ACCC press release 

The Australian Competition and Consumer Commission has issued a draft determination proposing to deny authorisation to the Australian Payments Clearing Association (APCA) and some of its members to mandate an industry wide security initiative using 3D Secure security measures to reduce online payments fraud.

APCA is the self-regulatory body for Australia’s payments industry. Its members include payment schemes, such as Visa and MasterCard, and banks.

“Currently, there are a range of anti-fraud products available for merchants to choose from. The mandatory roll out of 3D Secure to Australian payment cards and online merchants is likely to reduce this competition and would impose significant costs on a large number of online Australian businesses,” ACCC Chairman, Rod Sims said.

“There is broad support for reducing online transaction fraud and the ACCC supports moves by industry to address this growing problem. However we do not endorse mandating a single anti-fraud product.”

“We understand mandating a particular product is out-of-step with the approach taken in overseas jurisdictions. When security measures were mandated in Europe, India and Singapore, for example, a product neutral approach has been taken. APCA has not justified why a different approach is appropriate in Australia,” Mr Sims said.

“The ACCC does not accept that it is necessary to mandate a particular anti-fraud product. The cost of online fraud is principally borne by the online business that accepts a fraudulent transaction. Accordingly, each business can be expected to take the cost of fraud into account in making decisions about whether to invest in anti-fraud measures, and to engage anti-fraud technologies that are worthwhile for that business’ particular needs and circumstances.”

A number of interested parties raised concerns about the cost to businesses of implementing 3D Secure, which APCA estimates will be up to $393 million, directly affecting 60,000 Australian online businesses.

Interested parties are also concerned that businesses will lose the ability to choose an anti‑fraud program that suits them. The ACCC considers that mandating a single product reduces competition and stifles innovation, which could prevent or hinder the development of online fraud solutions that better suit Australian businesses and consumers.

Austra3D Secure is also owned by key players in these markets. The current version is owned by Visa, with EMV Co to operate the next version of 3D Secure.  EMV Co is owned by Visa, MasterCard, American Express, Discover, JCB, and UnionPay.

The ACCC is concerned that mandating this one product into the market with no controls over access or pricing for payment schemes will harm competition and increase costs for Australian businesses and consumers.

The ACCC considers that if fraud rates for online card transactions continue to increase, it will be more attractive for businesses to take up security measures. Such measures might be 3D Secure or other existing or new products. These market forces can be expected to check the growth in online transaction fraud, without forcing businesses to adopt a particular product.

While the ACCC accepts that the proposed conduct is likely to result in some public benefits in the form of reducing online payments fraud and associated costs, the size of these benefits is uncertain. The ACCC is therefore not satisfied that the likely benefit to the public from the proposed conduct would outweigh the likely detriment to the public.

For these reasons, the ACCC proposes to deny authorisation. The ACCC has also decided not to grant interim authorisation for the proposed conduct.

The ACCC is seeking submissions on its draft determination before making a final decision.

Background

APCA seeks authorisation so that its member payment scheme operators and issuers and acquirers such as banks can collectively require all relevant payment cards issued in Australia and all online businesses in Australia to use the 3D Secure fraud detection product. APCA is also seeking authorisation to collectively determine fraud thresholds to apply to online businesses and to undertake a joint consumer marketing campaign.

3D Secure is a security ‘protocol’ for online credit and debit transactions which aims to reduce fraudulent transactions.

Authorisation provides statutory protection from court action for conduct that might otherwise raise concerns under the competition provisions of the Competition and Consumer Act 2010 (Cth). Broadly, the ACCC may grant an authorisation when it is satisfied that the public benefit from the conduct outweighs any public detriment.

Further information about the application for authorisation is available at: http://registers.accc.gov.au/content/index.phtml/itemId/1192122/fromItemId/278039.