Europay is proof that it doesn't always pay to be first. In recent weeks, it became the first international credit and debt card company in Russia to be systematically targeted by thieves, who gained electronic access to at least 216 accounts.
That it happened to Europay may have been the price of success. Its brands - chiefly EuroCard/MasterCard - account for more than 57 percent of card transactions in Russia and lead the way in Europe as well.
Andrei Koroloyov, director of Europay in Russia and the CIS, spoke with the Russia Journal about the company's strategy for maintaining its market position even under adversity and for improving security and guarantees for its clients.
Russia Journal: There's been a lot of attention given to the recent credit card fraud scandal involving cards issued by Union Card [which Europay believes was the entry point for the thieves]. What's happening now?
AK: PricewaterhouseCoopers has been appointed to audit Union Card. Europay has asked PWC to analyze information security, in particular relating to operations using the cards. The checks will begin this week in Moscow. All this is being done with Union Card's close cooperation and support and that of the banks participating in the system. Once we have the results of the audit, measures will be implemented enabling Union Card to get its license back and resume operations with automatic teller machines [ATMs]. At present, we have sufficient reason to believe the leak of information took place at Union Card, but exactly how it happened technically, we are not yet able to say.
RJ: How soon will you have the results of the audit?
AK: The audit is set to take 10 days. Europay has no complaints regarding other operations carried out by Union Card at the moment. We will only be able to make any definite statements once we have the results of the audit. What is definite is that whatever action we take will be public and proper as regards the participating banks and processing centers, but will be resolutely tough as regards ensuring security. These are the principles we have to observe if we are to find a solution.
RJ: Is it true that the compromised cards were issued by foreign banks?
AK: Union Card worked with 65,000 cards - issued by both Russian and foreign banks. It's not yet clear why only cards issued by foreign banks were compromised.
RJ: What are the differences between the statements given by payment systems and those given by FAPSI (the Federal Agency for Government Communications and Information)?
AK: Payment systems certify coordination protocols. FAPSI certifies all cryptographic equipment. The payment system has the cryptographic equipment installed on all the ATMs, but encrypting the information is FAPSI's job.
RJ: Could the leak have taken place elsewhere than the ATMs or processing centers?
AK: No, only through ATMs or processing centers that work with the information in coded form. If the key to the code was certified by professional cryptographers, then either someone somehow broke the code or obtained the key.
RJ: What's happening at the moment with switching ATMs over to other processing centers?
AK: In Moscow, all ATMs have now switched to other processing centers. It's difficult to get a full picture of what's happening in the regions because there are quite a lot of banks linked to the system as associate members or agents. The banks' clients can still withdraw money from these banks' ATMs. The problem is in inter-bank processing. What has helped is that banks have looked after their own clients, ensuring that they're still able to get money, even in the regions.
RJ: Are there any other types of card fraud aside from that used at Union Card?
AK: Now there's a Y2K fraud scheme. The crooks ring the authorization service and say that in connection with the 2000 changeover, they have to carry out some checks. They tell the cashier to hold the line and, in the meantime, someone comes to withdraw $8,000 to $9,000. Some cashiers hand over the money. It's not such a technical kind of fraud, but it's happening, and we're warning our personnel to be on the lookout for it, and banks themselves are taking preventive measures.
RJ: How soon will your microchip project be ready?
AK: Things like the fraud schemes make the microchip project particularly timely. We've had a few delays with our pilot project, but next year we will launch the Maestro card with a magnetic strip and microchip. These cards will first be used in a pilot project.
RJ: Apart from improved security, what other advantages does the chip have?
AK: The chip is a good development strategy. In some places with telecommunications problems we can't use the magnetic strip, and the chip will provide a solution. It will also speed up the general shift to using the more secure chip technology, a good thing given the fraud schemes. I don't want to frighten anyone, but the fraud schemes we know about are only a fraction of all the possibilities out there.
RJ: Could Russian-made chips be used in Europay's chip cards?
AK: It takes at least a year to develop a chip. Banks, then, have two options. First, they can set out their demands and then have the chip developed on the basis of those demands. But that will take up to 18 months, not including certification. Second, they can use the ready-made standardized chips offered by the payment systems. Each bank has to choose for itself.
RJ: What is Europay's share of the market in Russia?
AK: Europay issues 57 percent of the cards and has 60 percent of transactions in Russia. That's concerning cards issued by Russian banks. Europay is thus the leader on the market, and we intend to further widen the gap with our competitors. As for the actual numbers, by the end of 1999, we hope to have 2 million cards. By the end of the third quarter, we had close to 1.8 million cards. We have come back to our pre-crisis levels for card issues and volume of operations. We're growing faster than our competitors, though we never had the lead in terms of volume of operations. At the beginning of 1998, we had 36 percent of all operations. By the middle of 1999, we had 52 percent.
RJ: What are Europay's plans in Russia in the near future?
AK: In Russia we will develop the same products as elsewhere. We haven't stopped taking in banks as members of Europay, nor have we reviewed the "entrance fee" we ask for - an insurance deposit for banking risks - and we have no reason to review it. Our risk-management has proven itself in Russia, weathering the crises this country has faced.
RJ: How many Russian banks could join Europay in the near future?
AK: At the moment we are holding negotiations with 68 Russian banks on joining Europay.
RJ: How do you see the role of competition among different payment systems on the plastic money market in Russia?
AK: Competition means that today, a Mastercard costs $100, whereas only 3 years ago, it cost $2,500. We certify as many processing centers as investors and banks make it possible to certify.
RJ: What could be done to make plastic more widespread in Russia?
AK: Cardholders must put pressure on shops to accept cards. The Petrovsky bank in St. Petersburg has come up with an interesting idea. It issues salary and pension cards. The bank's specialists analyzed the services typically used by their clients and then gradually began introducing card-based service in those places. Shops that refused to have terminals installed soon began losing clients to those that did. Then the shops turned to the bank and asked for terminals to be installed so that they too could accept payment by card.