January 2016 Monthly Member Bulletin

• Executive Director’s Corner
• 2015 Center of Excellence Program
• Council Highlights
• New EMV Resources
• Upcoming CSCIP/G Training and Exam
• Register for 2016 Payments Summit
• Save the Date – Security of Things Conference
• Download the 2015 Annual Review

Executive Director’s Corner

Dear Members of the Smart Card Alliance,

January is a time for boundless optimism, when everything seems possible and concerns about troubles from the past are now an unpleasant memory.  Perhaps slightly influenced by that boundless optimism of a fresh start ahead, it’s time for some New Year’s predictions. Here I present a few of my thoughts and predictions about the payments industry for 2016. I’ll save the discussion about other smart card markets for a later newsletter.

• EMV payments normalize. The naysayers said the industry needed more time and the holiday season on the heels of the EMV fraud liability shift would be a disaster.  To the relief of many, and a surprise to some others, there were no major hiccups or meltdowns.  Nearly 70% of cardholders had at least one chip card for this holiday season, and more than a few top retail chains were activated for EMV.  It wasn’t a perfect score card, especially with some merchant categories such as grocery and hospitality lagging, but as we move further into the year, inserting your card in the terminal and removing it at the end of the transaction will be the norm in most large cities in America and the number of chip-on-chip transactions, including debit, will start to soar.
• Mobile wallets and mobile payments catch fire.  It has been nearly a decade since the first NFC stickers introduced the mobile phone as another method of payment and NFC changed contactless payments from being just a replacement for swiping a card.  Many forms of mobile wallets came and disappeared, until Apple introduced the iPhone 6 with Apple Pay, giving the market the jolt it needed – a superior user experience and the arrival of tokenization as a solution to address security and the costly and complicated provisioning problem.  Apple’s success and its market power stirred up the mobile wallet space for big players like Google/Android and Samsung to get back in the NFC game to challenge Apple with their own solutions – Android Pay and Samsung Pay. Now in 2016, consumers have choices of phones, wallets, and methods of using them, without the mobile network operators muddying up the market forces.  Add a newly refreshed retail POS market ready to support EMV and NFC, and retailers no longer laser-focused only on EMV certification, and we finally have the ecosystem and consumer interest in place to solve the chicken-and-egg problem.  While disruption and trial and error will happen, the path forward to consumers using their mobile phones at every day merchant locations is only a tap away.
• Don’t count out contactless EMV cards yet.  Many saw the banks’ choice to roll out contact EMV cards as a sign that the financial industry had lost interest in contactless.  After all, the cost of EMV cards alone was a strain on the issuer business case, consumers appeared uninspired, and big merchants were shunning NFC by lining up behind MCX exclusively.  It looked like the contactless wave had passed.  But then Apple Pay happened and consumers got interested in NFC contactless payments again.  MCX struggled and major retailers broke ranks from their exclusivity pledge to only accept CurrentC mobile payments and the prospect for higher merchant acceptance of contactless payment with both cards and NFC mobile phones became real again. EMV contact-only cardholders will have to stop swiping their way through the check-out line and start inserting their cards and waiting to check out, which is going to be a lot less convenient than tap and go.  Chip transactions are sufficiently secure that they should not require a signature about 70 percent of the time, so contactless payments with no CVM could be the norm in most cases. If the UK and Canada have taught us anything about chip cards, it is that people like using contactless if they don’t have to enter a PIN and they find issuers and merchants who support it.
• Merchants get serious about CNP fraud mitigation.  We have been hearing from experts that card-not-present (CNP) fraud is rising, and, in fact, CNP fraud is now more than 50 percent of all card fraud in the U.S.  For the last few years, merchants have focused most of their resources getting through the EMV migration to avoid the card-present fraud liability shift, which did nothing about stopping CNP fraud.  Online commerce has seen double-digit annual growth since 2012, and by 2017, it will account for 10 percent of all retail sales in the U.S.  Large online merchants like Amazon, Walmart, and Best Buy keep online fraud in check with multiple layers of fraud fighting tools, but finding the right balance between risk and shopper convenience is very hard.  Every day thousands of new online sites are opening for business and millions of newly-stolen counterfeit card credentials are hitting the black market.  That combination is not sustainable, even with merchants bearing most of the cost of fraud.  New tools like 3D Secure 2.0, tokenization, and advanced online fraud analytics solutions are coming soon, but it will take a commitment the size and scope of the investment that went into EMV from the payment networks, issuers, merchants, and processors to get CNP fraud under control.

Here is hoping this year brings nothing but good news and fond memories in next year’s recap.  While you’re making plans for which conference events to attend in 2016, if you are involved in payments in any way, you can’t miss the 2016 Payments Summit (www.scapayments.com), now in a larger venue in Orlando, FL on April 4-7, 2016.  It will be bigger and better than last year – even if it means having to trade in your snow skis for jet skis in Orlando.  I hope to see everyone there.  Happy New Year!

Sincerely,

Randy Vanderhoof

Executive Director, Smart Card Alliance

2015 Center of Excellence Program

Last month the Smart Card Alliance announced the 22 member companies who reached the highest level of active participation in the Alliance by having made outstanding contributions of time, talent, and resources across a wide mix of Alliance activities. This designation, called the Center of Excellence (COE), indicates that organizations demonstrated the following criteria in 2014-2015:

• Industry Council recognition for Honor Roll inclusion or Top Contributor to one or more of our Industry Councils
• Council officer position elected by peers
• LEAP/CSCIP training and certification
• Participation in corporate CSCIP training and certification
• Financial support of Alliance conferences and events sponsorship of $5,000 or greater
• Supporting membership in multiple chapters (SCALA) or affiliated organizations (EMV Migration Forum)

In addition to being recognized with a plaque, each COE company will be profiled in a 2016 Smart Card Alliance Member Bulletin. We encourage our 2015 COEs to take advantage of this benefit! Please contact Debra Marshall to schedule your company’s profile. You can view past profiles here.

Congratulations to the Class of 2015:

• Advanced Card Systems, Ltd.
• American Express
• Consult Hyperion
• CPI Card Group
• Cubic Transportation Systems, Inc.
• Discover Financial Services
• First Data
• Gemalto
• Giesecke & Devrient
• Hewlett-Packard Enterprise Services, LLC
• HID Global
• Identification Technology Partners, Inc.
• Ingenico, North America
• INSIDE Secure
• MasterCard
• NXP Semiconductors
• Oberthur Technologies
• TSYS
• Visa Inc.
• Underwriters Laboratories (UL)
• Xerox
• XTec, Incorporated

Council Highlights

Councils completed two white papers and have nine projects in process. After a very productive 2015, the Councils are now discussing plans for 2016 projects.

• The Access Control Council is currently reviewing the NIST SP 800-116 Rev. 1 “Draft A Recommendation for the Use of PIV Credentials in Physical Access Control Systems (PACS)” and will be submitting industry comments
• The Health and Human Services Council had its session proposal for the HIMSS 2016 Conference accepted.  The session, “Patient Identity and Digital Matching: A New Approach,” will be on March 1, 2016 and feature Tess Coody, CEO, and Roderick Bell, CIO, of Tenet Health. The Council is currently working on a vision white paper on the convergence of the payments and healthcare identity acceptance infrastructure and an infographic on the future of healthcare identity management
• The Identity Council is working on a white paper on the FIDO protocol and smart card technology.  The Council Steering Committee will also be electing a new chair
• The Mobile and NFC Council published the new white paper, NFC Non-Payments Use Cases, to provide an educational resource on NFC non-payments implementations that must secure a user credential.  The white paper describes 11 use cases, including implementation considerations and challenges and examples of real-world implementations. The Council is now developing statements of work for three new projects: white paper on mobile authentication of identity and the use of the authenticated identity in applications; white paper and use cases for the EMVCo PAR; project to discuss barriers/obstacles to broad adoption of NFC
• The Payments Council published the new white paper, EMV and NFC: Complementary Technologies Enabling Secure Contactless Payments, in collaboration with the Mobile and NFC Council.  The white paper explains how EMV and NFC are companion technologies and clarify how they work together to enable secure payments.  The Council completed a project priority survey with members and is now discussing possible new projects for 2016
• The Transportation Council has elected a new parking vice chair, Brian Stein, CH2M.  The Council is currently working on two white papers: reference enterprise architecture for transit open payments system; multimodal payments convergence

If you would like to participate in a Smart Card Alliance Council, please contact Mike Strock, [email protected].

New EMV Resources

The EMV Migration Forum and Smart Card Alliance completed three EMV resources in fourth quarter of 2015. All EMV resources are available on the EMV Connection web site.

• The EMV Migration Forum published the new white paper, Implementing EMV in the U.S.: Best Practices in Support of EMV Instant Issuance, to provide an educational resource for issuers that documents the best practices for transitioning an existing instant issuance solution to support the issuance of EMV chip cards
• The Forum published new guidance, EMV Implementation Guidance: Fallback Transactions, to outline potential causes of fallback transactions and actions that can be taken to address problems
• The Smart Card Alliance Payments Council and Mobile and NFC Council collaborated and published the white paper, EMV and NFC: Complementary Technologies Enabling Secure Contactless Payments. The white paper describes the current status of EMV chip migration and predictions for contactless payments in the U.S., includes infographics on provisioning and using contactless cards and NFC mobile devices, and describes key considerations for contactless payment implementations