Contactless card on the underground

[jon0844]

Yes! Good for coffee shops no doubt?!

Yeah, I'm sure. There's every chance you'll find a Caffe Nero or Starbucks easier than an ATM!

 

[radamfi]

When you think about it, there had to be some kind of security measure. Otherwise you would be able to steal a contactless card and use it on buses forever.

Is there a fixed number of times that the card can be used without a PIN, or does this number change? Is it possible that you could use the card with a PIN, and then need to use the PIN after only a few more uses?

How are stolen Oyster cards prevented from being used on buses forever?

 

[jon0844]

When you think about it, there had to be some kind of security measure. Otherwise you would be able to steal a contactless card and use it on buses forever.

I totally understand the reasons for it, but that security measure effectively has a downside. In most establishments you'll have the fallback of being able to put your card in a reader and enter a PIN.

A bus, or tube gate, doesn't have that option. In fact, I'm struggling to think of another example where there's no fallback - and the only one I can think of is a vending machine. But not being able to get a bottle of coke or a Mars bar is probably less of an inconvenience than being chucked off a bus.

How are stolen Oyster cards prevented from being used on buses forever?

I presume the machine in the bus is updated at least every 24 hours with serial numbers of cards not to accept (and kill when touched).

The financial impact of having a whole day of free transport is pretty minimal.

 

[maniacmartin]

These questions have come up in threads before. I'll try to summarise

The limits are set by your bank and stored on the chip. It can depend on number of transactions since PIN entered, cumulative spend since then, the value of the current transaction and the merchant's floor limits. The values can be changed by the bank when you next do a Chip + PIN transaction (and should reset every time).

Regarding Oyster cards, the card stores the balance on the card itself. The accounts on Oyster are reconciled every night overnight by their central computer systems which take data from all of the gatelines, buses, etc. Cards that are reported lost or stolen or are overdrawn are added to a blacklist of card numbers which is downloaded onto Oyster readers, causing them to reject that card in future.

 

[hassaanhc]

Of course, it's perfectly fine if you use your cards PIN number every so often... I only have one contactless card that has ever declined a transaction with a PIN request, because I only ever use that card for contactless and online transactions so every so often Barclaycard like to know it's still me using it.

Every other contactless card I have has never asked for a PIN on a contactless transaction because I use the PIN for other transactions regularly enough.

Wow, I never realised that using the standard Chip & PIN validation regularly enough also counted for the contactless PIN validation. I've used contactless over 30 times since I got the card last September but as I regularly end up finding contactless not available (e.g. railway TVM) and having to use PIN I haven't been asked for a PIN validation at all using contactless. The guidance I got from my bank with the card implied that every 10-20 times I used contactless I would get asked for a PIN, with no mention that using traditional Chip & PIN payment would "reset" the counter. I was stumped over not getting asked for a PIN with contactless :P

 

[radamfi]

Cards that are reported lost or stolen or are overdrawn are added to a blacklist of card numbers which is downloaded onto Oyster readers, causing them to reject that card in future.

Surely there must be a vast number of cards that have been blacklisted? Can the bus ticket machine check against all those numbers in a fraction of a second? Does the ticket machine even have enough memory?

 

[Deerfold]

Surely there must be a vast number of cards that have been blacklisted? Can the bus ticket machine check against all those numbers in a fraction of a second? Does the ticket machine even have enough memory?

They only need to be blacklisted if they've been stolen and not deactivated, recovered or expired so cards will disappear from the list too.

 

[radamfi]

Once capping works for contactless cards, people could be touching in and out several times a day, especially if make several changes en route, use pink validators or using out of station interchanges. If each touch in/out counts as a use of the card, then there's a higher chance of reaching the limit for contactless transactions.

 

[jon0844]

It's definitely going to be a problem unless the banking industry can implement a way of avoiding the PIN request for when a card is presented for travel. A sort of override system, activated when you touch against certain readers.

And that obviously brings with it a certain level of risk that will have to be assessed as to whether it is acceptable or not for the added convenience (or, actually, reducing the obvious inconvenience that will occur otherwise).

 

[Be3G]

Once capping works for contactless cards, people could be touching in and out several times a day, especially if make several changes en route, use pink validators or using out of station interchanges. If each touch in/out counts as a use of the card, then there's a higher chance of reaching the limit for contactless transactions.

Indeed. Thinking about myself, I perhaps make a chip-and-pin purchase or withdrawal using my debit card once a month, but probably catch about 15 buses a week. So maybe I'll have to stick to the Oyster after all…

 

[island]

A balance enquiry at an ATM will also reset the counter, but I agree that TfL doesn't seem to have quite thought this true.

 

[DavyCrocket]

A balance enquiry at an ATM will also reset the counter, but I agree that TfL doesn't seem to have quite thought this true.

I am part of this trial and have collected the card to be used for TfL contactless payments- starts on 3 February. It's just a standard Barclaycard for Business credit type card.

 

[andrewkeith5]

Wow, I never realised that using the standard Chip & PIN validation regularly enough also counted for the contactless PIN validation. I've used contactless over 30 times since I got the card last September but as I regularly end up finding contactless not available (e.g. railway TVM) and having to use PIN I haven't been asked for a PIN validation at all using contactless. The guidance I got from my bank with the card implied that every 10-20 times I used contactless I would get asked for a PIN, with no mention that using traditional Chip & PIN payment would "reset" the counter. I was stumped over not getting asked for a PIN with contactless :P

Indeed! The whole purpose of Contactless is to make peoples lives easier, not harder! The only reason for the PIN requirement is to make sure its still the cardholder in possession of the card - the bank obviously knows this if you use the PIN regularly enough in normal transactions.

The number of transactions and total value changes dynamically based on your account usage - for example on my credit card (which I only use online and for Contactless) the limit is low and I get asked for a PIN frequently. My debit cards I use for regular chip and PIN and contactless transactions and have never been asked for my PIN when paying contactless.
--- old post above --- --- new post below ---

Once capping works for contactless cards, people could be touching in and out several times a day, especially if make several changes en route, use pink validators or using out of station interchanges. If each touch in/out counts as a use of the card, then there's a higher chance of reaching the limit for contactless transactions.

Its only the transactions that add up to the card usage limit. If someone with any amount of sense has implemented the system, 'validation' taps (e.g. touch in, pink validations) won't add to the transaction limit.

Similarly, from my understanding of the contactless implementation at present, only one charge is made per day irrespective of the number of taps - therefore heavily reducing the number of transactions and the chance of a PIN request.

In addition, if only one transaction per day is made, there is inherent security from the fact that the cast, vast majority of people would realise if their card had been lost/stolen and report the fact to the bank by the end of the day - thus the maximum loss would be the daily cap, which is well within the contactless single transaction limit, which ought to be refundable under normal cardholder protection schemes.

 

[Be3G]

A balance enquiry at an ATM will also reset the counter, but I agree that TfL doesn't seem to have quite thought this true.

Of course, but that's only useful if one's contactless card stops working at a bus stop right next to such a machine. My point was that with all the buses I catch and the infrequency of me entering my pin in normal use, it seems quite likely I could end up, say, trying to board a W10 and being refused entry!

(I know you're not disagreeing with me by the way – I just wanted to clarify my point anyway.)

 

[Brucey]

Could bus drivers not be provided with small cheap handheld offline chip and PIN devices (like those used for online banking) to validate a PIN and unlock the contactless feature? Of course it would slow down the boarding process, but would have the benefit of not leaving people stranded.

 

[87 027]

I don't use contactless myself but would validating the PIN in the online banking device from time to time also count as a reset?

 

[island]

Good question. I really ought to know this, but I don't.

 

[Be3G]

A good question indeed. My bank doesn't currently force customers to use such a device, but I log in to online banking once a week to reconcile statements so if they did provide a contactless reset, I'd apply for a card reader and that'd be an excellent solution.

 

[talldave]

I suspect that it doesn't because it's an "offline" PIN validation, so no opportunity for the card to have its limits/PIN count reset.

I'd suggest asking at the bank but I doubt they'd know the answer - especially if it's Barclays.

 

[Brucey]

I suspect that it doesn't because it's an "offline" PIN validation, so no opportunity for the card to have its limits/PIN count reset.

I'd suggest asking at the bank but I doubt they'd know the answer - especially if it's Barclays.

The PIN counter and limits are held within the chip on the card, so an offline transaction (e.g. on a train) can reset the counter.

 

[a729]

I wish I'd seen that before I filled in my (already negative) response to the cashless buses consultation last year. I find this statement particularly ironic:



If we're all being encouraged to use contactless bank cards where possible rather than Oyster (meaning some people will surely stop carrying Oysters eventually), and the facility to pay with cash is removed, what exactly is the passenger expected to do?! Not every bus stop in London is conveniently located next to a shop or ATM.

If it's night and the driver thinks you're 'vulnerable' you can get a UFN.

I still think it's a bad idea though!
--- old post above --- --- new post below ---

When you think about it, there had to be some kind of security measure. Otherwise you would be able to steal a contactless card and use it on buses forever.

Is there a fixed number of times that the card can be used without a PIN, or does this number change? Is it possible that you could use the card with a PIN, and then need to use the PIN after only a few more uses?

How are stolen Oyster cards prevented from being used on buses forever?

I think it's about every 3-5 Contactless transactions.

I agree that contactless will increase fraud- after all it means that a CPC can be even more lucrative than £20 note for pickpockets

 

[Panda]

Is there an actual link between the chip and the NFC chip on the card? Does it not just ask for a PIN for that specific retailer and then reset the count any way? What doesn't make sense to me, is how the chip & PIN device can reset the count on the NFC chip when the NFC reader decides to double check the PIN of the card.

My thinking would be that a company like TfL would have enough influence to change the way that contactless technology works in order to prevent the system in some cases of asking for PINs. I would imagine that if TfL guaranteed that in the case of a card reported stolen, they would not deduct the fare from the cardholder's account when reconciling with the banks (or issue a refund afterwards if there is a delay in the card being reported), that would be enough for the banks to allow TfL not to have to do these security checks?

 

[a729]

Could bus drivers not be provided with small cheap handheld offline chip and PIN devices (like those used for online banking) to validate a PIN and unlock the contactless feature? Of course it would slow down the boarding process, but would have the benefit of not leaving people stranded.

That could encourage fraud!

 

[wyvfe1]

I think that's a fair point. I use my card contactless as often as I can, and obviously that does sometimes mean being asked to enter a PIN.

That's fine, but does it therefore mean I have to try and make sure to deliberately use C&P just in case I might want to use a bus later?

I'm sure we've already seen what happens when someone gets on and their Oyster doesn't work.. They try over and over, perhaps try and plead with the driver, and then get told to get off and sort it out.

If that's what will happen to people who have a card that HAS got the funds, it's not going to very popular - and that's before the likes of Watchdog and the Daily Mail get involved.

I've a contactless Barclays sticker, supposedly meant to be stuck on the back of a mobile phone (NFC Style).

I've been to McDonalds where their contactless reader has requested authorisation by inserting the card into the reader, but the sticker has no chip and I'm forced to pay by cash or get out another card.

On My Credit card the contacless reader has never asked for a PIN but has asked me to insert the card into the reader where it then asks for the PIN

 

[Hyphen]

What doesn't make sense to me, is how the chip & PIN device can reset the count on the NFC chip when the NFC reader decides to double check the PIN of the card.

As I understand it, contactless transactions must all happen online. Therefore it would be the bank's backend payment systems that count the number of uses, then make the request for a chip transaction. The NFC reader simply respond to the bank's requests - they don't themselves decide to request chip payment. Once a chip transaction takes place, the count is reset on the bank's backend and will allow further contactless transactions.

Anything that needed to be updated on the NFC card's storage would happen during the next contactless session - much like offline chip cards get updated the next time an online transaction is made.

 

[a729]

As I understand it, contactless transactions must all happen online. Therefore it would be the bank's backend payment systems that count the number of uses, then make the request for a chip transaction. The NFC reader simply respond to the bank's requests - they don't themselves decide to request chip payment. Once a chip transaction takes place, the count is reset on the bank's backend and will allow further contactless transactions.

Anything that needed to be updated on the NFC card's storage would happen during the next contactless session - much like offline chip cards get updated the next time an online transaction is made.

I see , hence people with bad credit histories won't be able to get contactless cards

 

[swt_passenger]

I thought the big idea with the TfL system (as in fact mentioned a couple of times earlier in the thread) was that contactless transactions would be batched up over the course of a day, and only the daily total (including any capping) would be sent to the bank? That definitely suggests that if it is the bank that is calling for pin verification that won't happen at ticket barrier lines, because TfL won't be passing the individual transactions to the bank in real time?

Eg from this description in computer world:

...Cowen explained that with the introduction of NFC technology on the network, TfL is hoping to reduce this complexity by bringing all the calculations into the back-office, rather than trying to do it in real-time and update it each time the card gets tapped.

"It makes much more sense to do that complex fare calculation in the back office. As you travel around the system, what you will be doing is effectively creating a record of each of those places and times that you tapped. TfL, in the back-end, will then say person X tapped his or her card in these ten different places throughout the system over the day – that adds up to a total value of X," said Cowen.

"TfL will then take a payment from that person’s account for that amount on a daily basis. Then if you want to understand how that amount was determined, you can go to the TfL website to see how it is broken down."

http://www.computerworlduk.com/in-d...s-nfc-contactless-payments-strategy-for-2013/

 

[Deerfold]

I thought the big idea with the TfL system was that contactless transactions would be batched up over the course of a day, and only the daily total (including any capping) would be sent to the bank? That suggests that if it is the bank that is calling for pin verification that won't happen at ticket barrier lines, because TfL won't be passing the individual transactions to the bank in real time?

I did wonder if that might be the case (especially with Monday-Sunday capping being introduced).

Has anyone experienced a contactless card asking for confirmation and not having been permitted to board a bus?

 

[island]

Contactless transactions are processed offline and uploaded at the end of the day.

As for the contactless card "tags" attached to phones, I understand that these can never go online and at a guess are programmed to reject every Nth transaction. This theory would need to be tested of course.

 

[Hyphen]

That definitely suggests that if it is the bank that is calling for pin verification that won't happen at ticket barrier lines, because TfL won't be passing the individual transactions to the bank in real time?

That sounds about right to me. It would therefore be TfL accepting the risk from declined payments, rather than the banks.

I'd imagine on stations (not buses) that with the first touch of the day TfL would be able to make a pre-authorisation on the card (much like some hotels prefer to do) to check enough money for the daily cap is in the account. I don't think that would add to the contactless count, as no money transfer takes place.

.As for the contactless card "tags" attached to phones, I understand that these can never go online and at a guess are programmed to reject every Nth transaction. This theory would need to be tested of course.

The contactless card 'tags' are no different from the NFC logic inside a credit/debit card. They will go online with every touch (the online element is between the NFC reader and the bank, via the retailer's EPOS).

With the tags, rather than putting that same piece of plastic in a chip and pin reader, you simply have a corresponding card which you need to present if PIN authorisation is required. The count is then reset on the bank's end, and anything which needs to be updated on the NFC tag happens during the next touch.