Engaging, Enabling and Evolving Commerce in Canada since 1989

March 2007 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. Giesecke & Devrient Selected To Deliver Ontario's New High Security Driver's Licence
3. Tim Horton's Leads Charge On Contactless Credit Cards
4. Gemalto Puts Canadian Financial Institutions On The Fast Track To Smart Bank Cards
5. More Than 1 Million National Service Cards Issued By Oberthur In 2006 In Italy
6. Keycorp Reaches Sales Of 35 Million EMV Chips
7. Card Fraud Falls In UK
8. SCM Microsystems Smart Card Readers Ready For Windows Vista
9. Datacard Group Introduces Professional-Grade Capture Solution For Mid-to-High-Volume ID Card Issuers
10. MasterCard Assigns Contactless Communication Protocol To EMVCo
11. Gemalto To Provide 3.5 Million Transit Payment Devices To Massachusetts Bay Transportation Authority
12. MasterCard And ASK To Jointly Develop Paper-Based Contactless Cards
13. Belgian Mobile Operator Proximus Using Highly Secure SIM Cards From Giesecke & Devrient For Mobile Payment
14. Additional Stories Available In Members Only Section

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

ASSOCIATE

Blake, Cassels & Graydon ~ new member
Bohdan Myroniw ~ member since 2006

UPCOMING EVENTS

Smart Card Alliance: Smart Cards in Government Conference and Exhibition
April 10 - 13, 2007
Washington, DC, USA
http://www.smartcardalliance.org

CardTech/SecurTech
May 15 - 17, 2007
San Francisco, CA, USA
http://www.ctst.com
ACT Canada members receive 10% off delegate registration fee (including early-bird & renewal rates). Contact Andrea McMullen for more details - andrea@actcda.com.

ACT Canada presents Cardware 07
Government Focus Event - June 21st in Ottawa, ON, Canada
Financial Focus Event - June 25th in Toronto, ON, Canada

World eID
Sept.19 - 21, 2007
Sophia Antipolis, French Riviera
http://www.strategiestm.com/events/se/index.htm
ACT Canada members receive 25% delegate discount (including early-bird & renewal rates). Contact andrea@actcda.com for more details.

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (03/30)

This week Visa Canada held its second annual Security symposium, well timed to coincide with the national fraud prevention month. It served as a reminder that personal information is very often linked to electronic payments, for example address information for deliveries. Some merchants keep extensive information on frequent shoppers. Recent security breaches at merchants and third party processors, show that other sensitive data such as social insurance numbers, are often stored and at risk.

We heard from a forensic expert that organizations that have been breached often didn't have a good understanding of the "sensitivity" of the data they possessed and therefore had inadequate plans to protect it.

When merchants were asked why they keep data, one answer really struck a cord with the audience. It was that many of us come from a background where we routinely hang onto information because we have the storage capacity and because in the past we've had no real reason to destroy it.

With the growth of identity fraud and concerns of Canadians about this problem, we now have a strong reason to understand and protect sensitive data. Identity fraud related to mortgages has grown from $73 million in 1999 to $300 million in 2000 and is estimated to be $1.5 billion today. Is it any wonder that 77% of Canadians polled by Ipsos Reid in 2005 said they were very or somewhat concerned about identity theft and that 65% said they had experienced some form or attempt of it, through phising, fraudulent payment card use or stolen cards.

The payment card industry has taken an admirable lead in setting standards for the handling of payment data. EMV Chip and PIN will also help cut down on the amount of data that needs to be stored by a merchant. Two more steps must be taken. All organizations in both the public and private sectors must move to data access verification for their employees and all entities issuing cards must follow the lead of Canadian financial card issuers in moving to more secure cards. Of course, organized crime would prefer that neither step be taken.

2. GIESECKE & DEVRIENT SELECTED TO DELIVER ONTARIO'S NEW HIGH SECURITY DRIVER'S LICENCE
Source: ICMA Daily News (03/09)

Giesecke & Devrient (G&D) announced it has been awarded a 10-year contract by the Government of Ontario to deliver a complete end-to-end solution for the new high-security Driver's Licence.

The enhanced Driver's Licence will offer increased protection for identification by employing new built-in security features. The flexibility of the new card solution from G&D allows for increasing levels of security as Ontario's needs change and global technology for identification evolves. G&D's responsibility for the complete end-to-end solutions include;

  • Systems and equipment to capture photographs, signatures, and other information in Ministry of Transportation (MTO);
  • Design services for the Driver's Licence to maximize resistance to counterfeiting and tampering;
  • High-security manufacturing and storage of cards;
  • Printing and encoding individual photographs, signatures and other cardholder information on the Driver's Licences.
  • Mailing of cards and associated materials to cardholders.

Using a proprietary process, G&D will integrate a number of security features both visible and invisible to the eye, in the new Driver's Licence. These cards will have a new look and feel and will be processed in G&D's new state-of-the-art, high-security facility in Markham, Ontario. To add to its complete solution, G&D has incorporated the expertise of the Datacard Group, a trusted identification solution provider that has implemented government solutions worldwide.

"The technology being adopted today positions the Ontario Government with a flexible platform to pursue future initiatives for the Driver's Licence," says Hans Wolfgang Kunz, Member of the Management Board at G&D in Munich. "The Province of Ontario will stand out as a leader among its peers in North America for adopting and extending the current state of technology, and delivering improved security and convenience to its citizens."

Giesecke & Devrient and Datacard Group are members of ACT Canada, please visit http://www.gi-de.com & http://www.datacard.com.

3. TIM HORTON'S LEADS CHARGE ON CONTACTLESS CREDIT CARDS
Source: Financial Post (03/27)

Every second counts in the competitive fast food industry and Tim Horton's is about to speed up the clock.

This summer, the company plans to introduce new 'contactless' credit card payment technology that allows customers to pay for their daily 'double-double' simply by tapping their card against a point-of-purchase terminal.

That means no bills or signatures - at least for purchases under $25 - and UBS analyst Peter A. Rozenberg says it could shave 5-10 seconds off each transaction. In turn, he thinks Tim's could increase sales by 2.5% by 2009.

"We think Tim's could be a leader in contactless payment and Canadian acceptance of this technology as Tim's has a large network of 2,711 stores in Canada, a very loyal customer base where 46% of its customers visit its stores four or more times a week, and executes a very significant 1.7 billion payment transactions in Canada per year," he said in a note to clients.

He added that while contactless technology hasn't reached mainstream acceptance in Canada, a 2006 Ipsos Reid and Peppercoin survey concluded that 100 million Americans would use contactless payment for inexpensive items such as fast food and transit fare.

Over the next five years, Mr Rozenberg anticipates a "high growth" of contactless credit cards as it begins to replace cash as the preferred transaction method for consumers.

He also said plans for new cash-like gift cards could result in an additional 1-2% lift in Tim's sales.

4. GEMALTO PUTS CANADIAN FINANCIAL INSTITUTIONS ON THE FAST TRACK TO SMART BANK CARDS
Source: ICMA Daily News (03/29)

Gemalto announced a new end-to-end solution to help Canadian debit and credit card issuers implement the international EMV standard. With its EMV Pilot Package, which includes microprocessor-based smart card technology to provide better security to cardholders, personalization and consultation, Gemalto utilizes its global expertise and extensive experience to completely manage a financial institution's EMV migration from start to finish.

"Card issuers in Canada will find this solution particularly useful. As they gear up to meet aggressive deadlines for implementing the international EMV standard, many are realizing how demanding such a program can be," said Jack Jania, vice president and general manager of financial services for Gemalto North America. "Our EMV Pilot Package makes migration easy for issuers by providing everything necessary to successfully participate in EMV without relying extensively on internal resources."

The EMV Pilot Package includes banking cards containing Gemalto's secure digital technology, as well as data preparation, personalization and fulfillment of the cards at a state-of-the-art Gemalto center. Gemalto will also train the organization's team extensively on all activities associated with EMV migration.

Gemalto is a member of ACT Canada, please visit http://www.gemalto.com.

5. MORE THAN 1 MILLION NATIONAL SERVICE CARDS ISSUED BY OBERTHUR IN 2006 IN ITALY
Source: ICMA Daily News (02/27)

Oberthur Card Systems was selected at the end of 2005 by the Ministry of Innovation and Technology to be the reference provider of the CNS (National Services Card) for the Italian Public Administration. This pluri-annual contract, signed between CNIPA and a Temporary Group of companies including Oberthur Card Systems, Actalis, AlmaViva (Finsiel), Sia and TrustItalia, calls for the delivery of 3 million cards for the requirements of the CNS program and several other projects. In 2006, Oberthur Card Systems sold over one million units to the Italian administration.

Oberthur Card Systems will provide an end-to-end ID solution which includes smart card manufacturing, electrical and graphic personalization, fulfillment and delivery to citizens. The smart card products delivered under this contract comply with the highest levels of security - Common Criteria certified to EAL4+ level and SSCD (Secure Signature Creation Device) Protection Profile compliant - and support both contact and contactless interfaces.

This card will provide multiple services to Italian citizens, including strong authentication and administrative personal data storage, digital signature, health, ticketing (for example transportation and/or parking) and access control.

Oberthur Card Systems is a member of ACT Canada, please visit http://www.oberthurcs.com.

6. KEYCORP REACHES SALES OF 35 MILLION EMV CHIPS
Source: Keycorp (03/19)

Keycorp Limited announced the sale of their 35 millionth EMV smartcard chip. Additionally, Keycorp have renewed their global Alliance Agreement with MasterCard Worldwide to guarantee attractive module and card prices to all MasterCard customers. This agreement will run until October 2009.

Toni Merschen, Group Head, Chip, MasterCard Worldwide, said, "Keycorp's achievement of this milestone highlights their commitment to providing first class chip products to MasterCard issuers.

The renewal of our Alliance Agreement further demonstrates MasterCard's satisfaction with Keycorp serving our joint customers with leading-edge EMV solutions."

Richard Cusson, General Manager, Smartcard Technologies, Keycorp said, "Keycorp continues to lead the way in smartcard sales by enabling secure multi-application EMV solutions. This achievement highlights Keycorp's commitment to driving the technology into new markets, and investing in innovative new applications which deliver increased value to our customers. We expect sales of our EMV chips to pass the 50 million mark in 2007. "

Keycorp is a member of ACT Canada; please visit http://www.keycorp.net.

7. CARD FRAUD FALLS IN UK
Source: CardTechnology (03/15)

Fraud losses from credit and debit cards issued in the United Kingdom dropped by 2.6% in 2006, to £428 million (US$828 million) from £439.4 million (US$850 million) in 2005, according to figures from APACS, the UK's payments association. Last year, card fraud within the UK accounted for £309.8 million (US$600 million) in losses, 13% less than in 2005. However, the value of fraud on UK-issued cards used outside the country jumped by 43%, to £118.2 million (US$229 million), over the same period.

An APACS spokesperson says that the country's adoption last year of a "chip-and-PIN" smart card system has made it much harder for criminals to steal cards and then use them at point-of-sale terminals and ATMs in the UK. Even if a criminal steals a UK-issued card, without knowing the cardholder's personal identification number the fraudster will likely not be able to use the card illegally in the UK. As a result, APACS says, organized criminals are increasingly using stolen cards from the UK in other countries where magnetic-stripe cards are still the norm. UK "chip-and-PIN" cards carry a magnetic stripe as well as a smart card chip, so they can be used in countries that have not adopted smart cards. According to APACS, the value of card fraud committed at UK retailers' point-of-sale terminals plunged by 47% last year, to £72.1 million (US$140 million) from £135.9 million (US$ 262 million) in 2005, largely due to the adoption of the new, more secure card technology.

8. SCM MICROSYSTEMS SMART CARD READERS READY FOR WINDOWS VISTA
Source: SCM Microsystems (03/05)

SCM Microsystems announced that its innovative smart card readers support the new Microsoft operating system Windows Vista. The successor of Windows XP is being promoted as "the most secure Windows operating system of all time." Security enhancements in Vista complement SCM's highly-sophisticated Class 1 and Class 2 smart card readers, which enable secure exchange of electronic information and secure access to PCs and networks in the financial, government and enterprise sectors. The catalog of smart card readers supporting Vista - which includes SCM's PC card reader, ExpressCard™ reader, and USB readers -can be found on the SCM Microsystems'. SCM's readers support both the 32-bit as well as the 64-bit version of the new operating system with all Vista versions.

SCM's new software drivers ensure that users purchasing a new computer with Windows Vista or upgrading their existing PCs for the new operating system can continue to use their SCM smart card readers without disruption.

SCM Microsystems is a member of ACT Canada, please visit http://www.scmmicro.com.

9. DATACARD GROUP INTRODUCES PROFESSIONAL-GRADE CAPTURE SOLUTION FOR MID- TO HIGH-VOLUME ID CARD ISSUERS
Source: ICMA Daily News (03/28)

New solution ideal for government ID issuance and other demanding programs personalization solutions, introduced the new Datacard SecureCapture solution at the ISC West Conference and Exposition. This robust image capture solution - which includes a capture tower, digital camera, software and a powerful flash - is designed for ID card programs with high volumes or peak image capture demand periods.

The solution features an 8 mega-pixel camera and a high-powered flash, which are enclosed in a secure capture tower. The tower keeps the camera and flash in proper alignment and helps protect against damage or theft. The high-powered flash, which has an exceptional lifespan, eliminates shadows and ambient light, so users can capture high-quality images with exceptional consistency in almost any environment.

The SecureCapture solution also includes intelligent software, which automatically adjusts camera settings and manages lighting, cropping and other time-consuming steps. This allows operators to capture images with a single mouse click. A sleek design and small footprint also makes the SecureCapture solution an attractive and convenient addition to any work area.

Datacard is a member of ACT Canada, please visit http://www.datacard.com.

10. MASTERCARD ASSIGNS CONTACTLESS COMMUNICATION PROTOCOL TO EMVCO
Source: ContactlessNews (03/26)

MasterCard Worldwide has assigned the PayPass ISO/IEC 14443 Implementation Specification v1.1 to EMVCo, the EMV standards body jointly owned by JCB, MasterCard Worldwide and Visa International, in a move which signals significant progress towards a common platform for contactless EMV payment transactions.

This contribution will be the basis for the EMV Contactless Communication Protocol Specification, to be released in the second quarter of 2007. Until then, EMVCo will administer the licensing and distribution of the PayPass ISO/IEC 14443 Implementation Specification v1.1, which defines a contactless communication protocol and associated testing requirements for radio frequency-based contactless payments at the point of sale. It is an established specification already in use by JCB, MasterCard and Visa.

Ownership of the contactless communication protocol specification has been assigned to EMVCo to further the organisation's efforts to create common standards, globally, for contactless EMV payment transactions which will be available to all of its payment system members.

There are no technical changes to the specification with this assignment of ownership. The specification will support all existing EMV-based contactless solutions and will in the longer term provide the foundation for the development of a common contactless EMV application by EMVCo.

The specification will be made available to the industry on a royalty-free basis under licence by EMVCo. EMVCo will shortly announce a timeline for the availability of type approval testing to the new EMVCo standard, first for contactless readers and then for cards.

MasterCard and Visa Canada are members of ACT Canada, please visit http://www.mastercard.ca & http://www.visa.ca.

11. GEMALTO TO PROVIDE 3.5 MILLION TRANSIT PAYMENT DEVICES TO MASSACHUSETTS BAY TRANSPORTATION AUTHORITY
Source: ICMA Daily News (03/09)

Gemalto announced it is supplying transit payment devices to the Massachusetts Bay Transportation Authority (MBTA) for its historic CharlieCard electronic ticketing initiative. Gemalto is providing 3.5 million secure contactless transit smart cards to the MBTA for the program, enhancing the convenience and speed of service for public transportation in the Boston area.

With CharlieCards, Massachusetts commuters no longer need to use paper tickets to ride the MBTA's bus and subway system. Instead, they simply hold the CharlieCard close to a reader that instantly deducts the fare from the card or validates their time-based pass, allowing them quick and easy entry to subways and buses.

By the end of this month, Gemalto will have successfully delivered 2.4 million secure contactless transit devices specified for the CharlieCard program to the MBTA. Because the cards were delivered fully encoded by Gemalto, the MBTA was able to distribute the cards immediately without having to be processed through the MBTA's smart card encoding equipment.

Gemalto is a member of ACT Canada, please visit http://www.gemalto.com.

12. MASTERCARD AND ASK TO JOINTLY DEVELOP PAPER-BASED CONTACTLESS CARDS
Source: ICMA Daily News (03/26)

MasterCard Worldwide announced that it has signed a development agreement with ASK to create paper-based contactless payment solutions for use in transit and other payment environments. The announcement was made at the American Public Transportation Association (APTA) conference in Los Angeles.

"MasterCard PayPass is intended for environments where speed is at a premium. Transit is a perfect example." said Kathleen Reilly, MasterCard Worldwide. "In a subway environment, limited-use, paper-based contactless fare tickets could replace standard mag-stripe fare cards for riders who don't have a PayPass-enabled payment card. This solution would enable all riders to tap their way through the turnstile." MasterCard's development arrangement with ASK extends beyond contactless payment cards for transit. "The possibilities from paper-based solutions leveraging contactless payments are endless" adds, Reilly.

"More than 50 million ASK contactless paper tickets have already been widely spread worldwide in mass transit Automatic Fare Collection systems, says Thierry Burgess, US General Manager. Merging contactless paper tickets with Mastercard' PayPass payment technology provides a cost-effective and user-friendly solution", he adds.

MasterCard is a member of ACT Canada; please visit http://www.mastercard.ca.

13. BELGIAN MOBILE OPERATOR PROXIMUS USING HIGHLY SECURE SIM CARDS FROM G&D FOR MOBILE PAYMENT
Source: Giesecke & Devrient (03/26)

Proximus, BASE, Mobistar, telecommunications operators in Belgium and Banksys, Belgium's leading player on the electronic payments market, recently announced that they are now offering their clients a mobile payment service. Thanks to the Mobile banxafe application from Banksys, wireless customers can conveniently use their cell phones to make payments on a day-to-day basis, for example, when taking deliveries at their front door. Mobile banxafe is stored on a G&D SIM card, which meets the especially strict security requirements and has been officially certified at security level EAL 4+ to prove it.

With Mobile banxafe, all Belgian customers can conduct the same transactions using their mobile phones that they have previously been able to carry out via card terminals located in stores. These payments are made between two banxafe-enabled cell phones What's more: they can also use the function to recharge their prepaid balance. The technology that makes such secure payments possible is also provided by G&D. The 128 KB SIM card from G&D comes with the Mobile banxafe applet stored on it. "The chip platform has passed certification according to Common Criteria (CC) at level EAL 4+ based on a hardware and software evaluation approach and thus fulfills the highest security requirements, which are essential for sensitive applications such as monetary transactions" said Dr Klaus Vedder, Group Senior Vice President and Head of G&D's Telecommunications division.

Giesecke & Devrient are members of ACT Canada, please visit http://www.gi-de.com.

14. ADDITIONAL STORIES AVAILABLE IN ACT CANADA MEMBERS ONLY SECTION

These additional stories are available to ACT Canada members via the Members Only section of our web site. Click on the link below to access this section.
If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.
http://www.actcda.com/members-only/members-only-news/

RFID WANTED IN STORES & AT HOME

Canadian internet users say they are ready to embrace RFID technology, not only in their grocery stores but also in their homes, with their main fears having changed from safety, privacy and security to the cost of RFID, and that it might not work properly, according to a poll…

WILL FRAUD MIGRATION PUSH U.S. BANKS TO JOIN THE SMART CARD WORLD?

With Canada and Mexico rapidly moving towards EMV deployment, witness the world's largest player in the credit card market, the United States, left out in the cold. Some say it's not a matter of if, but when, the U.S. will implement EMV...

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.