Instant progress?

Flagship app:

Adoption of Pix has been rapid, but that’s come at a cost

Ron Delnevo explores the varied worldwide adoption of instant payment apps, and asks if one of the most successful so far – Brazil’s Pix – is everything it’s cracked up to be

The developments in person-to-person (P2P) digital payments over the last decade or so have been fascinating.

I had first-hand experience of this when I served as a director of the ill-fated UK Payments Council. The chairman was determined to leave a legacy – and that legacy was the mobile payments system Paym. Launched in 2014, Paym was a mobile payment system, with payment recipients identified by their mobile phone number instead of their bank account details. All the payment recipient had to do was to register with Paym to link their mobile phone number with their bank account. Senders could then simply use the phone number to make a payment, with the senders’ bank retrieving the recipient’s bank account details associated with that phone number.

But sadly, not all the major UK banks fully got behind the Paym launch. Does anyone remember Pingit (originally Barclays Pingit)? Launched by the bank, it provided the same P2P payment potential as Paym and was compatible with that service – but the continued presence of the separate Pingit brand after the launch of Paym only served to cause confusion.

Pingit closed in 2021. And, in September of this year came news that Paym itself would cease to operate within six months. Making the announcement on behalf of the 15 other UK banks and building societies that had co-operated to support the service, industry body Pay.UK said the decision reflected the rapid evolution in payments technology and services, which had seen Paym’s users shift ‘towards newer forms of mobile payment and access to Faster Payments through online banking’.

Evolution can be cruel.

EUROPEAN ADOPTION SOARS

In other European markets, most notably in Northern Europe, commercial banks have done rather better in fully cooperating to launch P2P payment systems.

Swish in Sweden, Vipps in Norway and MobilePay in Denmark, all launched since 2012, have impressive adoption rates of 75 per cent, 78 per cent and 81 per cent respectively. As a comparison, Paym never attracted much more than 10 per cent of UK current account holders.

Danish figures are particularly impressive, with the National Bank reporting that in 2021 there were 4.3 million registered MobilePay users, out of an adult population of only 4.7 million. As well as dominating P2P payments, mobile payments now account for 22 per cent of transactions in physical trade, which includes retail and catering outlets, along with self-service purchases such as through ticket machines.

Equally important, there are relatively few reports of serious fraud impacting MobilePay users. Security seems to have been given a high priority by the developers, which is as it should be.

Interestingly, despite the unquestionable success of MobilePay, cash continued to be used for 12 per cent of Danish physical trade payments in 2021, which is broadly in line with the Norwegian and Swedish experience. So, thankfully, none of these countries looks likely to become a ‘cashless

society’ any time soon and the public’s right to payment choice seems secure.

My research in the relatively ‘cash-lite’ Northern European markets got me thinking about what might be happening with P2P payments in areas where cash remains a more popular means of payment.

So, I decided to turn my attention to warmer climes, alighting on Brazil, where cash still accounts for more than 40 per cent of all payments. It turns out that Brazil is a VERY interesting market.

TOO GOOD TO BE TRUE?

No doubt having seen the success of mobile payments in Northern Europe, in the last two years Brazil has adopted an agenda of fast-tracking the digitisation of payments and, in particular, launched Pix, an instant payment system, in November 2020.

The promise of Pix was speed, security and financial inclusion. It works exactly as the UK’s Paym did for the public, with mobile phone numbers instead of bank account details identifying users. Interactions between personal users and businesses are created using QR Codes, typically on display in retail premises.

Nothing different from what we have seen elsewhere, you might think. Except for the crucial fact that it was Brazil’s central bank, rather than the commercial banks, that took the lead role in launching Pix and forced ALL financial institutions to participate in it.

This adoption was imposed at breakneck speed, seemingly leaving little time for the development of protocols and security mechanisms.

So, what has been the outcome of this rushed introduction of the Pix innovation?

In 2021, just one year after the launch of Pix, Brazil saw a significant increase in frauds impacting customers. These frauds included WhatsApp cloning and pyramid schemes, along with social media scams. It seems that security shortcomings in the Pix technology have opened the door to a variety of frauds, clearly seriously negatively impacting end users.

Extortion through kidnapping has also resurfaced in Brazil since the introduction of Pix, with criminals now imprisoning members of the public who are carrying their smartphones, and only releasing their victims after forcing them to make large transfers of money via Pix. In the city of São Paulo, the largest Brazilian metropolis, the number of such kidnappings increased by almost 40 per cent in the first half of 2021.

Another growing form of crime is the theft of smartphones, no doubt encouraged by the ease of stealing significant amounts of money through financial applications – such as Pix – installed on the devices. There are now gangs specialising in unlocking the phones and carrying out the fraudulent transactions.

With the increase in the number of these occurrences, the Brazilian central bank has belatedly recognised the insecurity of Pix and announced changes. However, many believe that the changes are inadequate to reverse the security chaos.

Moreover, the central bank has transferred the responsibility for Pix security to the financial institutions, seemingly to avoid the need for the bank to bear any blame attached to a product it launched.

It’s easy to understand why the central bank smelled the coffee and wanted to take itself out of the firing line in relation to Pix security. Its own figures show evidence

Extortion through kidnapping has also resurfaced in Brazil since the introduction of Pix, with criminals now imprisoning members of the public who are carrying their smartphones, and only releasing their victims after forcing them to make large transfers of money via Pix

of nearly 740,000 crimes involving Pix from January to June this year, compared to just 25,000 in the same period in 2021. That’s 170 crimes per hour in 2022. Or, put another way, there has been an almost 30-fold increase in criminal activity involving Pix in just one year.

Another vulnerability of Pix is data leakage. Between September 2021 and February 2022, the Central Bank of Brazil recorded three Pix user data leaks. More than half-a-million keys, consisting of data such as name, tax registration information, mobile phone number and banking details, have been potentially exposed to criminals.

It is not only in relation to security and consequent crime levels that Pix is proving very problematic. On the issue of financial inclusion, for example, there remain serious obstacles to achieving universal access to Pix. According to a survey by ITCN (the Institute for Strategic Studies of Technology and Cash Cycle), Brazilians relying on the minimum wage would need to commit about 20 per cent of their income to pay for the technology required to use Pix.

The ITCN study reveals that there are two main barriers to adoption. Firstly, the need to buy an expensive smartphone, capable of accessing financial institutions’ applications and, secondly, to purchase data packages to use those applications. The study concludes that the total costs involved are far beyond the means of a significant percentage of the Brazilian population.

This probably also explains why, today, use of Pix is much greater among young people between 18 and 24 years old, the better educated and those from higher income families. Data from the Central Bank of Brazil reveals that though there are nominally 131 million Pix users, only three million – less than two per cent of the Brazilian population – actually make more than 30 Pix transactions per month.

There are also concerns that state ownership of Pix does not encourage competition in the financial services marketplace. Superficially, state ownership may, at this stage, seem beneficial, because Pix does not currently charge fees. However, it is obvious that someone will have to pay the bill for the more secure architecture that will need to be developed to protect the Pix system from criminal activity. What’s the betting that it will be the hard-pressed Brazilian public who ultimately pick up this tab?

But, fortunately, the Brazilian public still enjoy payment choice. And that choice has seen cash continue to lead the way as the means of payment that gives people maximum control over their household budgets, aided by the fact that cash users are still able to claim discounts from merchants.

In Northern Europe, there’s little evidence so far of a similar downside to the many P2P systems available. But, given everything we know today, the question that arises in Brazil is this: Pix has brought progress for whom, exactly? ■ Ron Delnevo is a business consultant with over 30 years experience, specialising in financial services and, in particular, innovation projects.