Apple Pay Express Transit Users in NYC Reportedly Being Charged Just for Going Near Tap-and-Pay Readers

[zorinlynx]

On that note, I'm kinda surprised people haven't freaked out more about the latest contactless cards. We have a history of being very reluctant to use the technology due to security fears, after all.

I don't mind because I have a wallet that blocks the NFC signals. I remember testing it when I got my first credit card with an NFC chip; I rubbed my wallet all over the terminal and nothing happened. Then I took the card out and it worked right away.

Most wallets have RF blocking to stop NFC now; it'll usually say it on the documentation that comes with the wallet. If you keep your cards in such a wallet you can relax.

 

[tmiw]

I don't mind because I have a wallet that blocks the NFC signals. I remember testing it when I got my first credit card with an NFC chip; I rubbed my wallet all over the terminal and nothing happened. Then I took the card out and it worked right away.

Most wallets have RF blocking to stop NFC now; it'll usually say it on the documentation that comes with the wallet. If you keep your cards in such a wallet you can relax.

Multiple cards will cause many (if not all) terminals to refuse to read as well.

Really, though, I personally don't see wireless skimming as a big threat at the moment. I'm sure others will disagree, however, and it's also possible that this threat will become a bigger issue over time.

 

[abhibeckert]

Apple Pay usually requires authentication - why did they set this up to work without it? There’s no way I’d enable the feature.

Is it really too much for people to trouble tap the button on their watch/phone to pre-authenticate as they approach the gate?

If you have the card setup on your watch and phone - could that double charge it I wonder?

 

[ignatius345]

I used Express Transit twice in December, worked perfectly.. no additional transactions. Oddly, I received a refund for both of them a couple days ago. No idea why, though I now wonder if they're proactively giving refunds for people who used OMNY terminals that have been deemed to be hyper sensitive.

Same. I just noticed an MTA refund a couple days ago. I don't think I'd gotten an erroneous charge because I don't think I've gone through an OMNY-enabled turnstile without using the NFC payment.
[automerge]1578602396[/automerge]

Apple Pay usually requires authentication - why did they set this up to work without it? Is it really too much for people to trouble tap the button on their watch/phone to pre-authenticate as they approach the gate?

Because that would add massively more friction to the subway entrances. Authentication fails. People have stuff in their hands. People get distracted. There are a million reasons transit riders might not manage to dutifully unlock their phones before they get to the turnstile. And then you have people unlocking their phone AT the turnstile? Please. If you've ever been to New York and used the subway here, you'd know that nobody has time for that foolishness.

The transit NFC function has a pretty limited amount authorization, anyway. It's not like anybody's going to get ripped off for hundreds (or even a dozen) dollars.

 

[falainber]

Why is the US so much behind on contactless payment? Or is this something else?

In US, people mostly drive cars. Mass transit is an afterthought.

 

[steve knight]

I'm completely unsurprised this is happening.

Look at the photo in the post. Notice that the readers are right around hip height.

If your phone is in your pocket and you are EXITING the station (you exit and enter through the same turnstiles) it's conceivable that the phone in your pocket might brush right up against that terminal when you walk out.

This could also hit NFC-enabled credit cards in your wallet if your wallet brushes past the terminal so it's not just an Apple problem.

One potential way to reduce the issue is for the turnstile to disable the reader for five seconds whenever someone exits.

I dont think thats it it is they are too powerful. for the busses and transit and anywhere apple pay works you have to put your phone right next to the reader.

 

[nexesnex]

NY Post sometimes enjoys writing sensationalized stories.... this might be one. I wonder how they got a hold of that person with the bag, or if she even truly exists...

 

[acblue94]

This is not rocket science... if have an iPhone with Express Transit turned on and you walk near a gate it's going to let you in. That's what it's suppose to do. If you intend on using a transit card then this OPTION should be turned off on your phone.

I've tried that ad it does not work at all. I wish it did. I have to actually take the phone out and place it over the screen.
[automerge]1578605065[/automerge]
For these people complaining, TURN OFF EXPRESS PAYMENT FOR TRANSIT.

 

[Kabeyun]

With those sensors placed as they are, the only surprise is that they didn’t think of this. How about putting them on the top of the turnstiles where a bustling crowd won’t bump up against them?

 

[glowplug]

Are we sure this isn't just an MTA revenue strategy?

 

[Optheduim]

Why is the US so much behind on contactless payment? Or is this something else?

US is finally popularizing contactless cards. Believe it or not, the US has enjoyed far less credit card fraud compared to Europe. This also explains why Chip-based credit cards are only a couple years old here as well. Minimal issues begets minimal incentive to usher in something new.

Furthermore, US credit cards don’t have pin-numbers and there is no limit for contactless including Apple Pay.

That said— the contactless reader in the subway turnstiles are to sensitive/poorly placed and picking up false-positives.

 

[Dan555]

Weird story, the range on NFC really isn't far enough (we're talking 6 inches tops in ideal circumstances ie not in a bag) to be on mistake, so unless these people were hanging on terminals or walking right past them (both of which are weird things to be doing) without going in there's something else going on.

I agree with this, the terminals have a short range, so a purse, bag or wallet would need to be placed on to the reader to be read. I would suggest a back office issue is more likely, where taps or charges have been erroneously duplicated.

Also seems odd in the article that customers have Express Transit enabled but are then using their physical card or Met card instead!

 

[PTLove]

One potential way to reduce the issue is for the turnstile to disable the reader for five seconds whenever someone exits.

lol. People won’t get in to their 9am job till midnight if they did that.

 

[konqerror]

I call BS. This works great. Today I tried using my watch that was under my coat sleeve and it didn’t work because it was blocked. Then moved the sleeve out the way and it worked perfectly. No way the NFC is having the signal from a phone in a purse.

The Watch has a far shorter range than the iPhone. You can see this in normal purchase transactions, I've observed that the watch requires basically being on top of the antenna and a little bit of waving, while on the very same terminal, the phone will read from easily 3-4 inches away.

 

[jimthing]

Use this in London daily now on buses and tubes; no issues like this. In fact you typically have to put the phone directly on the reader to get it to work, so any chance of "air reads" like this from 2+ inches away just wouldn't happen.

 

[Bill Av]

Why is the US so much behind on contactless payment? Or is this something else?

Ugh. Someone always asks this question. My answer is FUD, probably planted by retailers (based on the way they've behaved with ApplePay). This is actually the second time the MTA has tried to initiate contactless payments. The first time was about 15 years ago. I can remember that several stations along the 6 line had tap to pay turnstiles installed. Usually one per station. It never caught on. Why? There were news stories of how easy it was to steal credit card information. Tech guys would demonstrate a gadget that could capture CC information without the victim knowing. I'm usually an early adopter - but when my bank sent me a letter asking if I wanted to upgrade my card, I turned them down.

 

[psycoperl]

I agree with this, the terminals have a short range, so a purse, bag or wallet would need to be placed on to the reader to be read. I would suggest a back office issue is more likely, where taps or charges have been erroneously duplicated.

Also seems odd in the article that customers have Express Transit enabled but are then using their physical card or Met card instead!

we have to use our metrocards if we want to transfer to a non-Omny enabled line. Such as going from the 1 train to a crosstown bus which are not yet omny enables.

It’s funny because OMNY displays an error when you have more than one contactless device or card and it can’t tell which one to choose.

I have express transit on and paid with my MetroCard as I was transferring from a non OMNY bus line to the train many times and there was no issue with being charged

Omny should be hitting the buses I use on the regular soon—looking forward to this.

btw, it seems that no one has mentioned that the metro card system is a mag stripe based card and is over 20 years old. The equipment is starting to reach end of life. For example, the vending machines for metrocard run on Windows NT.

 

[djdj]

Payment methods that require no action by the user are a really, really bad idea.

 

[timborama]

One potential way to reduce the issue is for the turnstile to disable the reader for five seconds whenever someone exits.

Oh ya, that would go over well with the crush of people behind you waiting to use the turnstile. LOL

 

[MadeTheSwitch]

Apple Pay usually requires authentication - why did they set this up to work without it? There’s no way I’d enable the feature.

Is it really too much for people to trouble tap the button on their watch/phone to pre-authenticate as they approach the gate?

They set it up this way because a GREAT many people have to pass through the turnstiles in a very short amount of time. Nothing can get in the way of that or hold up the process. Got to keep people moving at rush hours.

It’s not too much, but people being people would forget, or be fighting with their phones, or maybe have their hands full. It’s best to keep this as simple and as quick as possible. And we are talking low dollar amounts here..it’s subway fare. So it’s not like your card is going to be charged for hundreds of dollars that you didn’t authorize.

 

[ignatius345]

One potential way to reduce the issue is for the turnstile to disable the reader for five seconds whenever someone exits.

Excellent idea. Everybody just needs to allot an extra 15 minutes to wait in line at rush hour. Maybe they could sell hot dogs to people in the queues.
[automerge]1578635015[/automerge]

People actually expected the MTA to pull something off that works? LMAO

They move more people every day than the rest of the entire American mass transit system, and they’re doing it on century old infrastructure and have been short funded by the state for decades. It’s a miracle the subway works as well as it does, and without it NYC would literally grind to a halt.

 

[displaced]

Use this in London daily now on buses and tubes; no issues like this. In fact you typically have to put the phone directly on the reader to get it to work, so any chance of "air reads" like this from 2+ inches away just wouldn't happen.

Same here. Definitely seems that the NY readers are far too powerful/sensitive.

Contactless payment terminals here work with the phone about 5cm away from the reader. But the contactless pads on UK ticket barriers require the phone or card actually makes physical contact with the pad.

But then London ticket barriers have been contactless-enabled for almost 20 years. Not sure why the provider of the NY system didn’t take the time to learn from successful systems in other countries.

 

[Dan555]

Not sure why the provider of the NY system didn’t take the time to learn from successful systems in other countries.

It is the same provider as London (Cubic Transportation Systems), I can only assume that NY’s readers are a newer product, which perhaps they will gather feedback from and improve (fine tune the signal depth etc.).

 

[dz5b609]

The short range is really only “enforced” if the reader is built on spec power-wise. Although usually the worry in this regard is criminals rather than legitimate equipment.

But this could very well turn out to be a completely different issue, nothing to do with actually physically reading the pass multiple times. My money is on a software issue inadvertently triggering multiple charges under some set of circumstances.

This is utter nonsense. The short range is inherent to the NFC technique, that has nothing to do with readers built spec power-wise. The air interface and used frequency on which NFC works is short-range, you can put more power on it all you want but that doesn't magically remove the limitation of the used air interface or frequency and that limitation really is about 7 inch in ideal lab conditions.

 

[gnasher729]

In London, TfL (Transport for London) have warning signs everywhere that you shouldn't have two cards too close together, or you wll be charged twice, but you have to be very close to the reader for the card to be read.

However, if there are false charges, you just go to their website and reject the charges. Once a month without explanation, more often and you have to talk to someone in person. Nothing to get excited about.
[automerge]1578850477[/automerge]

Believe it or not, the US has enjoyed far less credit card fraud compared to Europe.

We don't exactly enjoy it in Europe :-(