David Birch of Consult Hyperion writes for Principia on contactless payments and how they deliver appropriate levels of security and privacy.

In a typical retail environment the retailer's point-of-sale (POS) terminal and the payment token both contain a microprocessor; the microprocessors communicate using a payment protocol (on top of the ISO 14443 protocol for basic data exchange).

When it is time to pay, the customer brings their tag close to the POS terminal. The terminal interrogates the card and gets back the serial number and a cryptogram (a one-time code calculated inside the token). It feeds these to the acquiring bank, which passes them back to the issuer. From the serial number, the issuer knows which account to authorise and from the cryptogram the issuer knows that the token is valid.

The cryptogram is made up from the serial number and a transaction counter, encrypted using the token security key. This key is inserted in the token during manufacturing; it is derived from the serial number and a bank master key. Once in the token, it is never divulged.

[Update: 2/1/06 - See this post for updated links to new bank investor presentations!]

The Lehman Brothers 2005 Financial Services Conference was held earlier this week and many banks participated with updated presentations on their strategies, etc.

Here are some links to those presentations (mostly PDF's): Bank of America, Commerce, Fifth Third, Huntington, JP Morgan Chase, KeyCorp, M&T Bank, National City, PNC, SunTrust, Synovus, US Bank, Wachovia, Washington Mutual/Providian, and Wells Fargo.

Presumably at next year's conference MasterCard will be presenting as a public company!