Stakeholders Driving Payment Evolution and Digital Identity

February 2007 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. New Chip Migration Study Provides Good News For Canadian Retailers
3. Giesecke & Devrient Launch Next Generation Of Contactless Payment Cards
4. Interac Hosts Additional EMV Training Sessions
5. Gemalto Selected For Portugal's National ID Project
6. New PCI PED Approvals For 5 Major Terminals From Ingenico
7. ICC Solutions Launches ICCSimSC: SmartConnect Featuring Enhanced Terminal Test Script Execution
8. UK Chip & Pin Migration Nearly Complete
9. Cybertrust & Corestreet Launch Government Smart Card Credential Validation Service
10. Gemalto & Abaxia Partner To Launch Complete Solution For Dynamic Management Of On-Device Services
11. Banka Koper Of Slovenia Issues World's 1st Visa Cards On Keycorp's MULTOS Smartcard Technology
12. Giesecke & Devrient Supplying TeliaSonera With 1-GB SIM Cards
13. Interac & Acxsys Announce New President And CEO
14. Additional Stories Available In Members Only Section

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

PRINCIPAL

Oberthur Card Systems ~ member since 2005

SME

Carta Solutions ~ new member

ASSOCIATE

PJE Consulting ~ member since 2005

UPCOMING EVENTS

Smart Card Alliance: Smart Cards in Government Conference and Exhibition
April 10 - 13, 2007
Washington, DC, USA
http://www.smartcardalliance.org

CardTech/SecurTech
May 15 - 17, 2007
San Francisco, CA, USA
http://www.ctst.com
ACT Canada members receive 10% off delegate registration fee (including early-bird & renewal rates). Contact Andrea McMullen for more details - andrea@actcda.com.

ACT Canada presents Cardware 07
Government Focus Event - June 21st in Ottawa, ON, Canada
Financial Focus Event - June 25th in Toronto, ON, Canada

World eID
Sept.19 - 21, 2007
Sophia Antipolis, French Riviera
http://www.strategiestm.com/events/se/index.htm
ACT Canada members receive 25% delegate discount (including early-bird & renewal rates). Contact andrea@actcda.com for more details.

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (02/26)

Province of Ontario could be on the Right Path

We do need a more secure driver's licence that could be used for cross border ID. This would lay the foundation for improved services and savings for Ontarians. The question is whether the government will take the right steps to wring every dollar of value out of this move.

By making key choices on standards and technology, the government could also improve health care, help citizens reduce the risks of identity fraud, cut operating costs and effectively reduce fraud in our social programs.

For secure ID you must know the person to whom you issue the card and the card itself must be highly tamper and counterfeit resistant. This rules out simply issuing new cards to existing cardholders or adding more security to a magnetic stripe card, but that could be good news for both the government and citizens.

A province wide registration of Ontarians would not only give us an accurate base from which to issue ID, but would also support solutions to other problems. This includes risks when personal data is stored on the face or magnetic stripe of a card where it is vulnerable, and the growing cost of fraud from the use of counterfeit cards or legitimate cards presented by fraudsters.

We could implement a system where health providers can share data with the patient's permission, increasing the quality of care and cutting costs. Citizens can access their own records; helping ensure that fraudulent data doesn't result in harm. This is of increasing concern to the health community.

Choosing the right standards and technology will save money and support interoperability with other governments and the private sector. Chip technology, being rolled out by financial institutions provides the necessary security. Their EMV specifications could be used with ICAO travel document standards.

Moving vulnerable personal information to the chip where it can be secured can fight identity fraud. Privacy design tools are available from ACT Canada. Reducing the need to issue separate cards for each program saves money. A recent Ipsos-Reid - ACT Canada subscription study, shows consumers strongly identify the benefits of carrying fewer cards.

Fraud savings can initially be used to pay for these systems and then can be re-invested directly into health care.

Several Ontario governments have headed down the path of a citizen services card. It is not a fast return on investment, but has an extraordinarily high payback over time, not just in money but also in quality of life. By taking the first step, this government is on the right track and could be the one to go the distance.

2. NEW CHIP MIGRATION STUDY PROVIDES GOOD NEWS FOR CANADIAN RETAILERS
Source: Visa Canada (02/02)

New Visa-sponsored study provides cost-benefit analysis for merchants. The Implications of Chip & PIN Migration: A Canadian Retailer's Perspective, an independent study, shows long-term benefits for retailers who implement upgraded technology that allows them to accept more secure payment cards.

Between now and 2010, Visa Canada and its Members will be implementing Chip and PIN technology for payment cards in the Canadian marketplace. Visa Canada commissioned the research from J.C. Williams Group, a leading independent retail and marketing consulting firm, to provide a complete picture of the technological migration for the Canadian retail sector.

The study provides background, analysis, and details regarding the migration to Chip and PIN, as well as a cost-benefit analysis for merchants. It shows that the majority of retailers who use rented hardware from their Acquirer will assume minimal costs associated with migration and will reap many benefits. The study also shows that retailers with integrated point-of-sale systems can expect a return on investment in 21 to 35 months.

Chip and PIN technology reduces fraud, and is a technology-based solution that creates many operational benefits that add up to significant savings for retailers. Benefits include reduced fraud and chargebacks, increased lane throughput, process optimization, reduced cost of store supplies, global interoperability and reduced administration costs. The introduction of chip technology also carries less tangible benefits, such as increased consumer confidence. According to a recent Visa survey, one-third of Canadians believe that the responsibility for credit card security falls on retailers. Implementing Chip and PIN technology is an important way to foster loyalty amongst consumers and provides retailers with an effective means of reassuring customers that security is a priority.

Large format retailers to see cost reductions of nearly $1.85 million a year
Merchants play a critical role in the successful implementation of Chip and PIN in the Canadian market. The new study shows that the majority of retailers who use rented hardware from their Acquirer will assume minimal costs associated with migration and reap many benefits, while large retailers with integrated point-of-sale systems can see a return on investment in 21 to 35 months.

Case studies included the study also show that two U.K. retailers realized a return on investment in less than one year following their migration to Chip and PIN with the reported savings in average transaction times, improved processes, a reduction in store supplies and chargeback reduction.

As in all business, the customer comes first, and maintaining consumer confidence in the security of electronic payments benefits all retailers. It is evident that implementing Chip and PIN technology is an important way that retailers can help foster confidence amongst consumers.

In 2006, members of the Canadian payment card industry joined together to announce a firm commitment to a broad industry migration to chip technology.

Visa Canada is a member of ACT Canada; please visit http://www.visa.ca.

3. GIESECKE & DEVRIENT LAUNCH NEXT GENERATION OF CONTACTLESS PAYMENT CARDS
Source: Giesecke & Devrient (01/31)

Giesecke & Devrient introduced its next generation of contactless payment cards for U.S. bankcard issuers. G&D's StarCL v2 contactless payment cards deliver enhanced performance and reliability integrated in a card platform that offers the potential for achieving mass-scale deployment.

G&D's newest StarCL v2 contactless card product line for the U.S. market provides bankcard issuers with a payment card platform that has major payment brand contactless applications loaded onto the card. The selection (e.g., MasterCard PayPass, Visa Contactless) is performed during the card pre-personalization or initialization process.

Using the latest MicroPass L4-2G contactless intelligent hardware technology from INSIDE Contactless, G&D's StarCL v2 offers full MasterCard PayPass and Visa Contactless compliance, faster contactless payment transaction times, and reduced internal power consumption for greater reliability and product life. The platform also features a built-in multi-application development environment to facilitate the deployment of value-added retail, loyalty, transit, and access control applications along with core payment processing.

Giesecke & Devrient; MasterCard Canada & Visa Canada are members of ACT Canada; please visit http://www.gi-de.com; http://www.mastercard.ca & http://www.visa.ca.

4. INTERAC HOSTS ADDITIONAL EMV TRAINING SESSIONS
Source: Interac (02/12)

In cooperation with Collis EMV Academy, Interac Association hosted six EMV training sessions for Members and their business partners in Toronto, Montreal, Calgary and Vancouver throughout November 2006 and January 2007. These EMV training sessions provided an overview of EMV; a functional description of EMV specifications; an understanding of EMV transaction flow, cryptography and key management; and the opportunity to work through applied EMV exercises. The sessions were well attended and, due to positive feedback and overwhelming demand, two additional sessions have been added in Toronto for February 2007. Upon completion of all eight sessions, over 150 registrants will have received valuable knowledge of EMV that they can effectively use in their organization's chip migration initiatives and planning

Collis and Interac Association are members of ACT Canada; please visit http://www.collis.nl & http://www.interac.org.

5. GEMALTO SELECTED FOR PORTUGAL'S NATIONAL ID PROJECT
Source: ICMA Daily News (02/16)

Gemalto has been selected by Imprensa Nacional-Casa da Moeda (INCM), the Portuguese Mint and National Printing Office, to provide the solution for the national e-ID card including the secure operating system, the personalization system and applications, the middleware and associated helpdesk services. A first pilot phase is starting today in the Acores region, and in mid-run, all Portuguese citizens should be able to use these high-end cards including a built-in biometrics feature (fingerprint) as their national ID document.

This smart card will be the official ID document for Portuguese citizens and incorporates extended printing security features. It will also enable citizens to communicate with their government administrations in a simple, fast and more secure manner. This new called "Citizen Card" will include several id-numbers such as civil identification, taxpayer, social security and health and will also replace, in the future, the elector card. A variety of e-government services will be available through the electronic identification provided by the new Citizen Card. The cardholder has a secret pin code to identify and authenticate himself/herself, and the card generates a, legally-binding digital signature for secure declarations and administrative procedures. This application will provide the required cryptographic means for secure access to e-government services portal and digital signature for electronic exchanges. Another application, which access is electronically restricted to forensic and police authorities, will perform the identity verification through fingerprint check.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

6. NEW PCI PED APPROVALS FOR 5 MAJOR TERMINALS FROM INGENICO
Source: Ingenico (02/12)

Ingenico announces that its i5100, i5310, i6780, i8200 and i8550 terminals have obtained the PCI PED (Payment Card Industry - PIN Entry Device) approval established by Visa International and MasterCard International. These new approvals are completing those already obtained by Ingenico for its i3070 and i3380 PIN pads and for its i6510 and i6550 signature capture terminals.

The PCI PED approval guarantees that all transactions carried out through smart card are securely handled at the PIN acceptance device. The tests conducted by an independent laboratory focused on the physical and logical security of the terminals and certify the highest level of security ever defined today in terms of security. The PCI PED standard, which will be compulsory for all new PIN-based payment devices delivered from January 1st, 2008 on, is already an assurance for merchants and consumers that their transactions are carried out in conformity with the strictest security requirements.

Ingenico; MasterCard Canada & Visa Canada are members of ACT Canada; please visit http://www.ingenico.com; http://www.mastercard.ca & http://www.visa.ca.

7. ICC SOLUTIONS LAUNCHES ICCSIMSC: SMARTCONNECT FEATURING ENHANCED TERMINAL TEST SCRIPT EXECUTION
Source: ICC Solutions (02/26)

ICC Solutions announced the immediate availability of ICCSimSC: SmartConnect which enables a fully configurable test environment to streamline your device testing process, whilst retaining the flexibility and unique functionality offered by ICC Solutions testing with a real smartcard.

This simple hardware device further extends the capabilities provided by the dual interface ICCSim card and reader, making terminal testing both quicker and easier to perform. ICCSimSC is used with ICCSimTT and ICCSimDE to create an automated test environment offering increased test cycle efficiency with reduced manual operation.

For more information on this new product, or other solutions such as the Interac Association approved Terminal Application Certification Test Script package, please e-mail info@iccsolutions.com.

ICC Solutions is a member of ACT Canada; please visit http://www.iccsolutions.com.

8. UK CHIP & PIN MIGRATION NEARLY COMPLETE
Source: ePaynews.com (02/14)

One year after the official changeover to EMV cards in the UK, 99.9 percent of all British chip-and-PIN card transactions are now PIN-verified, says APACS. According to the UK payments association, very few UK card-accepting businesses have not upgraded to chip-and-PIN.

After February 14, 2006, UK cardholders were required to enter their PIN when paying with their chip-and-PIN card instead of signing a receipt. This change was made to protect cardholders against fraudsters, according to APACS.

More than 185 chip-and-PIN transactions currently take place every second in the UK, up from 125 chip-and-PIN transactions per second a year ago, APACS says.

UK banks and credit card companies have now issued 138 million chip-and-PIN cards, representing 97 percent of the UK's 142 million payment cards. This compares to 130 million chip-and-PIN credit and debit cards in issue six months ago and 108 million 18 months ago, APACS says.

Around 900,000 point-of-sale terminals have been upgraded to chip-and-PIN, representing 98 percent of all POS terminals in the UK. APACS says that 75,000 terminals have been upgraded to chip-and-PIN since February 14, 2006.

The UK is leading the rest of Europe in its adoption of chip-and-PIN payment technology, according to APACS.

9. CYBERTRUST & CORESTREET LAUNCH GOVERNMENT SMART CARD CREDENTIAL VALIDATION SERVICE
Source: CoreStreet (02/13)

Cybertrust and CoreStreet announced collaboration around government smart card credentialing. Aimed at validating Federal Information Processing Standard (FIPS) 201-compliant smart cards, the U.S. Department of Defense Common Access Card (DoD CAC) and smart cards issued as part of numerous national ID and health card programs around the globe, this service provides customers with a cost-effective end-to-end alternative to deploying their own Public Key Infrastructure.

Cybertrust is offering a validation service that enhances the deployment of CoreStreet's PIVMAN System for government smart credential checking. The PIVMAN System consists of server software and handheld devices designed to allow authorized personnel the ability to control access to any site by quickly authenticating and validating the roles and identities of individuals wishing to enter an area. It provides those on the frontlines with the ability to immediately check and verify the status of any FIPS 201-compliant credential. Performing mobile validation, particularly in a communications-out environment, is critical in emergencies and first responder situations, such as natural disasters, as credentials can be verified across federal, state and local agencies and among jurisdictions.

CoreStreet is a member of ACT Canada; please visit http://www.corestreet.com.

10. GEMALTO & ABAXIA PARTNER TO LAUNCH COMPLETE SOLUTION FOR DYNAMIC MANAGEMENT OF ON-DEVICE SERVICES
Source: ICMA Daily News (02/20)

Gemalto and Abaxia announced the launch of a complete package that will enable the dynamic management of on-device services. This innovative solution relies on the new generation of multimedia SIM cards from Gemalto associated with an over the air (OTA) infrastructure. This combination will give mobile operators greater control of the handset user interface (UI) by allowing them to manage the way users access the handset's internal phone features and menus. It will also increase the average revenue per user (ARPU) generated by data services. With this Gemalto-Abaxia package, mobile operators can now proactively manage the user interface and the associated services via OTA, even once the handsets have been deployed.

The Gemalto multimedia SIM cards will carry the handset customization elements like the user interface and the settings for data services, in addition to the new multimedia phonebook and the local operator portal already available from the SIM. The Gemalto new-generation hosted OTA infrastructure will enable remote management of the user interface and the associated operators' services over GPRS or 3G networks.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

11. BANKA KOPER OF SLOVENIA ISSUES WORLD'S 1st VISA CARDS ON KEYCORP'S MULTOS SMARTCARD TECHNOLOGY
Source: Keycorp (02/14)

Keycorp Limited announced that Banka Koper, one of the leading financial institutions in Slovenia, has become the world's first Visa card issuer to deploy smart credit and debit cards using Keycorp's MULTOS smartcard technology.

MULTOS is a flexible, secure, and cost effective smartcard operating system used for banking and payments. Its key features are high security architecture, ability to co-house multiple, independent applications securely and its ability to remotely load and delete applications throughout the lifecycle of the card.

Banka Koper already uses Keycorp's MULTOS operating system for its MasterCard portfolio, however, certification of MULTOS and MULTOS Step/one with Visa lets Banka Koper use a single platform to support the chip applications of both payment schemes (MasterCard and Visa). This simplifies card issuance, personalisation and the management processes.

This implementation is a result of intensive work and co-operation between Visa International and Banka Koper, and MULTOS consortium members, Keycorp Limited, Thales eSecurity and StepNexus.

Keycorp; MasterCard Canada; StepNexus & Visa Canada are members of ACT Canada; please visit http://www.keycorp.net; http://www.mastercard.ca, http://www.stepnexus.com & http://www.visa.ca.

12. GIESECKE & DEVRIENT SUPPLYING TELIASONERA WITH 1-GIGABYTE SIM CARDS
Source: ICMA Daily News (02/12)

TeliaSonera (telecommunications operator in the Nordic and Baltic states) commissioned Giesecke & Devrient (G&D) to provide it with SIM cards featuring a storage capacity of over one gigabyte (GB) for preliminary trials. The 1 GB SIM card from G&D, dubbed GalaxSIM, runs on a corresponding chip platform from Samsung. The trial will be conducted on a P3600 personal digital assistant (PDA) from HTC.

The GalaxSIM card uses the MMC interface of the P3600 PDA from HTC for speedy communication between card and phone. Although the European Telecommunications Standards Institute (ETSI) agreed on USB as the standard for a high-speed protocol in November 2006, there are presently still no USB-enabled cell phones available on the market. TeliaSonera opted to go with the MMC interface, which is ready for use now, for testing and transition purposes. For later migration to USB standards, G&D already offers USB-enabled GalaxSIM cards. Test cards with phone book synchronization and pocket PC games

The GalaxSIM being used for the TeliaSonera pilot trials comes with a variety of information and applications incorporated into its high density NAND flash memory: graphics and logos, settings files for modifying network parameters, a selection of pocket computer games, and a phone boo application produced by G&D, called GalaxSIM Sync, which enables automatic backup of phone book entries on the SIM card. GalaxSIM Sync immediately recognizes new entries to the cell phone and saves them as backup on the SIM card in the typical VCard format, thereby allowing the entries to be easily and completely transferred from the card to a new phone whenever the owner changes handsets.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

13. INTERAC & ACXSYS ANNOUNCE NEW PRESIDENT AND CEO
Source: Interac Association (02/12)

Interac Association and Acxsys Corporation are pleased to announce the appointment of Mark P. O'Connell as President and CEO, effective February 7, 2007. Mr. O'Connell brings extensive experience in the payment card and banking technology industries to his new position, where he will focus on innovation in payment services and advancing Acxsys Corporation's and Interac Association's leadership in the industry.

Please note that this story was originally sent to ACT Canada members as an ACTion News bulletin on February 12, 2007. The full press release can be viewed on our web site at http://www.actcda.com/resource/Interac.pdf.

Interac Association is a member of ACT Canada; please visit http://www.interac.org.

14. ADDITIONAL STORIES AVAILABLE IN ACT CANADA MEMBERS ONLY SECTION

These additional stories are available to ACT Canada members via the Members Only section of our web site. Click on the link below to access this section.
If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.
http://www.actcda.com/members-only/members-only-news/

FIRST WAVE OF E-PASSPORT ROLLOUT HIGHLIGHTS CHALLENGES, POTENTIAL OF CONTACTLESS ID

A lack of readers and questions about the security of an international database are among the main problems facing the massive, ongoing rollout of electronic passports. But with some 30 governments pumping out the chip-based travel documents, the rollout shows no signs of slowing down…

NATIONAL ID PROJECT MOVES CHINA TO HEAD OF THE PACK IN RADIO FREQUENCY TECHNOLOGY

China has become the largest market for radio frequency identification technology, or RFID, driven largely by its mass issuance of a contactless smart card as a new identification document…

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.