In message , Roland Perry
writes

Don't be absurd. TfL are only taking the risk when the stolen card is
used to BUY TRAVEL!!

That's not what you said in your previous post. I made a point about the
general insecurity of contactless cards, which is the reason why the
transaction limit is low (in all countries, not just the UK).

You replied with "For all we know the risk is being borne by TfL"
(although I've seen no claim from them that they will bear the risk).

If he's using the card to buy packets of cigarettes, that's not TfL's
problem, or a new problem, or indeed anything to do with this thread.

It's the bank's problem, which is why I doubt that they will be prepared
to expose themselves to the risk of raising the limit.

I guess you're thinking that an exception could be made for TfL - I
don't know if that would be technically possible, as there are no
exceptions for anything at present. But even if it was possible, it
would be one heck of a job to persuade all the issuers of Visa,
MasterCard and AmEx credit and debit cards around the world to
reprogramme their systems and issue revised instructions to customers
for the sake of one small scheme in London which doesn't at the moment
look very attractive.
--
Paul Terry

"Paul Terry" wrote in message
...
In message , Roland Perry
writes

Don't be absurd. TfL are only taking the risk when the stolen card is used
to BUY TRAVEL!!

That's not what you said in your previous post. I made a point about the
general insecurity of contactless cards, which is the reason why the
transaction limit is low (in all countries, not just the UK).

You replied with "For all we know the risk is being borne by TfL"
(although I've seen no claim from them that they will bear the risk).

If he's using the card to buy packets of cigarettes, that's not TfL's
problem, or a new problem, or indeed anything to do with this thread.

It's the bank's problem, which is why I doubt that they will be prepared
to expose themselves to the risk of raising the limit.

TfL have negotiated that the cards can be used for travel with no PIN
challenge.

Most people would guess that the banks would only agree to this if the
misuse risk transferred to TfL.

I guess you're thinking that an exception could be made for TfL - I don't
know if that would be technically possible, as there are no exceptions for
anything at present.

Actually that is exactly how it is for "normal" PIN verified transactions.
Those places (pay phones/car parks etc) that accept Chip and Pin cards but
don't challenge for the PIN, take the risk of misuse instead of the bank

tim

In message , tim....
writes

TfL have negotiated that the cards can be used for travel with no PIN
challenge.

Well, it depends how you read the statement "customers will never be
asked to enter a PIN at a busy station gate-line".

But I guess it's reasonable to assume that the last five words are
redundant, as I can't see TfL providing PIN entry pads on gates.

But this is the same press release which claims TfL "will make full use
of the payments industry's security systems" - when they are obviously
not making use of one of the key security element (the need to key-in a
PIN after every few transactions).

I wrote:

I guess you're thinking that an exception could be made for TfL - I don't
know if that would be technically possible, as there are no exceptions for
anything at present.

Actually that is exactly how it is for "normal" PIN verified transactions.
Those places (pay phones/car parks etc) that accept Chip and Pin cards but
don't challenge for the PIN, take the risk of misuse instead of the bank

But the risk is much less with the "customer not present" system for
chip-and-pin, as the card details are checked on the spot, and the
transaction refused if the card is recorded as stolen or lacking in
funds.

With "wave and pay", the transaction goes ahead, come what may, and the
thief gets away with his or her purchase.
--
Paul Terry

"Paul Terry" wrote in message
...
In message , tim....
writes

TfL have negotiated that the cards can be used for travel with no PIN
challenge.

Well, it depends how you read the statement "customers will never be asked
to enter a PIN at a busy station gate-line".

But I guess it's reasonable to assume that the last five words are
redundant, as I can't see TfL providing PIN entry pads on gates.

But this is the same press release which claims TfL "will make full use of
the payments industry's security systems" - when they are obviously not
making use of one of the key security element (the need to key-in a PIN
after every few transactions).

I wrote:

I guess you're thinking that an exception could be made for TfL - I
don't
know if that would be technically possible, as there are no exceptions
for
anything at present.

Actually that is exactly how it is for "normal" PIN verified transactions.
Those places (pay phones/car parks etc) that accept Chip and Pin cards but
don't challenge for the PIN, take the risk of misuse instead of the bank

But the risk is much less with the "customer not present" system for
chip-and-pin, as the card details are checked on the spot, and the
transaction refused if the card is recorded as stolen or lacking in funds.

ITYF that phone boxes and car park machines don't authenticate in real time
either. That would cost them money.

The operators of these types of systems "save" money on the technology
needed to transact the payment, at the risk of greater level of "shrinkage".
They do this (as Roland eluded) because the product that they are selling is
not tangible and there is a limit as to how much of it can be stolen because
it cannot be resold at a benefit to the thief (premium rate phone scams
excepted).

tim

In message , at 16:50:39 on Sun, 27 Feb
2011, tim.... remarked:
The operators of these types of systems "save" money on the technology
needed to transact the payment, at the risk of greater level of "shrinkage".
They do this (as Roland eluded) because the product that they are selling is
not tangible and there is a limit as to how much of it can be stolen because
it cannot be resold at a benefit to the thief (premium rate phone scams
excepted).

I wasn't so much interested in the lack of selling on, but the fact that
the cost of the item that's "shrunk" is virtually zero.

So my local airport car park can attempt to charge me £25 to park there
for a day, but if the credit card I use to pay, turns out to be stolen,
it hasn't actually *cost* them anything extra to provide me with the
rental of the tarmac (especially when the car park is never full).
Unlike a packet of cigarettes, which has a very real manufacturing and
supply cost for each additional packet.
--
Roland Perry

In message , at 16:24:54 on Sun, 27
Feb 2011, Paul Terry remarked:

With "wave and pay", the transaction goes ahead, come what may, and the
thief gets away with his or her purchase.

But it's only local travel, which has no tangible cost. Just like the
multitude of car park machines that accept a credit card with no PIN
(not even magstripe PIN, let alone C&P), but car parking has no tangible
cost either, and the simpler quicker system is clearly worth it in the
long run.
--
Roland Perry

In message , Roland Perry
writes

In message , at 16:24:54 on Sun,
27 Feb 2011, Paul Terry remarked:

With "wave and pay", the transaction goes ahead, come what may, and
the thief gets away with his or her purchase.

But it's only local travel, which has no tangible cost. Just like the
multitude of car park machines that accept a credit card with no PIN
(not even magstripe PIN, let alone C&P), but car parking has no
tangible cost either, and the simpler quicker system is clearly worth
it in the long run.

I take the point about cost, but it is still lost revenue which the rest
of us get to pay through ticket prices and/or taxes as far as TfL is
concerned.

And if, as Tim mentioned, a number of services are now dropping the need
to supply a PIN or to authenticate in real time, the opportunities to
use a stolen card without detection are on the increase.

It's also worth bearing in mind that some banks make customers liable
for the fraudulent use of their card until reported as lost or stolen
(usually up to a maximum of £50).

I actually wonder what's in this for TfL in the end. Most commuters are
likely to use travelcards or seasons that are well beyond the reach of
wave and pay cards, and even tourists are likely to want a two-zone
weekly travelcard which would need the recently increased wave-and-pay
limit to be doubled. It would probably be of use for a trip between
Heathrow and central London, or for anyone who had forgotten their
Oyster (which TfL mentioned in their press release - although I would
imagine that most people keep their Oyster in the same place as their
bank card, so I'm not even convinced by that).
--
Paul Terry

In message , at 19:04:55 on Sun, 27
Feb 2011, Paul Terry remarked:

I take the point about cost, but it is still lost revenue which the
rest of us get to pay through ticket prices and/or taxes as far as TfL
is concerned.

You have to balance that lost revenue against the cost of selling
tickets, the cost of frustrated tourists using other means of transport,
and so on.

Most commuters are likely to use travelcards or seasons that are well
beyond the reach of wave and pay cards, and even tourists are likely to
want a two-zone weekly travelcard which would need the recently
increased wave-and-pay limit to be doubled.

You seem to have misunderstood the way this works. It's not a scheme to
allow people to buy tickets at machines by waving a card at it (although
there's no technical rather than commercial reason that couldn't become
a classic [with-occasional-PIN] way of using a paywave card).

It's for paying for individual entrances and exits from the tube (some
of the exits will be credits, of course), and for bus rides.

*if* the scheme also has daily and weekly capping, that will simulate
almost all the properties of a daily/weekly paper travelcard, so no need
for people to want one of those.

But that weekly, capped, travelcard-equivalent won't be one paywave for
~£40, it'll be the sum of lots of ~£2 trips capped at ~£6 a day over a 7
day period.

The fraud control for this is no worse than for "classic" paywave
transactions (admittedly no PIN, but there's the 4hr blacklist). Now, if
you were suggesting that the entire paywave initiative is misconceived,
that might be a good debate; but the Tfl version isn't any worse.

It would probably be of use for a trip between Heathrow and central
London,

Yes, that's a typical journey where knowing how painless it is to pay,
might persuade some people to switch to using the tube.

or for anyone who had forgotten their Oyster (which TfL mentioned in
their press release - although I would imagine that most people keep
their Oyster in the same place as their bank card, so I'm not even
convinced by that).

That does seem a bit of a stretch, but maybe we are assuming everyone
carries a wallet everywhere?
--
Roland Perry

In article ,
Roland Perry wrote:
It's for paying for individual entrances and exits from the tube (some
of the exits will be credits, of course), and for bus rides.

*if* the scheme also has daily and weekly capping, that will simulate
almost all the properties of a daily/weekly paper travelcard, so no need
for people to want one of those.

Well, we already know, I think, that it *won't* charge and refund for
individual entries and exits, but will instead make a single charge at
the end of the day for the total fare for that day.

But that weekly, capped, travelcard-equivalent won't be one paywave for
~£40, it'll be the sum of lots of ~£2 trips capped at ~£6 a day over a 7
day period.

Well, I imagine that when they implement weekly capping they will
still take the money daily (not weekly). So it will be the sum of
lots of daily totals, none of which will exceed the daily cap, of
course.

-roy

"Paul Terry" wrote in message
...
In message , Roland Perry
writes

In message , at 16:24:54 on Sun, 27
Feb 2011, Paul Terry remarked:

With "wave and pay", the transaction goes ahead, come what may, and the
thief gets away with his or her purchase.

But it's only local travel, which has no tangible cost. Just like the
multitude of car park machines that accept a credit card with no PIN (not
even magstripe PIN, let alone C&P), but car parking has no tangible cost
either, and the simpler quicker system is clearly worth it in the long
run.

I take the point about cost, but it is still lost revenue which the rest
of us get to pay through ticket prices and/or taxes as far as TfL is
concerned.

And if, as Tim mentioned, a number of services are now dropping the need
to supply a PIN or to authenticate in real time, the opportunities to use
a stolen card without detection are on the increase.

It's also worth bearing in mind that some banks make customers liable for
the fraudulent use of their card until reported as lost or stolen (usually
up to a maximum of £50).

I actually wonder what's in this for TfL in the end.

I can't see that either. Let's spend some money implementing a system that
allows people who we are currently "ripping off" with cash fares to pay
less, without actually withdrawing any of the products that we currently
have (and thus save some money there).

Cynically, once implemented fully, I can only see a result which is that
some other payment method is withdrawn completely and the only one that
makes sense is "cash"!

tim