Stakeholders Driving Payment Evolution and Digital Identity

May 2009 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. Subway's Canada Stores Go Contactless
3. Dynamic Card Solutions Releases New Contactless Personalization Platform
4. EMV Takes Aim At U.S. - Member Only Access
5. MasterCard Worldwide Says All Chip-Based Payment Products Must Be DPA Protected By Cryptography Research
6. NXP and Giesecke & Devrient Launch Contactless Fast Pay Solution
7. EPC and GlobalPlatform Sign MoU On Mobile Contactless Payments - Member Only Access
8. Feds Won't Delay Passport Requirement To Cross Canadian Border
9. Chicago RTA Looks Into Riders Using Cell Phones Instead Of Tickets Or Transit Cards - Member Only Access
10. Gemalto Acquires Mobile Software Solution Provider O3SIS
11. G&D Unveils Secure ID System For Blackberry Users
12. MasterCard To Bring MoneySend To U.S. Mobile Devices

ACT Canada Partners

 Visa

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

Collis

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

PRINCIPAL

Credit Union Central of Canada ~ member since 1990
EWA Canada Ltd. ~ member since 2004

GENERAL

Apriva ~ new member
Collis ~ member since 2006
MULTOS ~ member since 2007

Membership Benefit Reminder
All ACT Canada members, who do not currently subscribe to the Nilson report, are entitled to a 10% discount. Also, all members receive significant discounts for Cardware 09.

CALENDAR OF EVENTS

EMV Chip Seminar, presented by Collis
June 3-4, 2009
Toronto, ON, Canada
ACT Canada members receive a 15% discount

Cardware 09: Payment Insights
Financial & Retail Sectors Conference
June 17-18, 2009
White Oaks Conference Centre
Niagara-on-the-Lake, ON, Canada
Visit www.actcda.com for more details

Cardware 09 Secure ID Insights
Government Sector Event
September 16, 2009
Hellenic Centre
Ottawa, ON, Canada
Visit www.actcda.com for more details

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (05/27)

Market Wisdom

A lot of you have made very thoughtful decisions and I applaud you. Just two months ago our board raised concerns that were valid in light of the global drop off in conference attendance. We held firm in our belief that we should move forward because the program content was specified by the financial and retail sectors, and because we work with each speaker to ensure that our audience gets valuable information.

You've confirmed our belief that you are still investing in research and market insights. Over the past month we have been telemarketing and the feedback is everything we could hope for. The conference hotel is close to a sell out and we have had to secure rooms at the hotel across the street. Award nominations have increased and we're looking forward to celebrating the successes of the past year. Our exhibitors have new and innovative solutions to show. Our sponsors are making it possible for us to have the most memorable Cardware in history. Thank you for investing in your future and ours. We apply the profits from each conference to support you and the market throughout the entire year.

Just a last note: dress code at the party is jeans and there is a herd of reindeer - but you'll have to be there to know what that's all about! See you at Cardware.

2. SUBWAY'S CANADA STORES GO CONTACTLESS
Source: Contactless News (04/30)

Participating Subway restaurants in Canada will soon be accepting Visa's contactless payWave cards. Chase Paymentech, the merchant acquirer of record for Subway in Canada, will handle the implementation and provide support for the contactless terminals.

"We are looking forward to the opportunity to understand the impact of contactless on speed of service as well as understanding how many of our customers take advantage of this payment method," said Marina O'Rourke, director of Retail Technology at Subway World Headquarters.

The deployment of Visa payWave enabled Visa cards and POS terminals is aligned with Visa's migration to chip card technology in Canada. Visa employs a layered approach to its fraud prevention efforts, including technology on the card itself as well as on Visa's processing network to help heighten security efforts.

The Subway restaurant chain is the world's largest submarine sandwich franchise, with nearly 31,000 locations in 89 countries, including more than 2,400 in Canada.

Visa Canada is a member of ACT Canada; please visit http://www.visa.ca.

Want to learn more about the merchant point of view? Join us June 17-18 at Cardware 09: Payment Insights for the "Canadian Merchants: what will it take to turn them into partners" session.

Are you a merchant looking for information on EMV, Contactless & Mobile payments? Join us at Cardware 09: Payment Insights for the Merchant track - 2 days filled with the information you need now. See our web site for details on special registration incentives for retailers.

Visit http://www.actcda.com/calendar/symposium.htm for conference details & agenda.

3. DYNAMIC CARD SOLUTIONS RELEASES NEW CONTACTLESS PERSONALIZATION PLATFORM
Source: Source: Contactless News (05/20)

Dynamic Card Solutions has launched a new contactless personalization platform-the CardWizard Perso-to-Go-that enables financial institutions to instantly personalize mobile devices, fobs and contactless stickers at the branch level for NFC payments.

Using this new platform, branch personnel can securely personalize any contactless form factor-whether it is an embedded NFC chip on a mobile device or provided as a contactless sticker from a manufacturer, such as First Data's GO-Tag or Oberthur Technologies' FlyBuy sticker, that can be affixed to a mobile phone, MP3 Player, PDA or key ring. No over-the-air personalization is required, and because Perso-to-Go supports instant activation, the personalized device can be immediately used for contactless purchases.

The technology also meets worldwide security requirements for EMV specifications and complies with all Visa and MasterCard security recommendations.

Current CardWizard customers can simply upgrade their existing card issuance system to support the Perso-to-Go platform. Alternatively, the system can be implemented independent of a card issuance program and used solely for mobile payment personalization.

Dynamic Card Solutions is a member of ACT Canada and an exhibitor at Cardware 09: Payment Insights; please visit http://www.instantissuance.com.

4. EMV TAKES AIM AT U.S. - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section.
http://www.actcda.com/members-only/members-only-news/

If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.

5. MASTERCARD WORLDWIDE SAYS ALL CHIP-BASED PAYMENT PRODUCTS MUST BE DPA-PROTECTED BY CRYPTOGRAPHY RESEARCH
Source: SecureID News (05/14)

MasterCard Worldwide and Cryptography Research announced an agreement that ensures future chip-based MasterCard payment products will be licensed by Cryptography Research and thus secured against Differential Power Analysis (DPA) attacks.

Cryptography Research identified the smart card vulnerability known as DPA and then patented countermeasures to protect chips against the attack. The company has been working to encourage semiconductor manufacturers and chip card suppliers to sign license agreements (and pay license fees) for products utilizing DPA countermeasures. To date, three of the six largest smart card chip manufacturers - Infineon, Renesas and NXP - have signed license agreements.

Until today, the licensees have come from the supplier side of the smart card value chain. This announcement with MasterCard represents the first reversal of this arrangement whereby a downstream entity (i.e. a payment association, card issuer, end user) has publicly mandated the use of DPA-licensed products. This puts pressure upstream forcing companies that supply chips and cards to MasterCard-issuing banks to be licensed.

In the announcement, MasterCard's Christian Delporte said, "The new requirements and rigorous testing provide enhanced assurances to our smart cards and devices."

"The agreement covers all smart cards and as well as other types of payment devices using a security chip," Cryptography Research's Kit Rodgers told SecureIDNews, suggesting that EMV contact cards, contactless cards, and even mobile handsets with a SIMs would be covered. "These devices need strong security including DPA countermeasures and MasterCard is acknowledging that our portfolio of protections is crucial."

Will this trend continue throughout the payment industry and even into other industries? While many do not have a centralized entity such as MasterCard to mandate behavior, nearly every card-issuing industry has some organization, association, or body that at least influences or recommends security best practices.

MasterCard Canada is a member of ACT Canada; please visit http://www.mastercard.ca.

6. NXP AND GIESECKE & DEVRIENT LAUNCH CONTACTLESS FAST PAY SOLUTION
Source: ICMA News (05/14)

NXP and Giesecke & Devrient (G&D) announced the introduction of NXP's new Fast Pay contactless security chip and a new line of G&D contactless payment devices based on this IC. Fast Pay-based devices have been specifically designed to provide consumers in the USA and Canada with a convenient and swift contactless payment solution - replacing the need for cash and reducing transaction times.

In 2008 alone, over 70 million contactless smart cards were issued in the USA and this annual number is expected to rise to 100 million over the next 3 years. Combining G&D's strong position within the North American smart card market and NXP's leadership in security and contactless semiconductor technology, the new chip will be widely used for contactless payment applications, such as in G&D's Visa® payWave and MasterCard® PayPass™ cards. The EMVCo approved chip offers best in class contactless performance and its Data Encryption Standard (DES) hardware co-processor provides strong security and fast transaction times, all packaged within a small footprint.

NXP is a member of ACT Canada and Giesecke & Devrient is a member of ACT Canada as well as a sponsor and exhibitor at Cardware 09: Payment Insights; please visit http://www.nxp.com & http://www.gi-de.com.

Looking for the latest news on contactless payments or the migratory effects of fraud? Join us for Cardware 09: Payment Insights, June 17-18.

Visit http://www.actcda.com/calendar/symposium.htm for conference details & agenda.

7. EPC & GLOBALPLATFORM SIGN MOU ON MOBILE CONTACTLESS PAYMENTS - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section.
http://www.actcda.com/members-only/members-only-news/

If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.

8. FEDS WON'T DELAY PASSPORT REQUIREMENT TO CROSS CANADIAN BORDER
Source: Hearst Newspapers (05/20)

Homeland Security Secretary Janet Napolitano said she would halt delays in implementing the Western Hemisphere Travel Initiative, which requires Americans and Canadians to present passports or other secure documents proving citizenship before crossing the U.S. border with Canada.

"This is a real border," Napolitano said at a breakfast meeting with reporters. "The law is the law and it's not going to be postponed anymore."

The new requirements are set to take effect June 1 for all citizens of the United States, Canada, Mexico and Bermuda -- who previously were allowed to travel between their countries without stringent proof of identity.

Similar rules for air travelers went into effect in January 2007, but the regulations for land crossings and sea entries were delayed because of a massive backlog of passport requests in the months leading up to the air travel changes.

Napolitano displayed little sympathy for those who have "procrastinated" and said "we know there will be some who will be caught by surprise." The Homeland Security chief said the State Department is gearing up to make sure it is "staffed appropriately if there is a surge" in last-minute passport paperwork.

"We have done everything humanly possible to give this thing a soft landing," she said.

The Western Hemisphere Travel Initiative, first suggested as a security recommendation of the bipartisan 9/11 Commission, requires all citizens "to have a passport or other accepted document that establishes the bearer's identity and nationality to enter or depart the United States from within the Western Hemisphere."

U.S. citizens will be required to carry a U.S. passport or passport card, a valid "trusted traveler program" card, an enhanced driver's license, a military ID accompanied by official travel orders or a U.S. merchant mariner document. Canadians must meet similar requirements. Children under the age of 16 without passports will also be able to present a birth certificate or other proof of citizenship.

9. CHICAGO RTA LOOKS INTO RIDERS USING CELL PHONES INSTEAD OF TICKETS OR TRANSIT CARDS - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section.
http://www.actcda.com/members-only/members-only-news/

If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.

10. GEMALTO ACQUIRES MOBILE SOFTWARE SOLUTION PROVIDER O3SIS
Source: Gemalto (05/26)

Gemalto announced that it has completed the acquisition of O3SIS from its founders and funds managed by Duke Forest. The terms of the transaction were not disclosed.

The personal data of each mobile phone subscriber has become a key social feature of the subscription model. Such data, that includes personal contact, photos, mail and other multimedia content has created and reinforced an emotional bond between the end-user and its phone. It is also a real asset for the mobile network operator in its drive to develop its relationship with its subscribers. Personal Data Management is one of the most successful mobile services currently deployed in the wireless ecosystem.

O3SIS AG is a leading provider of carrier grade Personal Data Management solutions to Mobile Network Operators. With more than one billion personal data records managed and more than 300 devices supported, including popular devices such as the iPhone, the G-Phone and Blackberries, O3SIS' software suite allows consumers on the move to access and share any kind of personal data - contacts, email, multimedia content - wherever its location in the mobile equipment or in the cloud. O3SIS also provides the "push email" technology used to notify and transfer email to any mobile subscriber's device regardless of the storage place. O3SIS, which is based near Cologne, Germany, counts over 20 blue-chip customers including tier-one operators, retailers and large enterprise customers.

Gemalto is a member of ACT Canada as well as a sponsor at Cardware 09: Payment Insights; please visit http://www.gemalto.com.

Looking for new business models related to mobile payments? Join us for Cardware 09: Payment Insights, June 17-18.

Visit http://www.actcda.com/calendar/symposium.htm for conference details & agenda.

11. G&D UNVEILS SECURE ID SYSTEM FOR BLACKBERRY USERS
Source: SecureID News (05/08)

Giesecke & Devrient (G&D) is launching a security product for users of the BlackBerry Enterprise Solution. G&D's Mobile Security Card integrates with BlackBerry Device Software 5.0, which is planned for launch later this year, and provides customers with an independent cryptographic module that authenticates users and also encrypts information sent to and from a BlackBerry smartphone.

The BlackBerry Enterprise Solution gives mobile users secure access to their email, calendar, address book, tasks and notes as well as enterprise instant messaging, Web-based applications and services (intranet) and other corporate applications.

For authorities and companies with special security requirements, G&D has extended its existing range of services to include a new solution which can be integrated in any organization's IT procedures. It provides additional encryption for mobile e-mail - along the entire transmission route between senders and receivers.

Users simply insert the G&D Mobile Security Card into the microSD card slot of their BlackBerry smartphone. In addition to providing usable data memory of at least 1 GB, the Mobile Security Card also contains an efficient smart card chip as an alternative to external smart cards.

The Mobile Security Card can act as an independent cryptographic module and takes over the function of user authentication and all encryption and signature operations. Users authenticate themselves to the Mobile Security Card by means of a two-factor process and, if successful, are then granted access to their BlackBerry smartphone.

The card can also be integrated into the customer's mail server environment to provide user-friendly encryption and signature services for e-mail traffic. The data stored on a BlackBerry smartphone's in-built memory can also be encrypted with the help of G&D's Mobile Security Card.

Giesecke & Devrient is a member of ACT Canada as well as a sponsor and exhibitor at Cardware 09: Payment Insights; please visit http://www.gi-de.com.

12. MASTERCARD TO BRING MONEYSEND TO U.S. MOBILE DEVICES
Source: AppScout.com (05/14)

MasterCard announced that it will launch its Mobile MoneySend on-demand payment system in the U.S. later this month, according to FierceMobileContent.

What's that? It will enable banks to let their customers send and receive funds via SMS, the mobile Web, or downloadable mobile and PC applications, by linking their mobile phone number to a Bancorp-MasterCard prepaid card, the report said. MasterCard and Obopay developed the system together; it's already in use in 17 other countries, mostly in the Asia-Pacific region.

MasterCard has been pushing the use of mobile devices lately. Last month, the company announced ATM Hunter, an iPhone app that lets customers find nearby ATMs by keying in their address, airport code, or (if so equipped) automatically via the iPhone 3G's built-in GPS radio. There's also PayPass (pictured), a mobile payment trial the company ran a while back in NYC, and later, Dallas and some other cities.

MasterCard Canada is a member of ACT Canada; please visit http://www.mastercard.ca.

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.