RBC's 'Android M' Plan: Remove Passwords to Improve Mobile Payments

Royal Bank of Canada (RBC) is already working with the features of the upcoming Android operating system that Google previewed last week, with the goal of improving the usability and security of mobile payments.

RBC has created an app that runs on the Android M Developer Preview, a version of the next Android operating system made available early to developers. The app will be part of the RBC Wallet and is designed to bolster security by using mobile device credentials instead of passwords to perform authentication.

"We're always weighing the client experience against managing fraud," said Linda Mantia, executive vice president of digital, payments and cards for RBC.

Google's major updates to its Android operating system typically take their names from confections, with each new version following alphabetically from the name of its predecessor. The current version, Lollipop, followed a version called KitKat and was previewed under the name Android L. When showcasing Android M's new capabilities, Google emphasized security features such as fingerprint authentication and a streamlined process for granting apps permission to use certain hardware features.

The new RBC app doesn't require merchants or consumers to "do more" to execute mobile transactions once the user has unlocked his or her mobile phone, Mantia said. "We're talking work away from them."

The Android M Developer Preview allows credentials such as the device's personal identification number or fingerprint to be used to identify and authenticate users in Android apps. RBC is using this technology to allow the same PIN that locks the phone to serve as security for the RBC Wallet. By tying part of authentication closely to the device's hardware, the overall security is increased, according to the bank. The RBC app also employs a mechanism that does not require clients to re-enter their PIN to transact within a preset timeframe.

The authentication technology can be likened to an advanced form of device fingerprinting, or technology that matches computing devices to their owners, said Eddy Ortiz, the director of digital strategy for RBC.

"You have been authenticated as owning that device," Ortiz said, adding that allows less intrusive payment execution.

RBC's wallet will still rely on host card emulation (HCE) to enable contactless payments without requiring access to a device's secure element.

For payments up to a certain amount, minimal authentication will be required, and more extensive proprietary bank authentication will kick in after that threshold. "You can get through the checkout line quicker," Mantia said, likening the process to traditional plastic cards, which do not require extra authentication for most cardholder-present transactions.

RBC has long been an early adopter of new payments technology. Its mobile wallet dates back more than a year and it worked with Interac, Canada's national debit system, on a mobile payments test at McDonalds more than two years ago. The bank has also experimented with wearable devices.

RBC's new app will initially be available in Canada, and the bank did not disclose its plans for other markets. Apple Pay, was also built to balance security and usability, is reportedly plotting a Canadian expansion. 

Apple Pay has quickly won bank support in the U.S., but has faced challenges in attracting merchants. Apple Pay's fees have also led banks to consider developing their own mobile payment technology, and Google's new structure for Android Pay is designed to be friendly to developers at banks and other companies.

Though Apple Pay's user experience has helped adoption, "consumer adoption of mobile payments hasn't met the hype," said Julie Conroy, a research director for Aite Group.

"It's virtually impossible to change engrained habits if all you can offer is a clunky user experience," Conroy said.  "The user experience that RBC is proposing seems to combine [elegance] with good security. The combination of device identification and biometrics is far more secure than a username and password, which has long outlived its useful days as a security measure."

Mantia said the latest enhancements to RBC Wallet are meant to attract both merchants and consumers by lowering costs and navigation.

"If you look at merchants today that want to do e-commerce and online commerce, it's hard for them, the interchange is higher and the chargeback risk is higher," Mantia said. "With this app they will have a more manageable cost of doing business."