Evan Schuman's StorefrontBacktalk

As Home Depot prepares to make its in-store PayPal payment system a chain-wide feature next month, security and who-pays-the-fraud-bill issues are making the differences between Visa/MasterCard/American Express and PayPal more glaring. Say what you will about the old guard payment brands, PCI and fraud responsibility, but at least retailers know the payment ground rules with the treasury troika.

This is proving to be an especially key point with Home Depot as the trial’s convenience factor—no phone needed, no card, no chip, nothing beyond a phone number and a short PIN—is trumping its security.

The problem is that the two required datapoints are not especially secure. People routinely give out and publish their mobile phone number, and not only is a short PIN easy to guess—dates of birth are frighteningly frequently used—but looking over the shoulder is a very effective tactic.

Secondary security mechanisms—such as requiring a manager to sign off on larger transactions, after examining a driver’s license or some other identification—are not being done during this rollout, said Home Depot spokesman Stephen Holmes, who said the chain doesn’t see the need for doing security mechanisms that are not being done with Visa or MasterCard.

“A limit? Not sure why you would ask about that with PayPal as compared to any credit or debit card,” he said.

The reason is that the PayPal system is different in two key ways. First, it’s different because it’s not even merely a very different form factor. It’s the total absence of a form factor. With all of these efforts from MasterCard and Visa to push EMV for the U.S., it’s important to note that the PayPal approach is less secure than magstripe, which is saying a lot.

Also, consider this scenario: You’re a contractor. You want your crews to charge all materials to the same account. The easy way to do that is to give them all the same number to punch in (no cash, no plastic, just a piece of paper with the number). That’s great—until somebody else gets the number. Then they can steal with impunity, because you can be sure the boss isn’t going to pay attention to all those receipts in detail.

The old security standbys rely on something you know (passwords), something you are (biometrics, such as fingerprint, facial shape or retina scan) and/or something you have (payment card, phone with a chip, a one-time password token). By just using something you know, it’s weak. But by choosing a something that is easily discoverable, it’s really weak.

Home Depot’s Holmes spoke of another security verification, which is a text message (PayPal says customers will also have the choice of an E-mail) sent immediately after a purchase. Unlike the credit/debit cards, this will enable fraud to be identified much more quickly.

Although that is certainly true, it won’t prevent fraud. Clearly, if someone uses that PIN and phone number to make a bogus purchase, that thief will be long gone by the time the message saying the charge is a fraud is received. (Note: Loss-prevention video cameras focusing on the checkout area are a good security mechanism, but Home Depot and other chains have been doing that for decades.)

How big a deal is any of this? That depends on whether your chain has to pay the piper if fraud does happen. Officially, neither Home Depot nor PayPal would indicate how the fraud liability burden is shared. “PayPal does not disclose its anti-fraud agreements with its retail partners,” said PayPal spokesperson Beth Kitchener.

There are so many unusual factors with the Home Depot trial that determining who holds the bags may not be very meaningful. The chain is massive, so it is used to cutting special deals. Home Depot agreed to be the first retailer accepting this PayPal in-store payment, and that guinea pig agreement comes with negotiation privileges. It’s hard to imagine that PayPal hasn’t agreed to absorb any fraud losses with Home Depot.

PayPal is negotiating with lots of other chains, though. What will the deals look like for the 15th or 20th chain? The rules are clear and public with Visa. With the card brands’ EMV efforts, they are providing extra fraud-coverage protection for what is clearly a more-secure approach. Ironically, that’s not the case—at least not yet—with the firm that has no experience with in-store payments and is offering what is likely the least secure approach. Where the promise to cover the fraud cost is most needed, it’s the least explicit.