Norway's MeaWallet to Use Sweden's BankID Security Standard

MeaWallet is prepping to launch in a number of countries, and it is starting in Sweden through the use of a nationalized authentication standard.

"The ID standard is approved by the banks and it is a natural fit for a mobile wallet and it makes that part of it easy," says Lars Sandtorv, CEO of MeaWallet, a Sandvika, Norway-based company that will launch in Sweden in June.

As part of that launch, it has signed a deal to use Sweden's mobile BankID for authenticating and signing mobile financial transactions. BankID is based on PKI, or the public key infrastructure technical standard, which uses out of band communication to vet users and is frequently deployed by financial institutions. BankID was designed by a number of Swedish banks and companies, including Danske Bank, Ikano Bank, Lansforsakringar Bank, Nordea, SEB, Skandiabanken, Sparbanken SVD, Sparbanken Oresund, Svenska Handlesbanken, Swedebank and Alandsbaken.

The standard is the de facto online banking authentication method in Sweden, which has a population of about 11 million consumers who are expected to make about 400 million transactions this year, according to the banks behind the BankID standard. It is also used by government agencies and was the most common method used by Swedish citizens when filing this year's tax returns, the banks say.

"It's a very well-known security standard in Sweden for mobile apps and people trust it," says Sandtorv.

At launch in Sweden, MeaWallet will support mobile payments, loyalty cards, coupons, ticketing, virtual ID cards, virtual access cards and receipts. "That is most of what people have in their old wallets, and it can all be accessed by BankID," Sandtorv says.

The adoption of BankID should be helpful for MeaWallet, says Zil Bareisis, a senior analyst at Celent.

"Many rightly believe if you solve the authentication problem you solve payments," Bareisis says. "It makes complete sense to extend [BankID] to other service providers, such as mobile wallet providers. Instead of having to remember different authentication methods for each different app, customers can rely on a single method they trust and rely upon."

MeaWallet is also launching in Canada, the U.S., Poland, Norway and other countries in the next few weeks. Most of these countries do not have a federated ID system, so the company is tailoring its authentication system to meet the needs of local issuers. It may use dual authentication, biometrics, device fingerprinting, or a combination of methods, Sandtorv says.

"We're using an open framework, so it's simple to implement any kind of authentication. It's up to the bank to decide what kind of protection layer that they want," he says.

MeaWallet will also support multiple technologies for mobile payments, including Near Field Communication (NFC), QR codes, Bluetooth Low Energy beacons and Host Card Emulation (HCE).

Even within one country, different mobile payment systems use different technologies. In the U.S., the telco-driven Isis wallet uses NFC, for example, while PayPal and the Merchant Customer Exchange support software based methods. Google, Visa and MasterCard support HCE, which emulates NFC contactless payments without storing user credentials on the mobile device.

Apple remains a wild card. It has never supported NFC in any of its iPhone handsets, but it has numerous patents on the technology and is rumored to be developing an NFC payment system in China. Apple has almost 800 million iTunes accounts, most with credit cards attached, and the company is reported to be actively recruiting payments experts.

"Given that Apple does not support NFC, at least not yet, we have to be pretty flexible in working with different technologies," Sandtorv says.