Secure non-payment transactions via EMV

Technically it’s possible to use EMV cards and applications for other purposes but the challenge lies in the business case and whether individuals would want to do it, says Brian Russell, senior vice president for payments and transit at Giesecke & Devrient. “Technically you can take the EMV cards and the cryptographic capabilities and have the ability to communicate,” he says. “But there are a myriad of issues with the business case.”

Financial institutions would have to be willing to share the keys to the cryptogram with the enterprise in order to enable it to work, Russell says. There’s also the question of where the key management system lives, the bank, the enterprise or both? “You’re talking about implementing a backend system that would be reading the same system, it’s not impossible but it would take effort,” Russell explains. “The challenge comes in the infrastructure and having to manage and share keys across different segments.”

There’s also the consumer side of the equation and whether the employee would be willing to share an EMV card with an enterprise for access, Russell says. “Certain people may be sensitive about their financial information and may not want to share,” he explains. “Also, what happens if the card is lost or stolen or the employee wants to cancel the account?”

Enterprises want to control the personalization of credentials, says Xavier Giandominici, director at FIME. That said, depending on the card and memory available, it would be possible to use the card for other purposes.

The problem arises when it comes to the business case, Giandominici explains. How is the card authorized? What’s the lifecycle? What’s the liability if something happens to the credential? “The technology is here and it’s secure but these questions are what’s stopping it from being implemented,” he adds.

Low memory cards limit options

The main problem is that banks issuing EMV cards typically go with the lowest cost, lowest memory cards available, says Stephen Wilson, managing director at the Lockstep Group. Banks put the EMV application on the card and don’t leave room for anything else.

This is changing in some regions, as European banks are putting other applications on the card, such as transit, but leaving room to enable a third-party to place an app on the card is somewhat unchartered waters. “Post-issuance loading is hairy,” Wilson says. “People have an aversion to it because you have to be technically sophisticated to add an app to a smart card without breaking it.”

The alternative is to add all the applications when the card is first being issued.

EMV plus National ID for Nigerians

Nigeria and MasterCard worked together to add both parties’ apps at issuance creating a national ID that is also an EMV bank card. The two announced the rollout of 13 million MasterCard-branded National Identity Smart Cards with electronic payment capability as a pilot program.

As part of the program, the first phase of the pilot issues all Nigerians 16-years and older, along with all citizens with two or more years of residency, the multipurpose, 13-application identity card. The card includes MasterCard’s prepaid payment technology that will provide cardholders with electronic payments. For many Nigerians, this will be their first access to financial services.

But arriving at the multi-purpose ID wasn’t easy. Providing access to banking services was important with the Nigerian ID as more than 70% of citizens are unbanked or underserved. “The Nigerian government was resolute in creating a smart identity card based on a unique national identity number to harmonize and integrate existing identification databases in Nigeria,” Sami Lahoud, vice president of communications for the Middle East and Africa at MasterCard. “The Central Bank was equally resolute in advancing the Cashless Nigeria initiative to create efficiencies and gradually eliminate the vices of cash in the economy.”

The issuance of these new credentials, from a back office perspective, is complex but should be easy for the cardholder. The process starts with issuing the National Identity Card, which includes biometric identification and is linked to the unique national identity number, Lahoud says.

The electronic payment capability kicks in afterwards and features many possible applications. The identity card can be used as a standard prepaid card where the cardholder loads money on the credential at a bank. More importantly, it can be used by government agencies as an alternative cash disbursement tool. “The Minister of Finance has already stated that this card will be used to disburse pensions to eligible citizens,” Lahoud explains. Other applications are being discussed as the program evolves.

Lahoud says there are no similar programs like this in Africa or any other part of the world. Eventually, the scheme will include all adult Nigerians and all residents in the country. This is a potential of almost 120 million cards and will keep growing in step with the country’s population.

---

Related articles:

As Canada’s payment cards go to EMV, will fraud migration push U.S. banks to join the smart card world? Mientras las tarjetas de pago en Canadá migran a EMV, ¿se sentirán presionados los bancos de Estados Unidos a unirse al mundo de las tarjetas inteligentes a causa de la migración del fraude? SecureKey delivers online authentication with existing IDs