Open payments in Public Transport now a reality

• Posted by Mike Burden August 28, 2012 - Filed in Contactless - #Contactless  #Payments  #NFC  #PayPal  #card  #transport  #Europe  #EMV  #PCI-DSS  - 1,323 views

  Mike Burden at Consult Hyperion, uses experiences of designing an Open Payment system in London to highlight some of the key issues involved for other global transit operators thinking of moving to similar card-based systems.
  

  
  

  Open payments in Public Transport now a reality thanks to new bank-issued contactless cards

   

  Public transport ticketing has come a long way over the last 30 years, moving from printed paper-based tickets and magnetic stripe to smart cards in Europe, to NFC enabled mobile phones in the Far East.  However, these are usually in the form of proprietary schemes developed by a single supplier, within a closed network, which require considerable capital investment and have substantial operating costs.
  
  As technology has developed in other sectors, most noticeably through mobile communications and the switch to contactless cards in the banking industry, opportunities are opening up for operators to make public transport ticketing more convenient for users and cheaper to run.  They also offer new ways of collecting revenue, breaking away from traditional ticketing methods and their inherent constraints.
  
  From owners to merchants
  
  By moving to an open payment model, operators would become ‘merchants’ participating in a bank-led scheme rather than owners of a dedicated ticketing infrastructure. This could reduce costs through the use of off-the-shelf equipment from a range of suppliers, rather than bespoke equipment made to proprietary specifications. Introduction of EMV (Europay Mastercard Visa) schemes can dramatically change the concept of ticket purchase, offering more sophisticated facilities that take advantage of calculations being performed in the back office, rather than at the fare gate.
  
  While some operators want to move away from smart cards, as they are not viewed as a core business, others are keen to issue them as the registration fee generates a significant revenue stream.  However, social inclusion is a key public transport objective so operators may still need to offer alternative payment methods to those who do not have contactless bank cards.
  
  Non-transport payment applications have been cited as a benefit of introducing smart cards, but in reality there have been very few examples, as the proprietary nature of the infrastructure makes such applications costly. Moving to EMV could remove the barrier, allowing customers to use one card for all payments.
  
  So what’s next?
  
  Some commentators talk about the impending use of mobile technology as the future of payments and while I agree to a certain extent, a mobile on its own does not have the capability to perform payments without an application to carry it out. In this space, we are starting to see the modern IT giants; PayPal and Google presenting their ideas on a modern payments network in competition with the established technologies of the traditional banking industry - EMV.
  
  Contactless EMV cards, issued widely in Canada, Mexico and much of Europe have been developed with offline capabilities, that is, the card does not require online authorisation for the merchant to be guaranteed funds, the card has the capability of authorising small amounts offline.
  
  The opportunity to perform offline transactions is really beneficial for transit operators who are now able to assure that they are at the very least dealing with a genuine card through the offline authentication method. The majority of contactless EMV cards are now issued supporting the highest level of dynamic data authentication. In the future, the payments schemes have also specified a data area that can be used by merchants to record tap data. This could be used in the transit space for capping calculations, other payment models and revenue inspection.
  
  Transaction models and operational costs of moving to an open system
  
  Three key areas to consider when designing a new ticketing infrastructure are the scope of the network, interoperability and the likely cost savings.  Urban operators have different priorities to their inter-urban or rural counter arts.  Speed and self-service are essential in the urban environment, while inter-urban operators need to offer a greater range of customer focused products and services, perhaps including integrated ticketing with connecting urban or rural services.
  
  ‘Pre-issued’ media, such as the bank credit or debit cards, offer the opportunity to develop a ticketing or payment strategy with zero issuance costs, making use of a device that the passenger already carries and is fully interoperable worldwide.  But current payment cards are read-only; as a result, transaction data, value top-ups and ticketing products cannot be stored on the card.  Plans are in place to introduce payment cards that can hold transient data, supporting possible future ticketing applications.  Meanwhile, the operator can choose to use the card to collect a payment at the ‘point of tap’ or sometime later.  In this case, a new ‘middle-office’ infrastructure would collect the taps and charge an ‘end-of-day’ amount.
  
  Another important consideration is the communications requirements.  Can the reader be off-line or does it need a connection to a back-office system? although the primary benefit of the card-based model is to operate completely off-line.  The reader and middle-office models can also work off-line but they may need occasional network access to pass data, such as holistics to manage fraud and payment card authorisations requests.
  
  The introduction of payment cards can lead to a number of areas of cost reduction. The most significant of these include the reduction of card issuance to zero, the end of dealing with issues raised around the management of a proprietary system, and the end of the card and ticket distribution networks.  However, you get nothing for free in this world. The cost of acceptance is interchange, which is the charge the schemes make for processing the payment that is passed to the transit merchant through the acquirer.
  
  Reader certification is expensive

   

  Reader design is critical to the successful implementation of any project to accept new media. Bad design would increase the cost through unnecessary rounds of re-certification and could affect its vulnerability to security attacks, service denial or data harvesting.
  
  The reader will be required to support numerous applications, so the software for each one – be it card detection, payment card applications such as Visa, MasterCard, AMEX, Discover or a proprietary application – should be developed and installed separately, with an approach that’s more akin to loading applications onto a mobile phone.  Otherwise, changes to one application could result in a need to retest the complete reader.  Also, the high cost of certification will ensure that developers seek to minimise the number of times the reader is submitted, both initially and when changes are made to specifications and code.
  
  If the reader is, or might be, handling payments data, the implications of PCI-DSS (Payment Card Industry Data Security Standard) must be considered.  Payments data cannot be held or transmitted in a format that would allow it to be intercepted in plain text form.  The most secure method for securing compliance would be to encrypt all transactional data at source before it is stored and transmitted.
  
  Lessons from London: From Oyster to EMV
  
  Even with all this information, how can operators know that everything will work to specification, and that transactions will not take minutes instead of milliseconds? The answer is to prototype the system, and test the more complex processing which the reader must undertake.  This includes activating the card and selecting the correct application, deny-list processing, and any other management processes required to meet PCI-DSS.  This is the time to make mistakes and fix them.
  
  There are still many challenges to implement readers that are capable of accepting cards from several schemes as contactless EMV is introduced and older technologies are phased out. Some transit operators such as UTA have successfully implemented open payments and other operators such as Transport for London are getting close to the point of implementation and will start to test their propositions shortly.
  
  As the convergence of payment methods begins, bringing together payment card schemes and transport operators, there are many institutional issues that need to be addressed.  But in the long term, convergence will produce benefits for all stakeholders and passengers.  And once this has been successfully addressed, it may be time to look at the next steps and get to grips with implementing NFC.