Mayank Agarwal · Opportunity Canvas
Securing MOTO Payments
Eliminating card exposure in verbal & paper payments — a PayTo-based opportunity for any bank.
DiscoveryPaymentsPayTo / NPPPCI DSSFraudFintech
Problem
- Card-not-present (CNP) fraud reached $816M in CY2024 — 90% of all Australian card fraud and rising 19% YoY.
- In verbal MOTO the full card is exposed to the agent; paper order forms leave card data unsafe if lost or copied.
- Verbal MOTO sits in SAQ D scope (over 300 controls); penalties for non-compliance run $5k–$100k/month.
- The Scams Prevention Framework imposes new sector obligations from 1 Jul 2026 (Tier 1 penalty up to $50M).
MOTO is a primary contributor to CNP fraud — not the source of the full $913M headline.
Users & Customers
- Merchants taking phone & mail payments: utilities, insurance, councils, healthcare, professional services.
- Contact-centre agents currently handling raw card numbers.
- Less-digital customers who rely on phone & paper and are excluded by payment links.
- The adopting bank as scheme participant, app owner and merchant-services provider.
Solution
- Bank PayTo for MOTO: a PayID on the form or over the phone replaces card data entirely.
- Customer approves a merchant-initiated pull payment in their own bank's app — async, real-time, under 60s.
- Zero card data held — collapses scope to SAQ A (22 controls).
- Secures both channels: paper forms stay accessible, telephone orders need no card capture.
Competitive Analysis — Telephone Orders (3-way)
| Feature | Current (verbal) | DTMF masking (Eckoh / PCI Pal) | Bank PayTo solution |
|---|
| Card data heard by agent | Yes — full number spoken aloud | No — tones masked | No — no card data used |
| Card data in call recording | Yes — permanent audio record | No | No |
| PCI DSS scope | SAQ D — over 300 controls | SAQ A — 22 controls | SAQ A — 22 controls |
| Customer authorises in app | No | No | Yes — biometric / PIN |
| Credit card support | Yes (all banks) | Yes (all banks) | Yes (issuing-bank cards in pilot) |
| Real-time settlement | T+1 | T+1 | Under 60 seconds |
| Customer needs card in hand | Yes | Yes | No |
| Card data exists anywhere | Agent, recording, CRM | Payment processor | Nowhere |
| Works with other-bank customers | Yes | Yes | Via SMS link fallback |
| Deployment timeline | Already live | Weeks | 9–12 months (pilot) |
Read: DTMF is the safety net for today; PayTo is the architecture for tomorrow. A bank can offer both — DTMF compatibility for customers at any institution, full secure MOTO for its own customers — and be first to give merchants that choice. DTMF's edge: any bank, deploys in weeks. PayTo's edge: customer authorisation in-app, zero card data anywhere, instant settlement.
Competitive Analysis — Mail Orders (the DTMF blind spot)
| Dimension | DTMF masking | Payment links | Bank PayTo solution |
|---|
| Secures paper forms | No — phone-only tech, no tones to mask | Partial — replaces the form | Yes — PayID on form replaces card data |
| Keeps paper process | N/A | No — eliminates the paper form | Yes — form stays the interface |
| Form safe if lost / copied | N/A | N/A | Yes — no card data to misuse |
| Serves less-digital customers | N/A | No — excludes them | Yes — async, no live device needed |
| PCI scope for paper handling | Not addressed | SAQ A | SAQ A — eliminated for paper |
| Covers both MOTO channels | No — telephone only | Partial | Yes — mail and telephone |
Key differentiator: Bank PayTo is the only approach securing both MOTO channels while preserving paper forms as an accessible interface. The customer writes a PayID instead of card data; approval happens asynchronously in the app. No competitor can claim this.
Value Proposition
- For merchants: over 50% PCI cost reduction, fraud removal, retained phone/mail channels.
- For customers: card never shared; in-app authorisation they control.
- For the bank: new merchant revenue, app stickiness, AP+ standard-setting position.
Coverage & Rollout Phasing
Phase 1 · Pilot
Own-bank payers
PayTo debit happy path — the payer authorises in their own bank's app. Zero card data, under 60s settlement. The wedge.
Phase 2 · Cards
Credit-card bridge
A tokenisation bridge (Visa / Mastercard / Amex) extends the same flow to credit cards, not just bank-account debit.
Phase 3 · Cross-bank
Any PayTo bank
As PayTo broadens across the 120+ NPP institutions, any payer's bank app works. An SMS-link fallback bridges the rest in the interim.
Stated openly: on Day 1 the full in-app experience needs the payer to bank with a PayTo-enabled institution; an SMS payment-link fallback covers everyone else until cross-bank PayTo matures. This coverage ramp — not universal Day-1 reach — is the honest shape of the rollout.
Market Opportunity (illustrative · analyst-derived)
TAM
$47B
All Australian MOTO payments (card MOTO ~$18–22B + other MOTO/BECS ~$29B).
SAM
$1.1–1.4B
~520–650K merchants (large-bank base) × ~$200K avg MOTO/yr × ~1.2% monetisation.
SOM · Yr 3
$1.2–1.8M
50–75 merchants, 5–10% volume capture, 15% churn.
SOM · Yr 5
$8.5–11M
200–300 merchants, 20–30% capture.
All sizing figures are analyst estimates built on stacked assumptions — present as illustrative, not externally sourced.
Business Model
- 0.5% per NPP transaction
- $299/month merchant platform fee
- ~0.3% credit-card interchange (issuing-bank cards)
Plus non-revenue value: merchant retention, app stickiness, standard-setting.
Success Metrics & KPIs
Discovery go / no-go — 12 weeks
- ≥ 5 pilot merchants signed (letter of intent).
- Merchant willingness-to-pay validated at the target price.
- AP+ confirms a MOTO PayTo spec is on the roadmap.
- MOTO dispute / refund design signed off by risk & legal.
Product north-stars — pilot
- PCI scope SAQ D → SAQ A for every enrolled merchant.
- Card-data fraud on enrolled MOTO volume → zero.
- Authorisation time under 60s at p90.
- MOTO volume captured per merchant; churn under target.
Go / no-go is decided against the discovery column; the pilot is judged on the north-stars. No metric, no decision.
Go-to-Market & Adoption
- Lead verticals: high-MOTO, high-compliance-pain — insurance, utilities, councils, healthcare, professional services.
- Channel: the bank's existing merchant-services salesforce and portal relationships — no new acquisition engine to build.
- Migration: a drop-in for raw-card capture and DTMF — a PayID on the existing form, no merchant re-platforming.
- Switching trigger: lead with PCI cost reduction and the 1 Jul 2026 SPF deadline.
- Onboarding: ABN-verified merchant enrolment — which doubles as a scam control.
Why Now — Enabling Rails
27M+
PayID registrations (mid-2025)
~2B
NPP real-time payments / yr
PayTo live for billers since 2024; NPP designated critical infrastructure.
Key Risks & Open Questions
- NPP irreversibility — no chargeback; needs a MOTO-specific dispute design.
- APP / social-engineering scam risk — mitigate via ABN-verified merchants, verified name in push, velocity limits, first-payment cool-down.
- Credit-card support — PayTo debits bank accounts only; cards need a Phase 2 tokenisation bridge.
- ePayments Code & PayID enumeration — regulatory coverage and privacy questions to clear in discovery.
- No MOTO PayTo API spec or vendor accreditation framework — must be designed with AP+.
The Ask (ExCo)
- GE-level executive sponsor
- $300–500K discovery sprint budget
- Cross-functional working-group mandate
- Regulatory pre-engagement clearance (RBA / ASIC / AUSTRAC)
- 5–8 pilot merchant nominations
Path: ExCo approval → 12-wk discovery → go/no-go → Q1 2027 build → Q3 2027 live pilot.
Sources & caveats: Fraud and rails figures verified May 2026 against the AusPayNet 2025 Fraud Report (CY2024), PCI SSC, RBA and AP+ documentation. PCI DSS is set by the global PCI Security Standards Council (not the RBA). SAQ D standardised to "over 300 controls". MOTO card value shown as an estimated range ($18–22B). All TAM/SAM/SOM and revenue projections are analyst-derived and illustrative. Re-verify against the next AusPayNet report and AP+ roadmap before reuse.