ACTion Newsletter

August 31, 2010

Welcome to the August edition of ACTion News. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please email your request to andrea(AT)actcda.com.

IN THIS ISSUE:
1. 1. Editorial - In 20 years…
2. ACT Canada Announces New Issues Alert Team
3. Standard Seeks To Create More Secure PIN Entry For NFC Payment
4. U.S. Mobile Operators Plan For 2011 Launch Of NFC Payment
5. Visa And MasterCard Offer Little Response To Telco Payment Plans - Members Only Access
6. Zoompass Enhances Mobile Wallet And Makes Money Transfers Free
7. Amex Canada Sets October 2012 EMV Liability-Shift Deadline
8. Contactless Mobile Payment On The Rise In China
9. Cpv Module In Collis EMV Personalisation Validation Tool Qualified By MasterCard
10. Mobile Payments May Pose Fraud Threat, Consumer Advocacy Group Warns - Members Only Access
11. Germany Taps NXP For National Id Smart Card Chips
12. Watchdata Contactless Smart Cards Being Utilized As City Card In Southern China
13. NBS Technologies Introduces The Newest Enhancements To Horizon Evolution HD
14. Bank Of America Poised To Test MicroSD-Based Mobile Payments
15. Star Network's Answer To Chip-And-Pin Uses Contactless Technology - Members Only Access

ACT Canada Partners:

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS:

GENERAL
A LA CARD Marketing & Consulting Services Ltd. ~ member since 2004
American Express ~ member since 2008
CSC ~ member since 2009
HSBC ~ member since 2006
LoyaltyOne ~ member since 2008
MEI Inc ~ member since 2009
SecureKey Technologies ~ member since 2009
TechTrex Inc ~ member since 2009

GOVERNMENT
Canada Post ~ member since 2006

CALENDAR OF EVENTS:

Cardware Connections & AGM
October 25, 2010
Toronto, ON, Canada
Our next Cardware Connections Roundtable Networking event will feature guest speaker Pat Meredith, Chair of the Task Force for the Payments System Review. The roundtable questions will focus on the Canadian payments landscape. Our annual general meeting will wrap up the morning's agenda. ACT Canada members will receive further details in the coming week.
http://www.actcda.com

Smart Card Alliance 2010 Government Event
November 16-19, 2010
Washington, DC, USA
http://www.smartcardalliance.org

CARTES & IDentification 2010
December 7-9, 2010
Paris-Nord Villepinte Exhibition Centre
Paris, France
http://www.cartes.com

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (08/30)

In 20 Years…

Do you remember "boiler plate"? If the term is unfamiliar, it refers to text that can be used more than once and copied into multiple documents. We need the equivalent of boiler plate for changes to our payment system.

For the past 50 years, much of the technology that supports the payment system has been stable. Computers, databases and magnetic stripe technology allowed the financial sector to introduce new products and services at a manageable pace. Today, a tech savvy public and secure chip is changing that. Whether it is secure chips in phones, on cards or fobs, NFC or contactless - change is accelerating.

Having worked with emerging technologies throughout my entire career, I can tell you how easy it is to be excited about what you can do, but technology is such a small part of introducing something new.

A worthwhile approach to figuring out how we are going to manage change over the next 20 years is to look at it from the viewpoint of the various stakeholders. This can provide a blue print that identifies consistencies as well as changes and may allow us to build processes that add to the success and security of our payments landscape over that 20 year period.

Undoubtedly, this is 3D business chess, but we can plan to succeed.

2. ACT CANADA ANNOUNCES NEW ISSUES ALERT TEAM
Source: ACT Canada (08/31)

As advanced applications such as secure payment and identity management enter the Canadian market, there will be issues. To assist the members of ACT Canada and the market in general, an Issues Alert team has been formed. It is open to all members of the association.

This is a neutral forum where members can exchange non-competitive information about technology issues, and with the assistance of ACT Canada, pursue solutions. Members may make ACT Canada aware of emerging issues and the association will then determine whether a team meeting is needed.

Catherine Johnston, President & CEO, stated at the inaugural meeting, "I hope that we rarely need to meet, but when we do, I believe that we can all benefit from pooling our knowledge to overcome issues that are inevitable with change."

For more details about ACT Canada; please visit http://www.actcda.com.

3. STANDARD SEEKS TO CREATE MORE SECURE PIN ENTRY FOR NFC PAYMENT
Source: NFC Times (08/13)

A new specification from GlobalPlatform seeks to standardize applications securing PIN entry on NFC phones.

With viruses on smartphones an ever-present worry, some are not convinced it's safe to allow consumers to enter PIN codes on handset keypads, which could be spied upon by fraudsters.

So some banks are requiring users in trials, such as one now going on in Spain, to enter their PINs on point-of-sale terminal keypads, which are then compared with PINs stored on the backend. Some NFC trial organizers don't allow high-value transactions at all.

And while most banks and payment companies likely will want to enable PIN entry on the NFC handset to ensure the user experience is consistent, they might follow the lead of French banks, which in NFC pilots have renamed the PIN as the "personal code." Although the banks emphasize that this code is different from the PINs used by customers for their French debit cards, it does not avoid the potential risks of an insecure phone keypad.

But vendors have been developing hardware and software that could provide a trusted area right on the phone processor, which could store encryption keys, certificates and other security measures.

This so-called "trusted execution environment" would add security features to help safeguard PIN entry on the phone keypad and also deter hackers from spying on transaction data displayed on the handset screen. It could offer a security boost for a range of other applications, including enabling secure access through corporate virtual private networks or digital rights management for games or music, among a range of services in app stores of the various smartphone makers.

"The picture is very clear, you will have a smartphone in your pocket; you will have a rich OS (operating system), and there is a real need for security whatever the OS," Gil Bernabeu, technical director for GlobalPlatform, told NFC Times. "Currently, the Apple and RIM (BlackBerry maker Research in Motion) and Android stores, those guys are making applications with no security."

GlobalPlatform is developing specifications that apply to software and hardware that use the trusted execution environment in phones. The specifications are for the application programming interface, or API, for applications that run in this trusted environment. The API would enable developers working with various smartphone operating systems and chips to develop applications across all the platforms. Their products now remain proprietary.

While most trusted execution environments on phones use a secure area called TrustZone by UK-based chip design company ARM Holdings, TrustZone ties into different operators systems, such as BlackBerry OS and Android. There are also different phone processor chip makers and also at least two major providers of software platforms for applications using TrustZone and the trusted execution environment-smart card vendor Giesecke & Devrient and Trusted Logic, owned by smart card maker Gemalto.

These specs will not only be used for NFC applications, and mobile operator group, the Open Mobile Terminal Platform, also worked on the specifications. The group is now known as the Wholesale Applications Community, or WAC.

There is also a need for a secure connection from the trusted execution environment to the secure element or secure chip in the NFC phones, which would store the actual keys to the payment applications and the customers' PIN codes. This chip could be on a SIM card, embedded in the handset itself or located elsewhere, such as in a microSD card inserted in the phone.

4. U.S. MOBILE OPERATORS PLAN FOR 2011 LAUNCH OF NFC PAYMENT
Source: NFC Times (08/02)

U.S mobile carriers Verizon, AT&T and T-Mobile USA hope to launch precommercial trials of their planned mobile-payment service in the third quarter of 2011, sources told NFC Times.

The precommercial launches, in perhaps three to four cities, could use the Zip contactless payment application from Discover Financial Services, stored on either SIM cards or embedded chips in the phones, sources said. Bridge technologies, such as contactless microSD cards, are also possible in addition to the NFC phones. An internal trial of the service could launch in the spring of 2011, though the planning for this and the precommercial launches remains fluid.

As Bloomberg financial news service reported today, the U.S. arm of UK-based Barclays bank would be involved in project as the banking partner. Discover would provide the merchant network.

That follows reports by NFC Times earlier this year of the joint venture among the three telcos and plans to launch a mobile payment service or their own payment scheme. Sprint was earlier involved in the project, as NFC Times first reported in February, but has dropped out. Representatives from the telcos and their expected partners continue to decline comment.

Discover has been seen as a likely partner since it has almost as much merchant penetration as Visa Inc. and MasterCard Worldwide in the U.S., both in terms of total merchant coverage and merchants equipped to take contactless payment from either cards or NFC phones. A relatively small percentage of total card-accepting merchants in the U.S. accept contactless so far, however.

5. VISA AND MASTERCARD OFFER LITTLE RESPONSE TO TELCO PAYMENT PLANS - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section
http://www.actcda.com/members-only/news.htm

If you are a member of ACT Canada but do not have your login details please contact me - andrea(AT)actcda.com

6. ZOOMPASS ENHANCES MOBILE WALLET AND MAKES MONEY TRANSFERS FREE
Source: PR.com (07/30)

EnStream LP, Canada's leading mobile commerce company, announced that domestic person-to-person (P2P) money transfers are now free through the Zoompass Mobile Wallet. By removing the fees on domestic money transfers and increasing sending limits, the Zoompass Wallet brings us a step closer to realizing the vision of a cashless society.

"There is no cost to consumers for transacting with cash today, so in this sense we feel it's appropriate for us to remove the P2P transaction fees for the same transaction that could be done electronically through the Zoompass Mobile Wallet," said Robin Dua, President of EnStream LP.

"By removing the P2P fees when sending funds from a Zoompass account, we open up a whole new market opportunity associated with micro transactions," said Dua. Zoompass users can now pay back friends for a coffee, lunch or even the office lottery pool without incurring any fees. These everyday transactions can now be done electronically, more conveniently and at no cost via the Zoompass Mobile Wallet.

With recent changes to account limits, Zoompass Wallet users can also use the service for larger transactions. Zoompass users can now pay their nanny, send money to their kids off at university, or pay for their hockey league team dues all with just a few keystrokes on their mobile phone.

EnStream is a partnership of Canada's leading wireless carriers, Bell, Rogers, and TELUS. The company launched the award-winning Zoompass Mobile Wallet in 2009 and began offering Canadians a revolutionary way to send, receive, and request money using the mobile phone.

7. AMEX CANADA SETS OCTOBER 2012 EMV LIABILITY-SHIFT DEADLINE
Source: PaymentsSource (08/26)

Beginning Oct. 31, 2012, issuers, merchants and acquirers in Canada that support the American Express brand will become liable for credit and charge card fraud initiated with magnetic stripe cards that chip-and-PIN technology could have prevented, American Express Co.'s AmEx Canada confirms.

AmEx is the last major card network to set a card-fraud liability deadline in Canada. AmEx will be introducing the policy to address the avoidance of fraud at both point-of-sale devices and cards.

Beginning Oct. 1, Canada's Visa merchants, acquirers and issuers that have not converted to chip-and-PIN technology may become liable for fraudulent transactions that EMV could have prevented; MasterCard's deadline is Oct. 15.

Most merchants likely will not have to make dramatic changes to comply with AmEx's deadline, Catherine Johnston, president and CEO of ACT Canada, a nonprofit payments-industry association, tells PaymentsSource.

"Most companies have already been through the learning curve on EMV because of the Visa and MasterCard deadlines, and there will be minimal changes in what AmEx requires," Johnston says.

Nevertheless, merchants also are likely to be pleased to receive EMV guidance from AmEx, Johnston adds. "This should bring a sigh of relief to merchants who were wondering what they might have to do about AmEx, and now they have some clarity," she says.

By the end of this year, more than half of Canada's 800,000 merchant-acceptance points will be EMV-compliant, and approximately 70% of the country's estimated 105 million credit and debit cards will be equipped with chips, according to the association.

American Express is a member of ACT Canada; please visit http://www.americanexpress.ca.

8. CONTACTLESS MOBILE PAYMENT ON THE RISE IN CHINA
Source: ICMA Industry News (07/29)

The mobile payment market in China is expected to grow dramatically in the next two years, with the number of users exceeding 100 million by 2011, according to The Global Times.

IT research firm Analysis International reports that last year there were 72.8 million mobile payment subscribers in China, of which only 27.16 million used NFC-enabled contactless payment. This year, however, that latter number is expected to nearly double to 49.16 million contactless users, pushing the whole mobile payment community past 100 million.

According to analyst Li Wei, last year, the mobile payment market in China was worth $293 million. This year it is expected to jump to $441 million, and 2011 could see a further increase to $771 million.

9. CPV MODULE IN COLLIS EMV PERSONALISATION VALIDATION TOOL QUALIFIED BY MASTERCARD
Source: Collis (08/31)

Collis is very pleased to announce that the latest CPV version 3.3 module in the Collis EMV Personalisation Validation Tool (PVT) has been qualified by MasterCard.

The Collis EMV PVT is up-to-date with the latest version of specifications from MasterCard. Professional testing of personalised MasterCard EMV/PayPass™ cards is essential to ensure global acceptance of cards. Collis' newly developed CPV module checks if MasterCard cards are correctly personalised according to the latest MasterCards's specifications.

The new MasterCard CPV 3.3 module ensures compliance with the following MasterCard standards:

M/Chip Requirements - March 2009
M/Chip Personalization Data Specifications and Profiles - June 2009
PayPass Personalization Data Specifications - July 2009
M/Chip Card Personalization Standard Profiles - February 2010 (M/Chip and PayPass).

These standards have been regrouped by MasterCard in the version 3.3 of the CVP Test Requirements. According to the MasterCard specifications release cycle, no update of these requirements is anticipated before end 2010.

The CPV module within the Collis EMV PVT enables issuers of MasterCard cards to speed up their personalisation process and reduce their time-to-market. The Collis EMV PVT, with the MasterCard CPV 3.3 module, maintains its status as the most thorough, comprehensive testing tool available in the market today.

Both Collis and MasterCard Canada are members of ACT Canada; please visit http://www.collis.nl & http://www.mastercard.ca.

10. MOBILE PAYMENTS MAY POSE FRAUD THREAT, CONSUMER ADVOCACY GROUP WARNS - Members Only Access

11. GERMANY TAPS NXP FOR NATIONAL ID SMART CARD CHIPS
Source: SecureIDNews (08/23)

NXP Semiconductors announced that its SmartMX secure contactless microcontroller chip has been chosen to power the new German contactless National Identity card.

The German government has selected NXP as the supplier of an inlay solution containing a SmartMX chip, packaged in an ultra-thin module. Issuance of German contactless ID cards, which will replace the current paper-based IDs, will start in November. More than 60 million cards are expected to be rolled out over the next ten years.

Equipped with a new communication protocol, the contactless ID card will enable secure e-government and e-commerce services while protecting against identity theft and identity tracking. Only trustworthy service providers will be able to access ID card data once authorized by the citizen, ensuring privacy, as well as authenticity of data for service providers.

NXP is a member of ACT Canada; please visit http://www.nxp.com.

12. WATCHDATA CONTACTLESS SMART CARDS BEING UTILIZED AS CITY CARD IN SOUTHERN CHINA
Source: Watchdata (08/13)

Watchdata, one of the leading data security and smart card technology solutions providers in the world becomes the contactless smart card vendor of choice for Wuhan City, a southern transport traffic hub in Chinawith nearly 10 million citizens.

By waving their Wuhan City Card before the card readers, the citizens will enjoy the tap-and-go payment for buses, light railways, state-owned merchants, public utility, taxi, parking, library and many others within this year. All the convenience is brought by Watchdata's contactless card TimeCOS FLY that has been adopted by several cities with 10-million scale smart card projects including Singapore, Beijing, Shenzhen and many others.

Security is another reason that Watchdata's TimeCOS FLY has been adopted this time,since it has passed the highest chip security test, CC EAL5+ and the e-purse/deposittest for bankcard by the Bankcard Testing Center, the most authoritative third-party testing center inChina.

Accordingto Mr. Hu Zhiwen, Wuhan City Card is part of building a digital Wuhan City that is supposed to be an information platform for the government to gather data for their policy decisions that will ultimately benefit the people ofWuhan.

By the end of this year, 4.5 million Wuhan City Cards will be issued, with up to 500 matching top-up stations. This will undoubtedly bring much more convenience to the citizens and the cross-district economic communication in the future, which resonates with Watchdata's mission of "continuous innovation to make our lifestyles in the digital world more secure and convenient".

Watchdata is a member of ACT Canada; please visit http://www.watchdata.com.

13. NBS TECHNOLOGIES INTRODUCES THE NEWEST ENHANCEMENTS TO ITS HORIZON EVOLUTION HD
Source: NBS Technologies (08/02)

NBS Technologies Inc announced its release of two new Card Personalization Elements (CPEs) that offer enhanced capabilities to its flagship central issuance solution, the Horizon Evolution HD.

The Horizon Evolution HD is a market leading high-volume card personalization system offering state-of-the-art performance. High Speed Top Mono Printer and High Speed Bottom Mono Printer CPEs are the latest additions to its long list of current capabilities. Customers can pick and choose CPEs including high-speed colour graphic CPE, high speed split CMY Colour CPE, Laminator CPE, magnetic stripe encoding CPE, smart card encoding CPE, laser engraving CPE, tipping CPE, heavy duty embossing CPE, etc., that meet their current capacities and requirements. However, the greatest benefit to the Horizon Evolution HD design is the unique ability to add CPEs at a later date to accommodate growing and changing card personalization requirements.

Both the High Speed Top Mono Printer and High Speed Bottom Mono Printer provide the ability to print monochrome on either the top side of the card, using one CPE, the bottom side of the card, using one CPE or both sides of the card, using both CPEs, without requiring a flipper in between. This new and improved CPE design boasts a throughput of up to 1,500 cards per hour with full card coverage while ensuring the highest print quality at a price point that is unmatched. Mechanically designed to offer increased working life and reliability, the High Speed Top Mono Printer and High Speed Bottom Mono Printer CPEs are a testament to the continual improvement of Horizon Evolution HD technology.

NBS Technologies is a member of ACT Canada; please visit http://www.nbstech.com.

14. BANK OF AMERICA POISED TO TEST MICROSD-BASED MOBILE PAYMENTS
Source: PaymentsSource (08/20)

Bank of America Corp. is collaborating with Visa Inc. and DeviceFidelity Inc. on a mobile-payment program to begin next month in New York enabling consumers' smart phones to operate as contactless-payment devices, Visa confirms.

The test, using microSD chip technology integrated with a mobile payment application, is BofA's first foray into mobile contactless payments, a bank spokesperson says. The test will run through the end of the year.

Bank of America says it will issue microSD chips to consumers selected to participate in the test, providing them with an application that will act as an electronic wallet within their mobile phone, the spokesperson says. Once the phone is set up, consumers may use their phone as a payment device at merchants who accept contactless payments.

Visa says its microSD technology enables immediate point-of-sale authorization of credit and debit payments, and consumers receive confirmation on their phones a few seconds after the transaction is completed.

Visa Canada is a member of ACT Canada; please visit http://www.visa.ca.

15. STAR NETWORK'S ANSWER TO CHIP-AND-PIN USES CONTACTLESS TECHNOLOGY - Members Only Access

ACT Canada is the stakeholder association, focused on secure payment, secure identity management and other advanced applications. Now in our 21st year, we are the authority on the Canadian market, supporting our members through working with key stakeholders. We help members understand the market, public and private sector applications and potential barriers. We facilitate knowledge transfer and thought leadership through a neutral forum, while expanding our members' networks. Founded in 1989, ACT Canada is a non-profit membership association. Please visit http://www.actcda.com or contact our office at 905 426-6360.

Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.

Andrea McMullen
VP, Operations
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3