ACTion Newsletter

February 28, 2010

Welcome to the February edition of ACTion News. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please email your request to andrea(AT)actcda.com.

IN THIS ISSUE:
1. Editorial Comment
2. Commissioner Of Competition Announces Decision Re. Interac's Request To Vary Consent Order
3. EMV Hack May Be Overstated
4. Canadian Mobile Operators 'Plan To Introduce NFC Handsets Within The Year'
5. Big U.S. Telcos & Banks Pursue M-Payment Separately - Members Only
6. Visa & DeviceFidelity Collaborate To Accelerate Adoption Of Mobile Contactless Payments
7. INSIDE Contactless Releases Open-Source NFC Protocol Stack
8. CIBC Launches Mobile Banking For iPhone
9. Giesecke & Devrient + Toro Develop Innovative Offering For Mobile Financial Applications
10. Nokia Kills Its First NFC SIM Phone - Members Only
11. Gemalto Integrates DESfire Transport Card Into NFC Mobile Phone
12. NBS Technologies Introduces Re-PIN Application For Its Instant Card Issuance Chip/EMV Software
13. Interac Certifies New Ingenico Payment Device As Safest For Unattended & Petro Payment Terminals
14. Barclaycard Unveils Mobile Phone Payment Terminal - Members Only
15. INSIDE Achieves First Commercial Deployment Of Its NFC Technologies
16. Mobile Contactless Payments Trialled Live At Mobile World Congress 2010

ACT Canada Partners:

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS:

GENERAL
Carlson Marketing ~ new member
MSC ~ new member
NXP ~ member since 2006

RETAIL
Imperial Oil ~ new member

CALENDAR OF EVENTS:

Smart Card Alliance 2010 Annual Conference
May 17 - 20, 2010
The Camelback Marriott Resort and Spa
Scottsdale, AZ, USA
Visit http://www.smartcardalliance.org

ACT Canada presents Cardware 2010: Payment Insights
June 22-23, 2010
Sheraton Fallsview, Niagara Falls, ON, Canada
50% of the booth space is now reserved
Visit http://www.actcda.com/calendar.html

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (02/26)

2010 Olympics and the Canadian Psyche

I had an editorial on consumer drivers all ready to go, but then I watched the opening ceremonies of the Vancouver Olympics. With the eyes of the world currently focused on Canada, it seems appropriate to take this opportunity to comment.

As my husband and I started to watch the opening, we wondered what Canada would say to the world about who we are. After all, one of the benefits of hosting the Olympics is the ability to speak to the world via the opening and closing ceremonies and throughout the games.

Several years ago, a leading Canadian brewery ran a brilliant ad campaign called, "I am Canadian". It is still fondly remembered by most Canadians because it set straight a number of misperceptions held by our friends in the USA. We have more in common with them than we have differences, but the single biggest distinction was stated in the opening ceremony in three simple words, "We are Canadian". It isn't the "Canadian", but rather the "we", that sets us apart. "We" are a collective. The world views this as socialism, and although that term is devalued by some, being a part of a supportive society is a wonderful way to live.

I know what it was like before we had socialized medical care. I know from my father what it is like when you don't have a tax funded fire department to respond when your home is burning. In fairness, I know that Canadians would like to pay less in taxes, as is human nature, but this system of everyone contributing so that everyone can benefit works for us.

Every country has its own strengths. I believe that this is our greatest. We are Canadian.

2. COMMISSIONER OF COMPETITION ANNOUNCES DECISION IN RESPONSE TO INTERAC'S REQUEST TO VARY CONSENT ORDER
Source: Competition Bureau (02/12)

The Interac Association requested that the Commissioner of Competition consent to vary a 1996 Consent Order to allow Interac to restructure from a not-for-profit association structure to a for-profit model.

The Consent Order (Director of Investigation and Research v. Bank of Montreal et. al.) was issued by the Competition Tribunal to prevent Interac from engaging in anti-competitive practices designed to substantially lessen competition. Since its implementation, the Consent Order has promoted competition and, in particular, increased consumer choice.

Recognizing the importance of the debit market to Canadians, the Bureau conducted a comprehensive assessment of Interac's request. This included obtaining information from Interac and other market participants, as well as consultations with a number of subject matter experts.

Based on currently available information, including Interac's current dominant position in the market, the Bureau cannot support changing or removing the safeguards in the Consent Order, which are effective in protecting consumers from potentially anti-competitive activity. In particular, the Bureau does not agree that the removal of the restriction against for-profit activities by Interac would be pro-competitive, or is necessary to allow Interac to remain competitive.

To provide Interac with greater flexibility to respond to any material entry in the future by a competitor, the Bureau also evaluated other changes to the governance structure and corporate status of Interac. Those changes would allow Interac to continue as a not-for-profit corporation with independent directors. The Bureau has concluded that such changes would be acceptable, as they would maintain the necessary safeguards against anti-competitive activity that are contained in the Order.

While the Bureau will not support an application to vary the Consent Order at the present time to remove the restriction against for-profit activities by Interac, the Commissioner is prepared to re-examine Interac's request in the future if there is new information or material changes in the marketplace, or if Interac advances an alternative proposal, all provided that any changes would preserve the effectiveness of the key elements of the current Consent Order.

The Competition Bureau is an independent law enforcement agency that contributes to the prosperity of Canadians by protecting and promoting competitive markets and enabling informed consumer choice.

Interac Association is a member of ACT Canada; please visit http://www.interac.ca.

3. EMV HACK MAY BE OVERSTATED
Source: SecureID News (02/15)

Researchers at the University of Cambridge in the UK released a report claiming to have identified vulnerabilities with the EMV payment scheme. Industry organizations are meanwhile defending the technology, saying the hack would be difficult to pull off in the real world.

The attack uses a fake chip card connected with wires to custom electronics, a computer with specially designed software, and a stolen EMV chip & PIN card. The fake card and equipment sit between the stolen card and the point-of-sale terminal; the attack fools the terminal into thinking that the correct PIN had been presented and makes the stolen card believe that no PIN was required.??

The Smart Card Alliance has reviewed the hack along with other industry organizations and concluded that widespread implementation of this attack is unlikely and that there is no evidence that the attack described has happened in the real world.

These conclusions are supported by the following points:

- The attack requires the use of a stolen EMV card that has not yet been reported as stolen; this limits the scalability of this type of fraud since it must be done with one card at a time and in a potentially short window of time.
- The combination fake card and stolen chip & PIN card cannot be used in an ATM for a cash withdrawal, as ATMs rely on an online PIN verification.
- The fraud requires using a fake chip card with wires coming out of it, running up the sleeve of the fraudster and connecting to a hidden circuit board, computer and stolen EMV card, making detection likely at an attended merchant point-of-sale.
- The attack is technically difficult, requiring highly sophisticated software and customized hardware that could only be created by individuals with extensive knowledge of EMV protocols.
- Countermeasures are already available, either in EMV, within payment system products and networks, or within issuer host systems.
- Electronic audits of data from suspected transactions would protect cardholders and merchants from responsibility for fraudulent charges made to their card with this type of attack, if reported properly.

Additionally, such an attack would not compromise the smart card as the PIN would still remain secure inside the card.

4. CANADIAN MOBILE OPERATORS 'PLAN TO INTRODUCE NFC OR CONTACTLESS HANDSETS WITHIN THE YEAR'
Source: NearFieldCommunicationsWorld.com (02/17)

EnStream, the joint venture between Canada's three leading mobile operators which operates the Zoompass mobile wallet service, aims to offer NFC or contactless enabled handsets to customers within the year, the company has told NFC World.

Launched by Bell Mobility, Rogers and Telus in June 2009, customers can currently load funds into their Zoompass account via their bank account or credit card and then use their phone to send and receive money, including between friends and family, check their balance and review their transaction history.

Zoompass customers can also apply for a Zoompass Prepaid MasterCard, issued by Peoples Trust. This lets them make purchases at any MasterCard-accepting merchant and have the cost of the transaction automatically debited from their Zoompass account.

EnStream added support for Android devices to Zoompass this week and, the company told NFC World, "Zoompass registrations are rising month over month especially among smartphone users due to the integrated, rich and intuitive user experience offered by the Zoompass application."

5. BIG U.S. TELCOS & BANKS PURSUE M-PAYMENT SEPARATELY - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section
http://www.actcda.com/members-only/news.htm

If you are a member of ACT Canada but do not have your login details please contact me - andrea(AT)actcda.com

6. VISA & DEVICEFIDELITY COLLABORATE TO ACCELERATE ADOPTION OF MOBILE CONTACTLESS PAYMENTS
Source: Visa Inc. (02/15)

Visa Inc and DeviceFidelity Inc. announced plans to market an innovative solution that can enable a mobile phone with a memory card slot to be used as a Visa mobile payment device.

The solution combines Visa's contactless payment technology, Visa payWave, and DeviceFidelity's In2PayTM technology to transform a mobile phone with a microSD memory slot into a mobile contactless payment device. This can enable consumers to make mobile Visa payWave transactions at any retail location that accepts contactless payments. Trials are scheduled to begin in the second quarter of 2010.

The In2Pay solution conforms to the industry standard for memory chips, microSD, and fits into the memory card slot found in many existing mobile devices in market today.

In2Pay integrates seamlessly with multiple mobile phone operating systems, enabling a flexible application interface and interactivity with the consumer. In2Pay uses an onboard software controlled antenna and an industry standard dual interface contactless smart card chip that supports Visa payWave, as well as other contactless applications popular with consumers such as transit, identification and access control.

Visa Canada is a member of ACT Canada; please visit http://www.visa.ca.

7. INSIDE CONTACTLESS RELEASES OPEN-SOURCE NFC PROTOCOL STACK
Source: Payments News (02/03)

INSIDE Contactless has announced it is making its Open NFC commercial-grade NFC protocol stack available in a free and open source edition under the Apache License, Version 2.0. According to the company, "INSIDE's Open NFC 3.4 is available now for WinCE 6.0 (compatible with Windows™ Mobile 7) and Linux 2.6 platforms, and an Android implementation will premier with the planned release of Open NFC 3.5 at the end of March."

The Open NFC protocol stack provides a complete NFC middleware solution for mobile phones, embedded products and other devices. Open NFC supports several levels of functionality, from low-level RF control to high-level NFC Forum tag handling, peer-to-peer communications as well as Bluetooth and Wi-Fi pairing, interactions with single-wire protocol SIMs and other secure elements and compatibility with smart cards and RFID tags based on Felica, Mifare and ISO 14443 standards.

INSIDE Contactless is a member of ACT Canada; please visit http://www.insidecontactless.com.

8. CIBC LAUNCHES MOBILE BANKING FOR IPHONE
Source: Payments News (02/02)

CIBC has announced that its CIBC Mobile Banking App is now available from the iPhone App Store - saying it "offers greater flexibility and choice for CIBC clients to bank on the go by becoming the first major bank in Canada to offer a mobile banking App for iPhone. The App gives CIBC clients the flexibility to use their iPhone or iPod touch to check account balances, transfer funds, pay bills and even send INTERAC Email Money Transfers."

Interac Association is a member of ACT Canada; please visit http://www.interac.ca.

9. GIESECKE & DEVRIENT AND TORO DEVELOP INNOVATIVE OFFERING FOR MOBILE FINANCIAL APPLICATIONS
Source: Giesecke & Devrient (02/15)

Toro Development Ldt. and Giesecke & Devrient are working together to develop a cutting-edge offering for mobile financial applications based on G&D's Mobile Security Card and TORO's Akami mobile platform. Both companies are contributing their respective expertise in hardware, firmware, middleware, mobile software, and system architecture to create a platform offering system integrators, financial service providers, and retailers fast time to market for a proven secure mobile solution.

This new offering addresses the booming market of secure applications on mobile phones. It brings to the market a series of stand-alone solutions for secure applications that will not necessarily evolve toward near-field communication (NFC), such as mobile banking, mobile remittance and mobile ATM.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

10. NOKIA KILLS ITS FIRST NFC SIM PHONE - Members Only Access

11. GEMALTO INTEGRATES DESFIRE TRANSPORT CARD INTO NFC MOBILE PHONE
Source: Gemalto (02/15)

Gemalto announced a new solution enabling commuters to use their mobile phones as e- tickets in MIFARE DESFire infrastructures. Gemalto achieved the world's first implementation of a transport application compliant with the DESFire specifications in a SIM or UICC card.

This innovation will enable commuters to use their NFC mobile phone as an e-ticket, as simply as any other contactless travelcard. A high level of security is ensured, as the tickets are stored in the SIM card and the application meets the stringent security requirements of the DESFire specifications.

NFC technology in transport dramatically enriches the commuter experience by adding the mobile phone's keypad and screen to the travelcard and by connecting it to the online world. NFC-based services are part of Gemalto's Trusted Services Management (TSM) dedicated offering of solutions and services. It enables transport operators to offer travelers the ability to purchase and recharge their transport tickets, with the convenience of the mobile phone.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

12. INTERAC CERTIFIES NEW INGENICO PAYMENT DEVICE AS SAFEST FOR UNATTENDED & PETRO PAYMENT TERMINALS
Source: Ingenico (02/25)

Ingenico announced the Canadian certification of their fuel and unattended hardware device Ingenico OrSPT by the Interac Association Device Certification Program which will be sold and distributed under the name of the i9780UPT in North America. It is the safest alternative to existing solutions for fuel stations and harsh outdoor unattended environments in Canada.

According to the certification, the i9780UPT meets or exceeds the stringent Interac Association Chip Unattended compliance requirements, PCI PED and EMVCo L1 and L2 security standards.

"The Interac's certification of our i9780UPT as the most secure alternative to current fuel stations and outdoor payment solutions in Canada is the latest example of Ingenico's dedication to providing our Canadian customers and consumers with the highest levels of payment security," said Christopher Justice, president, Ingenico, North America. "As the innovative leader in payment solutions, Ingenico takes a strategic approach to bringing new payment terminals into the market that are fully aligned with the needs of the local marketplace."

Ingenico will start marketing the i9780UPT terminal in Canada as of March 1, 2010.

Ingenico & Interac Association are members of ACT Canada; please visit http://www.ingenico.com & http://www.interac.ca.

13. NBS TECHNOLOGIES INTRODUCES RE-PIN APPLICATION FOR ITS INSTANT CARD ISSUANCE CHIP/EMV SOFTWARE
Source: NBS Technologies (02/04)

NBS Technologies Inc unveiled its newest post-issuance re-PIN application for its highly successful Xpressi instant branch issuance software solution.

This new re-PIN application adds to Xpressi software's functionality allowing for the convenient change of PIN number for chip/EMV cards by the cardholder via web browser using secure internet access (https) or via the financial institution's local kiosk.

Xpressi instant card issuance software is NBS' software solution for the instant issuance of personalized chip/EMV cards right at the bank branch. Supporting multiple EMV/chip card configurations, chip types and even printer brands with one system, this solution gives an issuer the flexibility to keep their future expansion and operation options open for change.

NBS Technologies is a member of ACT Canada; please visit http://www.nbstech.com.

14. BARCLAYCARD UNVEILS MOBILE PHONE PAYMENT TERMINAL - Members Only Access

15. INSIDE ACHIEVES FIRST COMMERCIAL DEPLOYMENT OF ITS NFC TECHNOLOGIES
Source: BUSINESS WIRE (02/15)

INSIDE Contactless announced the first deployment of its portfolio of NFC technologies in a commercially available NFC handset. All three of INSIDE's core NFC offerings - the MicroRead NFC controller chip, the Open NFC protocol stack and the Wave-Me handset client software - are working together to enhance the user experience for the Cosyphone, a new NFC mobile phone announced by Sagem Wireless.

The Cosyphone is a stylish device that places a heavy emphasis on ergonomics and ease of use, and employs INSIDE's NFC technologies to simplify access to the phone's features. A connected lifestyle device aimed at the over 50's market, the Cosyphone enables users to make calls, send text messages or access data services such as weather or traffic information simply by waving the phone near an NFC tag or smart poster without having to navigate through more cumbersome menus.

The MicroRead chip's self-powered battery-off mode and low-power NFC tag detection features will help to improve the user experience of the Cosyphone by enabling payment or other transactions to take place successfully even when the handset is turned off or the battery is completely drained. Use of the commercial-grade Open NFC protocol stack reflects the trend toward open platforms in the mobile industry, and helps ODMs such as Sagem Wireless achieve faster time to market, lower development cost and greater flexibility.

With INSIDE's Wave-Me technology in the Cosyphone, users can access relevant, profile-based services with a simple waving gesture near an NFC tag or smart poster. This automatically simulates a complex series of keystrokes, eliminating awkward, time-consuming, multi-keystroke chores. NFC tags and smart posters may contain relevant phone numbers or complex URLs to send SMS messages or send and retrieve information from web sites.

Cosyphone will be available in early in the 3rd quarter of 2010 and will be sold through mobile network operators.

INSIDE Contactless is a member of ACT Canada; please visit http://www.insidecontactless.com.

16. MOBILE CONTACTLESS PAYMENTS TRIALLED LIVE AT MOBILE WORLD CONGRESS 2010
Source: GSM World (02/15)

GSMA, Samsung Electronics Co. Ltd., Telefónica, and Visa, together with Giesecke & Devrient, Ingenico, ITN International and La Caixa, announced the arrival of contactless mobile payments at Mobile World Congress in Barcelona this year. The companies unveiled the result of months of collaboration and have brought the first ever SIM-based NFC payments pilot to Mobile World Congress.

The participating companies have provided more than 400 NFC handsets to guests for use at the Congress. The Samsung Star NFC handsets contain Telefónica SIM cards from O2 pre-loaded with €60 airtime credit as well as a La Caixa Visa Mobile Payment Application. Participants can use their NFC phones to pay for food and drink up to a value of €75 at over 30 merchant locations around the Congress.

Participants in the trial will be able to purchase food and drink, simply by holding their Samsung NFC mobile phone against the contactless terminal at the participating merchants to pay for purchases under €10. Purchases above €10 require a passcode which the participant keys into the handset before presenting it to the terminal. The transactions are authorised online, with funds deducted from a La Caixa Visa account.

Giesecke & Devrient, Ingenico & Visa Canada are members of ACT Canada; please visit http://www.gi-de.com; http://www.ingenico.com & http://www.visa.ca.

ACT Canada is the stakeholder association, focused on secure payment, secure identity management and other advanced applications. Now in our 20th year, we are the authority on the Canadian market, supporting our members through working with key stakeholders. We help members understand the market, public and private sector applications and potential barriers. We facilitate knowledge transfer and thought leadership through a neutral forum, while expanding our members' networks. Founded in 1989, ACT Canada is a non-profit membership association. Please visit http://www.actcda.com or contact our office at 905 426-6360.

Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.

Andrea McMullen
VP, Operations
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3