
It would also cap spending via third-party payment accounts and restrict money transfers from bank accounts to accounts run by payment companies, such as Alipay’s Yu E Bao, an e-investment product that has attracted hundreds of billions of yuan worth of deposits from banks.
A central banker who worked on drafting the proposals said the regulator intends to limit the operating scope of third-party payment companies to online shopping. Offline payments would be off-limits because third-party payment accounts are less secure than bank accounts, he said.
“Once a payment company runs into trouble, there is fair chance that the balance in its account cannot be converted into cash,” the central banker said.
The central bank is also concerned that letting payment companies offer service to brick-and-mortar stores would bring chaos to the offline payment market, another central banker who drafted the proposal said. He did not elaborate.
The central bank recently ordered payment companies to suspend handling payments through quick response (QR) codes – those black and white blotches that can be scanned using a phone’s camera. Users scan a QR code to link a physical store’s charge to their account with a third-party payment company, which handles the payment based on its own agreement with banks. The process requires no involvement of UnionPay’s network.
The central bank also told Alipay and WeChat, Tencent Holdings’ messaging app, to delay launching electronic credit cards due to security concerns.
But critics say the bank’s motives involve more than security concerns.
“The development of third-party payment services and their virtual (credit card) accounts sidestep UnionPay altogether,” a manager of a payment company said. With QR payments, merchants do not need to pay UnionPay at all.
UnionPay, a state-backed company, was established in 2002 with the approval of the central bank and the State Council, the country’s cabinet. Its founding shareholders were 85 Chinese banks led by the big state-owned lenders. Former central bankers still fill UnionPay’s top ranks. The company’s chairman, Su Ning; president, Shi Wenzhao; and former president, Xu Luode; all worked for the regulator.
The relationship between the central bank and UnionPay is controversial. The regulator requires that all bank cards issued in China carry the UnionPay logo and that all yuan-based transactions by bank cards must be processed through the UnionPay network.
Foreign card brands like Visa and MasterCard question these requirements, saying it is a monopoly. In July 2012, the World Trade Organization decided that the requirements violated WTO rules, but it did not make specific recommendation for addressing the problem.
UnionPay issued a statement on March 14 denying it had any kind of influence over the central bank’s policy-making regarding third-party payment companies.
A source close to the situation said the central bank was under pressure from higher-ups to strengthen regulation of Alipay and the like. He did not elaborate.
‘Wait and See’
The policy released for feedback from bank executives also includes restrictions on spending via third-party payment accounts and money transfers to them. The requirements are so harsh that many analysts doubt they can be implemented.
One rule says that a user can only transfer up to 1,000 yuan to a third-party payment company’s account at a time, and the combined total cannot exceed 10,000 yuan a year.
Analysts say this requirement would cripple Yu E Bao and other short-term investment services offered by Internet companies, which have thrived because of high yields and convenient withdrawal terms.
By the end of February, some 80 million people had invested 500 billion yuan in Yu E Bao accounts. That means more than 1.3 million yuan worth of net investments flew into Yu E Bao every minute since it was launched in June.
The draft policy also seeks to cap transactions handled by third-party payment accounts at 5,000 yuan each and 10,000 yuan per month. The limits may be too low for many e-shoppers and inconvenient for those who spend heavily only on the few days when e-commerce companies offer steep discounts, analysts say.
Users who need to transfer more than the approved amount into their accounts with a third-party payment company and those whose spending exceeds the limit should do so by directly dealing with a bank, the policy says.
This rule reflects the regulator’s attempt to have third-party payment companies handle only small transactions, leaving the bigger ones to banks, a central bank official said.
The draft policy is expected to be reviewed, updated and published by the end of September.
Some say too many questions are unanswered. One is what happens when a payment company breaks the rules. If the punishment is revoking its payment license, who takes responsibility for shutting down a firm as large as Alipay, an employee at a third-party payment company asked.
“Luckily the procedures for making the policy under discussion have been relatively transparent,” an analyst who is following the situation said. “We will wait and see whether those proposals that go too far are really carried out.”