Square UK Launches | Hacker News Reader

Square UK Launches

squareup.com

53 pointswonderous55 comments

I'm not convinced by their card reader at all...

It would be trivial for people to intercept the PIN number when it is entered on the seller's phone. That's why competitor devices (iZettle, PayPal) all have a keypad and screen on the card reader itself, it lowers the possibility of interception of the PIN number.

In fact, I am fairly sure that I read in the past that the credit card companies wouldn't allow this type of implementation.

I would certainly feel very uncomfortable entering my PIN number into someone's phone.

EDIT:

So, from what I can tell the design of the PIN entry keypad for EMV is governed by ISO 9564[1], which states:

  "The PIN entry device shall be physically secured so that it is not feasible to modify its operation or extract PINs or encryption keys from it."

I don't believe that entering a PIN into a phone based keypad is compliant with that.

1: https://en.wikipedia.org/wiki/ISO_9564

This is a very good question and I wonder how they've "squared" that with the credit card companies. Is it by any chance iPhone-only? Or does it actually do a card-not-present transaction?

All the normal Verifone, Ingenico etc EMV devices have built in key pads.

For the types of places this device will appeal to (small businesses where individual transactions are less that £30), contactless is taking over (in the UK at least) so this is less of a concern I think.

Contactless has already taken over. But it is still possible to spend more than £30 in a small business. What happens then?

I don't see any indication on their website or marketing materials that they are accepting the PIN. I would be surprised if they did, because EMVCo have been firm in the past that a dedicated keypad is required.

I would be interested to know whether they're either capping the amount that can be charged, or are taking some of the liability themselves.

Square will also be looking to get as many people on contactless as possible, because with Apple Pay / Android Pay you can exceed the usual capped limit in the UK (I believe it's something like £30 with a regular contactless card before PIN entry is required).

They do clearly show a pin screen on their site though but it might just be the marketing dept

The only security-relates info I can find, the PCI PTS certification for the Square contactless and ICC reader, mentions a USB connection to a branded base-station, and nothing much about PIN entry.

I hope they aren't trying an end-run around PCI certs?

A few interesting things about this.

1) Amex the same price as other cards. Amex has low penetration among small retailers in the UK because they traditionally cost a lot more to accept.

2) Square are very up-front with costs. All the major banks hide their costs - requiring you to call their sales weasels to get a quote.

3) The card reader cost is the same as PayPal - but Squares costs are fixed @ 1.75%. Paypal's are 1.5%-2.75%. The same applies with iZettle - there's a variable cost which is quite opaque for small businesses.

Essentially, if you don't want to jump through hoops and worry about getting screwed over by small print, it looks like Square is compelling.

Major banks have small print, but I can assure you that Square is way more expensive than banks for credit card processing.

> variable cost which is quite opaque

I'm not a user but I see that iZettle has an up-front calculator to tell you what your % fee will be. It reaches 1.75% at £6200 which I believe means it's cheaper for most shops.

Talk about being late to the game... iZettle has been around since 2011[a]!

[a] - https://en.wikipedia.org/wiki/IZettle

Surprised they didn't just buy iZettle, who own both the market and the mindshare for these types of devices in Europe.

iZettle raises $63M more at a $500M valuation; company has raised about $235 million in funding to date.

Guessing they've had offers, but not good enough to make them sell and they're still able to raise capital.

Square's market cap is currently $6.51B and here's there balance sheet: https://markets.ft.com/data/equities/tearsheet/financials?s=...

iZettle are counting on exactly this, a North American player buying them for their market share. Margins are non-existent

I wonder how they'll compete. My sandwich man at work, and street vendors at the market all have iZettle now. Perhaps square will take less of a cut?

I see a lot of coffee shops and market stalls with iZettle too.

Interestingly Square seems more expensive than iZettle. Square is flat 1.75% in-person 2.5% online while iZettle is sliding 2.75%-1%. The threshold seems to be £6200/month at which point iZettle is going below 1.75%. That's pretty low so I suspect most shops would still chose them.

You could almost certainly negotiate the rate down with Square. Maybe not for £6200/month, but at a certain volume they'll do you a deal. There's no way Philz Coffee (big coffee chain in the bay), for example, are paying Square their advertised flat rate.

I was in London a few months ago. I have Android Pay (I'm American) and could use it everywhere [1]. Coffee shops, train stations, supermarkets, even a whole in a wall cafe. Unlike in US, payment simply was not a problem/point of friction at all.

I am really curious what was the thinking behind Square's UK launch (if there was). At least as a business traveler (and admittedly in London, the financial center of Europe), I saw no space in the market for Square to enter.

[1] (The ONLY place I could not use Android Pay was Apple Store)

The established nature of the market may be a mixed bag for Square. There is strong competition, but there's also a very large market. Square don't have to convince anyone of the merits of mobile payment, just offer a better solution for some portion of the market. They already have lower transaction fees than Paypal and iZettle for most users; they could gain significant ground by salami-slicing the market with better features for particular niches.

> See deposits in your bank account as soon as the next business day

That's a bit slow for the UK, most payments settle in 5 minutes with an upper limit of 2 hours for bank-to-bank transfers…

Bank transfers maybe, but Card processors are rarely that quick - merchant account's are rarely same day into bank, at least from what I've seen.

Oh, true enough. I've only seen the user-side of the transactions.

Yeah I was surprised to see stripe doesn't use faster payments in the UK.

Cool, more competition in this space is likely good.

I worked on a similar unit at a lower pricepoint back in 2014.

Unfortunately that was for London 'unicorn' Powa, and we all know how that went...

Somewhat related: I wonder if this launch means they will now work to open up their (awesome) Square Cash App to other countries, and sending between countries.

The support says:

> Credit card processing with Square is available in the 50 United States, Canada, Japan, and Australia. Payments can only be processed in the country in which you activate your account. For example, if you activate your account in the United States, you’re not able to process credit card payments in Canada, and vice versa.

Hopefully they are working to open up now that they are launching in the UK.

I was a little curious about the detail of this, since I didn't really know what Square offers beyond being a 'payments company' (which could mean anything).

It seems that they're claiming to be cheaper for small businesses. Is that true? Their per-transaction fee seems pretty high, and their device is about the same price as a chip and pin reader.

They also have mobile payment support, but surely that's just a gimmick at this point?

Given the proliferation of tap and pay in the UK, I can't help but think any other "mobile payment" solution is dead in the water.

Mobile payment like apple pay and android?

No, it's a growing sector. It also mostly comes for free once you have contactless in place.

Their offering seems to be more than just a card reader, they bundle a PoS app too.

Not saying it's the best thing since sliced bread, but it does seem like a fairly complete package.

edit - can I ask why I got a downvote? Not sure I said anything contentious there.

Every card in the UK issued in the last few years can be used for contactless payments, and every sandwich shop has a chip-and-pin handset which can process them.

I added the one card which doesn't support contactless to my iPhone wallet but being able to use my debit card is much easier (plus I don't have to worry about draining its battery).

Not every card, my credit card did not, for whatever reason.

There may be better security through Apple/Android pay, IIRC they don't expose a real card number, and the phone must be awake (and sometimes unlocked) to process a payment.

Regardless, it's irrelevant - the processing tech for android/apple pay is the same as for other contactless cards, so it comes for free - lots of places supported it without even knowing. That sandwich shop reader already supports phone payments most likely. I like it - saves me fiddling with my wallet.

My point is, consumers already expect to use their card, not a phone/app; and for users who do have the necessary hardware, it's still about as convenient to use their card rather than their phone.

So, some consumers now like to use their phone, I personally find it more convenient.

As an extra capability that appeals to some folks it's a no-brainer to market it as a feature.

Sure, it's probably only a few percent at present. Your objection seems to be "I don't use that, therefore they shouldn't mention it on their page", no?

> I don't use that, therefore they shouldn't mention it on their page

Oops, that's not my intended message at all! I don't care what they say on their site & I certainly don't expect them to pay attention to the rants of random HN commentators…

I know people don't use their phone to pay for things here, and I don't understand why you think it will help Square make any inroads into the UK market.

I don't understand why people object to it as a marketing selling point - it's a new(ish) payment method that's expected to become more widespread over time. Selling your product to a retailer with "Hey, it does this too" can't be a bad thing?

>> I know people don't use their phone to pay for things here

Where is here?

I've seen folks in London using their phone to pass the Oyster/underground gates, and I see people at work use their phones every day in the on-site eatery. When I brandish my phone at the McDonald's drive-through for a coffee, the staff don't look at me like I'm crazy, they hold out the machine. I'm really not sure why you think that it's objectionable.

I don't object? You're projecting a complaint onto me that I never made.

I don't understand why you think this feature is important when so many existing consumers will use their contactless card to make payments instead.

Making it crystal clear:

Why do YOU think this is good? In actual concrete terms, i.e. this allows contactless payment for purchasing automobiles which is a gamechanger because …

How do they accept pins for chip-and-pin transactions? If it's on the seller's phone then I wouldn't be comfortable using Square on either side of the transaction.

Looks like it is on the seller's phone, yup.

Not sure how trustworthy that is, exactly.

--edit-- You can find their PTS approval here - https://www.pcisecuritystandards.org/ptsdocs/Contactless_Chi...

--edit 2-- That's the only one with ICC and contactless I can find, but it talks about USB connections. This surely must be approved for untethered/bt connections? Hmm

I wonder why they own square.com but continue to default to squareup.com.

https://www.quora.com/How-much-did-Square-pay-for-square-com

Edited to add disclosure: I work for Square, but I don't know the details of our agreement with Square Enix, and I don't know what I'd be allowed to say about it if I did. :-)

>> "Looks like Square.com redirects now to Squareup.com but the owners are still that Japanese company. Maybe Square has an agreement with them and maybe they will buy Square.com domain name."

> That Japanese company

That Japanese company is Square Enix (formerly Square, before the merger with Enix), makers of the Final Fantasy games. I'd imagine the US Square must have paid a fairly non-trivial amount for whatever deal was made.

Interesting. Maybe they're renting it and measuring the benefit of having that redirect, and trying to decide whether they should buy it outright.

As other call out, from the whois information for square.com:

  Registrant Organization: Square Enix Holdings Co., Ltd.

do companies squat their names in other countries, or they use the same international trademark and add extra words if the name is taken?

Both actually.

E.g. Corona is called Coronita in Spain and Puma used to be Dasslerpuma, too.

I take it Company names mustn't clash, but trademarks can if they are in different sectors? (unless is a name made up especially for the product like CocaCola?)

Coca cola isn't made up, it's a description. The drink originally contained coca leaf extract (cocaine) and cola nut extract.

I don't know about the trademarks though.

oops, that's true :)

what i meant is rich company that can drag you through the courts for 15 years till you're bankrupt

As far as I know Corona is a trademark and not necessarily / only a company name :)

The cynic in me groans at the ability for chuggers to accept card. The "I only carry card, sorry" excuse will need revising!

Does Square have RFID chip (read/write) capability?

Why would this be useful? They support NFC payments, if that's what you're asking?

I'm looking for RFID POS systems and this just popped up, thought it was worth an ask.

Like, for operator identification?

Square supports NFC, which is compatible with RFID hardware (the physical layer). The protocol is different, so being able to read an RFID tag doesn't guarantee you'll be able to process a credit card transaction.

Reply on news.ycombinator.com