PAYM and Donor Led Mobile Number Porting Use Case

The PAYM mobile payment service enables UK bank customers to transfer money to an individual using their mobile phone number (MSISDN) as the identifier. Currently nine banks and building societies have adopted the PAYM service and customers of these providers can now register to use the service.

The PAYM architecture is based on a centralised database of receiver’s MSISDNs. The terms and conditions as part of signing up to the service require the customer to agree that their “mobile number will be stored on a database managed by a third party on behalf of all the participating banks and building societies”. The customer’s name, MSISDN and bank are then held as records within the centralised database. The sender’s bank accesses the PAYM database to confirm that the recipient is registered with the service and to retrieve their bank or building society account details of the receiving party.

According to the Payments Council’s How Does PAYM Work section “the payment will be processed whether or not the recipient’s phone is on or within coverage. In most cases the payment will reach the recipient’s account almost immediately and they will be able to see it in recent transactions on their account”. This means that there is no check by PAYM that the MSISDN is on the home location register or in use by the receiver.

The sign-up process requires MSISDN validation as part of a 2 factor step-up authentication process implemented by each PAYM supporting bank and building society. This allows the MSISDN to be validated before registration with the centralised database. It is sensible to presuppose that the centralised database ensures uniqueness for the MSISDN so that the same mobile phone number cannot be registered by two individuals.

Because the receiver’s mobile phone number (MSISDN) is used as an identifier which is only validated on registration there is the possibility that the payment receiver may not be the current MSISDN subscriber. Not all customers keep their existing phone number when they move network operators so a receiver may only be using a old phone number as an identifier. In the UK mobile number porting is ‘donor-led’ which requires the customer to initiate things by contacting the donor (first) network operator and asking for a Porting Authorisation Code (PAC code), which is needed to retain a phone number when switching. The customer must then give this to the recipient (second) network operator before things can proceed. If the receiver who changes networks initiates donor-led mobile number porting then all services linked to the mobile phone number will remain linked to the mobile number.  But if the receiver who changes networks does not initiate this process then the PAYM account identifier is tied to an unused mobile phone number.

Mobile phone numbers that are not ported will eventually be recycled and made available to new customers. If the new ‘owner’ of the mobile phone number chooses to register with PAYM they may find that the number is already is use and all therefore be blocked from registering. There is no current process for claiming an already registered mobile number. The process for de-registration or mobile number change is first user driven: “Customers are able to de-register from the service at any time. To de-register customers can change their choice of payment account, the mobile number they have registered for the service and the bank or building society they have joined with at any time. To change your registration from one bank to another, you need to deregister through the bank or building society you have signed up with and then re-register with the new participating bank or building society. The payments council has not implemented a process for this use case.”

The PAYM service would be stronger if it were linked to a synchronous HLR registration service supported and provided by all UK Mobile Network Operators.