How a Startup Processor Plans to Take on NACHA in Web Payments

A Bellevue, Wash.-based startup plans to have a Web-based payment system in operation some time in 2008 that will look strikingly similar to one that NACHA-The Electronic Payments Association has spent the past several years developing. Metafos Inc., which formed only 18 months ago, is talking to banks and online retailers about a product it is working on that will allow consumers to pay Internet merchants through their online-banking programs?a concept also being pursued by NACHA, the rules-setting body for the automated clearing house network, as part of an online payments product it is calling Secure Vault Payments. NACHA plans to launch a pilot for the new payments system later this year (Digital Transactions News, May 2). Though Metafos has not yet signed a client, Bob Cadd, vice president for retail partners at the company, says the company is in discussions with both financial institutions and merchants. “People are very curious about this,” he says. He says the timing for the product's launch will largely depend on the time it takes to recruit banks and have them do the systems work needed to support the product. “We're probably not going to pilot in 2007,” he says. As with NACHA's system, the Metafos product will depend on banks to authenticate their customers through online-banking logins. In both systems, the customer selects the payment method at the merchant's checkout page, then uses her online banking program to authorize payment out of her checking account. In both systems, funds are guaranteed to the merchant and settled through the ACH. The key twist with the Metafos system is that it requires the online shopper to type out her bank URL or select it from a list of bookmarks to go to the bank's Web site. NACHA's Secure Vault Payments system presents a page listing participating banks for the consumer to select from. Cadd argues this approach leaves the NACHA program vulnerable to spoofing and man-in-the-middle attacks, in which fraudsters redirect consumers to bogus Web sites or intercept information consumers enter online. “All the redirects are opportunities for spoofing,” he says. “We're trying to get rid of all this stuff in the middle to protect against this generation and the next generation of fraud attacks.” Although Metafos's data center will maintain secure communication channels to both banks and merchants, it will not collect account information or other personal data. “If someone hacked our data center, all they'd get is a long list of goods being sold,” Cadd says. Merchants will collect shipping addresses at the checkout page or have it already on file for regular visitors. For disputed transactions, Metafos has created an automated system consumers can use at either the bank or merchant site. If the claim is valid, it will refund the consumer electronically. NACHA has acknowledged the difficulty in hammering out rules to deal with so-called broken transactions, but has not yet announced how Secure Vault Payments will handle them. Another difference with Metafos is that it will admit merchants to its network with a risk ranking. Large merchants with a long history on the Web, for example, will likely receive their payments the next day, the normal settlement time for ACH transactions. A small merchant unknown to Metafos, however, may have part of its funds held back until the merchant establishes a trustworthy track record, Cadd says. These merchants could also get the holdback lifted with a line of credit, he adds. Like Secure Vault Payments (and, indeed, other alternative payment products), the Metafos system sells itself to merchants on the notions of incremental sales, reduced fraud, less manual review, guaranteed funds, and lower fees relative to credit and debit cards. Cadd says merchants can expect a sales lift of 3% to 8% from new customers alone, apart from additional sales from existing ones, as shoppers without cards or afraid to enter card details begin buying. “We think that's conservative,” he says. Metafos has established merchant fees but is not yet ready to announce them, Cadd says. NACHA was expected to announce its Secure Vault Payment pricing last month, but has postponed that action until later in the summer.