"Leap" into the unknown: The feedback thread

Alun

Just got this from them ...

LeapCard wrote:

We’re working with our payment partners to develop a more user-friendly interface for the payment screen, but didn’t want to delay the release of the App as the core functionality is available. Your feedback is appreciated and the ability to save/store your credit card details is a priority for a future release.

howiya

So my leap card became faulty today and stopped working. I phoned the customer care line and was told to order a replacement card on their website. I asked how long this would take and he told me it could take up to ten days...

What an absolute joke. I explained to him that all they had to do was transfer my balance to a new card, put the card in an envelope and put it in the post and I should get it tomorrow but the individual on the phone seemed to think it was a lot more complex than this and couldn't justify the length of time it would take when I challenged him.

Absolute shambles.

Hotblack Desiato

If it's not a personalised card, could you not just buy a new one and claim a refund of the old one? You'll be temporarily down 5 euro

howiya

Hotblack Desiato wrote: »

If it's not a personalised card, could you not just buy a new one and claim a refund of the old one? You'll be temporarily down 5 euro

I'd also be temporarily down the credit on the card while waiting for a refund.

Either way just because you can a new card instantly doesn't justify it taking up to ten days for a replacement card to be issued

bk

So I got on the trial for the NFC leap app.

The Good -
- App looks very nice, well written and simple
- The NFC team responded to my querys very quickly.
- I was able to top-up directly on the app
- I was also able to purchase top-ups and tickets * online on the Leap website and they were applied to the card.
* I tried the Cork Red Zone 24 hour ticket and it worked fine.

The Bad -
- There is no way of buying tickets directly in the Leap NFC app, unlike top-ups. I don't think this one is a show stopper, but would be nice to have in a future release.

- For tickets and top-ups you buy online on the Leap website, you have to select PayZone as the load location which might be confusing for people IMO, better to have a separate NFC app option as a load location [1].

But worst of all if you do select this option, the top-up and tickets you buy aren't available until 8am the next morning!!!

Honestly I can't think of any reason why tickets and top-ups bought in this way shouldn't be immediately available to add via the Leap NFC app. Again not a shop stopper, but definitely a priority IMO.

The Ugly -
- You have to enter ALL of your credit card details and use the stupid verified by Visa [2] rubbish EVERY time you want to top up. Certainly this isn't something you would want to do while standing at a bus stop on a cold wet evening waiting for a bus.

If Hailo, Uber, Deliveroo, etc. can all store your credit card details and not use Verified By Visa, then I can't see why this app can't too. I'm very happy to see from Alun's response that they know this is an issue and are working on it, but I think it needs to be a priority and that they probably shouldn't launch the app to the general public until they fix this. This one is a show stopper bug IMO.

In it's current form it would be just another Leap service that is half asses and only sort of works, but not very well.

Good app, but a lot to improve.

[1] I'd actually prefer if they merged all the load locations, people shouldn't need to think about this, it is an unnecessary complication. If you buy a top-up or ticket via the Leap website, then it should be available at all load locations (Luas, Irish Rail, Payzone, Dublin Bus - new ticket machines required) within one hour and on the NFC app immediately. There is really no technical reason why this can't be done today. Atlanta has been doing this with their cards since 2006!!!

[2] I truly loathe Verified By Visa, it is a terrible design, which slows down mobile commerce and teaches people very bad security practice! The sooner it goes away the better IMO. I can't wait for Apple PAy, Google Pay etc. to launch in Ireland and make using such mobile services much easier.

Slippin Jimmy

How do you purchase a blue zone ticket on the leap card site? Everytime I try its asking me to buy a card even though I have one registered.

LXFlyer

Slippin Jimmy wrote: »

How do you purchase a blue zone ticket on the leap card site? Everytime I try its asking me to buy a card even though I have one registered.

Log into your account and select top up - then halfway down the page select the operator and the ticket.

NB You will still have to go to a load location to get the ticket onto your card.

Slippin Jimmy

I have gotten the leap top up app. So I was going to buy my weekly ticket and use the app to load it on to my card.

Thanks for that though.

1huge1

bk wrote: »

[2] I truly loathe Verified By Visa, it is a terrible design, which slows down mobile commerce and teaches people very bad security practice! The sooner it goes away the better IMO. I can't wait for Apple PAy, Google Pay etc. to launch in Ireland and make using such mobile services much easier.

I'm hopeful that once it becomes standard that phones have fingerprint technology that this will speed up the verification a lot faster.

bk

1huge1 wrote: »

I'm hopeful that once it becomes standard that phones have fingerprint technology that this will speed up the verification a lot faster.

Yup that is basically what apple pay does.

Once you set up Apple Pay the first time, with any app on iOS that supports it, you can pay for things straight off just using your thumb print, without ever having to enter your credit card details in these apps or using idiotic Veirified By Visa.

For instance, when you install the Uber app on an iPhone in the US, you never have to enter your credit card details, you simply pay with tocuh ID and it is great.

Yes I know all of this is first world problems. But really no reason not to take advantage of the infrastructure there and make things as easy as possible.

MOH

bk wrote: »

idiotic Veirified By Visa.

I thought that was supposed to be phased out this year?

bk

MOH wrote: »

I thought that was supposed to be phased out this year?

Lots of talk, zero action *

First of all, they aren't talking about getting rid of 3D Secure, they are talking about moving to 3D Secure 2.0, it will still be there!

Mostly they seem to be talking about one time passwords via SMS. So when you buy something, you still get redirected to another page where you enter a code that is automatically sent to you by SMS.

A small improvement over the current system, but still annoying and comes with it's own problems (what if you phone has no signal or battery dead, you are in a foreign country, phone stolen, etc.).

They also have some talk about biometric authentication, but no clear information on what that actually means.

I think and hope that means that it is built directly into Apple Pay (with touch ID) and Google Pay, without it getting in the way of customers.

But it seems we still have a long way yo go to get rid of this scourge.

EDIT: * Zero action is probably unfair, as Apple Pay seems to either implement 3D Secure 2.0 or more likely Apples own implementation of something similar which is likely actually driving what the 3D Secure 2.0 spec will end being. Just can't wait for it to hit Ireland.

devnull

bk wrote: »

First of all, they aren't talking about getting rid of 3D Secure, they are talking about moving to 3D Secure 2.0, it will still be there!

Mostly they seem to be talking about one time passwords via SMS. So when you buy something, you still get redirected to another page where you enter a code that is automatically sent to you by SMS.

That is already existing and has been for some years on the existing system, it's just not offered in many countries. ING Bank use this as the default setting for their banks in Europe since the beginning of Verified by Visa.

Biometric is completely new though.

bk

devnull wrote: »

That is already existing and has been for some years on the existing system, it's just not offered in many countries. ING Bank use this as the default setting for their banks in Europe since the beginning of Verified by Visa.

Biometric is completely new though.

Yeah, I think it was Apple who developed and drove the "biomteric" extension. It is pretty obvious since the first mention of Biometric for 3D Secure came about 1 month after Apple Pay with Touch ID was announced and Apple Pay seemed to use technology that didn't yet exist in the 3D secure specs.

Brilliant to see Android Pay and others take up the same now. It will make mobile commerce vastly easier.

coylemj

I have a Wi-Fi only (no SIM) Android tablet which is my only gadget with NFC, will I be able to add credit to my Leap card using that app when the tablet is connected to my home network?

Mario95

coylemj wrote: »

I have a Wi-Fi only (no SIM) Android tablet which is my only gadget with NFC, will I be able to add credit to my Leap card using that app when the tablet is connected to my home network?

I don't see why a sim card would be needed. It should work with WiFi.

Vic_08

bk wrote: »

[2] I truly loathe Verified By Visa, it is a terrible design, which slows down mobile commerce and teaches people very bad security practice! The sooner it goes away the better IMO. I can't wait for Apple PAy, Google Pay etc. to launch in Ireland and make using such mobile services much easier.

Why don't you just disable it? I have it disabled on my CC for years, there is only a small delay as a transaction gets sent to 3ds and then bounced back to vendor authorised.

I know you are in love with every new IT innovation but I don't share your enthusiasm for fingerprint scanning authorisation.

How to steal from person's account: pinch iphone, lop off owner's thumb and take it with you.

bk

Vic_08 wrote: »

How to steal from person's account: pinch iphone, lop off owner's thumb and take it with you.

Won't work for iPhone, Touch ID will only read a fingerprint with a pulse:

http://www.engadget.com/2013/09/16/why-a-disembodied-finger-cant-be-used-to-unlock-the-touch-id-se/

I'm not sure how this works for other fingerprint scanners (Samsung, etc.).

As anyone who works with computer security knows there is no such thing as perfect security, you can only make it better and harder, while trying to balance that with convenience for the end user.

BTW An important point about your scenario is risk versus reward. A criminal who cuts off your finger in order to steal your phone, has now gone from a minor crime of theft, that would likely get no prison time if caught, to grievous bodily harm and likely 5 years in prison if caught. Also police go from not really caring about the crime to likely a major police investigation and manhunt. Not worth it to steal a few hundred euro from some ones account *

I'm not saying it wouldn't ever happen (it has happened once with fingerprint enabled Mercs), but it wouldn't be as wide spread as people make out, just not worth the trade off.

* Actually €120 max at the moment as the limit for contact-less payments is currently €30 and you have to enter a PIN after every 4 attempts. Though that is likely to change in future.

Why don't you just disable it? I have it disabled on my CC for years, there is only a small delay as a transaction gets sent to 3ds and then bounced back to vendor authorised.

Not all cards allow that, certainly my AIB Visa card doesn't, nor does my stupid Permanent TSB card which I just ended up getting blocked just now because I tried :mad:

devnull

I have never, ever been asked for a PIN for a contactless payment.

plodder

I've never been asked for a PIN either, but I assume that is because I have never used it in contactless mode 4 times without using it in an ATM or PIN pad machine at least once in between.

I do wonder about the liability implications of it though. You would have to assume that if you lose your card, the 120 euro will be gone out of it very quickly, and I don't recall ever "signing up" to it as such. It is very convenient though.

Dravokivich

I think the 4 attempts thing would be dependant on a time frame? Such as a day or so?

plodder

Dravokivich wrote: »

I think the 4 attempts thing would be dependant on a time frame? Such as a day or so?

Could be. I just looked at Bank of Ireland's site and they are vague about it. It just says you will be asked for a PIN "from time to time".

Alun

This is what AIB say over on their TalkTo forum ...

The maximum value for an individual transaction is €30; the maximum you can spend is €45 in consecutive contactless payment transactions before you will be requested to do a Chip & PIN transaction. This is for security purposes.

loyatemu

Alun wrote: »

This is what AIB say over on their TalkTo forum ...

so just keep doing €22 transactions to avoid the PIN? (asking for a friend :pac:)

MJohnston

bk - any idea what platforms the Leap app will support? I'm guessing Android only because (a) iOS doesn't support NFC and (b) no Windows because developers are jerks?

Alun

loyatemu wrote: »

so just keep doing €22 transactions to avoid the PIN? (asking for a friend :pac:)

How would that help? The €45 limit is cumulative, once you go over that amount it will trigger a PIN request.

Fred Swanson

This post has been deleted.

MJohnston

Fred Swanson wrote: »

This post has been deleted.

There's no time limit, it's consecutive transactions, no matter how long you wait in between. Easier to just enter the pin once in a while.

Alun

MJohnston wrote: »

There's no time limit, it's consecutive transactions, no matter how long you wait in between. Easier to just enter the pin once in a while.

Exactly, as I said, it's a cumulative limit, no mention of the word 'daily' anywhere in the quote I gave

MJohnston

Usually isn't a problem for me anyway thanks to Tesco being useless when it comes to modern technology.