Snippings

Customers of Manchester, London Stansted and East Midlands airports are being warned of secondary attacks as their email addresses, phone numbers, addresses, licence plate numbers, purchasing history and browsing device data are now available for criminals to use.

xxx

The open nature of the Ethereum token ecosystem provides an opportunity to examine the dynamics of its adoption. The ERC-20 and ERC-721 token standards, which share a technical foundation, make them easily comparable with each other in terms of their on-chain and off-chain metrics. Our results suggest an increasing concentration, which contradicts the core tenet of decentralisation and has been previously reported in the literature [12]. The rich do get richer, even in Ethereum-based tokens; very few projects are successful, while the majority of them quickly disappear. Past token transfer events, or transactions, still appear as the most reliable predictor of new events.

From: Frontiers | Patterns and centralisation in Ethereum-based token transaction networks.

xxx

xxx

Less noticed is that China’s domestic redesign is quietly pulling against its own international rail. The digital renminbi that circulates on mBridge and the digital renminbi in retail wallets share a name and a par value, but since January they are not even the same class of claim, and the difference is architectural rather than cosmetic.

At home, the digital renminbi is now, by Beijing’s own account, a deposit liability of the distributing commercial banks: it is recorded on centralised infrastructure that the People’s Bank of China designs and operates, while the banks onboard customers, operate wallets, pay interest and screen transactions. Every balance sits inside one administrative hierarchy, which is precisely what allows deposit-like features to attach to it.

On mBridge, the People Bank of China’s Digital Currency Institute issues wholesale digital renminbi natively onto a shared ledger that the participating central banks validate jointly, each operating its own node. Commercial participants exchange those tokens directly, settlement is final when the ledger updates, and each currency enters and leaves the platform only through issuance and redemption gateways run by its home central bank. One instantiation is bank money inside a single sovereign’s system; the other is central bank money in bearer-style form, whose validity is established collectively.

From: China’s digital renminbi is running on two tracks – OMFIF.

xxx

xxx

Same money, rival railways

The BIS’s rail is Project Agorá, run with seven central banks representing the major reserve currencies, including the Federal Reserve Bank of New York, the Bank of England and the Bank of Japan, with the Bank of Canada joining as the project advances to real-value testing. Its defining feature is conservatism: tokenised commercial bank deposits settle in tokenised central bank reserves on a unified ledger, but correspondent banking survives intact, keeping commercial banks and their compliance apparatus inside every cross-border transaction.

China’s rail is Project mBridge, which does the opposite. Wholesale central bank money from five jurisdictions sits directly on a shared ledger and correspondent banking is bypassed entirely. The BIS incubated mBridge, then exited in October 2024 and redirected its energy to Agorá. Since the handover, activity has only accelerated: cumulative settlement has climbed to roughly $69bn from the $55bn the Atlantic Council recorded last November, about 95% of it in digital renminbi. Whatever its formal multilateral governance, mBridge is functionally a renminbi corridor.

From: China’s digital renminbi is running on two tracks – OMFIF.

xxx

xxx

Major banks and retail companies will make their infrastructure available for processing digital rubles on 1 September 2026.

Starting from this date, individuals will be able to use the new form of the national currency, if they wish. To do so, they will need to open an account on the Bank of Russia’s platform. This can be done in the Digital Ruble section that will appear in the mobile applications of banks connected to the platform. An individual or a company may have only one account while individual entrepreneurs are permitted to have two accounts for personal use and for business purposes.

Individuals will be able to top up digital ruble accounts from their bank accounts by up to ₽300,000 per month. Businesses will have no top-up limit. Both individuals and businesses will be able to use all funds in their digital wallets without any restrictions. Available operations will include customer-to-customer and business-to-business transfers, as well as transfers to/from government, purchases, and refunds.

Additionally, certain banks wish to provide digital ruble services now, though they are not legally obliged to make their infrastructure available this autumn. The regulator has given them this opportunity.

For individuals, all payments and transfers in digital rubles will be free of charge. Businesses will be granted a grace period until the end of 2026, when no fees will be charged for payments and transfers. From 2027, individual entrepreneurs and businesses will have to pay fees that will be the lowest in the payment market.

From: Digital ruble launched | Bank of Russia.

xxx

It was some nice to be able to catch up some old friends at the Central Bank Payments Conference (CPBC) in Istanbul in September 2026. One of them that I particulalry enjoyed listening to was Kosta Peric from the Gates Foundation. Kosta took part in a fireside on financial inclusion in Africa that I found especially interesting.

As the picture shows, during the fireside the audience (primarily bankers and central bankers) were asked what might make the biggest difference to cross-border payments in Africa, the overwhelming sentiment was in favour of interconnecting instant payment systems rather than, for example, using stablecoins or central bank digital currencies. This caught my eye because my Fime colleague Arnaud Crouzet and I have just published a paper on “Cross-border payments as a key opportunity for dometic schemes” in the Journal of Payment Strategy and Systems (Vol. 20, No. 3, Fall 2026) in which we use Africa as one of the case studies to illustrate the benefits of precisely this approach. We looked at the issues around the interconnection of domestic schems and concluded that:

• Interconnecting domestic payment schemes is no longer a purely theoretical idea. In several regions, it is already taking shape.
• It offers a realistic and practical path toward cross-border payments that are cheaper, faster and more transparent by leveraging assets that already exist.
• For domestic schemes, the opportunity is to move beyond a purely national utility role and become a meaningful participant in regional cross-border networks.

For central banks, regulators and schemes who are looking to exploit the possibilites here, all I will say is that I am sure that Fime’s expertise and experience can support management decisiom-making very effectively!

The always interesting Andrew Dresner writes about a colleague using an AI-enabled App to recommend which payment card to use for each specific purchase based on rewards and notes that “this kind of AI optimization ruins spend economics if widely adopted”. Indeed it does, so in a way I wasn’t surprise by his comment about a couple of big issuers (eg, Chase) blocking the app. But in a world of open banking, AI-turbocharged switching and competition for spend data, how long can even the biggest issuers hold out? Given the fact that premium cards with rewards may not be good value for money for many consumers, where is the sector headed?

You might be able to persuade me that I’ll look cool taking out a metal card (which, of course, I never actually do because I use my phone and the expensively-engineered metal card is at home in a draw) but how will you persuade my AI agent to spend $1,000 on a premium card that only delivers $300 worth of value over the year? I’m pretty sure that any half-decent agent would stop me from using my British Airways card right away given that Avios are next to worthless these days.

By the way, if you think I’m being a bit hard on Avios, I have twice this week tried to use Avios for flights to the US later this only to see no seats or upgradde available. There seem to be plenty of Avios seats for Dusseldorf next week though. I’m not joking. See the screenshots.)

xxx

A dark web marketplace is selling 153,000,000 American and Canadian driver’s licenses, reportedly siphoned from idscan.net. This platform specializes in in-person identity (ID) verification and serves businesses such as Hertz, FedEx, Target, marijuana dispensaries, and many more.

From: 153M driver’s licenses for sale after alleged leak from IDScan | Cybernews.

xxx

Liminal 

The breach illustrates why identity documents are a higher-value and more permanent target than credentials like passwords, and how age-verification mandates are expanding the pool of exposed data.
A driver’s license is far more useful to an identity thief than a password, because a password can be reset while a face, date of birth, address, and license number cannot easily be replaced, especially when paired with high-resolution images of a government ID. The presence of front-and-back images plus infrared and ultraviolet scans means the exposed records include the security features used to validate authenticity, which raises the risk that the data could be used to pass identity checks or produce convincing forgeries.
Malwarebytes ties the incident directly to the growth of age verification, noting that requiring users to upload an ID or selfie to a third-party provider turns a simple website visit into a decision to share an enduring identity document with a company the user may never have heard of. This connects the breach to the wave of age-assurance mandates advancing across U.S. states, the UK, the EU, and Australia, each of which expands the number of organizations, contractors, and cloud platforms holding copies of government IDs.
The incident fits a broader pattern of identity data concentrating in verification vendors that become single points of failure. Facial images and ID copies can be reused to make scams more convincing, pass weak checks, or assemble victim profiles by combining records from separate breaches. The episode strengthens the case for privacy-preserving age and identity checks, such as zero-knowledge or on-device verification, that confirm an attribute without transmitting or storing the underlying document, an approach that vendors and regulators have increasingly promoted.

xxx

Bank of America, Citigroup and Goldman Sachs are among a group of nearly two dozen firms teaming up to jump into the world of stablecoins, or digital tokens that can be used for cross-border transactions. On Tuesday, the consortium said it would move to launch the stablecoin venture in the first half of 2027.

JPMorgan Chase has separately evaluated whether it could launch its own stablecoin, though those discussions have been preliminary, with no active product underway.

From: These Banks Are Banding Together to Launch a Stablecoin – WSJ.

xxx

xxx

Only $390 billion of the $35 trillion that moved across stablecoin networks in 2025 was a genuine economic payment. The rest was trading, internal shuffling, and automated contract loops. That 1.11% figure — which Axis Intelligence Research calls the Real-Payment Penetration Rate (RPPR) — is the single most important number in this entire dataset: it tells you both how small the real market is today and how large the runway ahead actually is

From: Stablecoin Payment Statistics 2026: Volume, Adoption, and the Real-Payment Gap – Axis Intelligence.

xxx