Cuscal bringing HCE NFC payments to Australian KitKat devices

Australian financial services provider Cuscal is bringing mobile payments using Host Card Emulation (HCE) – a new feature in Android KitKat‘s NFC functionality – to market in Australia later this year.

You may not know the name. Cuscal was founded more than 30 years ago and counts some 150 of Australia’s financial institutions as its clients. It services mutual banks and credit unions, including NAB and Bank of Queensland as well as other companies seeking payment solutions like Virgin’s Velocity program. It’s one of Australia’s leading end-to-end payments providers and runs a network of ATMs around the country, but is focused on B2B operations.

As Cuscal evolves its mobile payment capabilities for its clients, it’s embraced KitKat’s Host Card Emulation feature and has been working hard to integrate the feature into its payment processing systems since the feature was announced towards the end of 2013. The company is now in a position to run a pilot program amongst its staff in consulation with Visa, six of whom have Nexus 5s running a special app (currently named “Redi2Pay”) that allows them to tap their phones on a POS payment terminal and use it to process a payment.

We heard from Adrian Lovney, General Manager of Product & Service, and Brian Parker, Cuscal’s Chief Information Officer. Brian was the first person to perform a live transaction using HCE, purchasing a packet of TimTams at a 7-11 store in Sydney’s CBD earlier this month, and gave me a good look at the app running on his Nexus 7.

The company aims to develop an app that their clients’ customers can download from the Google Play store, register their card and start tapping their phone to make payments. It’ll also make HCE payments capability available to clients via an API.

Hosting Cards in the Cloud

Host Card Emulation marks a significant change in the way NFC interaction takes place when your phone comes in contact with another NFC device.

Previously, the NFC antenna would pass the signal to the Secure Element inside the device in order to process signal and respond appropriately. In order to perform secure transactions on a device, a financial instition would need to “rent” space on the Secure Element, dealing with device manufacturers and possibly even carriers to do so. We’ve seen this in Australia where the Commonwealth Bank and Westpac have a deal in place with Samsung allowing their customers to use Samsung devices for tap-and-go payments (which was a major feature of the Galaxy S5 launch on Wednesday).

HCE allows a device to move this functionality away from physical hardware to the Operating System, which can invoke a service/app to process the signal through the Internet. Cuscal’s solution stores the relevant data encryption keys on their server in their secure data centre and removes the need to store any sensitive data on the user’s device.

Processing the signal on a server over an Internet connection introduces a delay into the tap-and-go process (it takes time to send the NFC signal to the data centre and receive the response), which Cuscal has put at around 400ms on a 4G data network, but it removes the need for the company to deal with device manufacturers and carriers in order to get their payments system working. Importantly, Cuscal’s focusing on using the technology and protocols available to make payments and isn’t trying to solve connectivity issues.

Looking Forward

Cuscal plans to expand its pilot program in the coming weeks to 12 staff members, and looking to bring an update to their platform to customers mid-2014 that will allow them to bring their customers on board with appropriate Android handsets. As the HCE feature relies on Android KitKat, the current market for the service is fairly limited but by the time it’s available to the general public we’ll have had a few months of 2014 flagship phones with KitKat on board, which should broaden the

It’s also working with Visa on the project to ensure that their solution meets Visa’s recently-announced HCE specification. Visa’s standard includes some provision for making payments in environments where a data connection isn’t available, which will necessitate some changes to Cuscal’s current solution.

The company is also embarking on a research study to understand all the different types of POS units in place in Australia’s retail space and ensure that its solution is compatible with as many different terminals out there as possible.

Cuscal’s not just looking to use NFC HCE to power mobile payments. The technology can also enable some neat enhancements with the way a user interacts with their bank – my personal favourite of the examples given was to pre-process a cash withdrawal as you approach an ATM, then tap your phone on an NFC reader attached to the ATM to immediately dispense your money.

It was fun to be in a room with Android users and people who were very familiar with the operating system yesterday. Instead of being asked by someone with an iPhone in their hand what I think the best Android phone for an iPhone user would be, Adrian approached me as I was tapping a message out on my phone and asked “so, what phone are you packing there?” before revealing his own Nexus 5.

I also got a live demo of the technology in action after the briefing, as another Cuscal employee bought a hot chocolate for me from the cafe next door using her Nexus 5 to tap-and-pay. Everything worked flawlessly, and the hot chocolate was also pretty good.

The future may not be here just yet, but it’s coming. Your move, CommBank.