Card, mobile credential, payment and security
When Northern Arizona University launched its JacksCard mobile ID, they did not want to use a new campus app to provision the credentials. The existing NAUgo app was already well-established with the student population, so the NAU team knew they wanted to build the functionality into the app.
They worked with their credential provider TouchNet and their app developer Modo Labs to bring the idea to reality.
It was a great choice as each of the two technologies has benefited the other. It was no surprise that the popular app expedited student adoption of the new NAU mobile ID. But the mobile ID also significantly increased usage of the mobile app.
On March 1, 2024 at 11 am ET, a webinar explores how NAU pioneered the integration of TouchNet OneCard Mobile ID within the Modo-powered app.
Patty Allenbaugh - NAUgo Design and Development Team Lead, NAU
Patty's responsibilities include leading all app design and development efforts and facilitating cross-departmental efforts for content on the app.
Matt Willmore - Sr. Director of Product Management, Modo Labs
Matt currently leads Modo's higher ed and platform product strategies. Prior to Modo, he led the mobileND Program at the University of Notre Dame.
Celicia Hiatt - Senior Product Manager – Credential Management, TouchNet
Celicia helped launch TouchNet's 360u app and has successfully launched mobile ID with TouchNet's lighthouse institutions.
Fred Emery - Senior Business Development Manager, TouchNet
Fred manages OneCard partner relationships with third-party vendors. Prior to TouchNet, he managed Hofstra University’s card program.
REGISTER NOW
The use of campus cards as voter IDs is hot topic nationally, as numerous state legislatures push for stricter laws. One side calls it fraud prevention, the other voter suppression.
Currently, 12 states and the District of Columbia do not require an ID for in-person voting so the question of student ID acceptance is irrelevant in those locales. That leaves 38 states that require an ID to vote, and nine will not accept a campus card. The remaining 29 states accept the student ID, though restrictions apply and differ from state to state.
Most require that the ID be from a post-secondary institution and include a photo. From there, things get fluid.
In Kentucky's 2023 general election, 99% of the 1.1 million in-person voters used a driver’s license as their ID. A student ID card was used just 354 times.
Rules surrounding the expiration date vary. Some states require that the campus card include an expiration date, but others do not. Some require that if the ID has an expiration, it must be current. Other states grant a grace period that enables acceptance of a recently expired ID.
Certain states require that the ID must also contain a signature. Because most campus cards eliminated signatures years ago, this has restricted use of some institution’s campus cards in states with this requirement.
Florida, for example, accepts student IDs at the polls but requires that all voter IDs include a signature. This blocked campus IDs from some Florida institutions.
Several years ago, Florida State University students lobbied administration to add a signature panel to the FSUCard to facilitate voter ID. In Spring 2021, the redesigned FSUCard complete with signature panel launched.
Kentucky is among the states with bills proposed that would outlaw the existing use campus cards for voter ID. The Kentucky bill passed in the Senate and is awaiting next steps.
Proponents of the bill point to mass voter fraud with student IDs as its genesis, but voting records show extremely minimal use of campus cards.
According to Lexington’s NPR station WEKU, in the 2023 general election in 109 of Kentucky’s 120 counties, more than 99% of the 1.1 million in-person voters used a driver’s license as their ID.
A student ID card was used just 354 times. That is 354 out of 1.1 million voters.
In the counties that are home to the state’s two largest institutions, University of Kentucky and University of Lousiville, just 89 and 81 voters used a student ID at the polls.
Additionally, WEKU notes that the Kentucky Attorney General’s office has not received a single complaint of fraud involving a campus card since the state’s new voter ID law – that first enabled acceptance of student IDs – was passed in 2020.
To many, this dispels the threat of mass voter fraud. At least in Kentucky.
Still the bill’s sponsor points out that laws are not written because of things that have already happened, but to close loopholes and prevent problems from happening.
Voter ID is an issue that is split down partisan lines, and universities and their campus card offices sit squarely in the middle.
Institutions strive to best serve their students, but should a campus modify its program to meet state voting requirements?
At Florida State University, they added a signature panel. But if the use among students is as low as the numbers reported from Kentucky, was it worth the effort and expense?
In Kentucky, the law that first granted acceptance of campus cards was enacted just four years prior, and it is now likely to be abolished. The impact of any changes made by institutions in the state were short lived.
It is always hard to hit a moving target.
To find out if your institution’s campus card can be used as a voter ID in your state, check out the guide at VoteRiders.org/student.
Security provider, Allegion US, is partnering with The "I Love U Guys" Foundation to contribute to the group’s programs for school crisis response. The goal is to make schools safer together through the development and dissemination of procedures and standard response protocols.
In 2006, Ellen and John-Michael Keyes founded the organization after losing their daughter Emily to a school shooting. On that day, Emily sent texts to her parents, saying "I love u guys.” In the nearly two decades since, the foundation – named for those messages – has positively impacted more than 50,000 schools and countless millions of students and families.
In 2006, Ellen and John-Michael Keyes founded the organization after losing their daughter Emily to a school shooting. On that day, Emily sent texts to her parents, saying "I love u guys.”
The focus is on development of programs and procedural documents including a Standard Response Protocol for crisis response and a Standard Reunification Method for post-event reunification. These resources are created through research-based collaboration with school administrators, psychologists, public space safety practitioners, families, and first responders.
In addition to its own programs, the Foundation also advocates for the ability to lock classroom doors from inside the classroom, a recommendation developed by the Sandy Hook Advisory Commission.
Allegion’s contribution to The "I Love U Guys" Foundation goes beyond sponsorship. The company plans to leverage its internal expertise in school safety to assist in the development of new recommendations and documents.
"We are aiming to go beyond facilities and locks to share valuable advice and truly help the K-12 industry,” says Melany Whalin, marketing manager for education, Allegion US.
The development of best practice solutions requires input from non-profits, industry, educators, law enforcement and community leaders, explains Ken Cook, director of national school safety and advocacy, Allegion US.
“The relationships we're building with organizations like The 'I Love U Guys' Foundation will ultimately have a positive impact on students – helping them feel safer and enabling them to learn and thrive," he says.
In addition to this partnership, Allegion also collaborates with school safety organizations including Safe and Sound Schools, Partner Alliance for Safer Schools, and the Security Industry Association.
To learn more about current efforts in school safety and crisis management, check out the following resources:
A new video chronicles the impacts of mobile credentials on the students and the administration at the University of New Brunswick (UNB). Featuring interviews with key leaders from IT, finance, security and housing, the video presents a wide-ranging perspective that can help leaders on other campuses share the vision with their administration.
The University of New Brunswick mobile credential was first issued to students, faculty, and staff in the summer of 2021. It was the first launch of the Transact Mobile Credential at a Canadian institution.
According to Bill Best, VP of Admin & Finance at UNB, his students expect a digital experience.
“In the backdrop of these older buildings … inside is the pulse of the university that is actually thinking about the future,” he says. “How can we make the experience both historic and also futuristic.”
I’ve been tasked with offering a single residence experience across our two campuses, and with mobile credential, students can now move between them seamlessly.
Mobile credential is key to this effort. It impacts all aspects of the university, not the least of which is housing.
“I’ve been tasked with offering a single residence experience across our two campuses,” says Cory Brown, Sr. Director of Residence, UNB. “With the Transact mobile credential, students can now move between the campuses seamlessly.”
Reallocating staff to higher purpose roles has also been key for UNB.
“We have less people handing out cards, we have more people helping students with other IT needs,” says Joshua Leon, Dean of Engineering, UNB.
“On the sustainability side, most provinces no longer allow single use plastics in a lot of things, so the less cards we print, the less plastic,” Leon explains. “It is a simple way to reduce your carbon footprint … and every little bit counts.”
Melissa Hannah, Director of IT Services at UNB agrees that the mobile credential’s environmental impact is positive, and this is important to a new generation of environmentally conscious students.
“It’s important for all our departments to work together to reach UNB’s sustainability goals,” she says. “The UCard can play its part by reducing the use of plastic cards and the mobile credential is one way we could do that.”
UNB has built an impressive mobile-first experience anchored by the mobile credential. To learn more, click the image at the top of this page.
It's and age old question - how do I dispose of used card printer ribbons. Are most campus card offices already doing it?
When you print an ID card, there is an imprint of the data left on the printer ribbon. When you are done with a ribbon, there is a visual record of the most recent 200 or more cards you’ve printed.
For years, some have warned that discarding ribbons in the trash is a dangerous idea as counterfeiters could use the data to duplicate valid IDs. Others dismiss the concern, pointing out that names and ID card numbers are of little value to fraudsters. Very few college and university card programs print social security numbers or other such data on their IDs today, so is the risk really that great?
In this episode of the "IDk" webinar series, CampusIDNews publisher Chris Corum talks with Rob Miskelly, President & General Manager at IDP Americas. His company manufactures the SmartBit, a dedicated device specially designed for printer ribbon shredding.
Among other topics, they discuss:
Is the idea of destroying used ribbons overblown, are there DIY methods to do the job, or is a ribbon shredder a must-have for a secure card office?
To watch the video, click the image at the top of this page.
Penn State University is undertaking an ambitious project to replace magnetic stripe readers and implement mobile-first technology at its 20-plus campus locations.
According to the university, “all residence halls, administrative facilities and academic buildings at every Penn State campus will be compatible with the mobile id+ card by the summer of 2025.”
The university first launched its mobile credential for iPhone, Apple Watch, and Android in January 2023. The Penn State mobile id+ card program has been expanding from the main campus in University Park to other commonwealth campuses.
At the time of the initial launch, the university said it was installing contactless technology through a phased approach at all campuses.
“Physical cards will remain necessary, as not all University locations will accept mobile-only transactions, and access to academic buildings and other facilities and resources may still require the physical id+ card to be present,” they reported.
This newly announced initiative changes that initial plan, creating a system-wide mobile-first solution that ultimately eliminates physical cards.
“To simplify user experiences and enhance the security of University resources, Penn State IT has announced the mobile id+ card as Penn State’s primary credential,” says the announcement.
Reader infrastructure at most Housing and Food Services buildings has already upgraded to contactless/NFC technology, but this new push aims to deprecate physical cards in favor of the mobile-first approach at all locations.
Mobile-ready readers are currently launching in the administrative and academic buildings at Penn State's Beaver, Behrend, Greater Allegheny, Harrisburg, and Mont Alto campuses. These will be the initial mobile-first campuses starting in the summer of 2024.
While most institutions are eliminating physical keys in favor of cards and mobile credentials, Saint Louis University (SLU) was forced to make the opposite move. This comes after a student illegally cloned a valid ‘master’ card and used it to access another student’s dorm room.
According to an article in SLU’s student newspaper, the student used a card-skimming device known as a flipper to copy data from the mag stripe of an campus card belonging to a staff member. This data was then encoded to the magnetic stripe on another card, creating the clone.
We have long known of the vulnerabilities inherent in both magnetic stripe and 125kHz prox technologies, still thousands of facilities continue their use.
According to an anonymous residence advisor, the cloned card belonged to a staff member who had master access to the residence halls, so the forged card could potentially provide entry to any dorm room.
This aligns with a university statement.
In an email to students, the university said the switch to keys was due to an incident involving a student worker in the central housing office.
Though not explicitly confirmed, it would follow that the cloned card belonged to a housing staffer with master access privileges to residence hall rooms.
Fortunately, though the impacts of the cloning could have impacted life safety, they were minor. The university says the unauthorized access was limited to the single event, no one was hurt or robbed, and the card skimmer was confiscated.
The anonymous residence advisor says a female student used the card to enter her ex-boyfriend’s dorm room.
In response to the incident, the university suspended use of ID cards at residence hall doors and returned to physical keys. The campus cards are still being used for functions including parking, dining, and access to non-residence hall buildings on campus.
SLU’s reacted quickly to remedy the situation. Because the doors in the dorms had both physical and electronic locks, in just a few days card access was shut down and physical keys were provided to residents.
There are lessons to be learned for campuses across the country and beyond.
The SLU case is just one more in a decades-long string of events that demonstrate the dangers associated with antiquated ID technology. We have long known of the vulnerabilities inherent in both magnetic stripe and 125kHz prox technologies, still thousands of facilities continue their use. Migration to secure chip-based contactless and NFC credentials is essential to guard against card cloning and other security threats.
There’s never been a better time to be a University of Notre Dame student with a healthy appetite. Thanks to a partnership with mobile ordering and food delivery platform, Grubhub, Notre Dame has forged a dining services program that offers students flexibility, variety, and convenience.
Notre Dame’s mobile ordering journey started in 2018 when it began working with the campus mobile ordering provider Tapingo, which would later be acquired by Grubhub.
“We essentially had Grubhub in place as a secondary ordering service for select dining retail operations,” says Bin An, Director of Retail Dining for University Enterprises and Events at the University of Notre Dame. “When COVID hit and we had to figure out ways to service students while reducing physical contact, we pivoted to increase our Grubhub footprint.”
During COVID, we temporarily ceased walk-up service. Student behavior changed, and ordering food through a phone or kiosk became the norm.
That increased footprint included more ordering kiosks and Grubhub Ultimate locations. At the same time, temporarily ceased walk-up service. “The effect was that student behavior changed and ordering food through a phone or kiosk became the norm,” explains An.
Adapting to the times, Notre Dame is working with Grubhub to offer contactless ordering solutions at most of the dining locations on its South Bend campus. That includes in-person kiosk ordering, pre-ordering via the Grubhub mobile app, and offering autonomous robot delivery.
The Grubhub app is the primary mobile ordering channel for Notre Dame students and is fully integrated with the university’s ID card system to support order payment. The Grubhub kiosk is a guest-facing ordering software that supports all cashless forms of payment, including credit, debit, and student ID card tenders.
It’s worth noting that Notre Dame is a cashless retail environment, with food-service locations, dining halls, and concession stands accepting only credit, debit, or campus card tenders.
“Being cashless improves efficiency, eliminates security risks associated with transporting cash, and lowers health concerns with less cash repeatedly changing hands,” says An.
The integrated dining experience at Notre Dame also paved the way for the addition of autonomous robot delivery.
“We launched autonomous delivery in February of 2023, and the robots serve all parts of campus,” says An. “Robot delivery is an important part of an expanded omnichannel retail strategy that increases flexibility and accessibility for our community.”
Notre Dame students, faculty, and staff can interact with Grubhub in a myriad of ways, with each method offering its own measure of convenience. Let’s explore a typical day with Notre Dame student, Riley.
Riley is a busy guy, so he saves time in the morning by pre-ordering breakfast on the Grubhub app from home. He uses flex points to pay and then grabs the order on his way to class.
At lunch, Riley uses one of the Grubhub kiosks in the dining hall to place his made-to-order stir fry prior to entering the facility. This speeds up the process, allows him to customize with all of his favorite vegetables, and gives him a little extra time to go over his notes before his next class.
At midnight, Riley orders a pizza and some wings via the Grubhub app. Thirty minutes later, a robot delivers it to his dorm.
Because of tomorrow’s exam, it’s now midnight and Riley is still burning the candle at both ends. He needs a late-night snack to keep him going, and once again Grubhub is there to help. Riley orders a pizza, some wings, ice cream and a cookie via the Grubhub app. Thirty minutes later, a robot delivers it to his dorm.
University staff members also leverage Grubhub. “Our staff often have back-to-back meetings and long days, so calling on a delivery robot from their favorite lunch spot across campus can be a lifesaver,” says An.
With the entire Notre Dame community able to access the Grubhub suite of ordering solutions, it comes as little surprise that the program is thriving.
According to An, the Fall 2023 semester saw a 10% increase in year-over-year sales through Grubhub. Since the launch of the robot fleet in February 2023, there have already been 36,000 deliveries. To put that into perspective, Notre Dame has an undergraduate population of just 9,000 students.
Notre Dame is also employing the ghost kitchen concept to further build out its comprehensive dining portfolio. The ghost kitchen fills a void in late-night dining, utilizing existing infrastructure and operational capabilities to do so.
The ghost kitchen functions as a normal kitchen, but it operates after hours when the facility would traditionally have sat unused. The operation uses existing equipment, inventory, and staff to execute the menu, but does not offer a dine-in option. Instead, students order late-night food on the Grubhub app where it’s then prepared in the ghost kitchen and delivered via an autonomous robot.
We cross-train our teams to be able to execute multiple menus so that we can service the ghost kitchen without additional talent.
“We cross-train our teams to be able to execute multiple menus so that we can service the ghost kitchen without additional talent,” explains Reggie Kalili, Director of Student Dining for University Enterprises and Events. “Our staff loves trying new concepts and this one has been fun to deliver.”
For its efforts, the Notre Dame dining services team and Grubhub have successfully provided the campus community with a diverse portfolio of dining options.
“We continue to listen to our stakeholders and innovate to deliver what our community needs and wants through student ambassadors, surveys, and collaboration with student government,” says Kalili. “All of these efforts work cohesively to make Notre Dame and its dining program so special. It allows us to fuel the mind, body and spirit of our university community as it seeks to be a force for good in the world.”
In a recent article by TouchNet president Adam McDonald, four trends impacting higher education administrators in 2024 were highlighted. Among the four was “understanding your data and how to use it.”
Recently, EDUCAUSE reported that institutions are beginning to progress in their approach to data. They suggest that the key now is, “converting data analytics into action plans to power institutional performance, enhance operational efficiency, and improve student success.”
McDonald agrees, noting that data cultures are maturing at many institutions as administrators recognize data as critical to outcomes and revenue.
“They are hard at work to generate insights that help refine processes and policies, improve the student experience, save time and effort for staff, and potentially increase revenue while decreasing costs for the institution,” he says.
Data cultures are maturing at many institutions as administrators recognize data as critical to outcomes and revenue
Data is created by the various campus activities such as door access, class and event attendance, transportation usage, purchases, and more. This data can be used for a wide range of purposes, from assessing space utilization in campus buildings to piecing together the life of students to better understand and serve their needs.
In a separate piece, TouchNet highlights that the discussion typically focuses on service improvements, like analyzing the busiest dining hall times to adjust staffing and food production levels.
“But ID system data also provides information on a larger scale, such as the hourly and daily use of buildings, rooms, and other spaces on campus,” the report notes. “Administrators can look at this data when making decisions on whether to maintain, renovate, lease, or possibly sell a space on campus.”
When it comes to collecting, analyzing, and putting data to use, an institution’s approach will vary based on its size, infrastructure, and type of institution.
McDonald stresses that the key is to get started, and the ID card system is a key piece of the puzzle.
“Work with your committee of campus stakeholders to develop goals, strategies, and tactics to enhance your institution through data-informed decisions,” he says.
Three other trends highlighted for 2024, include the continued rise of mobile technology, the barrage of new regulations, and attempts to address the ongoing staff turnover on campus.
Ohio State University’s BuckID program began a campuswide transition to include contactless technology in all university ID cards. Starting in summer 2023, all new cards issued included both a mag stripe and a DESFire contactless chip.
“We had been issuing DESFire cards in a limited capacity to certain employees for about two years,” explains Josh Bodnar, director of BuckID. “But this summer was our transition to issuing DESFire cards for all new faculty, staff and students.”
In an article in the Ohio State student newspaper The Lantern, Bodnar cited security as the primary driver for the move.
All new BuckIDs contain both magnetic stripes and contact chips, but existing cardholders who want the contactless card can swap their old card for a $5 fee.
In the past, BuckID cards only included a mag stripe. Mag stripe data is not encrypted or secured in any manner, so it is widely considered inappropriate for secure applications and use cases.
Contactless chips on the other hand make use of encryption, mutual authentication, and a host of security techniques to ensure data on the card is always protected. Where mag stripe cards are easily duplicated, contactless cards cannot be cloned.
In addition to the added security, Bodnar also touts the convenience of contactless.
“Around 18 months ago BuckID began a comprehensive planning process, called BuckID 3.0, to evaluate future directions for our credentials,” says Bodnar. “The first action to come out of that effort was to begin wide-scale deployment of contactless cards to students and employees this year.”
All new BuckIDs contain both magnetic stripes and contact chips, but existing cardholders who want the contactless card can swap their old card for a $5 fee. The replacement fee for a lost card was increased – from $20 to $30 – with the advent of the new card.
The process of upgrading the vast number and variety of card readers across campus is also a massive task.
“The (BuckID 3.0) plan also recommended that departments begin the process of replacing legacy magnetic stripe readers with dual technology readers that support magnetic stripe and NFC (contactless),” explains Bodnar.
Currently, the reader transition process is underway, but there are many locations that may not have contactless capability for months or even years.
The timeline to complete the transition of all card readers and BuckIDs to only use contactless, is not known, but conversations with stakeholders related to costs and timelines are underway.
Today, most exterior residence hall doors, some dining facilities and newer academic buildings are contactless-enabled. That means that on-campus students are using their contactless cards in many ways. For students that don’t live on campus, however, Bodnar says there are not many places ready for them yet.
That situation, however, will change rapidly as new IDs are issued to future incoming classes and existing campus buildings and services deploy the new readers.
