Effective immediately, Visa has introduced cloud-based payment capability, which enables contactless payment functionality on a mobile device without a hardware secure element. This new solution provides an alternative way to deploy near-field communication (NFC) payments by enabling issuers, merchants and third parties to add Visa payWave functionality to their mobile applications by managing payment credentials via the cloud, thus removing the dependency on a hardware secure element on the mobile device.
Background
The Visa Mobile Contactless Payment Specifications (VMCPS) enable NFC mobile phones to make payments at merchant locations that accept Visa payWave transactions. Included in the specification is the requirement that payment account credentials must be provisioned to a secure element within the consumer’s mobile device. Until recently, this was the only technological option supported by Visa to enable mobile contactless payments for in-store payments at a physical point of sale.
Google’s support for Host-based Card Emulation (HCE) in the Android operating system means that any mobile application on a NFC mobile phone running Android 4.4 (KitKat) or above may now be enabled to emulate a contactless payment card without the use of a secure element in the consumer’s device.
Visa has introduced a new standard for Visa payWave to support HCE, which will allow issuers, merchants and third-party application developers to develop mobile applications that can initiate Visa payWave contactless payments. Specifically, such mobile applications may be developed to host payment account information in the cloud rather than in a secure element.
Visa Cloud-based Payments Program
To take advantage of HCE capabilities and enable a shift from traditional plastic cards to digital / mobile form factors, Visa has launched a cloud-based payments program that will provide standards, specifications, tools and services to issuers, merchants and third-party partners.
To this end, Visa has released Version 1.0 of the cloud-based payments software development kit (SDK), which supports Android KitKat, and consists of sample code for the logic described in the Visa Cloud-based Payments Contactless Specification. This initial version of the SDK is provided as a tool to support cloud-based payments within a mobile application. Future releases of the SDK will include code libraries and reference applications that may be used in conjunction with Visa cloud-based services. Issuers that wish to access this SDK can email a request to cloud@visa.com.
In addition, Visa has developed a quick-response (QR) code payments specification for in-store payments. The QR code will hold a tokenized version of the consumer’s Visa account credentials and a cryptographic value that changes for each transaction. The new Visa QR specification is intended to support mobile payments by allowing a merchant to read a QR code from a consumer’s mobile device. This specification is the second mobile payment interface (along with Visa payWave contactless payment technology) that Visa supports for in-store payments.
The new QR specification is initially available under an “internal evaluation” license only. Visa has also developed “evaluation” documents with minimum requirements for merchant mobile applications for merchants interested in
deploying in-store payments within their mobile applications; and minimum requirements for merchant value-added services data. Visa expects to publish a commercial version approved for use for Visa payments later in 2014. At that time, Visa intends to formally incorporate the QR standard as an approved Visa payment technology in the Visa International Operating Regulations.
To enhance consumers’ payment experience using a mobile device, Visa introduces new options for implementing a consumer device cardholder verification method (CDCVM) as an alternative to traditional cardholder verification methods (CVMs), such as signature and PIN. Until now, the only option for a CDCVM was a passcode. Visa is expanding the range of CDCVMs available to issuers to other “on-device” capabilities, including the screen unlock function, fingerprint sensor and “in-application” capabilities (e.g., a login password). These CDCVM options apply to both secure element-based and cloud-based mobile payment deployments. Issuers of cloud-based mobile payment deployments must ensure that the device supports a CDCVM and that the CDCVM is not the same as the cardholder’s PIN.
Visa International Operating Regulations Updated
Effective immediately, the Visa International Operating Regulations have been updated to support the first release of the Visa Cloud-based Payments Contactless Specification and minimum requirements, which will enable issuers to deploy a Visa-compliant cloud-based NFC payment application. This product is optional for issuers and does not require any changes for acquirers or merchants.
The Visa Cloud-based Payments Contactless Specification uses existing Visa payWave data logic and terminal acceptance infrastructure. Cloud-based payWave transactions will look and be treated identically to other (i.e., secure element-based) payWave transactions. The operating framework, including liability and chargeback treatment, is also the same, whether the payWave transaction originates from a mobile cloud-based payment device, a mobile secure element payment device or a physical card conducting a contactless transaction.
Guidelines and Specifications
The existing Visa International Operating Regulations outline a small number of core requirements related to mobile transactions; detailed technical specifications are included in extension documents.
In addition, Visa has developed documents to help acquirers and issuers better understand Visa’s cloud-based payments program, which are linked in the “Additional Resources” section, below. Visa clients do not need any additional licenses to access these documents.
Third parties (i.e., entities that are not Visa clients) can gain access to Visa cloud-based payments program documentation through the Visa Ready program at www.visa.com/visaready. Third parties that are already licensed for Visa chip and/or mobile specifications ordinarily can request and receive the documentation under those existing licenses. Third parties that are not yet licensed must execute the Visa Mobile Specification license before they may access the documentation.
Visa clients may visit the Chip and Contactless Specification Service page at Visa Online to access cloud-based payment resources, including:
• Visa Cloud-based Payments Program Description, Version 1.1: Explains the cloud-based payment program, including minimum requirements and benefits for issuers, acquirers, merchants and consumers.
• Visa Cloud-based Payments Program Minimum Requirements and Guidelines, Version 1.1: Specifies the minimum requirements for issuers to deploy a cloud-based payments program.
• Visa Cloud-based Payments Contactless Specification, Version 1.2: Provides the contactless specification for a mobile device making cloud-based, payWave transactions.
The following documents are available as “Evaluation Releases” and may be obtained by sending an email request to cloud@visa.com:
• Visa Cloud-based Payments Program Description for QR Code Payments, Version 1.0: Provides a high-level overview of QR code payments using the Visa cloud-based payments programs and the benefits for issuers, acquirers, merchants and consumers. (Evaluation Release)
• Visa Cloud-based Payments Program Minimum Requirements and Guidelines for QR Code Payments, Version 1.0: Outlines the minimum requirements and guidelines for issuers to deploy a cloud-based payments program using Visa QR. (Evaluation Release)
• Visa Cloud-based Payments QR Code Specification, Version 0.78: Provides the contactless specification for a mobile device making cloud-based, payWave transactions using QR codes. (Evaluation Release)
• Visa Cloud-based Payments Program for QR Code Payments, Acquirer Implementation Guide, Version 1.0: Contains information for acquirers and payment technology providers (POS vendors) responsible for implementation, certification, and activation of the Visa QR code program. (Evaluation Release)
• Visa Cloud-based Payments Program Minimum Requirements for Merchant Mobile Applications, Version 1.0: Details key features and requirements unique to a Merchant Mobile Application in the Visa cloud-based payments program. (Evaluation Release)
• Visa Merchant Value-Added Services Data Specification, Minimum Requirements, Version 1.0: Defines Visa Merchant Value-Added Services data exchange between a Mobile Application and a reader at a merchant’s physical store. (Evaluation Release)
Contact your