Definition of Ticket under Byelaw 18

[summie]

Sorry first post here and hoping someone can help me.

I was on a train between London Bridge and Petts Wood travelling using a south Eastern Train. Fully within the tfl zones so I could use my contactless card on Google Wallet.

A man from south eastern asked to see my "ticket" and I explained I'd rather not tap my card in his reader but he could see my tap ins on my google wallet. I have had my NFC cloned in the past and wasn't sure about the security of their devices. The wallet allows someone to see where they tapped in and at what time.

After a fairly frustrating encounter a colleague came to help where they explained that under Byelaw 18 I had to show them a valid Ticket. I explained that Byelaw 18 does not require me to touch my phone on their reader. It requires me to prove that I have a "ticket".

So my question to you kind readers (excuse the pun) is are required to tap a machine to prove we have a Ticket under Byelaw 18 or is what I showed them enough to constitute a Ticket. Side question is there any other way I could have resolves this?

 

[signed]

Side question is there any other way I could have resolves this?

Taping your card/phone

is are required to tap a machine to prove we have a Ticket under Byelaw 18

When you tap in with your card or Oyster, a pending maximum fare is registered on your card, this is your ticket. When you tap out, that maximum charge will get converted to whatever ticket/cap and that will get charged.

I have had my NFC cloned in the past and wasn't sure about the security of their devices.

Google Wallet (and others), aren't really at risk from NFC cloning, they don't store any card info (even the original number) and instead contain anonymous tokens which some are rotated at every transaction

Security | Device Tokenization Developer Site | Google for Developers

developers.google.com

 

[Bletchleyite]

I have had my NFC cloned in the past

I very much doubt you have because that basically isn't possible, or if it is it's incredibly rare. You could have had a transaction debited if a reader was brought near your phone when unlocked, but if you did it would be a heck of a lot more likely for it to come from a physical card use e.g. in a cash machine with a "skimmer" attached, or from a compromised card number from an online purchase.

In short, though, if you're unhappy with fully complying with how NFC/contactless is done, you will need to pay a different way, e.g. a paper ticket. It's fairly obvious that what you did is what someone who didn't tap in would do - you're lucky you're not defending a prosecution.

 

[John R]

In short, though, if you're unhappy with fully complying with how NFC/contactless is done, you will need to pay a different way, e.g. a paper ticket. It's fairly obvious that what you did is what someone who didn't tap in would do - you're lucky you're not defending a prosecution.

This. And if you continue to do this expect to be prosecuted and go through an awful lot of hassle at some point.

Just do what everyone else does and tap your card. You’re not being at all reasonable.

 

[ainsworth74]

The definition of a ticket is given down in Byelaw 25 the interpretation section which states:

“Ticket” includes:

1. a ticket (including one issued by or on behalf of another railway undertaking) authorising the person for whom it is issued to make the journey covered by the fare paid on a train provided by an operator (whether or not it also authorises that person to make a journey on a train provided by another railway undertaking)
2. any permit authorising the person to whom it is issued to travel on a train provided by an operator (whether or not it also authorises that person to make a journey on a train provided by another railway undertaking)
3. an authority to travel on a train provided by an operator subject to a condition that payment of the correct fare for the person using that authority on which it is used is made during or at the end of that journey or otherwise as provided by the terms applicable to its use
4. a ticket authorising a person to enter a compulsory ticket area but not to make a train journey
5. any type of free pass, privilege ticket, or any warrant, identity card, voucher, or other similar authority accepted by an operator as authority to travel, or in exchange for or on production of which a ticket for travel may be issued
6. any identity card, reservation or other document required by an operator to be held or produced for use with other travel documents
7. any type of smart card, pre-pay, or other form of electronic ticket, and
8. any other ticket or document issued for the purpose of travel of any animal or article on the railway accepted by an operator

I suppose it might be possible to argue that what you presented may fit one of those definitions above (perhaps point 7) and as the definition is "includes" not "is" that would suggest it's not intended to be an exhaustive list of examples. However this feels potentially tricky and would require very careful arguing in my opinion to have a chance of success should someone actually prosecute you under byelaw.

Far better to simply tap your device on their reader when they ask you too and avoid a lot of hassle, this risk of doing so is miniscule!

 

[azOOOOOma]

I suppose if you’re not prepared to comply with their requests then you’ll need to purchase a paper ticket.

Sorry but you’re giving off vibes of someone looking for a ‘legal’ route out of illegally travelling without paying.

 

[John R]

Also, the National Rail Conditions of Travel say:-

18.1 You must show and, if asked to do so by the staff of a Train Company, hand over for inspection your Ticket and any Railcard, photocard or other form of personal identification which your Ticket requires

So you were required, if asked, to hand over your ticket, (albeit an electronic device) for inspection, at which point the staff were at liberty to tap it as part of their inspection.

Note that the conditions are very specific in that they don't exclude electronic devices from the requirement to hand over, although there is an appropriate carve out for electronic devices where it comes to retaining a ticket in the event of any problem.

https://assets.nationalrail.co.uk/e8xgegruud3g/77fuBWp62YPSrGwBP1mNQX/5f912e6484a2dc7efbad3b4ed0c9b383/National_Rail_Conditions_of_Travel_2024.pdf

 

[summie]

Sorry as I didn't finish my story so many of you think I didn't touch in. I was met by some REOs and I complied with then and they proved I did indeed have a valid ticket. I'm just curious as to the actual law.

The attached picture is what I showed them but it didn't have the touch out at petts wood so please stop with the comments that I didn't touch in.

My concerns about their security are fairly valid as I've had 7k stolen from me recently from my account and couldn't pay my employees which had untold stress. I just asked questions to the inspectors and acted fairly reasonably. They were getting agitated and wanted to escalate.

== Doublepost prevention - post automatically merged: 15 Oct 2024 ==

The definition of a ticket is given down in Byelaw 25 the interpretation section which states:



I suppose it might be possible to argue that what you presented may fit one of those definitions above (perhaps point 7) and as the definition is "includes" not "is" that would suggest it's not intended to be an exhaustive list of examples. However this feels potentially tricky and would require very careful arguing in my opinion to have a chance of success should someone actually prosecute you under byelaw.

Far better to simply tap your device on their reader when they ask you too and avoid a lot of hassle, this risk of doing so is miniscule!

Thank you. This was what I was looking for. It was a lot of hassle but I was just uncomfortable and wanted to know the law and the risks with facts not with feeling.

I get that it is easier to comply but I'm can get very bogged down in the nitty gritty. Thanks again for your thoughts.

 

[Bletchleyite]

My concerns about their security are fairly valid as I've had 7k stolen from me recently from my account and couldn't pay my employees which had untold stress.

You didn't have £7K stolen from you by way of contactless phone payment unless a reader was touched to your unlocked phone with a transaction of that on it, which you would have noticed happening. It's also very unlikely because people committing fraud of that kind wouldn't have a merchant agreement for very long. Your card or account will have been breached in another way not involving contactless payment on your phone.

However, as I said, if you're unhappy with complying to the required procedure for payment by contactless, you can choose to pay a different way, e.g. a paper ticket or (if in the area) an Oyster card without auto top up set. It is not mandatory to pay by tap in tap out contactless.

 

[reb0118]

So, the advice going forward is, if you are uncomfortable tapping your phone on an authorised person's portable device, to use an alternative form of ticketing - such as Oyster.

That said you could open a "travel & transport" account with just enough balance for travel & emergencies and use payment from that. The risk would be limited to the balance in that account

 

[signed]

My concerns about their security are fairly valid as I've had 7k stolen from me recently from my account and couldn't pay my employees which had untold stress

In the UK, contactless has a limit of £100, so unless you have 70 £100 transactions, NFC sniffing is simply just not the attack vector (not that it was an option before)

 

[methecooldude]

In the UK, contactless has a limit of £100, so unless you have 70 £100 transactions, NFC sniffing is simply just not the attack vector (not that it was an option before)

Not via Apple/Google pay. As you authenticate via biometrics you can make very large payments via it. I've made a payment over £100 via my Google Pay many times.
It is subject to the limits set by either the merchant or the payment provider

 

[skyhigh]

In the UK, contactless has a limit of £100

Not with Google/Apple Pay.

 

[signed]

Not via Apple/Google pay. As you authenticate via biometrics you can make very large payments via it. I've made a payment over £100 via my Google Pay many times

My bad, Apple Pay does says that there may be issues with more than £100

About limits when using Apple Pay in shops – Apple Support (UK)

In some countries and regions, you may need to enter your PIN, sign your receipt or use other methods of verification at the request of the merchant or card issuer.

support.apple.com

You may not be able to use Apple Pay for purchases over GBP 100.

 

[methecooldude]

My bad, Apple Pay does says that there may be issues with more than £100

About limits when using Apple Pay in shops – Apple Support (UK)

In some countries and regions, you may need to enter your PIN, sign your receipt or use other methods of verification at the request of the merchant or card issuer.

support.apple.com

Well yea, as I mentioned, it's subject to limits set by the merchant and their payment provider. If they want to say "contactless inc mobile payments are subject to £100 limit" then so be it

 

[kacper]

For your reference the official revenue inspection device in London looks like a phone with a bright thick yellow case on it, and on the screen is shown a national rail and tfl logo. Tapping your card or device to it doesn’t charge it.

 

[summie]

There seems to be a lot of side tracking. I'm being honest. I don't quite know how it happened. The bank managed to get it back. It just seems that nobody can really answer my original question. It's just easier to call me a fare evader and liar. I noticed nobody apologised for calling me a fare evader after showing you my google wallet. And I have made many purchases over £100 via contactless. To be fair it was a targeted crime on me so the chances of it happening by touching a ticket inspectors reader is unlikely as many have said but that doesn't really answer the original question. Do I have to? Is there another way to prove?

 

[skyhigh]

It just seems that nobody can really answer my original question

Your question has been answered.

Do I have to?

Yes, if you choose to use contactless you must present your card on request. If you're not willing to do that, use another method of payment.

 

[summie]

Please show me in the byelaws where that is? That's what I'm struggling to find. I can only see that I have to show them my ticket which I can do using my phone.

 

[reb0118]

Nobody is accusing you of fare evasion. However, look at it from the perspective of the revenue inspectors. In your refusal to tap your card/phone you may appear to be somebody avoiding their fare. How would your actions be seen to be materially different from someone with no valid ticket. The inspectors do not have the time to get into nuanced esoterical discussions as to what constitutes a ticket, physical or metaphysical. In their view you have accepted the terms of using a contactless card/phone for travel and must, therefore, accept the requirement to tap their device.

To reiterate my previous advice. Other ticketing options are available.

 

[skyhigh]

Please show me in the byelaws where that is? That's what I'm struggling to find. I can only see that I have to show them my ticket which I can do using my phone.

See post 5.

 

[summie]

Nobody is accusing you of fare evasion. However, look at it from the perspective of the revenue inspectors. In your refusal to tap your card/phone you may appear to be somebody avoiding their fare. How would your actions be seen to be materially different from someone with no valid ticket. The inspectors do not have the time to get into nuanced esoterical discussions as to what constitutes a ticket, physical or metaphysical. In their view you have accepted the terms of using a contactless card/phone for travel and must, therefore, accept the requirement to tap their device.

To reiterate my previous advice. Other ticketing options are available.

I completely understand what is reasonable and unreasonable. What I did must have agitated them but I am just looking directly at the law. I understand that I can use other ticketing options and what their point of view is but I would also expect a ticket inspector to know the law. Just like a police officer would tell you why you are being stopped and under what statute.

What I gave them I believe constitutes proof of a ticket. Yes it semantics but that's is what I would like a sensible discussion on.

== Doublepost prevention - post automatically merged: 15 Oct 2024 ==

See post 5.

Post 5 is what constitutes a ticket. But it doesn't specifically address the situation. Google pulled nothing but I was hoping this of you with more experience could assist.

 

[Adam Williams]

There's a lot of chatter in this thread trying to discredit OP's account of being a victim of "NFC" cloning.

The NFC data you can read from a card is enough to be able to do a "downgrade attack" and process a "contactless magstripe" transaction afterwards. Up until scarily recently, there were not sufficient controls in place to prevent this sort of attack.

Payments are a complex beast and banks/card networks are far from impervious to security issues. EMV itself has had its fair share of attacks. Instead of fixing these promptly, the UK Cards Association went after the university responsible and tried to get the research censored (twice!).

Whilst I don't disagree that the lowest-conflict route for OP would've been to simply touch the card against the reader, I don't think the way these revenue inspection devices work is particularly ideal and I can understand some nervousness to touch a device to a random card reader. Particularly if the person with the card reader has insufficient proof of identity and/or is in plain clothes.

It's very, very easy to sign up online and get a payment terminal delivered.

I have to say, the way this is done on buses is superior from a card security perspective - you get a print-out of the last 4 digits of the (D)PAN from the ticketing terminal and can then check that against the customer's card (or the details of the card used within Apple/Google Wallet's transaction history). Obviously in a rail context it's not nearly as simple as that, but let's not pretend that the approach the rail industry has taken should be immune from criticism.

 

[cool110]

The contactless conditions of use

4.2 You must be prepared to show your contactless payment card on every
journey you make with it. You must let an authorised member of staff or a police
officer inspect your contactless payment card at any time during your journey if
asked to do so. You may be asked to touch your card on their portable card reader
as part of their inspection. By touching your card on the portable card reader, you
are confirming that it is the card you intend to travel with and that you consent to the
fare being charged to your card account.

4.3 If you are found not to have touched in at the start of your journey or if your
mobile phone or contactless device has run out of battery and cannot be read, you
may be charged a maximum fare or you may be given a penalty fare or you may be
prosecuted.

 

[summie]

The contactless conditions of use

Thank you. Can you let me know where this is from please?

 

[Darandio]

Thank you. Can you let me know where this is from please?

It's linked from TfL.

 

[Adam Williams]

Particularly if the person with the card reader has insufficient proof of identity and/or is in plain clothes.

Do any TOCs proactively publish what passengers should look for in terms of proof of ID from an revenue inspector? Is there any cross-industry join-up, or does each operator do their own thing?

The only thing I'd know to be relatively consistent (and have seen before) is the RST Travel Identity Card, but that obviously isn't designed for this use-case.

 

[summie]

There's a lot of chatter in this thread trying to discredit OP's account of being a victim of "NFC" cloning.

The NFC data you can read from a card is enough to be able to do a "downgrade attack" and process a "contactless magstripe" transaction afterwards. Up until scarily recently, there were not sufficient controls in place to prevent this sort of attack.

Payments are a complex beast and banks/card networks are far from impervious to security issues. EMV itself has had its fair share of attacks. Instead of fixing these promptly, the UK Cards Association went after the university responsible and tried to get the research censored (twice!).

Whilst I don't disagree that the lowest-conflict route for OP would've been to simply touch the card against the reader, I don't think the way these revenue inspection devices work is particularly ideal and I can understand some nervousness to touch a device to a random card reader. Particularly if the person with the card reader has insufficient proof of identity and/or is in plain clothes.

It's very, very easy to sign up online and get a payment terminal delivered.

I have to say, the way this is done on buses is superior from a card security perspective - you get a print-out of the last 4 digits of the (D)PAN from the ticketing terminal and can then check that against the customer's card (or the details of the card used within Apple/Google Wallet's transaction history). Obviously in a rail context it's not nearly as simple as that, but let's not pretend that the approach the rail industry has taken should be immune from criticism.

Thank you for this additional information. It was a very stressful time and have taken steps with my bank even creating a seperate account for day to day transactions but it was crazy because they had all my card info from all accounts even as silly as my tesco club card.

 

[summie]

Thank you

It's linked from TfL.

 

[Haywain]

The question of what a ticket is can also be found in the definitions section (Appendix B) of the National Rail Conditions of Travel:

“Ticket”: means any physical or electronic document or record which entitles a passenger to make a journey on the National Rail Network between the stations or within the zones indicated by one or more of the Train Companies. An electronic document or record may consist of (but not be limited to): a Smartcard (including an Oyster or ITSO card); a payment card or identity card; a mobile telephone or tablet device; other mobile electronic device; or a database, in conjunction with an authorised Contactless Bank Card bearing the symbol described in the notices and publications of the Train Company as being valid for travel on their services. Electronic documents or records may not display the same information as printed Tickets but the conditions for use of these will explain where this information can be found. Where you have a road-enabled Mobility Scooter, a Ticket is also evidence that you are permitted to carry your Mobility Scooter (where that Mobility Scooter is permitted by the Train Company's Accessible Travel Policy –for further information see the Train Company’s mobility scooter policy). If you are making a journey using a combination of Tickets, each Ticket must be used in accordance with these Conditions;