Forged tickets on Dark Web

[Tetchytyke]

I expect there are different standards and levels of encryption. We just need to adopt the right technology.

I'd agree with that, but the same can go for old-fashioned paper: there are ways of embedding things into paper tickets to prevent them from being easily forged.

 

[jon0844]

I'd agree with that, but the same can go for old-fashioned paper: there are ways of embedding things into paper tickets to prevent them from being easily forged.

Yes, and I think that's a must as paper tickets won't likely go for some time. In the first instance, season tickets should be issued on smartcards. Then perhaps other high value tickets.

At least then usefulness of the fakes are reduced and there's less money going to organised criminals.

 

[Bletchleyite]

If only the industry was a bit more advanced on smartcards by now, although to ATOC/RDG and the DfT they're still some futuristic technology that's as yet unproven..

They're dead. A ticket in a database with any simple piece of technology (barcode, NFC, simple numeric RFID, ticket reference number scribbled in biro on a piece of chip paper) to point to it is the future.

 

[jon0844]

I wouldn't say dead. A smartcard can hold a ticket or ID, just as I'd like my phone to be able to. All part of the same future IMO.

You couldn't expect everyone to have their own device, so a smartcard would be that alternative. M-tickets could also exist too.

What you want rid of, bar a major redesign, is paper tickets. Or you make all new tickets have an Aztec code and nobody is let through without it being scanned. Then ditch the magstrip.

 

[mark-h]

A ticket in a database with any simple piece of technology (barcode, NFC, simple numeric RFID, ticket reference number scribbled in biro on a piece of chip paper) to point to it is the future.

The main issue with the database approach is that the database has to be accessed and written to each time a ticket is sold or checked. This would need a constant data connection for on board checks and sales.

If the same ticket number is checked multiple times the system would have to work out if it being used in a valid way, it would be good to reduce the number of times a member of train staff has to check the usage history manually.

In the short term a modification to ticket stock would be a quick fix whilst better solutions are found.

 

[TonyMitchell]

It seems ironic that almost 30 years after scrapping a ticketing system with 150 years heritage and investing hundreds of millions of pounds into new technology, the issue of ticket counterfeiting and the ability to quickly visually detect the fakes, is now much harder than it was back in the day.

One of the more popular scams in the 70s/80s was date alteration on seasons & travelcards. Having seen many of these, most were poor and unconvincing (3s to 8s and 0s to 8s being common), only needing the glance of an experienced eye to know something's not quite right. Month alterations also cropped up, usually poorly disguised behind a dirty wallet, and those where the fraudster used the conventional 'DEC' instead of railway 'DMR' abbreviation, etc.

Obviously copying and printing technology has moved miles in the digital revolution, however I still maintain it would be more difficult today to produce a plausible fake traditional Edmondson, NCR21, Handiprinter, etc. ticket than it would be to replicate an APTIS or SMART type ticket that uses common stock.

 

[Bletchleyite]

The main issue with the database approach is that the database has to be accessed and written to each time a ticket is sold or checked. This would need a constant data connection for on board checks and sales.

This is true, but we really aren't far from that kind of capability. Certainly 10 years, probably 5.

If the same ticket number is checked multiple times the system would have to work out if it being used in a valid way, it would be good to reduce the number of times a member of train staff has to check the usage history manually.

"Have to". No, but it would be desirable, and writing algorithms to identify obvious repeat use would not be so hard. Much easier than interpreting a load of biro squiggles on a card ticket, and it could do things like checking Permitted Routes in real time and giving a correct explanation of non-validity if not valid, and identifying what the correct remedy to the non-validity is.

But even manually you'd have better information than a biro squiggle - for each check, you'd have train headcode, precise date and time, previous and next stations (by GPS or cell-locate), identification of guard who checked. Look at that and it'd be easy to identify misuse.

In the short term a modification to ticket stock would be a quick fix whilst better solutions are found.

In the short term yes. However, I'm unconvinced that smartcards (actual smartcards that store ticketing data, not simple unsecured numeric RFID cards) have any role other than possibly a short-term means of storing a season ticket.

 

[jon0844]

The main issue with the database approach is that the database has to be accessed and written to each time a ticket is sold or checked. This would need a constant data connection for on board checks and sales.

If the same ticket number is checked multiple times the system would have to work out if it being used in a valid way, it would be good to reduce the number of times a member of train staff has to check the usage history manually.

In the short term a modification to ticket stock would be a quick fix whilst better solutions are found.

Of course a short term solution needs to be found to an existing problem, but going forward it should be possible for all rail staff to carry a connected device.

Connected devices will offer many benefits to staff, and many members of staff already have a connected device in the form of a phone with data connection.

4G/4.5G and later 5G, will make it all seamless. In any rare situation where a connection goes down, discretion can be shown. Fraudsters aren't going to know when that will be!

4G by 2020 will offer 99% UK geographic coverage, so I'd say ALL railway routes are going to be connected. At this point, you have a way to authenticate every ticket and much more, depending on how clever or willing the industry is.

 

[Bletchleyite]

I wouldn't say dead. A smartcard can hold a ticket or ID, just as I'd like my phone to be able to. All part of the same future IMO.

With e-ticketing it needn't hold a ticket, that's in the database. All it needs to be is simple "dumb" RFID that just issues a numeric identifier to any device that requests it - same as most work door security systems. Some people call those smartcards, I'd separate them - actual smartcards are computers-on-a-chip that communicate in a more detailed way with the host.

Your phone similarly wouldn't hold a ticket, just a reference to one (think airline boarding card).

What you want rid of, bar a major redesign, is paper tickets. Or you make all new tickets have an Aztec code and nobody is let through without it being scanned. Then ditch the magstrip.

Probably the easiest way to deal with "paper" tickets is to include an RFID chip in them which would refer to an e-ticket by number. But AZTEC codes would also work and be cheaper.

 

[Mojo]

Mike Keeber (who actually works for, or at least used to work for, Great Western) is certainly no expert which the BBC is trying to portray him as. I have seen a number of internal briefings written by him which are just plain incorrect, including one that points out features on supposedly counterfeit tickets but which are present on certain types of tickets that come from S&B TVMs.

It might sound all exciting or mysterious to describe something as from the "dark web" however phoney tickets have been, and probably still are, sold for years at drinking establishments, workplaces, and amongst social groups. It's primarily the reason why the requirement to hold a Photocard for a 7 day Inboundary was reinstated a couple of years ago. Indeed, the BTP have already had at least one successful prosecution of someone, back in 2014. We aren't talking about the odd person photocopying tickets, or altering the date, but mass cloning of tickets that work barriers and look almost identical to the originals.

It's time someone in the rail industry got a grip and decided on a common standard for ticket printing and designs, but no, we have now seen at least three new designs in the past few months, on top of the minimum of 10 variations that already exist.

 

[Tim R-T-C]

The main issue with the database approach is that the database has to be accessed and written to each time a ticket is sold or checked. This would need a constant data connection for on board checks and sales.

It seems to work perfectly well abroad - I've had e-tickets scanned on an Amtrak train in the middle of Arizona desert and in rural areas of Sicily.

Would be easy to use code within the scanned code that would identify the route and date of a ticket, with its unique ID being checked as and when a signal is available - which aside from very rural areas, shouldn't be a problem in most towns or villages.

 

[DynamicSpirit]

It seems to work perfectly well abroad - I've had e-tickets scanned on an Amtrak train in the middle of Arizona desert and in rural areas of Sicily.

Out of interest, how do you know that those e-tickets were being linked to a central database, as opposed to the scanner simply reading information in the e-ticket itself?
--- old post above --- --- new post below ---

Smartcards aren't necessarily the solution either, given that people have been able to hack into MiFare chips before now...

Smartcards have two other problems:

• They provide no way for the passenger see what ticket is on their smartcard (apart from going to a machine that can read it), which isn't very helpful for the passenger. Not too much of an issue on local metro systems where journeys are always cheap, but problematic when you're talking about fares of £100 or so. Oyster for example is convenient in a lot of respects, but there have been many occasions when I've been on a train wondering whether my Oyster has actually correctly scanned for the journey (typically if I had problems at the gate).
• If the system charges you for the actual journey made, then that tends to mean you sometimes don't know what the fare is going to be until after your journey is complete. Again not really an issue for metro systems where fares are typically only a couple of quid, but imagine a customer who misunderstands peak restriction rules and therefore makes a journey that they thought would cost £40 but it actually costs £100 - and they don't find out until after they made the journey...

And what do you do with someone who touches in and forgets to touch out, if the theoretical most expensive journey they could've made would've cost £300 to the other end of the country? (And the system has no way of knowing that they actually went two stops down the line and should've been charged £2.50)?

Because of that kind of problem, I find it hard to see smartcards being a solution for national rail.

 

[Tim R-T-C]

Out of interest, how do you know that those e-tickets were being linked to a central database, as opposed to the scanner simply reading information in the e-ticket itself?

That was my point, there was no way there was signal in the areas I was, but the machine worked well enough to check the tickets, presumably against a standard data format.

It wouldn't be hard to produce a machine that could then talk to a database when there is signal and alert the conductor when there has been a dodgy ticket detected for them to follow-up.

 

[jon0844]

For now, a terminal could sync tickets when there is coverage - just like any other database in the cloud. Would take a matter of seconds, so a later check could work even without a signal.

I doubt there are any routes with no signal anywhere, and if there were you'd deal with those problems individually.

 

[3141]

The BBC News item about this quotes a railway spokesperson saying that ticket fraud costs the industry £200 million annually.

What would be the cost of some of the solutions being discussed here? We know the DfT has already spent considerable sums on something called ITSO without much result.

I don't understand a lot of the solutions being discussed in this thread, and it leads me to think there could come a time when I'm not able to travel because I no longer know how to buy a valid ticket. Etickets, for example. When I travel by plane a few times each year, I buy the tickets well in advance and I print out at least a page of what the airline calls an eticket. Whether it is a ticket or not doesn't really matter, because when I get to the airport I find they have a record of my booking, which is for a specific flight. But when I go by train I frequently buy the ticket at the station. It can be a late decision which station to go to, or which train to catch, so sometimes it wouldn't be practical to buy it beforehand.

There are IT solutions for everything, apparently, even for the meaning of life it sometimes seems, but not all these possible solutions will make life better than it was before.

 

[Tim R-T-C]

The BBC News item about this quotes a railway spokesperson saying that ticket fraud costs the industry £200 million annually.

Actually they talk about fare dodging, I suspect ticket fraud is still a pretty tiny part of this.

I suspect 'fraud' in the sense of people re-using/selling or passing on unstamped tickets is likely to be higher than actual fake tickets.

I don't understand a lot of the solutions being discussed in this thread, and it leads me to think there could come a time when I'm not able to travel because I no longer know how to buy a valid ticket.

I think there will always be a place for buying a 'paper ticket', just it will have a scannable code on it so it can be scanned by a conductor. There will always be tourists and people making quick impulsive trips for whom a paper ticket is best.

The difference is, for those with a mobile phone or who want to buy their ticket at home, they can do and just print out their ticket with a code on.

Done properly, it shouldn't make things any harder for anyone, just add in extra options and flexibility for those who want it.

 

[CarlSilva]

Factor in the cost-risk of sending £111 to some mysterious website, along with presumably giving them your address and details to produce and send you the ticket. What are you going to do if simply nothing shows up?

Dont they do a print at home service ?

 

[Mojo]

lf anyone wants to see the TV report behind this programme, it was on lnside Out South East this evening, now available on iPlayer http://www.bbc.co.uk/iplayer/episode/b0816yxy/inside-out-south-east-31102016

 

[Jonny]

They're dead. A ticket in a database with any simple piece of technology (barcode, NFC, simple numeric RFID, ticket reference number scribbled in biro on a piece of chip paper) to point to it is the future.

Which is OK as long as the rail industry staff can access the database at any point (as in potentially every part) of the journey. Otherwise, the system falls down.

 

[6Gman]

The difference is, for those with a mobile phone or who want to buy their ticket at home, they can do and just print out their ticket with a code on.

Done properly, it shouldn't make things any harder for anyone, just add in extra options and flexibility for those who want it.

My last four trips to a booking office have seen me queue behind somebody who has used a TVM or e-ticketing ... and now has a complex problem to sort out at the booking office (except that the booking office can't give them the answer they need/want).

There's a lot to be said for:

"I want to go to xxx"
"Certainly sir, here's your ticket(s)"
"Thank you"
"Have a good journey sir"

 

[Busaholic]

A colleague of mine working for a local authority in the mid 1970s had a profitable sideline in selling forged tickets for long-distance European rail travel. He'd worked for NUS Travel or somesuch and so had had access to genuine tickets, which in those days came in a 'book' form with layers of tickets, to be torn off in sequence. He'd used Filipino connections (he was married to a Filipino) to get identical tickets printed. I only remember what he said was the most important detail when he sold the tickets, that you never travelled to the final destination printed on the ticket, which was (almost unbelievably through modern eyes) Baghdad West! So, get off at Baghdad Central and retain your ticket. I never took advantage of his 'offer' but I think it undercut the true fare by upwards of 50%. The last I heard, but that was thirty years ago, he had quite a senior position in that council, and his secret had never come out.

 

[Hartington]

How big would a central database need to be? How much bandwidth would be needed to check a train full of people at one of the London terminii in the rush hour?

 

[route:oxford]

How big would a central database need to be? How much bandwidth would be needed to check a train full of people at one of the London terminii in the rush hour?

It would only need to be big enough to store valid tickets.

It wouldn't take much bandwith at all really. Multiply the number of gates by the length of uncompressed string - you could probably do it on a dial-up.

 

[Tim R-T-C]

Which is OK as long as the rail industry staff can access the database at any point (as in potentially every part) of the journey. Otherwise, the system falls down.

As mentioned before, most other countries use e tickets and have far more remote areas than we do.

Would not be hard to have a code with a preprogrammed string to ID the route and purchase date, then when signal is available, the unique ID of the ticket can also be checked.

 

[AlterEgo]

Which is OK as long as the rail industry staff can access the database at any point (as in potentially every part) of the journey. Otherwise, the system falls down.

Yes, a live database would probably be insufficient, as there are lots of places where there is no reception on many routes.

Better would be a closing of reservations 10 minutes before the train departs the origin station, and the guard/revenue staff connecting their machine to download the data for the trip. Any passengers buying or collecting tickets after that time would have to use a different method, such as a paper ticket.
--- old post above --- --- new post below ---

My last four trips to a booking office have seen me queue behind somebody who has used a TVM or e-ticketing ... and now has a complex problem to sort out at the booking office (except that the booking office can't give them the answer they need/want).

That's more to do with the fact that booking offices are (sometimes deliberately by the TOC) powerless to deal with many online issues.

 

[Bletchleyite]

Yes, a live database would probably be insufficient, as there are lots of places where there is no reception on many routes.

In 2016.

By 2026, I would expect only a very few tiny rural lines not to have near 100% coverage. They could be treated separately in some way, e.g. like BR Paytrains where tickets were all dealt with on board except for through tickets, which could be dealt with by collecting a "boarding card" from a connected machine at points where you enter that network.

 

[Groningen]

Why is this happening?! Maybe ticket prices are too high. The highest price you pay for a First Classticket in the Netherlands is 37 Pounds.

 

[AlterEgo]

Why is this happening?! Maybe ticket prices are too high. The highest price you pay for a First Classticket in the Netherlands is 37 Pounds.

Yes, but Great Britain is six times the size of the Netherlands.

Even Scotland's twice the size of the Netherlands.

 

[A0]

I expect there are different standards and levels of encryption. We just need to adopt the right technology.

The problem is there is no such thing as the "right" technology.

At a given point in time there is the most suitable solution, but considering the extent of a rollout over the UK rail network (and I've been involved in large scale IT rollouts, but not of the same scale as the rail network would be) and you're looking at a multi-year project. The problem is during the time of your rollout (i) a newer better technology will come out and everyone will go "ooh look, shiny toy, shiny toy, why can't we have that one, it's miles better than the one we're getting" and (ii) someone will inevitable manage to hack the system your deploying and start undertaking fraudulent activity.

Sadly it's a bit of a no-win situation.

 

[jon0844]

But we need to do something. Agree on something that is hopefully scalable and go with it.