Tag: digital money electronic money mobile payments e-payment m-payment

Front end

12th November 2010by Consult Hyperion1 Comment

[Dave Birch] We’ve often looked at the natural strategy of using identity infrastructure as the “front end” to payment infrastructure. To put it simply, if you have an id card in your pocket (or, more likely, your phone) wherever you go, then what’s the point of carrying other cards around? Well, one reason is that if you only have one ring to rule them all, and that ring is lost, you’re in schtuck (I think there’s an idea for a book there somewhere). This is a valid concern.

A junior, who wishes to remain anonymous to protect her identity, had her ID card number stolen.
[From Identification card theft becomes a documented issue on campus – News]

Now, of course, in a developed nation (such as Germany, for example) this shouldn’t matter, since there is nothing remotely secret about ID card numbers and they cannot be used to effect any transactions — you need the smart ID card for that. But when the ID number is attached to something that has no inherent security, like a piece of cardboard, then it can be the root of mischief.

A week later, she decided to check her account balance at the Help Desk. The help desk printed her receipts, and she realized her laundry money account had decreased from $21 to $2.

“I saw a lot of Marvin’s, but I hadn’t ordered from Marvin’s at all this year,” the student said.

“I looked at the transactions to compare them,” she said. “When I was in Chicago, my card was being used here, and once of my receipts said that I had charged for Marvin’s at 6:46 p.m., when I had also bought food at the Hub at 6:48 p.m.”
[From Identification card theft becomes a documented issue on campus – News]

This is the inevitable consequence of 1-factor authentication, just like magnetic stripes on credit cards. Fortunately, the story has a modern, happy ending.

Public Safety, who traced the Marvin’s orders to a cell phone number, caught the perpetrator.
[From Identification card theft becomes a documented issue on campus – News]

Too funny: the master criminal who copied the ID card number down used his own mobile phone to order food using the number. Still, it’s a serious point, and it has been discussed with relation to some of the national smart ID schemes that we have advised on: there’s a reasonable concern that ID cards might be a target for crime if they can be used for payments, which is true, if the ID cards have no security. But suppose the ID cards have not only a chip on to prevent counterfeiting, but also a biometric cardholder verification method.

The much talked about Unique Identity Project (UID) is not just about providing citizens with biometric cards. In fact, the new identity cards can be used for multiple purposes and can even replace the debit or credit cards one day.
[From UID cards can replace bank cards – CIOL News Reports]

So, once again, let’s be clear about these implications. An effective digital identity infrastructure sitting on top of a standardised “payments cloud” will completely reshape the sector. It will substantially reduce the cost and complexity of starting a new payment scheme, and will further substantially reduce the cost and complexity of running a new payment scheme.

Continue reading “Front end”

Maple leaf rage

8th November 2010by Consult Hyperion1 Comment

[Dave Birch] I was pottering off to Canada and thought that perhaps I ought to pick up some Canadian dollars. After all, I figured, it’s an advanced nation so I can probably pay by card everywhere, but just in case I’d better get a couple of hundred dollars. I went to Travelex at Heathrow, and the clerk pointed me toward a new product: they had an EMV prepaid MasterCard denominated in Canadian dollars. Hurrah! As a rule, I much prefer to carry prepaid cards rather than cash and I already have a prepaid US dollar Visa, a prepaid UK pound Visa and a prepaid Euro MasterCard. So I got myself one of these new-fangled Canadian dollar cash passports.

When I got to Toronto, the first two places I tried it, it didn’t work. The luggage cart at the airport wouldn’t even recognise it, and the taxi driver wouldn’t accept it because it didn’t have embossing. He had one of those zip-zap machines that you sometimes still see in the third world (it turned out, ironically, that I’d been travelling to a meeting about the future of payments in a moving payments museum). Then it didn’t work at the restaurant, chip or stripe. It did work in the hotel bar, by stripe, and it also worked on Canadian railways, by chip. It worked at the lunch place, but it didn’t work to buy a bus ticket. Whatever happened to the brand promise of universal acceptance?

On balance, I give the Travelex Canadian Dollar MasterCard… 4/10 (must try harder).

Remember, I do this so you don’t have to.

Continue reading “Maple leaf rage”

What would you toss?

4th November 2010by Consult Hyperion4 Comments

[Dave Birch] In some European countries — Finland and the Netherlands are good examples — both retailers and consumers have spontaneously abandoned low-value coins. Transactions are automatically-rounded (by custom and practice, not by law) to the nearest five euro cents and the one- and two-cent coins are just thrown away. In my house, we throw coppers into an old wooden bowl in the kitchen, and we are not alone.

Research revealed yesterday that up to one in five people suffers from “penny rage” – we chuck out 1p and 2p coins because we get fed up carrying them.
[From Express.co.uk – Home of the Daily and Sunday Express | UK News :: We really do throw away cash]

I'd never heard of "penny rage" before, and I'm not sure that "rage" is the right description, but I too find low-value coins nothing more than shrapnel. When was the last time you bought anything for a penny? Every day I take them out of my pocket, every night I come home with more (although my efforts to have cashless days have gone much better recently since Arriva introduced its iPhone application and mobile bus tickets in Woking — last week I didn't have to find cash for the bus even once!).

The 18bn British copper coins in circulation weigh the same as 213 fully loaded jumbo jets. Many of them – along with a further 6.5bn pennies the Royal Mint believes are “missing” – line the bottom of sock drawers and fill fridge-top jars. This mass of idle shrapnel indicates that many Britons stopped bothering with the stuff long ago. So it is surprising that the UK – along with G8 peers US and Japan – still continues to circulate their most basic unit of coinage, while countries such as Australia, the Netherlands, Brazil and Israel have all phased out their low-value change in the past 20 years.
[From FT.com / Lex / Financial services & property – Small change]

Yet in the UK, instead of doing something sensible such as melting down "copper" coins (they are not, of course, made out of copper at all) to make something more useful in these times of austerity, we are focusing on the higher-value coins.

Random sampling tests carried out by the Mint last May found that 2.58 per cent of £1 coins were counterfeit-compared with 2.06 per cent seven months earlier in October 2007 – or one in 50. This had doubled since 2002, when one in 100 £1 coins was counterfeit.
[From £1 fakers are quids in: Counterfeit coins surge to a record high | Mail Online]

Perhaps it's time to call in the £1 coins and remint a more counterfeit-resistant alternative? No: we're going to remint the small "silver".

Britain's 5p and 10p coins are to be substantially changed next year, causing potential chaos for the millions of people using vending machines and parking meters.
[From New steel 5p and 10p coins a 'disaster' – Telegraph]

Actually, this could be a blessing in disguise. Hopefully, some of the people who are complaining that enormous amounts of their money is going to be wasted (people who sell things through kiosks and the like) are going to take the opportunity to simply give up on coins completely: why replace the coin unit in a drinks machine with another coin unit when you could replace it with a contactless card reader and at the same time put the vending machine online through a built-in GPRS unit? (Answer in Europe: because under the current EMV scheme, you must install a contact reader and a PIN pad as well.) A good place to start would be with the vending machines in the London Underground, where every single person has a contactless-only card already.

Continue reading “What would you toss?”

With my peers

1st November 2010by Consult Hyperion1 Comment

[Dave Birch] I went over to the FS Club to hear Forum friend Giles Andrews of Zopa give an update on their progress. He explained that one way of thinking about Zopa is as a bond market for consumers, but one that allows people to get a social return as well as a financial one. What an interesting description. And it was an interesting meeting. I won’t quote anyone, because the meeting was held under the Chatham House rule, but rather I will give some general impressions of the discussion…

We all know Zopa as P2P lending, a marketplace for money. It’s not that hard to set up a web site, though, so there must be more to it. What makes it work, seeing as their numbers have steadily climbed? Giles gave a few insights: he said, for example, that the core of Zopa’s business is their sophisticated credit rating model. I deduce it must be working tolerably well, since their bad debts over the last five years have averaged 70bp.

What I found particularly interesting was the relationship between Zopa and retail banks. In an odd way, the credit crunch came along at the right time for Zopa. Their lending went from £15 million in 2008 to £35 million in 2009 to £75 million this year. It seems to me that as public trust in banks collapsed (along with the interest rates) so more and more people turned to Zopa.

Recently Zopa have been lobbying for regulation of P2P Lending in UK.
[From New Datamonitor report on P2P Lending in the UK has some interesting analysis points « The Bankwatch]

This is true. In fact Giles has said that Zopa think they should be highly regulated and properly supervised. This would be good for them for two reasons: first of all it would create a structure for more competition, and more competition is good for innovation and excellence, and secondly it would further legitimise the P2P sector, thus bringing in more borrowers and lenders. It would also, presumably, bring in more competitors, which would be good for competition.

Continue reading “With my peers”

Clipper chips

29th October 2010by Consult Hyperion1 Comment

[Dave Birch] I've read quite a few stories about the new Citi card with a chip in it. Not an EMV chip, of course, but a chip that allows the cardholder to dynamically rewrite the "magnetic stripe" on the back of the card so that it can switches between a credit card and a rewards card.

Next month, Citibank will begin testing a card that has two buttons and tiny lights that allow users to choose at the register whether they want to pay with rewards points or credit, at most any merchant they please.
[From The Mundane Credit Card Gets a Modern Makeover – NYTimes.com]

These are the "dynamic stripe" cards from Dynamics. The idea of them is that since US retailers are not going to replace magnetic stripe readers with chip readers, the way to deliver new services to customers is by emulating the magnetic stripe.

Called “Redemption,” the cards will work at any merchant where mag stripe readers are used. The new cards include programmable and electronic components such as a battery, an embedded chip, buttons and a card-programmable magnetic stripe.
[From Citi’s Pushes Buttons With 2G – Bank Technology News]

You can see how this kind of thing might have a window in the US where the retailers don't have chip terminals. It would make no sense anywhere else: in the UK, for example, Barclaycard's new Freedom rewards programme works at the POS so when you put your card in it asks you if you want to pay with Pounds or Points, which seems much easier than press a button the card, but anyway. And if you try to use a magnetic stripe card in a UK terminal, whether it's dynamic or not, they'll assume you're a fraudster and call the police.

So why do I say that using this kind of technology in the US may have a window?

Well, consider the example of the Cutty Sark. The Cutty Sark was a tea clipper, built for speed, and at one time was the fastest ship of its size afloat, famously beating the fastest steamship afloat and doing the Australia to UK run in 67 days. At the time, get tea from Asia to Europe at high speed was economically important and so there was pressure from the tea companies to get the fastest ships (so they weren't built just for the fun of it, or to show off the technology, but because of the economic imperative.

What's the point of brining this up? Well, it makes the point that the fastest sailing ship was built after the steamships arrived. In Christopher Freeman and Francisco Louca's "As Time Goes By: From the industrial revolutions to the information revolution" they note that

However, it had taken a fairly long time for the steamship to defeat competition from sailing ships, which also began to use iron hulls. The competitive innovations in sailing ships are sometimes described to this day as the 'sailing ship effect', to indicate this possibility in technological competition for a threatened industry.

In the long run, the sailing ships vanished, except for leisure, and the steamships took over. But when the steamships first came on to the scene they stimulated a final burst of innovation from the sailing ship world, which was then stimulated into building some great ships as a kind of "last hurrah".

Source: Historic Naval Ships Assocation (2004).

Perhaps we should look at the Citi initiative as the "last hurrah" of the magnetic stripe. I bumped into our good friend Adrian Cannon from Edgar Dunn while I was writing this, and he summed it up as "a very complicated way to achieve a partial answer" to the problem of card security, which strikes me as an accurate description.

Continue reading “Clipper chips”

Behind enemy lines

27th October 2010by Consult Hyperion1 Comment

[Dave Birch] At the EFMA “Future of Cash” conference, M. Giles Lardy, the Director of Banknotes and Coins at the Banque de France set out the basic case in favour of cash. He said that the growth of cash in circulation in the eurozone is because of a number of factors:

It is trusted. The amount of cash in circulation shot up after the credit crunch as people began to worry that banks might fail.
Anyone can accept it. This is the major advantage of cash in commerce, an advantage that I think will be eroded by mobile phones.
It’s quick and easy. French studies indicate that cash transactions take 26 seconds on average and card transactions take 46 seconds. This will change because of mobile and contactless, of course, but fair enough.
You don’t need to have a bank account. The hoarding of euros represents a kind of tax paid by non-Europeans to the eurozone states. The number of euros in circulation is something like 40% higher than might be predicted from economic growth. Much of this “surplus” appears to be in the form of €500 notes.
Cash is anonymous, and although M. Lardy is right to say that “cash is not responsible for fraud”, it certainly makes a lot of fraud more tempting and more profitable.

He also set out the cash agenda for the coming years, something that a number of people at the conference spoke about. Broadly speaking, this means more recycling and “optimisation” of cash management.

And here’s the stats block, as we used to call it in Dungeons and Dragons..

There were 13.7 billion euro banknotes in circulation at the end of August 2010 with a face value of €820 billion.
There are 91 billion euro coins issued, worth €22 billion.
To date, the major banks that file with the ECB have reported shipments of €110 billion outside the eurozone (these shipments jumped €20 billion since the crash).
Where do euros go? EU non-eurozone (mainly UK) 24%, rest of Europe (mainly Switzerland) 41%, North America 2%, Asia 5%, Africa 5%., Eastern Europe 20%.

As even the most cursory examination of the statistics shows, virtual none of this cash is used to support the needs of commerce (the Bundesbank estimated that only 10-15% was used for this) and the rest of it is “unexplained”, as they say. This means that the cash is used for hoarding, tax evasion, criminal purposes, corruption and other elements of the less-regulated economy.

The stats about the cost of cash in retail aren’t worth reproducing since they were so confusing: they are clearly measuring apples and oranges, because they showed that the cost of a cash transaction to retailers in 3p in the UK and 300p in Belgium, or some such, the cost of a card transaction as 50p in the UK and 500p in Spain or whatever.

Continue reading “Behind enemy lines”

Unprotected text

26th October 2010by Consult Hyperion1 Comment

[Dave Birch] When I checked in to PayPal X "Innovate 2010" I was given a free "Bling Powered by PayPal" sticker with a free $10 on it to spend at local merchants (such as the diner round the corner). Hurrah!

A helpful young chap explained to me that I had to text the sticker number to 78787 to activate it, so I did, and then I got this puzzling response.

I showed it to the chap, and he explained to me that Bling and PayPal are discriminating against foreigners and that the short code only works if you have an American phone number: if you have an international phone number, you have to pay for you own breakfast at the diner! Fair enough: there is a bit of backlash against immigrants in the US at the moment. But they should have told me before I texted my Bling sticker number to a UK "dating" service. I just got this message…

Unlike e-mail, there's no junk filter for text so I can't put this number onto a kill list or send the messages into junk mail automatically. I hope my wife is reading this.

Continue reading “Unprotected text”

Gelding

19th October 2010by Consult HyperionLeave a comment

[Dave Birch] The German Savings Bank Association are to launch a contactless e-purse for low-value payments in 2011. The project takes the highly unsuccessful Geldkarte, which is on every debit card but rarely used, and adds a contactless interface to give it a convenience boost. They are targeting transactions under €20 (which will be without a PIN) although in the future they will extend the scheme to larger transactions (which will be PIN verified) and expect the scheme to be more popular with German retailers than Visa or MasterCard contactless payments because it is cheaper and simpler (they say). Germany has, historically, been seen as being a rather conservative retail payment market but in addition to the savings banks’ son-of-Geldkarte, the German telcos are also launching their own new contactless payments scheme, but using stickers.

Major German telcos plan to hold a trial next year using contactless stickers that would enable subscribers to tap their phones to pay in stores with the telcos’ mpass payment service that is now available only for purchasing on the Internet.
[From German Telcos To Launch Trial of Their Own Payment Scheme in 2011 | NFC Times – Near Field Communication and all contactless technology.]

The trend to stickers, incidentally, isn’t confined to Germany.

U.S.-based mobile-payment start-up RFinity is adopting passive-contactless stickers for its payment project in and around a university campus in Idaho, changing an earlier plan to expand its pilot using contactless microSD cards… RFinity and Bling are among a host of start-ups hoping to take businesss from Visa Inc. and MasterCard Worldwide and major banks in the budding mobile-payment market.
[From M-Payment Start-Up Trades MicroSDs for Passive Stickers | NFC Times – Near Field Communication and all contactless technology.]

Never mind contactless, some German retailers have already been looking beyond it to the next technology revolution in retail e-payments, biometrics. Specifically fingerprints.

“This is an interesting system for the future with a high security standard. There will never be a system that is 100 per cent secure,” Binneboessel said, adding that using a fingerprint payment method is as secure as using a PIN… “On average paying using a fingerprint takes only seven seconds, paying with a bank card that requires a PIN takes 12 seconds and paying with cash takes 20”.
[From German grocery stores experiment with payment by fingerprint : Technology]

See how the report talks about security but then cites speed as the main benefit of switching to the technology. Talking about security, some customers have security concerns about contactless technology. When Discover did a trial with contactless payment stickers, they found that users were quite security concsious. They wanted to put their stickers inside the cover over their mobile phones and…

Few said they would want their name or account number printed on the sticker.
[From U.S.: Discover Pursues Contactless-Mobile Strategy With Sticker Trial | NFC Times – Near Field Communication and all contactless technology.]

I don’t want my name or account number printed on my bank card either, but there you go. Anyway, the point is that stickers were seen as being an interim technology, just there to fill in until mobile proximity handsets arrived. Which, by the way, they now have, although in very, very limited numbers. Why the delay? Because the mobile operators insisted on a standard called Single Wire Protocol (SWP) that keeps the proximity interface under their control, and it’s taken a while for the handset manufacturers to get going on this. Samsung have already introduced an SWP phone into their line up (and, indeed, we’ve been using these at Consult Hyperion on a couple of major projects).

The phone for the Telefónica trials, the Samsung S5230, known as the Star or Player One, is an EDGE handset–not a 3G phone. But Samsung said it is one of the handset maker’s top sellers.
[From New Samsung NFC Phone Gets First Trial in Spain | NFC Times – Near Field Communication and all contactless technology.]

These phones, however, need a contactless infrastructure in place at POS to make them desirable for payments. How is that going? Some up-to-date figures on US consumers payments

Adoption of contactless technology also shows promise. Some 21.7% of consumers have adopted contactless debit cards, while just over a quarter hold a contactless credit card. Some 9.5% report having adopted a contactless toll-payment instrument. Overall, those who have adopted any kind of contactless payment device stands at 44.3%, a figure that may seem more robust than critics of contactless payment have supposed. The report, though, does not look at actual usage of contactless devices.
[From News]

This reminds us that contactless payments aren’t only about open-loop payments. Even in the US, consumers are familiar with the technology primarily because of transport and transit applications. The report goes on…

While the report does not touch on contactless payments via mobile phones, it reports that 8.2% of consumers are now using mobile banking to access their accounts, compared to 70.7% for online banking and nearly 85% for ATM or debit cards.

In summary, then, there are lots of people who know what contactless is, quite a few people with contactless cards, but not so many actual transactions. And yet…

that the only real threat to cash on the horizon is contactless payments.
[From Mobile Transfers – Will They Live Up to the Hype? — Counting On Currency]

This is wrong, of course, because the threat to cash will come from mobile phones, but in developed markets they need the contactless rails to run on. So where are those contactless rails? Personally, I think that Forum friend James Van Dyke of Javelin is right, as he generally is, to say that the problem lies not with the market but with the industry. Customers like fast, “touch and go” payments. But they don’t seem to find them as an option in any of the places where replacing cash with the tap makes sense: their parking meter, their coffee shop, their PC: the industry has driven contactless down the path of existing business, existing terminals, existing POS. That’s not good enough.

Continue reading “Gelding”

Cards on a plane

18th October 2010by Consult Hyperion3 Comments

[Dave Birch] When I was last on a domestic US flight, I very much enjoyed hearing the announcement that beer and wine were available for $4 and $5 respectively but that “Continental Airlines is no longer accepting cash so please have your debit, credit or charge card ready”. Ah, music to my ears. When the stewardess came along with the drinks trolley, none of the passengers that I could see appeared to mind in the least. Perhaps they had given up complaining, but it’s more likely that there was no-one over 21 on the flight without a debit card and probably none of them without a credit card either.

In the closed ecosystem of the airplane, everyone can see that cash isn’t efficient. It has to be collected, transported, protected, managed and counted. A waste of everyone’s time. Electronic payments save money throughout the ecosystem. This is true for society as a whole, but in an excellent paper on “The Single European Cash Area” in the current issue of the Journal of Payment Systems and Strategy, Carlo de Meijer of RBS asks why we still use cash so much when it imposes such high costs on us all. He says that

…most citizens still believe cash is free of charge. That, however, is a misconception… Cash is expensive because it has higher production costs, costs of storage, distribution and security measures. And there are other costs for society, such a fraud and tax evasion.

He’s absolutely correct, of course. It’s reasonable to observe though, that not everyone has a card to pay with, and even I wouldn’t go so far as saying that anyone who doesn’t have a card is a drug dealer, corrupt politician or perhaps even a terrorist — unlike the British government, apparently.

A recent British radio advertisement for the anti- terrorist hotline urged listeners to call if they spotted a neighbour behaving unusually. Such odd behaviour included, “He pays with cash, because he doesn’t have a bank card”.

The advertisement has now been banned by the Advertising Standards Authority, because it encouraged listeners to report people for doing something which is perfectly legal
[From When cash is king | Stuff.co.nz]

But the day will certainly come when paying with cash is regarded as odd. Perhaps in my local Waitrose you will have to go to the special checkout to pay with cash, the plumber will refuse to accept cash because he think it may be part of an HMRC sting operation and the kids won’t want cash pocket money but it’s just plain uncool. We’re not there yet, but we should be.

Basic cash registers — and really, cash itself — are analog dinosaurs in the digital jungle of financial transactions. It’s time for them to check out.
[From Ten technologies that should be extinct (but aren’t) – Technology & science – Tech and gadgets – PC World – msnbc.com]

How true.

Continue reading “Cards on a plane”

Follow the pain

13th October 2010by Consult Hyperion7 Comments

[Dave Birch] Our friends over at PYMNTS have been asking an interesting question:

What is the biggest reason why contactless payment cards are not moving further along?
[From Why Hasn’t Contactless Ignited: PYMNTS Community Fires Back – pymnts.com]

They’ve had a lot of different answers, and it’s well worth looking through the various comments. I remain convinced that one of the biggest problems is the mismatch between bank channels and cash-replacement locations. In other words, cash doesn’t work properly in some locations, and this ought to be an opportunity to replace it. Someone commenting on the question said that “if it ‘aint broke, don’t fix it”. Well…

This was the scene on Clapham Junction station. I didn’t get my chocolate bar, they didn’t get a sale. This is where cash is a pain, and where contactless ought to be an alternative. In fact, there are plenty of places where cash is a pain: the car park, the vending machine, the bus, the stupid Smart Carte machine at San Francisco airport, and none of them take contactless. My dry cleaner does take contactless, but I’m sure his terminal will never, ever be used. At the Mobile Payments and Commerce conference in Brussels last year, I heard a lovely phrase from Christian Sere-Annichini. He was talking about low-value payments for parking meters, vending machines, newspapers, that kind of thing, and he called it “street commerce”. An ideally descriptive phrase, you know immediately what it means. I think I use it in every presentation on low-value, cash-replacement strategies from now on: s-commerce.

I wonder, though, if another problem — apart from the failure to address s-commerce — might be that it has proved difficult to communicate to the general public how contactless cards work and what the benefits might be. Therefore, I thought it might be useful to look to see what the public’s concerns are and try harder to answer them.

How does it work? Contactless cards use short-range wireless technology. The reader at the till picks up a signal from your card when it’s very close.
[From Contactless payments: Time to wave goodbye to cash | Money | The Guardian]

Well, not really. The cards have no power: they pick up power from the till and then respond to commands from the till. They don’t send out a signal until they’ve been powered by the till.

The retailer has to enter the amount for you to approve, you then have to hold your card in front of the reader at precisely the right time – and for more than half a second. The reader display will confirm your transaction.
[From Contactless payments: Time to wave goodbye to cash | Money | The Guardian]

I don’t know where the “half a second” thing comes from, the transactions are faster than that, and the reader will prompt when it is expecting a card. Admittedly, the issue about the retailer having to enter the amount is really, really annoying as it means that they have to mess about pressing buttons, which slows everything down.

But what if someone steals my card? To combat the risk of a thief going on a contactless spending spree, cardholders will, when they hit a certain number of transactions or amount of spending, have to enter their pin the next time they pay, typically, each time they rack up £50 spending.
[From Contactless payments: Time to wave goodbye to cash | Money | The Guardian]

As a contactless card holder, I can genuinely say that I don’t care, since it’s the banks’ problem and not mine. But nevertheless, this is a genuine concern for members of the general public and we do need to deal with the fact that journalists (in particular) really like to recycle stories about contactless card insecurity. Remember this?

the crew at BoingBoing TV has posted up a little demo of how easy cracking the RFID encryption on an American Express card can be. All it takes is an $8 dollar reader easily available on eBay
[From RFID credit cards easily hacked with $8 reader – Engadget]

I don’t understand the psychology, obviously, but it seems to be a case of a story that journalists want to hear, if you see what I mean. As a consequence, everything gets framed in terms of stupid banks (who, it appears, have spent millions developing a system that can be trivially-defrauded) and clever hackers who are sticking it to the man.

In some organizations, RFID cards aren’t just for entering doors; they’re also used to access computers. And in the case of RFID-enabled credit cards, RFID researcher Chris Paget, who gave a talk at DefCon, says the chips contain all the information someone needs to clone the card and make fraudulent charges on it
[From Feds at DefCon Alarmed After RFIDs Scanned | Threat Level | Wired.com]

Once again: you cannot “clone” a contactless card with this information and you cannot create a counterfeit magnetic stripe card because the “track 2 equivalent” data in the chip is not the same as the actual magnetic stripe track 2 data. Yes, data can be read from a contactless card, but it cannot be used to create another card!

RFID credit cards surfaced in Canada since 2006, when MasterCard started aggressively pushing its PayPass cards. Today, about 90 per cent of MasterCards in the country are RFID-enabled and the company aims for 100 per cent by the end of the year, said Scott Lapstra, vice-president of market development for MasterCard Canada.
[From CBC News – Consumer Life – New credit cards pose security problem]

Oh no! So many Canadians are already at risk from large-scale identity theft! All you have to do it walk down the road with an $8 reader and you can get the all of the card details that you like and then use them to go on a spending spree. Actually, no. You have to read a lot further down the article to find out that

The MasterCards in Johanson’s demonstrations were of a later model and didn’t cough up their cardholders’ names.
[From CBC News – Consumer Life – New credit cards pose security problem]

So let’s review. You can’t use the data to create a counterfeit magnetic stripe card and you can’t use the data to create a clone contactless card. But you can get readers for an alleged $8 — great, I’ll take ten. But that’s not what the public take away from this. It’s up to us to work harder to get the message across if we want contactless take-up to accelerate.

Continue reading “Follow the pain”