counterfeit season ticket

[AM1]

At manchester victoria ive just seen a gentleman being cautioned for what I can gather is a counterfeit ticket as the BTP officer quoted a value and quoted the ticket number. As it was in a wallet I think it shows how serious Northern are now getting.

He's exactly the sort of offender they should be going after and I'm glad to see that sort of tug rather than the easy pickings they've been taking where people trying to buy a ticket at their destination are refused and threatened with magistrates before being offered a fixed penalty.

 

[yorkie]

There is apparently a production facility of fake tickets in Romania*, they even work the gatelines and are very realistic-looking. Apparently a high proportion of paper Travelcards used at certain stations are fake. I was surprised at how big the problem is and how convincing the tickets are.

(* Though no traces of horse-meat have yet been found in these products )

 

[michael769]

I was surprised at how big the problem is and how convincing the tickets are.

With annual seasons costing thousands of pounds (more than a cheap second hand car) it may not be so surprising - where large sums of money are involved on can expect to find large organised crime rings!

 

[maniacmartin]

Someone in revenue control showed me a fake ticket. It was a monthly zones 1-6 travelcard. Apparently they are traded for a whopping £25! They are surprisingly real-looking, and apart from a few errors it would be very hard to distinguish them from real tickets.

 

[jon0844]

Why do fakes always have errors? I am amazed someone can't make a copy without mistakes. Counterfeit cash is one thing, as there are loads of security features - but a train ticket?

I'd have thought that with no form of encryption you could EASILY produce a valid magstrip code that would work a gate.

It doesn't therefore surprise me at all that there are loads of fakes in circulation - and this is perhaps another good reason to get as many people are possible over to using smartcards. You might still have problems with fakes for singles/returns, but for a season ticket holder I can't imagine anyone preferring to have a paper ticket.

 

[michael769]

Why do fakes always have errors? I am amazed someone can't make a copy without mistakes.

Well perfect fakes will be undetectable so may never be uncovered. It is possible that the ones with errors are the only ones being detected.

but for a season ticket holder I can't imagine anyone preferring to have a paper ticket.

Unless they want to use a fake one!

 

[jon0844]

Indeed, which is why paper tickets for seasons should be scrapped - and most people won't miss them one bit.

I'd like to see only smartcards in use, but accept that for some time there will be people just walking up who haven't got one (and a smartcard isn't cheap enough to just issue from a machine for a single ticket!).

But for a season ticket, you need to go through a process to get one - and have a photo ID (another thing that seems easy to fake, so you could have a duplicate season and just have another ID to match the number) so it's quite simple to ONLY offer smartcards and thus there won't be (many) high value tickets in circulation.

Is it worthwhile getting a fake daily Travelcard in comparison to a monthly or annual season? Perhaps, but I'd say it wouldn't be anywhere near such a big deal.

The other benefit to the season ticket holder is that they can get multiple replacements as the lost/stolen cards can be killed.

Sure, there will no doubt come a time where someone can encode a smartcard with fake data to operate gates but I am sure it will be harder and can be countered with new encryption codes/cards as required.

There's one good thing about loads of fake tickets being used; it will finally get the industry to speed up the introduction of smartcards!!

 

[island]

This is a perfect reason why people should not be waved through manual gates with a flash of their season. It's not going to kill them to take it out of the wallet twice a day.

 

[jon0844]

I only ever had my season inspected close-up (taken out of ticket wallet) once in almost ten years, and even that was only because of the RPI concerned being desperate to get back at me!

Besides that physical examination of the ticket, the only other checks were done by inspectors at King's Cross underground station - after exiting the station. Here I was asked a few times to show my ticket (but not removed from the wallet) and my photo ID, with a check that they matched. I was always allowed on my way in seconds, and realised after that they'd set the gates to flag up high-value tickets on exit so it wasn't random!

Seems to me rather ironic that it's only LUL that has ever taken any real interest in checking for fraud on tickets worth many thousands of pounds!

 

[ainsworth74]

It's not going to kill them to take it out of the wallet twice a day.

But judging from other threads is might kill the ticket!

 

[JamesRowden]

A system to stop this fraud might be to give each individual ticket a unique identification number that a ticket barrier or ticket inspector would use to reference it on a national database to check the details of the ticket (would require a national ticket data network with a wireless data update to the ticket inspectors machine at each station) and could be implemented with both paper and smart tickets.

A paper ticket's identification number could be reused after it has expired.

A fake ticket could therefore not be made unless the details of one that exists were cloned.

If a clone was made of a season ticket, suspicious behavior could be identified by logging the use of each ticket and identifying ananomies (e.g. the same season ticket being used for multiple journeys at the same time).

 

[sheff1]

..... a smartcard isn't cheap enough to just issue from a machine for a single ticket!

The Porto Metro issues a smartcard for a single ticket. You can then either throw it away after your journey or save it to load different tickets (for single or multiple journeys) at a later date. The incentive to keep it for future use is the €0.50 supplement for the card.

 

[michael769]

To be honest the relatively lower value of most single/return tickets means that there is less incentive to forge (or seek out forged) tickets, so I'd be surprised if fake single/returns was a major issue.

There are far simple (and lower risk) ways to avoid paying fares for this group of users.

But smart cards should not be considered a perfect solution to the problem. Yes they will be much harder to fake and that will seriously reduce the problem but with long distance seasons costing more than a brand new car the incentive to invest in defating smart card security measures will be there.

 

[jon0844]

Most technology can be hacked but it's no reason not to use it. It will be harder and measures can be taken to reduce the chances but that's not to say the industry wouldn't become complacent.

That wouldn't be the fault of a smart card system though.

 

[yorkie]

Why do fakes always have errors?

Usually, but not always.

A couple of years ago someone who worked on a gateline showed me a fake ticket that he confiscated that looked very realistic, but we were both able to identify things wrong with the ticket. Unfortunately his manager was not supportive and didn't think it was fake and wouldn't take it any further.

However, more recently I've been shown another fake ticket, and although I only saw an image of it, I could not tell anything wrong with it at all. It was very professionally done. Definitely an organised crime gang behind it.

 

[Deerfold]

A system to stop this fraud might be to give each individual ticket a unique identification number that a ticket barrier or ticket inspector would use to reference it on a national database to check the details of the ticket (would require a national ticket data network with a wireless data update to the ticket inspectors machine at each station) and could be implemented with both paper and smart tickets.

A paper ticket's identification number could be reused after it has expired.

A fake ticket could therefore not be made unless the details of one that exists were cloned.

If a clone was made of a season ticket, suspicious behavior could be identified by logging the use of each ticket and identifying ananomies (e.g. the same season ticket being used for multiple journeys at the same time).

Unfortunately the current barriers aren't sophisticated enough to support this.

So you'd need to roll out new barriers everywhere too.

I'd like to see only smartcards in use, but accept that for some time there will be people just walking up who haven't got one (and a smartcard isn't cheap enough to just issue from a machine for a single ticket!).

I think the cards themselves are cheap enough - the reason for the charge is because the PAYG used in London allows negative balances.

In Venice shorter travelcards (from 12 hours) are issued on cardboard smart cards which are presumably cheaper than plastic ones with no charge mad for the smartcard (but you can top one up online so you don't have to queue again).

 

[jon0844]

Cardboard tickets in Venice.. they must be really soggy.

I am sure NFC cards will become extremely cheap sooner or later. You can now buy business cards with NFC tags in them (but presumably a lower memory capacity) so I guess we might soon see smartcards replacing all paper tickets. Can't happen soon enough in my opinion.

Yes, you'll need to have more machines to let people view what's on their card (and of course, with everyone having a smartphone that has NFC by then, you can read your own ticket on that too - including additional information).

2013 might be a year that sees the smart watch taking off (if not this year, perhaps next) and one feature is being able to relay important information to your watch - so checking that for your seat reservation will be easier than looking at your phone display, for example.

Google Now already shows localised information on the latest Android phones, so with GPS knowing where you are, your phone could already show real time train information and reservation details right now - having the watch as a second screen suddenly seems practical (unlike the silly idea of using your watch to talk into or use for video calling).

 

[DelayRepay]

In my work (non-railway) I've seen an increase in counterfeit documents over the last 12 months. Without going into too much detail the fraudsters have got clever and can replicate the majority of security features e.g. watermarks, holograms. Given that rail tickets don't have any of these features, I'm not surprised that forgeries are on the increase.

Knowing what I do about conterfeiting, I would suggest that it wouldn't be too difficult to create your own tickets. I'm not about to try this! But the railway does need something more secure than a printed piece of card which easily fades, if they're going to combat this problem.

Smartcards would seem an ideal solution, as would a national season ticket database against which the photocard could be checked.

 

[PaxVobiscum]

Knowing what I do about conterfeiting...

My evidence for this post being a fake.

 

[Deerfold]

Cardboard tickets in Venice.. they must be really soggy.

Despite very high flooding and heavy snow they retained structural integrity.

It probably helped that in the 5 days we were in Venice I only had to take them out of my wallet to validate them the first time I used them, twice for barriers (that's new in Venice and potentially annoying) and twice for ticket checks. A tourist card for 7 days is 50 euros, an on the spot payment of 56 euros is required if you've boarded without a ticket and don't tell staff as soon as you board.

 

[185]

At manchester victoria ive just seen a gentleman being cautioned for what I can gather is a counterfeit ticket as the BTP officer quoted a value and quoted the ticket number. As it was in a wallet I think it shows how serious Northern are now getting.

He's exactly the sort of offender they should be going after and I'm glad to see that sort of tug rather than the easy pickings they've been taking where people trying to buy a ticket at their destination are refused and threatened with magistrates before being offered a fixed penalty.

Agree. All this time spent chasing those with no ticket, means Northern were missing the large number of forged/altered ones, subsequently intercepted by other operators.

Smart ticketing is the answer with embedded RFID data. Confirming what's written on it.

 

[swj99]

........I'm not surprised that forgeries are on the increase................
........Smartcards would seem an ideal solution, as would a national season ticket database against which the photocard could be checked.

There were some ticket blanks on ebay, with a link posted on this very forum not very long ago, so it is hardly surprising.

I'm not sure how secure smartcards really are. Basically, the idea of trying to make it more difficult for people to get away with not having a legitimate ticket, whether it's a paper one or an electronic one, is similar to moving the goalposts in a football game. All that happens is that the determined people change the direction they kick the ball, in this case by finding loopholes in any new system.

For example, when chip and pin bank and credit cards were introduced, the banks said they were secure, but card fraud still happens. In an episode of The Real Hustle, someone demonstrated how it was possible to clone a cashpoint card onto a mobile phone top up card. Basically, the idea of trying to make it more difficult for people to get away with not having a legitimate ticket, whether it's a paper one or an electronic one, is similar to moving the goalposts. All that happens is that the determined people change the direction they kick the ball, in this case by finding loopholes in any new system.

 

[jon0844]

The Real Hustle was of course very fake, in that everything was staged. Based on facts, perhaps twisted a little, and not necessarily showing that many scams are rather hard to do if people aren't simply acting as dumb marks to get conned!

But, I do agree that smartcards will (and must already be) targeted for scams and I am sure the clever organised criminals in China, Singapore and Eastern Europe are probably doing all sorts of great things. You can however better protect them than a paper ticket - and it all comes down to how much money you're willing to spend (in many cases, some fraud is accepted if it's not widespread or well known).

For me, smartcards offer many benefits and will be far more convenient for me to use - especially if I could interrogate the card from my NFC phone or even buy a ticket on my phone and download it to the card with a single tap.

 

[Nick W]

For example, when chip and pin bank and credit cards were introduced, the banks said they were secure, but card fraud still happens.

Can you give an example of fraud involving chip and pin? I do not believe such fraud occurs except for the occasional and very rare software exploit.

Having looked at http://en.wikipedia.org/wiki/EMV#Vulnerabilities, it seems all vulnerabilities involve "swipe + pin" or "chip and chip".

 

[swj99]

Can you give an example of fraud involving chip and pin?

http://www.bbc.co.uk/news/technology-19559124

http://www.thisismoney.co.uk/money/...ip-pin-fraud-Its-YOUR-fault-insist-banks.html

 

[Nick W]

http://www.bbc.co.uk/news/technology-19559124

"The attack uses an electronic device as a "man-in-the-middle" in order to prevent the PIN verification message from getting to the card, and to always respond that the PIN is correct. Thus, the terminal thinks that the PIN was entered correctly, and the card assumes that a signature was used to authenticate the transaction (see bottom part of above figure)."

So that's "chip and sign" not "chip and pin". The attack would not exist if only chip and pin was allowed.

 

[DelayRepay]

I'm not sure how secure smartcards really are. Basically, the idea of trying to make it more difficult for people to get away with not having a legitimate ticket, whether it's a paper one or an electronic one, is similar to moving the goalposts in a football game. All that happens is that the determined people change the direction they kick the ball, in this case by finding loopholes in any new system.

I'm not denying that fraudsters will catch up. The aim is to keep one step ahead of them, or make fraud so difficult or expensive that they give up and go somewhere else.

You mention credit cards. By far and away the vast majority of card fraud I see (and I see a lot) involves the customer having disclosed their PIN to the fraudster somehow, either via a device attached to an ATM, by being "shoulder surfed" or by being stupid and keeping it written on a piece of paper wrapped around their card. Chip and PIN is secure. The item you mentioned on the Real Hussle would have involved using the data from the magnetic strip, not the PIN. A few ATMs will revert to reading the mag strip data if they can't read a chip, but the majority now will decline the transaction. My bank has further controls around this but I won't say any more

Smartcards on their own won't stop fraud but they could reduce it significantly.

 

[michael769]

Can you give an example of fraud involving chip and pin?

http://news.bbc.co.uk/1/hi/england/4980190.stm
--- old post above --- --- new post below ---

For me, smartcards offer many benefits and will be far more convenient for me to use - especially if I could interrogate the card from my NFC phone or even buy a ticket on my phone and download it to the card with a single tap.

But offering such a capability will make it impossible to use very secure closed encryption to protect the card. Basically if you can read it so an a criminal who can write the details read onto a blank card.

As a general rule security and convenience are mutually exclusive, most real world applications require an appropriate trade off between security and convenience.

 

[DelayRepay]

You could still make it secure. If we're only talking about seasons, you analyse journey patterns to identify cases where the same season ticket was being used twice, and kill both tickets. When the holders try to touch out the barriers would alert the RPI. If they stopped the genuine ticket holder, they could replace the ticket and send them on their way. If they stopped the counterfeit ticket holder then they would summon the police.

 

[michael769]

You assume it will always be possible to identify the true owner from the criminal.

I can also, off the top of my head think of at least two simple ways to defeat your approach, I am confident a determined criminal would with a little more time come up with more (just as they defeat the systems banks have in place to detect fraudulent card use).

It is not possible to devise a usable system that is perfectly secure, all you can hope for is to make it hard enough to defeat that you reduce the number of criminals able and willing to abuse it to a manageable level.