[Infowarrior] - UK Chip & Pin Report

[Richard Forno]

(c/o Dissent)

http://cryptome.org/UK-Chip-PIN-07.pdf

This report has been produced by APACS, the UK trade association for
payments and for those institutions that deliver payment services to
customers.  The report is for the key stakeholders who participated in the
introduction of Chip & PIN in the UK including APACS and its sub committees,
the British Retail Consortium and members of the Chip & PIN Programme.  The
report aims to assess whether the forecasts and assumptions contained in the
original high-level Business Case have been met and to provide explanation,
where applicable, for any divergence.  The report will also quantify, where
robust data is available, the figures used to justify the Business Case.

This report represents the final chapter in the UK¹s successful
implementation of Chip & PIN and demonstrates that the UK is a market leader
in this technology.  It will present the high level business case used to
justify the movement towards Chip & PIN in the UK and compare the forecast
reductions in fraud against actuals (2000 - 2006) and more recent forecast
figures until 2010 to assess the effectiveness of Chip & PIN on fraud
compared with the anticipated levels had it not been implemented.

Included in the report is qualitative analysis from UK stakeholders on key
learnings from their involvement in Chip & PIN¹s design and implementation
together with independent analysis of the role played by the Programme
Management Office (PMO).

Although this is the final report covering the introduction to the UK of
Chip & PIN, it does not represent the end of the story.  Globally, there are
moves to introduce similar Chip & PIN initiatives and the UK will itself not
stand still.  Having introduced the Chip & PIN infrastructure, which
provides a platform for future innovation, there are a number of planned
developments that will build on its robustness to tackle other areas of card
fraud.  Without the Chip & PIN infrastructure in place, the introduction of
additional authentication to address fraud in remote channels and the launch
of contactless card technology would be more difficult.

Looking at global Chip & PIN developments, Europe is committed to becoming
EMV-compliant by 2010 under its Single Euro Payments Area (SEPA) initiative.
Central Europe, Middle East and Africa (CEMEA) already has a liability shift
for Point of Sale (POS) transactions in place and ATM transactions are
expected to follow suit.  Canada has its own PMO in place and is expected to
implement a liability shift for Lost & Stolen and Counterfeit cards by 2010
and Asia Pacific is believed to be considering a liability shift for chip
and signature cards.