Rabobank Makes Calculated Move to Smart Cards

As the third-largest bank in the Netherlands (after ABN AMRO and ING Group), Rabobank Netherlands, the banking subsidiary of the $306 billion Rabobank Group, has to find ways to stay abreast of its more globalized competitors. Smart cards have been one key part of its strategy.

But as Rabobank discovered, launching a viable smart card network requires more than simply adding a chip to an existing plastic card. The smart card has to work in conjunction with an external device in order to display or transfer the contents of its digital storage and computing capacity.

Smart card readers commonly take the form of merchant terminals at the point-of-sale, or devices that connect to a user's PC. Since smart card terminals still have to accept magnetic stripe cards for the time being, many consumers have felt little urgency to switch over to smart cards. Furthermore, smart card readers for PCs are often beset by installation and incompatibility problems, and therefore slow adoption and usage rates.

Instead, Rabobank went with a portable, standalone device that, in conjunction with a smart card, acts as the equivalent of a limited-function PDA (personal digital assistant). This makes the Rabobank smart card more than just a debit card-it's also the brains of an access code generator.

The bank has issued the Vasco Digipass 800 reader to all of its Internet banking customers-a technology-savvy component of Rabobank's six million customers. The device is fundamentally a pocket calculator with a slot for a smart card. By inserting the smart card and entering a PIN, the user can receive a time-stamped code that's required for authentication when using a PC to access Rabobank's Internet banking site. No connection between the Digipass and the computer is required-just the code, to be entered along with user ID and password.

"That means it's portable, so you can check your balance and detail information and you can send a payment to whoever you want using Internet access from anywhere in the world," said Bert Willems, manager of operations at Rabobank.

Although financial services customers in the United States can access most Internet banking sites with just a user ID and password, that's not quite secure enough to inspire confidence for using the Internet channel to initiate online debit card transactions, which draw money directly out of customer accounts. "In the U.S., almost everybody has a credit card," said Willems. "In Holland, everybody's got a debit card, and only a certain percentage have credit cards."

Still, even European credit card issuers are making a big move to chip cards, both to protect against counterfeiting and identity fraud and to offer a differentiated mix of advanced services. Non-bank issuers, such as supermarkets, are also using smart cards to manage customer loyalty programs. "But that's only on a small basis, and those cards lack the payment functionality," said Willems. "That was the objective when they brought on the multifunctional smart card, but no one has realized it."

Rabobank has ordered 300,000 Digipass units this year and another 500,000 for next year. Although Vasco offers other form factors for the smart card display unit, Rabobank is moving forward one step at a time.

It's anticipated that the ultimate combination will be the marriage of the mobile phone and the debit card. "It's almost certain that they will introduce mobile phone payments in Holland in the coming year," said Willems. "What's really holding them up is the whole security issue."

Since consumers have different combinations of mobile phone and banking providers, a payment-enabled mobile phone would likely require the capacity to accept smart cards from both telecom and banking providers, perhaps even at the same time. Furthermore, the transmission protocols have to be ultra-secure in order to use banking applications.

"If the phone can be overheard, then there's a security leak," said Willems. "If it were really secure with a standardized solution for security, then you would see the mobile phone used for payment services right away."

Rabobank plans to offer such a solution in the first half of 2002.