Stakeholders Driving Payment Evolution and Digital Identity

January 2006 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. EMV Entrenching In Global Payment Card Markets
3. 12 Canadian Issuers & 5 Acquirers Commit To Introduce MasterCard Chip Cards
4. Cardware 06 Goes On The Road
5. E-Passport Testing Begins At San Francisco Airport
6. Keycorp Selected For Hong Kong ePassport Project
7. Giesecke & Devrient Awarded Contract To Provide E-Passports, Other ID Systems, For Macedonia
8. Contactless EMV Payments Are In The Pipeline
9. Axalto Terminals Go Contactless In Taiwan
10. Gift/Loyalty System Integrates With Payment Platform
11. Texas Goes Live With A Benefits Smart Card
12. Smart Cards For Patient Histories
13. UK Charity Pilots Smart Card For Visually Impaired
14. Additional Stories Available In Members Only Section

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

PRINCIPAL

Oberthur Card Systems ~ member since 2005

GENERAL

CUETS ~ member since 1990
ICC solutions ~ member since 2003
NBS ~ member since 1995

ASSOCIATE

Energy Card ~ new member
IMS-MTE ~ member since 2003
Pierre A. Roberge - new member
Technology Surveys International ~ new member

UPCOMING EVENTS

Smart Card Alliance presents - 5th Annual Smart Cards in Government Conference 2006
April 18-20
Arlington, VA, USA
http://www.smartcardalliance.org

CardTech/SecurTech 2006
May 2-4
San Francisco, CA, USA
http://www.ctst.com

ACT Canada presents Cardware 2006
June 13 - Toronto, ON, Canada (financial focus)
June 15 - Ottawa, ON, Canada (government focus)
http://www.actcda.com

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (01/30)

Happy New Year. We wish you every success this year, both personal and professional.

2006 is certainly off and running with EMV conversion progressing in the financial services sector and much discussion of a cross border identification card in the public sector. The first seeks to improve upon an existing product but the second still has time to go another route - that of building a Canadian solution to meet Canadian needs.

Many years ago I talked with the developer of a highly innovative product. It had so many features that made perfect sense, you couldn't help but wonder why no-one had brought it to market earlier. I asked how he had come up with the original concept. It seems that a number of co-workers were in a bar one night after work and when the bill came, someone asked, "How would we pay for this if no-one had invented cash?" That led them to develop payment from scratch, free of any restrictions encountered when you are trying to improve upon an existing product. In this case the product was ahead of its time because it required extensive infrastructure upgrades, but I strongly believe that it will emerge when that infrastructure is rolled out for other business reasons.

The point is that sometimes it's best to improve upon an existing product or service, as is the case with EMV for credit payments, and other times you can achieve the best by starting from scratch.

Our government must now decide what kind of identification is needed for Canadians crossing between Canada and the US. This decision cannot be made in isolation because we must work with our counterparts in the United States, but we do need to explore all our options. In that process, we should look at existing ID to determine whether it can be made more secure; tamper and counterfeit resistant. We need to openly discuss the use of provincially issued identification for this purpose. In the end, we will make decisions bound by many factors, but the discussion should be as broad as possible. Someone should ask, "What would we do if no-one had invented travel ID?" Regardless of the final choice, any ID carried by a citizen must be highly counterfeit and tamper resistant.

In June we will be hosting Cardware 06 with programs designed to help financial services maximize their EMV investments and government, both federal and provincial, to understand the case and options for identity management. (see Cardware story).

ACT Canada is committed to helping source and analyze information and identify contacts for our members in both the public and private sector.

2. EMV ENTRENCHING IN GLOBAL PAYMENT CARD MARKETS
Source: Card Technology (01/05)

By mid-2005, 329 million EMV-compliant payment cards had been issued globally, 65 million of which were issued during 1H 2005 alone, or 38 per cent more than in the same period of 2004. At end-June 2005, 3.9 million EMV-compliant POS terminals and ATMs had also been installed, a 25 per cent increase on end-2004, according to EMVCo, which defines the EMV card standard. While this is just 15 per cent of the global total for internationally-branded credit and debit cards, the reality is that EMV is rapidly gaining a presence in the global payment card infrastructure.

EMV chips feature on over one-third of payment cards in the 25 countries of the European Union in part due to the regional liability shift that MasterCard and Visa mandated for January 1, 2005. About 40 per cent of ATMs and 30 per cent of POS terminals in Europe are said to be EMV-ready, but the Netherlands, Italy, Germany and Spain still rely heavily on magnetic-stripe card transactions. Despite this, MasterCard believes that acquirers in Spain had EMV-enabled 10 per cent to 15 per cent of their card terminals by end-2004, up from virtually none in July 2004.

On this basis MasterCard, which expects two-thirds of its cards and terminals in Europe to be EMV-ready by end-2007, argues that EMV conversion can occur within a very short timeframe. In 2007, Italy is expected to shift fraud liability for domestic transactions to the non-chip compliant party, but for now, its bankers believe the case for EMV is weak with a card fraud rate of 4 cents for every EUR 10,000 in transactions. Although other European countries have a similar stance and some financial institutions have a long way to go, EMV is acknowledged to be gaining steam.

MasterCard and Visa are members of ACT Canada; please visit http://www.mastercard.ca & http://www.visa.ca.

3. 12 CANADIAN ISSUERS & 5 ACQUIRERS COMMIT TO INTRODUCE MASTERCARD CHIP CARDS
Source: MasterCard (12/21)

MasterCard Canada announced that 12 of its card issuers will be working with MasterCard and five leading acquirers to introduce chip-enabled MasterCard payment cards in Canada by 2010. With 17 commitments to date on the migration to chip, MasterCard is leading the market in Canada.

The Canadian MasterCard issuers are ATB Financial; BMO Bank of Montreal; Canadian Tire Bank; Capital One Canada; Citibank Canada; Credit Union Electronic Transaction Services (CUETS); GE Money Canada; HSBC Bank Canada; MBNA Canada; National Bank of Canada; People's Trust Company; and President's Choice Bank. The acquirers are First Data Loan Company, Global Payments Inc., Moneris Solutions Corporation, Paymentech Canada and United Network Payment Solutions.

"The shift to chip is one of the most important changes to the Canadian payments industry since its inception," said Kevin Stanton, President, MasterCard Canada. "Chip cards will bring unprecedented security, convenience, and value to consumers and businesses. It also means the implementation of industry-wide technical and commercial infrastructures. MasterCard is providing cutting-edge, customized hands-on support and extensive expertise to assist in a smooth transition, with the philosophy of 'do it once and do it right.'"

Bank of Montreal, CUETS, MasterCard and Paymentech are members of ACT Canada. Please visit: http://www.bmo.com; http://www.cuets.com; http://www.mastercard.ca & http://www.paymentech.com.

4. CARDWARE 06 GOES ON THE ROAD
Source: ACT Canada (01/30)

The race for information is on! Over the past few months we have had an unprecedented number of questions from issuers, acquirers, government and the industry.

Stakeholders in EMV, and there are at least nine groups, are starting to ask questions about how to optimize their investments as they move forward. Everything from streamlining data management to pre-formatting customer cards for future use, managing the card lifecycle to PIN selection for multiple applications, is being questioned. The Cardware program committee has selected "Optimization" as the theme for this year's Financial Services event, to be held Tuesday, June 13th at the St Andrews Club in Toronto.

To meet government needs, we are, for the first time, taking Cardware to Ottawa. On Thursday June 15th we will hold a 2 track event. The first deals with Identity Management for Canadians. The second track also looks at ID, but for civil servants and contractors. Privacy will be a key issue in the discussions.

All the topics for both cities have been chosen by the committee to meet the needs of the market. We will soon publish more information on the sessions, speakers and exhibitors, but for now, Mark Your Calendars - June 13th & 15th.

5. E-PASSPORT TESTING BEGINS AT SAN FRANCISCO INT'L AIRPORT
Source: Contactless News (01/16)

A live test of e-passports, that contain contactless chips with biographic and biometric information and the readers that are capable of reading these e-passports, began January 15 at Terminal G at San Francisco International Airport (SFO). This test is a collaborative effort between the United States, Australia, New Zealand and Singapore that will run through April 15, 2006.

Participants include citizens of Australia and New Zealand who have been issued the new e-passports, Singapore Airlines crew and officials holding trial e-passports and U.S. diplomatic and official e-passport holders.

The test will assess the operational impact of using new equipment and software to read and verify the information embedded in the e-passports. Participants will present their e-passports when arriving in the United States at SFO, at Changi Airport in Singapore or at Sydney Airport in Australia.

The e-passport contains the holder's biographic information and a biometric identifier, in this case a digital photograph, embedded in a contactless chip set in the passport. The inspection process for those participating does not change.

The e-passports being tested are enabled with a security feature known as Basic Access Control (BAC), which helps prevent the unauthorized reading, or "skimming," of information from e-passports.

This is the second live test conducted between the United States, Australia and New Zealand. The goal of the live test is to gather information that can support countries around the world in their development and implementation of e-passports that comply with International Civil Aviation Organization (ICAO) standards. It will also provide valuable information on the capability of the reader technology.

For more information on US-VISIT, or to learn more about entry procedures, please visit the US-VISIT site at http://www.dhs.gov/us-visit.

6. KEYCORP SELECTED FOR HONG KONG EPASSPORT PROJECT
Source: : Keycorp (01/24)

Keycorp Limited announced it had been selected as the exclusive supplier of MULTOS technology to the consortium awarded the tender for ePASS, Hong Kong's ePassport project. It is the first win for Keycorp's MULTOS ePassport solution, which was launched in November 2005 at the Cartes smartcards trade show in Paris.

Hong Kong Immigration Department awarded a tender for ePASS to Unihub Limited, which is heading a consortium of suppliers, including Keycorp, who will develop and deliver the new ePassport system. The project is due to commence in 2006.

The Keycorp MULTOS ePassport technology capitalises on the special features that have made MULTOS the most secure, open, multi-application smartcard operating system.

Keycorp is a member of ACT Canada; please visit http://www.keycorp.net.

7. GIESECKE & DEVRIENT AWARDED CONTRACT TO PROVIDE E-PASSPORTS, OTHER ID SYSTEMS, FOR MACEDONIA
Source: SecureID News (12/06)

The government of the Republic of Macedonia has awarded international technology group Giesecke & Devrient (G&D) a contract to provide the country with electronic passports, personal identity cards, and driver's licenses, as well as a corresponding, combined system for personalization of the documents. Work on the project is scheduled to begin this year, with the project itself expected to take a total of 11 years to complete.

The first electronic passports and ID cards are due to be issued to the citizens of the Republic of Macedonia as early as 2006. The order covers delivery of 1.5 million passport documents with integrated microchips, 1.8 million personal identity cards, and 500,000 driver's licenses. In addition to the documents, G&D will be supplying equipment for centralized personalization and decentralized data acquisition as well as centralized data storage and preparation. The international smart card manufacturer will also handle system integration and upkeep through a maintenance agreement.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

8. CONTACTLESS EMV PAYMENTS ARE IN THE PIPELINE
Source: epaynews.com (01/19)

Contactless card payments, which are designed to gain share of the traditional cash payment market, are rapidly gaining traction in the US due to running on existing payment infrastructures. Their value is underscored with the recent establishment of the Contactless Payments Council by the US-based Smart Card Alliance, which promotes smart-card based payments in that market. In May 2005 card issuer JPMorgan Chase achieved two firsts with its contactless card, blink, which runs on both the Visa and MasterCard contactless infrastructures, and others quickly followed suit.

Visa International recently issued a specification for global contactless payments interoperability that allows regional card issuers to customize their programs to local markets. Contactless cards meeting this new specification, which applies to all card platforms (credit, debit and prepaid) can use both mag-stripe and EMV chip card functionality. Improved transaction processing speed also will fuel the use of contactless payments in low-value payment environments and in higher-value environments where PINs and signatures are currently used to verify the cardholder.

Now that Visa and MasterCard have issued contactless card specifications that incorporate EMV security, banks in EMV-mandated regions can support offline contactless transactions and contact-based online transactions with PIN verification if wished. For example, a cardholder could make offline contactless transactions for values of up to EUR 30, and for larger totals, be required to insert their card in a payment terminal for online PIN verification. This approach allows banks to leverage their contact infrastructure while also offering the convenience of contactless payments.

MasterCard and Visa are members of ACT Canada; please visit http://www.mastercard.ca & http://www.visa.ca.

9. AXALTO TERMINALS GO CONTACTLESS IN TAIWAN
Source: ICMA Daily New (01/12)

Axalto announced that its MagIC 6100 terminal is being upgraded to accept TaiwanMoney Card purchases. This MasterCard M/Chip-powered card features a contact interface for traditional EMV (Europay MasterCard Visa) payments and the OneSmart(R) MasterCard(R) PayPass(TM) functionality for EMV contactless payments for use in both transport and retail environments. This enhancement to Axalto terminals will allow consumers to benefit from the speed and efficiency of contactless at convenience store chains, movie theaters and retail merchants.

The Axalto terminals are updated with an external reader to accept the TaiwanMoney Card. Within this project, Paysys Communications Pte Ltd, an Axalto partner based in Malaysia, has developed the software required to integrate the contactless application into the terminals. This Axalto solution was certified last October by Mondex Taiwan, a subsidiary of MasterCard International.

Both Axalto and MasterCard are members of ACT Canada; please visit http://www.axalto.com & http://www.mastercard.ca.

10. GIFT/LOYALTY SYSTEM INTEGRATES WITH PAYMENT PLATFORM
Source: Ernex; AJB Software Design Inc. (01/30)

Ernex has integrated its real-time loyalty and stored-value gift card solutions into the AJB Software Design payment processing platform, to help retailers leverage their legacy point-of-sale terminals and infrastructure to authenticate new gift and loyalty cards.

The integration of gift and loyalty processing abilities into AJB's Retail Transaction Switch (RTS) and FiPAY payment applications will also allow merchants to run real-time POS promotions for the gift or loyalty card programme.

FiPAY is a store-level communication gateway, interfacing the merchant's PIN pad devices, POS system, RTS network, and financial institutions, while RTS is a multi-purpose transaction switch that performs real-time authorisation for a variety of transaction types, from numerous sources, over any communication medium, and prepares them for any destination system.

11. TEXAS GOES LIVE WITH A BENEFITS SMART CARD
Source: Contactless News (01/25)

Speed, convenience and quicker reimbursement all add up to a successful launch of the WIC smart card program in Texas. WIC, a federal program begun in 1974, stands for Women, Infants and Children and provides participants with nutritious foods, counseling, and referrals to health and other social services at no charge. The program serves low-income pregnant, postpartum and breast-feeding women, and infants and children up to age 5 who are at nutrition risk.

After a year-long pilot program in El Paso, the state's Department of State Health Services (DSHS) is expanding the use of an electronic benefits smart card for purchases made by WIC clients, replacing the paper voucher system.

"The pilot went very well," said Hank Lundberg, part of the DSHS Electronic Benefits Transfer Development project. Last October, the state began the gradual implementation of the WIC smart card program, issuing its Lone Star Card to women in the north central Texas area near Dallas. This same card is also used for food stamp and TANF (Temporary Assistance for Needy Families) recipients, he said.

"It will be an incremental expansion," said Mr. Lundberg of the multi-year project. "We had to break this up into manageable pieces so stores can get ready."

The smart card, produced by Gemplus and issued through First Data Government Solutions, contains a chip that stores food benefits data for all members of a household participating in the WIC program. "The card is loaded for each client at a WIC clinic," Mr. Lundberg said.

Before the state even began its pilot program, it worked closely with retailers, making sure the system would work with the various cash register systems in use. "Let's say the grocer users NCR or IBM systems. We worked with the grocers to make sure their ECR (electronic cash register) vendors could integrate the electronic benefits transfer (EBT) function into their software," said Mr. Lundberg.

The program will also work for the small grocer who may not have the sophisticated electronic cash register capability of the chains. "We have an EBT-compatible device developed for the small operation," he added. "We have three commercial vendors who have developed solutions for small grocers which does the same thing as the electronic cash register."

Gemplus is a member of ACT Canada; please visit http://www.gemplus.com.

12. SMART CARDS FOR PATIENT HISTORIES
Source: medGadget (01/24)

Mount Sinai Medical Center, along with 8 affiliated hospitals, next spring plans to begin deploying more than 100,000 smart cards to its patients. In total, there will be more than 45 related and affiliated health facilities in the region involved with the smart card initiative.

The project, which will be rolled out in phases and might eventually provide the facilities' 500,000 patients with smart cards, could also serve as a model for a regional health information network effort in New York City overall, which has a population of about 8 million, says Mount Sinai VP of IT Paul Contino.

The cards, which will also feature a photo of the patient, are embedded with a "secure microchip" that will contain demographic information-like patient name and address-and also medical history, drug prescription and allergy, recent lab results, and other key data, says Contino. The information can be updated whenever a patient receives new health services or has a change in health status. The cards, which are read by devices that can attach to PCs, require that patients enter a PIN before the chip's data can be accessed. If cards are lost or stolen, information cannot be accessed without the PIN, Contino says.

"No other rollouts have reached 100,000 cards yet in health care," says Randy Vanderhoof, executive director industry organization, Smart Card Alliance. "This will be the largest smart health card rollout in the country," he says.

13. UK CHARITY PILOTS SMART CARD FOR VISUALLY IMPAIRED
Source: CardTechnology (01/12)

The Royal National Institute of the Blind (RNIB), a UK charity, will start pilot trials next month for a smart card that will let users alter the appearance of ATM screens. The RNIB developed the card in collaboration with UK software developer SmartCitizen Ltd. and the Suffolk County Council. On the chip, the card includes an application that lets users set their individual preferences for screen display features including font size, color, and contrast. When the card is inserted into an ATM, a public computer, or a fare-vending machine, the card will automatically signal for the display settings to be changed to suit the user's preferences. Once the card is removed, the machine's display will revert to its normal appearance. The initial trials will take place on public computers at five libraries in the Cambridge area, and the RNIB expects the card to be available in libraries nationwide later during the year. There has also been discussion of incorporating the technology into the Oyster smart card program, which is used for fare payment by Transport for London, the operator of the UK capital's mass transit system.

14. ADDITIONAL STORIES AVAILABLE IN ACT CANADA MEMBERS ONLY SECTION

These additional stories are available to ACT Canada members via the Members Only section of our web site. Click on the link below to access this section.
If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.
http://www.actcda.com/members-only/members-only-news/

UNDERSTANDING DPA ATTACKS AND THE COUNTERMEASURES AVAILABLE TO PROTECT SMART CARDS

The primary reason for smart card technologies growing success in the marketplace is simple - security. Smart cards are self-contained security units that can provide unparalleled barriers to fraud and piracy. But what if they were actually discovered to be insecure…


TSA ANNOUNCES KEY ELEMENTS OF REGISTERED TRAVELER PROGRAM

The Transportation Security Administration (TSA) announced several parameters for a nationwide private sector Registered Traveler (RT) program, including the biometrics to be used for identification purposes and the redress process for individuals who are denied access to the program...


GERMAN MOBILE OPERATOR SEEKS TO LAUNCH CONTACTLESS PAYMENT, TICKETING

Vodafone D-2, one of Germany's largest mobile phone network operators, plans to allow subscribers to pay their bus fares by tapping their handsets against onboard contactless readers, says a source with the operator. Later, it hopes to test contactless credit payment and health services…

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.