Contactless Visa Debit

KoolKid

Just wondering is there a list or any details of what retailers are using this technology.
The ideal ones that come to mind would be drive through s like Mc Donalds etc.

Ben D Bus

I was just about to ask the exact same question.

Got my Visa debit today and can't wait for the day I can do small transactions with my card but without the whole card processing rigmarole.

Donnielighto

Whole thing seems very unsecure.

KoolKid

Newsagents would be ideal as well if they would drop that silly €10 minimum rule.

KoolKid

Donnielighto wrote: »

Whole thing seems very unsecure.

That's why there is a maximum of €15 . You are also covered for an transactions after you report your card stolen.

Ben D Bus

Looks like Spar & Mace are on board anyway. That's my lunchtime sandwich sorted.

http://www.siliconrepublic.com/business/item/26576-spar-mace-xl-to-accept-co

And Centra

http://www.musgravegroup.com/en/news/news_article/Centra_announced_as_first_retailer_to_accept_contactless_payments.php

So is there a little icon in a shop window or at a card terminal that will tell me I can conduct a contactless transaction? Cos I haven't noticed one yet. Lots of future tense in the above articles (although Musgraves is a year old)

KoolKid

A lot of Centra I know have a €10 minimum spend . That leaves transactions between €10 ,& €15 . Can't see that being very often.

ted1

The minimum spend is there to cover the costs associated with accepting card payment. With a low mark up you could make a loss accepting cards.

KoolKid

This still doesn't change that it only gives you a €5 window of when you can use this method of payment. I would have thought this was ideal to speed up those small transactions thus saving you money in other ways.

Ben D Bus

KoolKid wrote: »

A lot of Centra I know have a €10 minimum spend .

But does (or will) that apply to contactless transactions?

KoolKid

Unless the charges are different, I would say so.

Bank of Ireland: Graham

Hi all,

KoolKid wrote: »

Just wondering is there a list or any details of what retailers are using this technology.

You can find information on where you can use your contactless card on Visa's own website here.

Donnielighto wrote: »

Whole thing seems very unsecure.

There's also a section on security but we've had a query on that before so I've included the response below:

Bank of Ireland: Linda wrote: »

Also regarding security, the card will be enabled with the latest security features. As an extra precaution, from time to time, you may be asked to enter your PIN to complete a transaction. Once you report the card lost or stolen you will be covered by the Visa Debit card terms and conditions of use.

KoolKid wrote: »

A lot of Centra I know have a €10 minimum spend

Ben D Bus wrote: »

But does (or will) that apply to contactless transactions?

Our Visa Debit cards allow contactless purchases up to €15 with no minimum. Any minimum spend will be at the discretion of individual retailers.

Ben D Bus wrote: »

So is there a little icon in a shop window or at a card terminal that will tell me I can conduct a contactless transaction?

Most will have the Contactless symbol displayed on the terminal. You can view a short demo on how it works here.

Thanks for all your posts,
Graham

KoolKid

Thank you Graham.

collier

@BankOfIreland - I think you guys should be supplying RFID blocking sleeves with all of your contact-less Visa Debit cards.

You could integrate them with the credit card wallets you used to give to customers (maybe still do).

Just my opinion, would add peace of mind.

KoolKid

What range is this receivable from???

collier

KoolKid wrote: »

What range is this receivable from???

I would say for the cards it's a max of 1 metre in ideal conditions but would probably be much less.

I'm only giving the suggestion based on how packed Luas and Commuter trains are which could result in somebody having an RFID reader in their pocket walking by you and obtaining your card number and expiry.

With that data it is possible for them load the data onto a standard magnetic card and spend away. It would be unlikely to happen but in theory is possible.

I love the idea of RFID payments but so would criminals.

KoolKid

Could this get you the information to use with the PIN or the security code?
If not I think the low probability on top of the low limits make this impractical for criminals.

Ben D Bus

Given that these cards have been out for years, what are the actual figures for theft from contactless cards? And how does it compare to theft of cash from pockets?

KoolKid

Ben D Bus wrote: »

Given that these cards have been out for years, what are the actual figures for theft from contactless cards? And how does it compare to theft of cash from pockets?

I'd be interested in seeing this as well.
I'd imagine it is low . If there was a risk at present I could not see them being pushed.

Tow

Once upon a time the banks thought 1/2 inch magnetic tape on the back of cards was secure...

KoolKid

Security is more reactive than proactive. They will respond to threats rather than just possible scenarios.

Bank of Ireland: Graham

Hi all,

I just wanted to re-iterate that, as required by the payment card industry, our contactless cards include the latest security features. The protection of our customers' data and card security is a primary concern to us. When developing products and services for our customers, it's at the forefront of our considerations.

We provide Verified by Visa, for example, which is a free fraud prevention service that helps guard against unauthorised use of your Visa Debit card on the Internet. It's added security to help protect against fraud by asking customers to authenticate themselves when shopping online.

Also, as mentioned previously:

Bank of Ireland: Linda wrote: »

As an extra precaution, from time to time, you may be asked to enter your PIN to complete a transaction. Once you report the card lost or stolen you will be covered by the Visa Debit card terms and conditions of use.

We'll always investigate all reported cases of fraud and review each case on an individual basis. Our cardholders will have exactly the same protection as they have for all other fraud reported transaction types, once there hasn't been a breach in the terms and conditions of use of the card.

Thanks for all your posts,
Graham

Tow

Bank of Ireland: Graham wrote: »

I just wanted to re-iterate that, as required by the payment card industry, our contactless cards include the latest security features.

The technology has already been hacked, according to this report: http://www.boards.ie/vbulletin/showthread.php?t=2056678772

Popoutman

Questions for Graham:

What exactly are the "latest security features" that have been implemented in the debit cards being issued at the moment to BOI customers? I'm genuinely interested in this from a true security and crypto point of view, not just the generic marketspeak that is usually churned out to interested parties.

What exactly is contained in the RFID transmissions between card and reader? Is it a form of a zero-knowledge challenge? What protocol is in use? If the protocol(s) is/are truly secure then knowledge of the protocol is not a security problem.

What are the charges per transaction to the retailer? How do these transactions compare to Laser?

Bank of Ireland: Pat

Hi Popoutman,

Thanks for your query. Apologies, but unfortunately we don't have access to the technical specification details that you're looking for in relation to the RFID (Contactless) feature of the card.

As for the second part of your query, we wouldn't know what charges are applied to the retailers. This is down to the agreement between the retailer and the acquirer. The acquirer is the bank or financial institution that processes credit or debit card payments for a retailer.

Thanks
Pat

Popoutman

Pat,
Thanks for the response.
That's what I feared for the technology portion. As someone working in the security side of computing, I try to see through the marketspeak to see for myself if any new technology is actually more secure, or just advertising fluff. Time to read through the patent applications and conference papers so..

And I should have realised that the transaction charges may not be known to yourselves - (commercially sensitive information). I do hope that the charges by the merchants will be reduced compared to the current sets, otherwise it will be pretty pointless and a waste of money and an increase in consumer vulnerability, to roll out the contactless RFID cards and readers for what is only a tiny proportion of the sales.

who is this

ted1 wrote: »

The minimum spend is there to cover the costs associated with accepting card payment. With a low mark up you could make a loss accepting cards.

Cash handling has costs associated with it too.

I do not believe that any of the managers have done the slightest amount of investigation into the ideal minimum spend for a card. Can anyone really picturing them doing that? Cause it does seem to be ad-hoc shop-by-shop. Some it's €5, some €10 etc.

More likely they thought "Oh taking cards is a pain, lets make it a minimum of €10 to save ourselves the hassle" and now they're set in their ways that its so widespread, they won't consider changing it. They apply it as a blanket rule even though most credit cards are percentage based merchant fees (and Visa Debit is too, if I'm not mistaken?).

Tesco and Dunnes take a card with a minimum of €1 (I think. I only ever had a transaction refused once: it was something like 48c, to see if it would work). Based on their profit margins in Ireland, Tesco are no fools when it comes to doing business.

Anyway, they're just as secure as normal cards. Using an NFC app on Android only gives you the card number and other printed details (you can only do cardholder-not-present transactions). You can get the same information with a camera when someone opens their wallet! Getting close enough to someone to read it by NFC would be far more difficult without arousing suspicion than taking a picture. I have an NFC phone. at most you can be ~5cm from the card if stationary and nothing is in the way. If swiping past it, you pretty much have to brush off the card itself.

I do have a question for BoI though out of curiosity. Why is the limit €15, when according to Visa Europe, the standard limit for euro-denominated cards is €20? With minimum purchase rules of €10, a maximum of €20 would have been more useful. I can't imagine that Visa Ireland had a change of heart for any reason other than the influence of the only Irish contactless issuer :rolleyes:.

Bank of Ireland: Billy

Hi who is this,

Thanks for the question.

This is business sensitive information that we cannot discuss.

Thanks

Billy

youngblood

Apart from Luas/Trains/Dart....where else can I do a contactless payment?
I've seen no where for the last 3 weeks that accepts it.................

Bank of Ireland: Graham

Hi youngblood,

We don't have a full list of retailers that have contactless pay points. However, we've had this query earlier in this thread. I hope this helps:

Bank of Ireland: Graham wrote: »

You can find information on where you can use your contactless card on Visa's own website here.

Thanks,
Graham

Kopparberg Strawberry and Lime

Bank of Ireland: Graham wrote: »

Hi all,

I just wanted to re-iterate that, as required by the payment card industry, our contactless cards include the latest security features. The protection of our customers' data and card security is a primary concern to us. When developing products and services for our customers, it's at the forefront of our considerations.

We provide Verified by Visa, for example, which is a free fraud prevention service that helps guard against unauthorised use of your Visa Debit card on the Internet. It's added security to help protect against fraud by asking customers to authenticate themselves when shopping online.

Also, as mentioned previously:



We'll always investigate all reported cases of fraud and review each case on an individual basis. Our cardholders will have exactly the same protection as they have for all other fraud reported transaction types, once there hasn't been a breach in the terms and conditions of use of the card.

Thanks for all your posts,
Graham

PCI DSS ? i know all about PCI DSS having worked for many UK banks, one major irish bank and an american bank all on this one thing.

How can this technology be safe when the system thats already in place for PCI DSS is already flawed as it is ? (maybe i need to take this to a new thread in a forum not aimed at a specific bank ? )