Visa and MasterCard announced in late February plans to support cloud-based mobile payments through a new feature in the Android mobile operating system called Host Card Emulation (HCE). HCE leverages Near Field Communication (NFC) applications on Android smartphones, letting users make payments by swiping their smartphones and permitting financial institutions to host payment accounts in the cloud. Android HCE using NFC differs from currently available contactless payment systems that rely on card account details stored in the smartphone’s secure element (SE). The SE approach requires credit card issuers to enter into arrangements with mobile network operators for storing such account data in the SE. When a user makes a payment, the account details stored in the smartphone SE are sent to the merchant’s point of sale system. By contrast, HCE-based applications communicate with a remote server controlled by the issuer where the card account details are held.
Visa and MasterCard are taking further steps to assist companies with cloud-based applications in complying with the payment networks’ requirements and security standards. Visa has made available specifications, requirements and guidelines for HCE-based applications, including a software development kit (SDK) for HCE. MasterCard intends to publish its HCE specifications later this year and also make an SDK available.
Visa’s and MasterCard’s decision to endorse HCE will undoubtedly result in an increased number of NFC-based mobile payment offerings. Mobile payment application providers that previously were reluctant or unable to enter into arrangements and pay a fee to store account data on the SE no longer face this obstacle. On the other hand, HCE is new technology with unanswered questions about its capabilities and limitations, including the security of cloud-based payments and the complexity of storing multiple card accounts in a single HCE digital wallet.