Broadcom Payment Security Reviews

The valuable element is the data that I have. They have a lot of machine fingerprint data and that's data that we miss on non-3D Secure card not present transactions. We see a high value in that. With all the fraud rules that we built, we have a very good false positive ratio because of the big data that CA has.

We are using CA Transaction Manager for authentication and have CA's Risk Analytics for rules and case management. As an authentication method, we currently have static password + OTP via SMS (2-factor) and softOTP in our App. SoftOTP is an OTP generator within our own banking app delivered by CA. Soon we are going to migrate from SoftOTP to a new sdk that includes biometrics, also delivered by CA.

For CA Risk Analytics, we would like to have some statistics available, to do some counting on the number of transactions for example. Also, to have the ability not only for 3D Secure, but accross all online channels. Online banking and App.

Because then you would have three online channels. You would have the same device data, so you can combine it. So then you would have an online banking platform, an app, and 3D Secure all from one supplier. This supplier would support all of our authentication methods across those three channels.

That's our ultimate goal to have one supplier to support all three online channels.

It's very stable. I know in the beginning when moving from static password to soft OTP there were some bugs. But that's normal. With every new solution, you have to tweak.

Within the Netherlands, if I can speak about the Dutch market, a lot of Dutch internet merchants support 3D, but on a scale of all card not present transactions, only 25 to 30% of the merchants are 3D Secure for card not present transactions. But we would like to see that moving further so that all card not present merchants support 3D Secure.

This is very good. We have been in contact because the technical team is in India, so we have a lot of contact with the people over there.

Sometimes, there is a bit of language issue of understanding problems. But normally, project managers who are there to deal with our issues speak very good English and there's a good relationship there.

I think in some migrations from static password to SoftOTP, there was a large impact on cardholders. We also did a biometrics pilot together with MasterCard and CA and it went very smoothly.

Card holders have to step up for authentication. The fraud rates dropped for card not present fraud. We see that the non-3D Secure fraud is rising as well as account takeovers. That's why I think it's very good to have such a product in place.

When selecting a vendor, I want them to be straightforward, do a lot of innovation, and be a step upfront of the issues as needed. I think those are the most key and important things that we expect.

I work under fraud analytics. So I use this product to extract cases from there and then send it to Ops to review and analyze. Then mark it as either fraud or genuine. And if we get bad IPs from there, I add it up to our negative IP list. So it's pretty useful operation wise, and also in terms of some inquiries from us, if a customer is disputing they didn't receive an OTP password on their online transaction, and then they're disputing that it's not theirs, and it's unauthorized, but it was a successful transaction,

I use this product to see the customer's previous IP addresses. If they used it genuinely before then we ask them again, that this IP address or this device was used genuinely on these so and so days. And how come they say it's unauthorized. Maybe check if it's your son who used your phone or so forth.

In other scenarios we would require if you are saying someone has ported your phone to get the OTP from your phone, please get a certificate from your network, something like that.

It's pretty useful for our daily online pretty secure needs. So I don't know yet, I don't know yet. I'm still new as an analyst, but if I had wish it would be this one, this authentication for fingerprint and face would be promising.

That will solve my problems with a customer saying they didn't authorize, they didn't sent that OTP, when in fact we saw that it's a successful one, and how can you prove that it wasn't you? Yeah. Will solve that problem.

I don't have any issues with stability.

They quickly respond to me, whenever I need help. It's not a show stopper for me, per se, but currently I know there's an issue with an IP address change that my colleagues in Manila can't access their website. They've been using it for five years though. But it's a conversation between the IP and the technology head in Manila to explain why their IPs has changed.

For me they're really quick. if I need my password change, or I ask something urgently, I can get it.

In terms of the fraud that we see on the card site, card not present fraud, the person gives contribution to what the total fraud has increased substantially.

Therefore, having a robust solution to manage your 3D security rules authentication strategies is very important. And that's, again, balancing customer experience with fraud, so that's where all this becomes important.

I definitely brought over a lot of my learnings from a previous company. I was already familiar with the interface over there on rules, etc. We were doing the space for authentication over there. So that's something, which I tried to influence once I started working here. Based on my knowledge, I've been able to get and write better rules over here and try to drag down challenge rates.

Probably having more flexibility and working on usability and how we use the solution. Obviously, the network that they are now trying to implement, which has information coming across the world, rather than looking at isolated information from your own bank.

I think those are the things that would make the solution much better.

I joined my current company a year a and a half back, so I've been using this for a year and a half. But I was at Citibank in a different geography, so we had CA as well, so I was using it there as well. All in all, maybe five years.

I think stability-wise, we've not really had any issues in terms of stability.

Flexibility, yes. User, as in more user confederation options. These are the things, which we've been talking about, to try and see how these things can move.

So basically usability and flexibility.

No, the market over here is such that penetration of 3D secure is pretty low, and that's not changed dramatically, so we've not really seen that increase in scale happen as of now.

But with the new protocol coming in, we definitely expect that over the next year and a half, two years, it should scale up. But I've seen this in another market, so I know that this solution is quite scalable.

They're pretty quick to get on to whenever we have an issue of any problems, they're pretty good to get on to them. There were a couple of problems last year that we faced.

Their response time was amazing, but it took a lot of time to actually get the responses that we got were not really satisfactory, so it took a lot of time and alterations to get something fixed, which should have been fixed much earlier.
But in terms of engagement, at least people over here are pretty good as in they get on to your things straight away.

It's pretty straightforward. The initial setup I don't think it's complex.

For us, it enables the bank or the issuer to offer their customers protection on their online transactions. It also gives some sense of security to the merchants, and it enables us to confidently accept that liability that comes over when both teams are playing. So when your issuer and your merchant are participating, it gives us a significant amount of control over accepting that risk.

Hopefully with 2.0, we are going to see improvements. I think improvements for us, it's making it simple enough that anybody can understand how it works. But then, that's having the ability to give us access to that really deep information. Again, in an easy manner. I think at the moment, getting into that rich data is quite an effort. I think if, moving forward once 2.0 comes in, there's going to be a real benefit in being able to communicate that complex data quickly and readily.

The process will look after itself. I think that that's there already but it's the insights that come from that. At the moment, they are quite complex and quite difficult to access. Possibly just from getting access to the information, but how it's represented, and how it's interpreted by the people that aren't eating and breathing fraud every day.

It's been at our company since 2001.

No. So, we haven't had materially any downtime. In its current state it's quite, sort of, basic. I don't think it's sort of fraught with uptime, downtime issues. We haven't had a lot of issues with it.

It's probably more so the peripherals around the outside, like accessing user interfaces, those sorts of things. But the actual transaction platform, no.

Probably within the last couple of years, we added in more of our portfolio. So, we initially only had a certain number. We've added in the debit product, and we've added in commercial product, but that's only because we were sort of forced to. We probably wouldn't have put the commercial on there otherwise.

Within the last 12 to 18 months, tech support has been probably less around tech support, but tech, like, technical assistance. Because it doesn't really go down, there's not really a lot of tickets that are raised. But technical assistance when we're asking technical questions has been really, really good.

We've got really good response times back for some technical questions. Because we touch it so infrequently, it's not like for the business that I sort of look after, it's not something that you touch every day. So you will have to go back and, what does that mean, again? How does that work, again? And so the response has been very, very good.

We haven't really faced any challenges. I think a couple of times some changes have been made and once, believe it or not, the CA team were ahead of time, and they implemented sooner than we thought. And so it had very bad flow and effects for us. So, it was "Back it out." But, no. Everything that the tech support has been good in whatever they're doing technically.

To be honest, we don't notice it, so I would argue that if we're not noticing it, if they're telling us there's outages, we're not seeing it. It's not impacting us, so it must be good.

I think for us, the value that we get out of CA is their effective scheme diagnostics. It can be utilized by any scheme issue for us. Then, the fact that it's quite similar in a sense that there's not really a lot of onus on us to manage the service itself.

CA does a great job of being able to manage it in and of themselves. They then come to us with issues if there are any other suggestions where they feel as though we could improve.

This solution can improve around the challenge rates and the failures. I don't know if that's necessarily incumbent on CA to solve that problem. I think it's more of an industry problem, so it's not necessarily the solution itself that needs to be improved. It's probably more around us as an industry focusing on education, the data integrity, and a few other aspects.

Since February 2015.

I'm not as close to this part as my other colleagues, so I sort of sit in the business of managing the P&L and then you've others who look after the operational side of this. However I have to say that not once can I recall stability concerns since we've been on board with CA.

The majority of my interactions were when we were first on board with CA, those interactions there as there should be. Then we recently sort of re-established, quarterly reviews so to speak, just business reviews. Then now in light of 2.0 there's been more engagement with CA, as there should be.

That's the right frequency, so to speak. You consider the scale of our business and their business relative to what we do. It seems to be adequate, certainly for myself. I think they engage more frequently with management because they are using things that they're trying to develop. It seems as though from what I hear from them, the relationship is managed well and it's managed the way it should be.

It was, from what I understand, quite complex. We're moving from one scheme managed to a phased solution, to three schemes. It ends up being a great solution and it's resulted well for us.

Frankly, it is quite complex when you have multiple parties. Any delivery is more complex when you've got multiple parties collaborating to achieve a common goal, when you've got different staging environments and different release cycles and whatnot that you have to manage as well. So I would say on the scale of things it was quite complex.

The service works as described, the Admin console is very good along with customer service, and the management support, which is excellent.

Our organization is able to see fraud transactions and the subsequent realized losses.

The service is improving with the implementation of 3D Secure 2.0.

I have used this solution since February, 2016.

There were no stability issues, the SLA uptime percentage has never dropped below 99%.

There were no scalability issues.

Technical support is excellent, I would rate it a 10 out of 10.

Utilize the transaction pricing model versus the active cards because the ability to monitor active cards hasn’t been good.

The reason I gave my rating of a nine was on the basis of us not having clear visibility into our billing structure. The original contract was based upon active cards, which is the number of cards that is stored in CA’s database system. Once a card is in the system, there is no way to validate whether that card was actually utilized during that billing month or not, yet the customer is charged for that card being stored. We also do not have an ability to remove the cards without implementing a $20K software module, which we really didn’t need because the software module primarily performed other functions but deletion of cards was just one of the many functions.

With no ability to validate activity, no active reporting to determine the validity of activity, and no ability to remove cards that would be considered inactive, lost/stolen, our costs increased month over month. I worked with the CA management team to revise the pricing model; but to me that is what needs improvement. The pricing construct can be very cumbersome.

All of the features are valuable in my day-to-day work.

It has added another layer of security in which it reflects customers' confidence in dealing with our organization.

We need more improvement in the Arcot console, which is used in monitoring 3DS transactions for example caching real time transactions rather than getting them after two or three hours.

Six months.

No issues with deployment.

No issues with stability.

No issues with scalabiility.

The technical support is great.

No, this is the first time.

The setup for this product is very straightforward.

No, this is the only product we looked at.

I advise anyone that is looking for a payment security product to choose this solution.

I think the performance from my organization's perspective is excellent in terms of minimizing the friction on genuine transactions with genuine customer, whilst optimizing the bad transactions, the fraudulent transactions that it stops. It achieves a tremendous balance.

Customers want to be able to use their cards online in a manner which is fast but secure and minimizes friction, so the solution that we have from CA means we can achieve that objective.

I've been using them now for a couple of years, but have been using similar solutions for over 15 years.

I'd say it's been consistently stable, very minimal downtime, absolutely. We've been really happy with that.

Certainly, our experience has been that as the business has grown in terms of volume, but also we've put other countries, other regions across the world onto the solution as well, which is added volume. I've not experienced any issues with that increased volume, so I'd have to say yeah, it's meeting our scalability needs.

This is the one area where there's room for improvement. This is information I've fed back to CA already. I think that is the one area where improvements can be made in terms of speed of response, in terms of quality of response, and in terms of more so a proactive problem monitoring.

This is a particular area of CA strength, is their customer focus, ability to work with you and change. I talked earlier about working with CA to deliver an innovative solution that works across multiple geographies. I've found in other solutions, it's more of a kind of one-size-fits-all approach, less customer-focused. You know, "This is our solution and you need to change to use it," as opposed to the CA approach was much more flexible and responsive to change.

That's a difficult one for me to answer, because from most customers' perspective, it would be quite straightforward. We have a very complex business in terms of the countries that we operate in, meaning that we need to offer the solution in multiple different languages. We're in different markets that have different regulation, each one has different regulation, so there's a lot of challenges there for our business, but I think CA have done a really good job in terms of helping us through that, so we've managed to keep a standard solution that fits all of the needs of those different markets. I think we've got quite an innovative solution as well for those customers that may be looking to operate in multiple countries as opposed to one particular market.

I would certainly recommend CA over other solution providers in this space for the reasons that I mentioned in terms of being very flexible and responsive to the customer's needs, having that experience now of being able to operate across multiple geographies, and looking to constantly invest and improve the performance of the solution as well.

I think that many of them are on the roadmap already in terms of making the solution work better in the mobile space, investing in collecting device information, more device information, more transaction information to improve the predictability in terms of the score of transactions to keep increasing the percentage of transactions that don't require customer authentication, while stopping more of the fraudulent ones and trying to get that balance as optimal as possible. Investing in the science behind that, the data behind that, making it work with more and more types of devices, bringing in touch ID, bringing in other forms of biometrics as well to make that customer journey much easier.

I would rate it with a nine right now, and I think the reason for that is I do think there's room for improvement in the technical support space. I think if CA can get that right, it could easily be a 10 right now.

We found that we were able to give much improved customer service and improved fraud prevention. It improved commercials. Commercials were a big factor. The opportunity to do an improved customer service offering in changing the way that we approached the process, almost shaking it up a little bit, and having an opportunity to rethink what we did.

Keep them what they are doing at a time when they are growing to be able to keep that one to one support for us when other people are starting to come aboard and realize the benefits of moving to CA. We want them to be able to keep up that level of relationship management with us.

There is always room for improvement, but we really don't have any complaints in our office. We work well with CA.

There is always room for improvement. For example, there have been service outages/incidents and work has to be chased, for completion or comment

Our first anniversary is coming up, so one year.

It is all within our contractual SLA. Anything that we had, has been a blip. How that has been handled has been brilliant.

We've had a lot of attention on any small bits that we had to report in. We've been hand-held throughout. We've had regular meetings, one to ones. It's all been great.

We are in the process of collaborating with CA at the moment on a proof of concept for further developing our syndication in the long term to further enhance the customer experience.

They are excellent. They do one to one marking. Their reaction to our needs, whether it be from email queries, full on technical support, or running proof of concepts; their ability to work with us is great. We really feel that we have got a one to one relationship management setup with them. They're brilliant.

The migration was very straightforward. I think, all-in-all, it took us about 12 to 15 weeks, post-contract, for us to migrate. So, it was very easy, with a lot of support.

We currently are migrating to CA. We're coming from a legacy model. We only have simple functionality, in terms of what we are going to do for challenging fraud.

Overall, there's a strategy to reduce that. It's kind of a new within our commercial book. CA has been recognized as being the leader within the commercial sector. Hence, there's a move to move towards these best practices.

Unifying operational changes around highlighting. If you highlight one item, it will highlight the one card that's affected across the board.

Unifying that functionality across all areas of the components that operations would use would be really good, giving them a great landscape to work with. Can you see all of it on one screen and is it clear?

One thing we are going through right now is looking at the legacy system and seeing where that information from the audit area would be getting back to an agent.

They are used to seeing something that they're adopting in the new system. Are they going to see the same thing? If not, do they need to see it?

Challenging the operations as well, rather than just saying, "The product doesn't give us what we need, therefore, we need to change it".

The legacy platform's been there for 13 years. The improvements we've done from the colleague or a customer side of things has been limited. I joke when it says your Internet Explorer options needs to be 5.5 and above. That gives you some idea of how often we update the site.

For customers and colleagues, there's a good length of engagement we've had with them to make sure that they are fully immersed in what we're doing.

The reduction in operational impacts improves customer journeys. We have got a whole emphasis that the organization works for, of bringing in more digital experience to customers, as most probably the industry has as well.

RTS feedback today says you've got to look at virtual and pre-paid. We would keep the working assumption that it wasn't going to be in scope for us and that it was just going to be physical.

Virtual is possibly our largest growing segment within the commercial portfolio. We concert more business and large corporations. It's very diverse.

The scale of it is in terms of options we can give to customers, in line with operational impact against the fraud reduction will be absolute paramount to what we need to do going forward.

It's purely been from a technical implementation respect, but we had a few curve balls thrown at us by our own internal governance. They have literally taken everything on board and said, "We can't do it this timescale, but we can work to this".

So, it's constantly proactive. We're constantly engaging with them backwards and forwards and saying, "Can we do this?" We always throw the curve balls at them. We always were, especially, with the new releases.

We're doing this for our third-party as well. As a team, it's successful with everybody playing their part and they have been there at the forefront defining new stuff, suggesting things around strategy where we don't have the experience, and we don't have the current data. It's a fresh book that we are looking at.

Let's put it this way, it's like going from Larder to a Ferrari. People laugh when I say that, but at the end of the day, it's more intuitive.

The customer experience is better. We are going for a light to light design to where we are still using impartial password. But, it gives us the foundation to move forward into something that we want to do and know where the business wants to go. We're seeing it as a commercial opportunity above and beyond the fraud savings that we're looking to generate.

There are a few unique things that we're looking at around access controllers for internal purposes, for audit. It's not an out-of-the-box functionality. We don't have reports. It's got to be automated.

Again, it was a new requirement. We've put it across. These guys are working to do it and our US operation has requested the same thing, because it came across the group and they are working with us.

They want to put this on their roadmap and say, "How can we facilitate you?" Considering as we're a new customer, we'd talk about the innovation that they're doing around risk analytics.

I think if we had gone to the old systems, our operational errors might push back a lot harder. But seeing what they are doing within it and the support we do get with the training and the level of engagement, they want to support us with the strategy where we might not have that skill set yet.

We're building as a new team. They have been absolutely paramount of any conversation we have with the business.

The way I see it, with the MI coming up to bat, that is what will drive anything, whether it's a customer journey, an operational change, or just the fraud strategy and the engagement.

From a professional element, knowing their stuff and just seeing them today talking from a data science perspective, these guys know what they're talking about. It seems really, really engaging.

When looking for a vendor, I look for communication and innovation.

Communication: Somebody you can actually work with, talk to, and get along with. We're not developing any code ourselves. The implementation changes that we are doing are literally being done between a third party vendor and a strategic partnership with CA.

We are the customer, but we are working alongside them, because obviously the operational impacts and building the strategy is from the ground up.

And you need to put scheme involvements in there. There are five third-parties that I'm dealing with on a day to day basis. CA has very much unified that. They have brought their experiences together with the schemes books. We own that relationship, so we have to drive the changes.

We couldn't ask for anything more, really. They really have unified that element given their experience. Going forward, we are looking to build our own roadmap against what regulation changes are coming up.

If it all goes well and we get our numbers down, then we can talk again for a higher rating.