This week, an estimated 180 000 EasyPay customers will receive an e-mail that offers money-back rewards on all their transactions as part of the company’s strategy to restore its credibility and regain customers’ confidence after its site was hit by credit-card fraud two months ago.

EasyPay will also carry the full liability of any fraudulent transactions, said Serge Belamant, the CEO of Net1, the holding company of EasyPay. He said he has confidence in the site’s newly built security features.

EasyPay has one of SA’s largest third-party payment systems. It allows consumers to use their credit cards to pay their bills, including Telkom, the municipality and traffic fines, either through its website or at pay points in shops such as Pick n Pay.

It also allows consumers to buy airtime and prepaid electricity online and it was these purchases that were targeted in September by a crime syndicate. The criminals obtained a list of credit card numbers, which it used to buy airtime, electricity and prepaid gift cards.

The reaction from Absa, which found that one in three transactions were fraudulent, was to prevent its cardholders from transacting on the site temporarily until EasyPay removed the high-risk products. Some banks continue to limit the number of EasyPay transactions they allow.

Walter Volker, CEO of the Payment Association of SA, said EasyPay had nothing to do with the release of the credit card details. An investigation is underway to determine how the syndicate obtained the credit card details, which resulted in losses of millions of rands. It must still be determined which banks will carry the liability.

Belamant said the company had been unfairly targeted by the banks because it was not responsible for the breach. He said the high volume of traffic on the site — it does 4m to 5m transactions a month — made it attractive to fraudsters.

EasyPay processes payments worth R120m/month, according to Belamant, and the new site is growing at a rate of 10%/month.

He claimed Easypay is a target for competitors: by preventing customers from using their credit cards on the site, banks can effectively destroy EasyPay.

But Volker said EasyPay does carry some responsibility because any merchant, especially one offering services such as airtime and prepaid electricity, which can be sold for cash, has to have additional risk measures in place to manage and monitor the transactions for trends and anomalies. One of the principles of the payment system is that any entity that introduces risk into it is responsible for managing that risk. Therefore, EasyPay needs to be proactive and in this case it failed to do so, forcing the banks to take action.

Volker said it was the banks’ own risk-monitoring systems that picked up the problem and they followed a risk-mitigation process of limiting access to the site to stem the fraud. The banks also requested that EasyPay close down the three products that were being targeted until the site had a system in place to lower the risk.

Volker said online credit card transactions are a risk globally and work is being done to improve the security of “card-not-present transactions”, which have experienced a significant increase in fraudulent activity. Although cards with chips and PINs have reduced the incidence of card fraud at the point of sale, syndicates have still been able to obtain credit card details and transact online when PINs are not required.

He said whatever solution is found will have to be globally applicable, because crime syndicates work across all geographical areas. The solution will have to form part of the global standards for card payment systems.

Belamant said the EasyPay site meets all the banks’ security requirements and is as secure as their own Internet banking systems. He is introducing security measures that banks have not put in place, which will ensure that no fraud is possible. He is so confident of the new system that he is prepared to guarantee all payments. In other words, if you claim it was not your transaction, he will not ask for proof but simply refund the payment.

This is quite a significant promise, because EasyPay is reintroducing the high-risk products, such as airtime, as well as new products. It is not clear how Net1 will meet this promise if a similar situation occurs again.

“We believe that once we have launched our new product the site will grow substantially because the new solution removes so many existing barriers to entry and also eliminates fraud. Our incentive programme is cash-based and thus is far more transparent and usable when compared with other point-based systems,” said Belamant, who argued that the greatest security breaches come from within the banks and yet he pays the price.

Brand attack
Although EasyPay has met the banks’ requirements and processes only third-party bill payments, the banks remain highly cautious. This is affecting the EasyPay brand.

First National Bank allows cardholders to do only one EasyPay transaction a day and Standard Bank is contacting its customers each time they use the site, which creates negativity around the brand.

Jacques Celliers, chief executive of FNB’s credit card department, said although only one transaction a day through EasyPay is allowed, multiple accounts can be paid in that transaction.

Customers tend to use EasyPay because it allows them to earn loyalty points on their credit cards. Belamant said FNB has approached him to see whether there is a way to incorporate EasyPay into its Internet banking site so that customers can have the security of the FNB site while still earning eBucks.

“There is no better way than giving FNB customers the opportunity to do everything on one site. It’s just pure convenience,” said Celliers.

Clearly, reward points are a significant driver, which is why EasyPay will investigate paying a percentage of its fee back to customers. Although the full details are still to be announced, Belamant said the refund will be about 0,3% to 0,5% of the transaction total and will be paid in cash and not in loyalty points. — Maya Fisher-French, Mail & Guardian