The easiest way to describe stealthy mobile payments startup ZipPay is to say it’s like Square and Venmo had a baby, and this was the result. Like Square, the startup aims to address the needs of individuals and small business owners who can’t afford the high fees associated with having their own merchant accounts by allowing them to accept credit card payments using their phone. Meanwhile, like Venmo, the solution will also provide a way to perform person-to-person payments.
But there are some key differences. For starters, unlike Square, ZipPay won’t use a dongle. It also promises rates lower than Square’s 2.75% per swipe.
How this will be done, however, is still unclear.
Instead of dongles that attach to the phone’s headphone jack, as is the case with Square, ZipPay will offer a mobile wallet solution that uses some undisclosed patent-pending technology.
To load cards into the wallet, ZipPay is leveraging Card.io, the new software development kit (SDK) for mobile developers that uses a combination of computer vision and machine intelligence to “read” a card held up to the mobile phone’s camera. This technology allows faster entry of credit card information into a mobile application, when compared with manually typing in numbers on a small keyboard.
Unlike Square’s wallet-like Card Case, which provides digital “tabs” for local merchants, ZipPay’s wallet supports all major credit cards, including Visa, MasterCard, Discover and American Express. Store cards, discount cards and membership cards will be supported in the future.
The card data is stored directly on the device in an encrypted format, however, this is not an NFC-enabled mobile wallet system. There’s a mandatory 4-digit PIN code for the ZipPay app, but how the card data is sent between the customer and the merchant or two ZipPay users remains a mystery.
Company CEO Ryan Stevens says he isn’t ready to reveal this part of the system for competitive reasons, but it’s possible that the app somehow uses smartphone sensors to connect the two devices, each which need to run the ZipPay app. Perhaps something like Bump?
On the merchant’s side, like Square, ZipPay will allow for expedited sign-up, so new users can start accepting credit cards immediately. The company runs a basic background check on the spot, and if there aren’t any obvious red flags, the account is approved. Merchants can charge up to $1,000 that first day (the same as Square’s manual entry/card not present limit). Later on, when the full background check goes through, the limit is dropped.
ZipPay has a banking partner on the backend (unnamed for now) and payments are deposited into merchant’s accounts within 1 to 3 days, implying an ACH system is involved.
The second part of the ZipPay system is the feature which involves peer-to-peer payments, something very much like the startup Venmo. In this case, both people would need to have the ZipPay app on their devices and then, again using the undisclosed technology, payments can be instantly sent between the devices.
Because the company is not ready to detail its technology, it’s hard to compare what it’s offering with Square, PayPal, Google Wallet or others. We do know it’s not NFC and there’s no dongle, but that’s about it. We also know that it plans to take a portion of the processing fees, like Square, and the app will also include “a small ad,” which may be how it plans to undercut Square.
Security is also a big question here, considering that encrypted data stored on the device may still be vulnerable if the device is compromised by a virus or malware, for example. Also, in NFC’s case, each contactless card stored on the device generates a cryptogram to exclusively identify each transaction. No two cards share the same key and the key is never transmitted.
How will ZipPay’s system work? Is it storing full mag stripe data on the device? What level and type of encryption is involved? What’s being done to protect the data on both ends? During transmission?
The company says it stores no credit card data on its own servers, only the technology used to decrypt the data on your device. Using an online dashboard, lost or stolen phones can be immediately disabled from making payments, but that does not guarantee that the credit card data couldn’t somehow be extracted from the device before you realize your phone is gone.
Until the system launches into beta, many of these questions may remain unanswered. ZipPay will offer iPhone and Android apps, starting with the iOS version, launching in Q1 2012. It’s accepting beta sign-ups now.