What does the Paytm POS App actually solve?

Three weeks after the demonetization of the Rs. 500 and Rs. 1000 notes, it is still chaos for many. Among the few with cause for celebration are the various mobile wallet companies, such as Paytm, FreeCharge and MobiKwik. These companies have seen a huge increase in downloads, signups, and transactions as it becomes difficult to find money.

We’re increasingly looking for alternatives to cash, so when Paytm announced the launch of its in-app point-of-sale system last week, many praised the idea. The way it works is simple – it allows small vendors, such as your roadside vegetable vendor, who cannot accept card payments, to start using the Paytm app as a replacement for the swipe machine EDC cards. Then, just a day later, Paytm shut down the idea, citing security concerns in a now-deleted blog post.

Just two days later, Paytm resumed service, saying the risks are no different from using a card reader. On Monday, Gadgets 360 contacted Paytm to find out what changes or security features were added, but there was no response. From what the company revealed, this seems like a great idea for small merchants, as it will allow them to start accepting card payments.

EDC machines are expensive – you have to pay several thousand rupees for one, and you need the infrastructure in place to use it. It can be bought or rented from banks, but it’s something that doesn’t really make sense for small shops, forget your local thelawala. This is why wallet companies have started the process of integrating these merchants – the costs are lower, and as FreeCharge CEO Govind Rajan pointed out to Gadgets 360, integrating small merchants with wallets will also drive consumer adoption.

The catch is that if you want to buy fruit from a seller that supports Paytm, you need to install the Paytm app on your phone and load money into the app before you can pay; if the seller has only registered with MobiKwik, then you need a MobiKwik account. This is why Paytm’s announcement looks so appealing at first glance. Now you’re no longer locked into your Paytm account – as long as you have a credit or debit card, you can simply use it to pay wherever Paytm is accepted. This adds a huge amount of convenience and makes the seller using Paytm much more useful than one on another wallet.

However, although Paytm CEO Vijay Shekhar Sharma says that “India needs a highly innovative mobile POS machine”, the fact is that Paytm’s solution does not include an actual machine. And that’s a problem.

No device, Nope problem
Why is this such a big deal, you might be wondering? There is no physical swipe machine, but you can still use your card, anywhere. Thanks to this, you will be able to use your debit card to pay the auto rate or take care of the ironing bill. What could be better?

Well, Paytm’s implementation could have been much better. Here’s how it works, based on our understanding of what Paytm said and showed at launch. Paying with a debit card follows these steps:

1. The merchant is registered as a seller with Paytm and has the app on a smartphone.
2. An invoice is generated on this phone, which is then delivered to you.
3. You enter your card details, expiration and CVV; an OTP is sent to your phone, which is used to confirm the transaction.

What he did was basically figure out a way to make a transaction online, but on the spot. And instead of using your phone, it uses the merchant’s device to do it. This solution is problematic for a number of reasons. First of all, having to enter your card details every time you need to make a transaction is extremely tedious. In the days of pre-demonetization, you would have pulled out a few hundred rupee notes, several times a day, handed them over, taken your change and left in less than 10 seconds.

Now you’re going to pull out your wallet to get your card, carefully enter the details on a phone that probably has a small, low resolution screen (remember, this is mostly for small vendors who can’t get a point of sale terminal regular sale), and then you have to hope that the SMS OTP arrives timely, put the wallet back and take out your own phone to read the OTP, then enter it into the phone, before the transaction is completed.

Imagine doing this every time you pick up a car or buy vegetables, and you’ll see why the interface needs a complete overhaul.

The other problem is that you have no real assurance of security in this transaction. The phone used is the merchant’s, not yours, and it could easily have some kind of software installed to capture all of your transaction data. Of course, a seller could also steal your card number and CVV with a physical card, but that’s harder to do if the transaction takes place in front of you. Malicious intent isn’t the only problem either. The phone in question is not only will be used as a card reader. It is connected to the Internet and will be used online. Android malware remains a problem, so even if the merchant can be trusted, the phone may not be safe.

So what, you tell me again. The OTP can provide protection, you might think. And it’s true – it’s a minor inconvenience that serves a very useful purpose. Of course, in the case of malware stealing your card details, there is a real risk that those details could be used to transact in a foreign market, which does not have the authentication requirement at two factors from India. If you have an international debit card, it’s suddenly a lot more worrying if someone has your card number, expiration date, and CVV.

By contrast, with a chip and PIN card, it’s harder to wade through the details if the transaction is happening in front of you, and the process is quick and almost as easy as using cash. Paytm’s solution therefore loses in terms of security and ease of use.

While Paytm’s POS app is a neat idea, the implementation leaves a lot to be desired, and at least for now we suggest you load up your (merchant’s) wallet of choice and use this method for on-site payments.

Disclosure: Paytm’s parent company, One97, is an investor in Gadgets 360.