TOD same/any card collection

[crablab]

As we all hopefully know, TVMs are changing to request the TOD collection reference upfront. If no card collection was specified, then that's it - you go straight to the printing screen.

Otherwise, you have to present either any card or the same card that was used for the payment.

(Previously this was the other way around: you always had to present a card, and you had to do that before entering the reference)

It's now possible to collect tickets without a card at all.

This caught me out today. After months of LNER not setting that flag (and not needing to present a card), it was set to 'same card collection' this morning.

There is nothing which I can see in the app to indicate:
a) that this flag is even set
b) that it was same card, rather than any card

As passengers get used to not needing the card to collect tickets, should retailers now be explicitly highlighting the card collection setting in the purchase flow so passengers can make an informed choice about whether they wish to purchase through that retailer?

Trainsplit, for example, don't set this flag.

I can see the "random" setting of card collection being more problematic than consistently requiring it!

(LNER did tell me they'd set this, at the bottom of a long confirmation email that I never read, as I buy the same ticket several times a week. It's not visible in the app, which I used to buy the ticket)

 

[styles]

I really despise this flag and wish it would be abolished or at least made an explicit opt-in for the person booking the tickets.

When I worked for a small charity, because we didn't have business accounts set up with any of the retailers, this flag used to be set by default, but the problem was the treasurer was booking the tickets and I was the one collecting them and travelling. It caught me off guard a couple of times, and in the last encounter a bit of a 'debate' with a ScotRail ticket office worker who didn't want to print the tickets despite all the evidence I was showing of the tickets being for me.

I also had an issue when I paid with a virtual credit card, which obviously couldn't be inserted into the TVM and the contactless reader didn't work for this purpose either. Went to the ticket office counter and showed them me opening my credit card app then the full PAN on the card inside the app matching the digits they had available for the booking (probably just the last 4 digits). No debate or anything this time but could tell the staff member was uneasy about doing it for some reason.

Edit to add: one edge case I had. I had about a dozen bookings I wanted to collect tickets for, as I was doing a lot of travel at the time. After using the same credit card to collect something like 3 bookings, it then started refusing my credit card for collecting tickets even though they were set to any card. I assume this is some anti fraud measure or something, and I appreciate this won't be a common problem, but it was a bit of a pain, as I don't carry lots of payment cards.

 

[Haywain]

After months of LNER not setting that flag (and not needing to present a card), it was set to 'same card collection' this morning.

I’m not sure that LNER have at anytime removed their insistence on same card collection. Perhaps @Wallsendmag can confirm?

 

[Bletchleyite]

I’m not sure that LNER have at anytime removed their insistence on same card collection. Perhaps @Wallsendmag can confirm?

Presumably it's any card if using Apple Pay as that (unlike Google Pay) does not give the merchant the original card number? Or do they not offer Apple Pay?

 

[styles]

Presumably it's any card if using Apple Pay as that (unlike Google Pay) does not give the merchant the original card number? Or do they not offer Apple Pay?

Yes, which is why I have mostly switched to buying rail tickets with Google Pay or PayPal.

 

[crablab]

I’m not sure that LNER have at anytime removed their insistence on same card collection

Ah, thanks. perhaps it's because my purchases of late have been all or part funded by a voucher.
I didn't expect this to differ depending on whether card was used for part or all of the payment.

It does seem a little archaic...

In any case, I think the general point I'm making stands about the lack of visibility and poor user experience As we know, this is particularly problem for virtual cards (irrespective of the unique Chase situation), which are increasingly common.

 

[ainsworth74]

It does seem a little archaic...

Well duh, this is the railway industry! If they can find the most un-customer friendly way of doing anything they'll make sure they do that first because of some perceived risk of fraud or other misuse, only to eventually work out that they're being stupid and change their mind and then realise that not only is it better for passengers it's even better for them as well (think m-tickets to e-tickets).

It therefore should be no surprise that the approach to collecting tickets from TVMs is done as badly as possible and in such a way that buying from one retailer results in one sort of experience and from a different retailer the same tickets give a completely different experience

 

[styles]

Well duh, this is the railway industry! If they can find the most un-customer friendly way of doing anything they'll make sure they do that first because of some perceived risk of fraud or other misuse, only to eventually work out that they're being stupid and change their mind and then realise that not only is it better for passengers it's even better for them as well (think m-tickets to e-tickets).

It therefore should be no surprise that the approach to collecting tickets from TVMs is done as badly as possible and in such a way that buying from one retailer results in one sort of experience and from a different retailer the same tickets give a completely different experience

Then people wonder why passengers lap up Trainline when they're offering new features which make their travel experience less bothersome.

 

[crablab]

It therefore should be no surprise that the approach to collecting tickets from TVMs is done as badly as possible and in such a way that buying from one retailer results in one sort of experience and from a different retailer the same tickets give a completely different experience

I'm just too idealistic, thinking someone might have considered the user experience!

In fairness, at the time TOD came into use, online payments were less common than they are now. Without 3DS (and equivalents) there was quite a substantial fraud risk, using the railway to cashout illicitly obtained card details for high value/resellable tickets which might later be subject to chargeback.

But this has not been the case for over a decade. Even before SCA (Secure Customer Authentication), merchants who failed to do 3DS were liable for fraud related chargebacks - there is no floor limit and no defence to a properly processed fraud chargeback in these circumstances. So most retailers have been putting people through 3DS challenges anyway, to mitigate chargeback risk.

There is now a legal obligation (in PSD2) for merchants to carry out SCA, which means 3DS. So "same card collection" is at worst redundant, and at best actively hostile to customers.

This is particularly the case as increasingly physical cards are not issued, are not carried or do not have matching PANs.

I would suggest either:
- any/same card collection is just disabled. I don't see what risk it mitigates
- RDG Accreditation should require retailers to clearly and explicitly disclose to customers that they will be required to present same/any card on collection, and this must be highlighted as a restrictive term in the purchase flow.

It's not good enough to hide it at the bottom of a confirmation email, after the passenger has checked out.

 

[styles]

I'm just too idealistic, thinking someone might have considered the user experience!

In fairness, at the time TOD came into use, online payments were less common than they are now. Without 3DS (and equivalents) there was quite a substantial fraud risk, using the railway to cashout illicitly obtained card details for high value/resellable tickets which might later be subject to chargeback.

But this has not been the case for over a decade. Even before SCA (Secure Customer Authentication), merchants who failed to do 3DS were liable for fraud related chargebacks - there is no floor limit and no defence to a properly processed fraud chargeback in these circumstances. So most retailers have been putting people through 3DS challenges anyway, to mitigate chargeback risk.

There is now a legal obligation (in PSD2) for merchants to carry out SCA, which means 3DS. So "same card collection" is at worst redundant, and at best actively hostile to customers.

This is particularly the case as increasingly physical cards are not issued, are not carried or do not have matching PANs.

I would suggest either:
- any/same card collection is just disabled. I don't see what risk it mitigates
- RDG Accreditation should require retailers to clearly and explicitly disclose to customers that they will be required to present same/any card on collection, and this must be highlighted as a restrictive term in the purchase flow.

It's not good enough to hide it at the bottom of a confirmation email, after the passenger has checked out.

3DS and SCA affect the point of purchase though, not the point of collection (where no authorisation is made, e.g. PIN, signature, 3DS), so it has never really made any sense to require the same card to be used for collection.

There is arguably a small risk of somebody seeing a ticket collection reference on somebody's screen then going to a collection point and collecting their ticket. But this is such a low risk opportunistic situation that I'd be surprised if the industry even had data on its abuse. I mean, if I've got a ticket from say Nottingham to Chester, and somebody sees the collection reference, this is only of use to them if they're going west from Nottingham, and have a stolen physical card to insert into the machine to conceal their real identity, and beat me to the machine, and then board the train before someone in a CCTV control room tracks them down, and actually knows the journey details to know the ticket will be valid for the journey they want to make, and etc etc.

 

[crablab]

3DS and SCA affect the point of purchase though, not the point of collection (where no authorisation is made, e.g. PIN, signature, 3DS), so it has never really made any sense to require the same card to be used for collection.

Reread my post It would have made sense in the past as there was a cashout vector.

Cards were being 'skimmed' or leaked (pre-PCI DSS) and large lists being sold on the internet.

Card details obtained this way could have been used to purchase train tickets which would have then been collected (and either resold or used), with essentially no way to invalidate them. Without requiring presentation of the physical card at collection, it would be difficult to confirm the purchaser was the cardholder.

The transaction would have then been subject to chargeback and, prior to liability shift for AVS/3DS, the railway retailer would have been left liable and suffering the loss.

 

[styles]

Reread my post It would have made sense in the past as there was a cashout vector.

But it still doesn't stack up. Buying rail tickets with stolen card details to then try and resell is probably as much effort as just creating a legitimate ticket retailer or travel agency. Alternatively somebody proactively buying stolen card details with the premeditated intention of buying some pre-planned train tickets is such a low benefit, high risk activity.

Far more concerning was people buying gift cards and selling them, which is high value, low risk, and can be done in volume very easily, even decades ago.

This is before we consider that TVMs are almost always covered by CCTV and even back when TOD started were well covered.

Requiring the same card would've disrupted business passengers where their centralised travel/finance departments or PAs would've bought the tickets on one company card then the traveller tried to collect on another. This sort of inconvenience in exchange for trying to mitigate against a minute risk of somebody trying to launder money through pre-booked rail tickets.

I suspect the industry has encountered so little of this attack vector that they won't even have data on it. Happy to be corrected though.

 

[crablab]

I don't disagree the user experience is/was poor.

I think you're perhaps misunderstanding the risk being mitigated, and understating it somewhat. There's no substitute for real world experience here

 

[styles]

I don't disagree the user experience is/was poor.

I think you're perhaps misunderstanding the risk being mitigated, and understating it somewhat. There's no substitute for real world experience here

But that's the point - we're all giving examples of real world experience of this system being a farce.

Do you have real world experience of widespread money laundering via rail tickets using stolen card details?

 

[OscarH]

But it still doesn't stack up. Buying rail tickets with stolen card details to then try and resell is probably as much effort as just creating a legitimate ticket retailer or travel agency. Alternatively somebody proactively buying stolen card details with the premeditated intention of buying some pre-planned train tickets is such a low benefit, high risk activity.

It was, and to some degree is still, a big issue. You could buy high value rail tickets with stolen cards and sell them on with even less traceability than gift cards, it was very lucrative. Setting up a legitmate retailer is a lot of effort, and you'd keep a lot more than 4.5% of the ticket value if you're selling fraudulent tickets you didn't pay for :P

SCA/3DS helps, but it relies on the banks not being morons with decided when to challenge, and banks and not being morons don't go well in the same sentence.

 

[styles]

It was, and to some degree is still, a big issue. You could buy high value rail tickets with stolen cards and sell them on with even less traceability than gift cards, it was very lucrative. Setting up a legitmate retailer is a lot of effort, and you'd keep a lot more than 4.5% of the ticket value if you're selling fraudulent tickets you didn't pay for :P

SCA/3DS helps, but it relies on the banks not being morons with decided when to challenge, and banks and not being morons don't go well in the same sentence.

I'm just looking to clarify though - how is this a 'big issue'?

If somebody told me it was costing the railways £10m a year and they had a source to prove that I'd say fair enough.

But in my time working in rail, and my time working for a card payment processor, I have never encountered this. I suspect that at best the use of this attack vector is overstated, at worst it's just heresay.

 

[yorkie]

Originally, collections were generally set to "any card", however after a huge fraud was uncovered around 12 years ago, it changed to "same card"....

'£1m' ticket scam exposed

A TRAIN ticket scam that is claimed to have netted villains £1m has been uncovered at Manchester's Piccadilly station. Fraudsters were using stolen or cloned credit cards to buy tickets from the website thetrainline.com. A team of `runners' would then collect them from...

www.manchestereveningnews.co.uk

A TRAIN ticket scam that is claimed to have netted villains £1m has been uncovered at Manchester's Piccadilly station. Fraudsters were using stolen or cloned credit cards to buy tickets from the website thetrainline.com. A team of `runners' would then collect them from automatic fast ticket machines at the station.

A team of `runners' would then collect them from automatic fast ticket machines at the station. They then sold the tickets on to passengers for cash at a discount...

They would get credit card numbers from people who work in garages and restaurants, buy the tickets, and then send runners to get them out of the machines.

...by requiring the same card, this ensures that card details that have simply been written down are not sufficient, which reduces the scope of the fraud.

The fraud risk with e-tickets is lower, as there is more traceability, and also any tickets purchased with a card that was reported as lost/stolen/compromised could be cancelled.

Paper tickets can't be cancelled, so even if the card used to obtain the ticket was cancelled, the physical paper ticket could still be used, once it has been printed from the machine.

 

[styles]

Originally, collections were generally set to "any card", however after a huge fraud was uncovered around 12 years ago, it changed to "same card"....

'£1m' ticket scam exposed

A TRAIN ticket scam that is claimed to have netted villains £1m has been uncovered at Manchester's Piccadilly station. Fraudsters were using stolen or cloned credit cards to buy tickets from the website thetrainline.com. A team of `runners' would then collect them from...

www.manchestereveningnews.co.uk

...by requiring the same card, this ensures that card details that have simply been written down are not sufficient, which reduces the scope of the fraud.

The fraud risk with e-tickets is lower, as there is more traceability, and also any tickets purchased with a card that was reported as lost/stolen/compromised could be cancelled.

Paper tickets can't be cancelled, so even if the card used to obtain the ticket was cancelled, the physical paper ticket could still be used, once it has been printed from the machine.

I may be misreading this article, but it says that this happened at a time when the same card had to be presented to collect the tickets?

A TRAIN ticket scam that is claimed to have netted villains £1m has been uncovered at Manchester's Piccadilly station. Fraudsters were using stolen or cloned credit cards to buy tickets from the website thetrainline.com.

A team of `runners' would then collect them from automatic fast ticket machines at the station. They then sold the tickets on to passengers for cash at a discount.

Tickets bought online from thetrainline.com can be collected at the station in a fast ticket machine - but the same credit card has to be put into the machine to obtain the ticket.

If anything that seems to simply justify not allowing more than say 3 booking references to be collected from the same card the same day (the blocker I experienced)?

The article suggests it was mainly blocked by a change to the fraud act.

 

[yorkie]

I may be misreading this article, but it says that this happened at a time when the same card had to be presented to collect the tickets?

At that time, I believe many retailers didn't set this flag. In fact, there may have been a time when all collections were "any card", but exposure to fraud made that situation change, so that most then did require the actual card. These days it seems to be quite a mixture.

I believe some retailers may enforce same card for new customers, but then allow any card once that customer is demonstrated to be legitimate, but I'm not sure on that.

The fraud risk with TOD collection cannot be eliminated, however it can be reduced by setting same-card collection.

If anything that seems to simply justify not allowing more than say 3 booking references to be collected from the same card the same day (the blocker I experienced)?

The article suggests it was mainly blocked by a change to the fraud act.

I really wouldn't take too much note of details in such articles; the general principle that there is/was deemed to be a fraud risk is not in question, but journalists aren't always good at obtaining the details, and the exact mitigations in place might not necessarily be disclosed publicly.

 

[styles]

At that time, I believe many retailers didn't set this flag. In fact, there may have been a time when all collections were "any card", but exposure to fraud made that situation change, so that most then did require the actual card. These days it seems to be quite a mixture.

Sorry I'm getting a bit confused now.

Originally, collections were generally set to "any card", however after a huge fraud was uncovered around 12 years ago, it changed to "same card"....

In fact, there may have been a time when all collections were "any card", but exposure to fraud made that situation change, so that most then did require the actual card.

Do we know whether they actually were or if it's a hypothesis?

I've used TOD for a long time, probably more than the 'average' rail user 10+ years ago, and my recollection was requiring the same card was the default.

I'm struggling to find any history about TOD online though.

I believe some retailers may enforce same card for new customers, but then allow any card once that customer is demonstrated to be legitimate, but I'm not sure on that.

The fraud risk with TOD collection cannot be eliminated, however it can be reduced by setting same-card collection.

I really wouldn't take too much note of details in such articles; the general principle that there is/was deemed to be a fraud risk is not in question, but journalists aren't always good at obtaining the details, and the exact mitigations in place might not necessarily be disclosed publicly.

I don't disagree that same-card will prevent some fraud, I just am yet to see any evidence that it was introduced because such fraud was taking place. Even in the article above, it points out that the offender was arrested for a fraud offence 9 hours after a change to the fraud act was made, suggesting it was the fraud act change which made the difference, rather than a change to same/any-card collection policies.

 

[Wallsendmag]

Ah, thanks. perhaps it's because my purchases of late have been all or part funded by a voucher.
I didn't expect this to differ depending on whether card was used for part or all of the payment.

It does seem a little archaic...

In any case, I think the general point I'm making stands about the lack of visibility and poor user experience As we know, this is particularly problem for virtual cards (irrespective of the unique Chase situation), which are increasingly common.

Nothing has changed recently

Originally, collections were generally set to "any card", however after a huge fraud was uncovered around 12 years ago, it changed to "same card"....

'£1m' ticket scam exposed

A TRAIN ticket scam that is claimed to have netted villains £1m has been uncovered at Manchester's Piccadilly station. Fraudsters were using stolen or cloned credit cards to buy tickets from the website thetrainline.com. A team of `runners' would then collect them from...

www.manchestereveningnews.co.uk

...by requiring the same card, this ensures that card details that have simply been written down are not sufficient, which reduces the scope of the fraud.

The fraud risk with e-tickets is lower, as there is more traceability, and also any tickets purchased with a card that was reported as lost/stolen/compromised could be cancelled.

Paper tickets can't be cancelled, so even if the card used to obtain the ticket was cancelled, the physical paper ticket could still be used, once it has been printed from the machine.

I think NXEC/EC/VTEC/LNER has always been same card, at least it was in 2009

 

[Belperpete]

What happens if you pay using PayPal, using your PayPal balance (such as obtained as a result of DR payments)? Will this be "any card" collection, or will you have to take the card that is linked to your PayPal account? I don't carry that particular card around with me.

 

[styles]

What happens if you pay using PayPal, using your PayPal balance (such as obtained as a result of DR payments)? Will this be "any card" collection, or will you have to take the card that is linked to your PayPal account? I don't carry that particular card around with me.

Any booking paid using PayPal will be available for collection with any card.

Same is true for Google Pay/Apple Pay/Samsung Pay/etc.

With such payments, your card is effectively represented with a token, which won't be the same as your actual card number.

 

[Belperpete]

Any booking paid using PayPal will be available for collection with any card.

Same is true for Google Pay/Apple Pay/Samsung Pay/etc.

With such payments, your card is effectively represented with a token, which won't be the same as your actual card number.

Thanks for that.

 

[Haywain]

I've used TOD for a long time, probably more than the 'average' rail user 10+ years ago, and my recollection was requiring the same card was the default.

I agree with this - I am certain that same-card collection was a thing in the days of 'Virgin Trainline' and Q-Jump.

I don't disagree that same-card will prevent some fraud, I just am yet to see any evidence that it was introduced because such fraud was taking place.

Fraud was certainly a thing with same-card collection as much as 20 years ago. It revolved around card cloning, with the ticket "collector" carrying something like a Tesco Clubcard with the cloned card details on the magnetic strip. I recall catching someone in the process of collecting something like a couple of hundred Day Travelcards from a machine one evening when it ran out of ticket stock, and he was spooked and did a runner without the tickets or the card. In London at the time (around 20 years ago) it was easy to flog Day Travelcards outside tube stations and that one collection could have easily been worth around a thousand pounds.

 

[crablab]

Nothing has changed recently

Thanks for confirming.

A good reason to go back to Trainsplit who don't set this flag

As I say above, I think given no-card collection is now so common that the TVM flows have been redesigned to accomodate it, setting of the (same|any)card collection flag should be highlighted in the purchase flow.

In any case LNER could just not set it! I don't know what risk it is designed to mitigate nowadays

 

[crablab]

A coda to this.

As we know, LNER let you buy eVouchers through their website (3DS, of course), those can be of up to £100 each which are then added to the account as a stored value system.

I've gone back to buying vouchers and then buying tickets, as that circumvents same card collection (even if the transaction is part voucher, part card).

But if you think about it, the security posture is actually worse as I could have a £100s in my LNER online balance that's protected only by username/password (they don't support MFA).

Yet there's no additional authentication required to spend the stored balance, and no card to present upon collection.

So the only protection and individual has is (as I do) to add vocuhers incrementally.

There's some nice additionally liability shift for LNER though, as their chargeback liability becomes solely limited to the performance of "delivering a voucher" (generally "online wallets" do not receive transitive chargeback rights).

I reprise my point:
- (same|any) card collection is for a bygone age
- application of it is not consistent across ticket retailers
- if it's going to be used, it should be considered a restrictive term and require explicit acknowledgement in the purchase flow

 

[redreni]

I reprise my point:
- (same|any) card collection is for a bygone age
- application of it is not consistent across ticket retailers
- if it's going to be used, it should be considered a restrictive term and require explicit acknowledgement in the purchase flow

Yeah, I think each retailer probably takes a fairly parochial view of this, and if they're setting the flag and have been doing so for years, they don't see why anyone should expect anything else.

I do the voucher thing as well (not so much to avoid same card collection, although that's a bonus, but to take advantage of Amex discounts before they expire). None of my vouchers have been pinched yet, but that's one of the few passwords I do still change regularly, since the password is really the only thing protecting the funds I have on LNER vouchers.

 

[Ennis]

Hello does anyone know if tickets purchased on the RSTL website require the same card for collection? I want to book some undiscounted tickets for a relative to collect in York, I am in Hayes, thanks.

 

[Bletchleyite]

Can confirm that Avanti TVMs ask for the booking reference first, so don't require a card unless the same card flag is set.