Can NSW commuters trust contactless card payments?

NSW Transport Minister Andrew Constance has strived to reassure the state's commuters that tapping on at a turnstile with a credit or debit card will be no riskier than using PayPass to buy their groceries at the supermarket.

Steve Wozniak and Andrew Constance at the Future Transport Summit

Constance announced at yesterday’s Future Transport Summit that the state government would begin trialling contactless payments in the place of Opal smartcards in 2017. Smartphone-based payments based on in-built NFC technology or Apple Pay will also form part of the pilot program.

The minister insisted that the same safeguards would be in place to protect payments on public transport as currently guard against the theft of financial data in any other retail transaction.

“It is about making people’s lives easier,” he said.

How will it work?

The NSW government’s electronic ticketing provider, Cubic, has already rolled out contactless payments across the London and Chicago public transport networks.

Speaking from the Sydney summit, Cubic president Matt Cole said NSW already had contactless payments capability in the reader hardware and communications infrastructure making up the $1.2 billion Opal system.

This “future proofing”, he said, means NSW won’t have to pay for the kind of hardware replacements that its counterparts in Queensland and Victoria are now facing.

“The trial will focus on back office technologies required to process the payments,” he said.

Once that groundwork is laid, Cole said, the leap to tapping on and off with a phone becomes very simple, because the system treats phone-based payments in the same way as credit cards.

“If by the time the system is stood up Apple Pay is an accepted product in Australia, then the system would accept it because essentially it is a contactless credit/debit card,” he said.

The biggest hurdle posed by open loop payments is the risk that a commuter has no money in their account, and the subsequent hold-up at the train station gates while the check takes place.

Cole said not all NFC chips are created equal and some pings back to the banks will take longer than the one-second window that is commonly accepted as the maximum processing time.

Chicago has opted for a risk-based approach that will fully check that a card is good to go the first time it is used on the transport network. If the transaction is successful, then that card will go on a ‘good’ list where expediency through the turnstiles is favoured against time consuming checks. Unsuccessful transactions will get a card placed on a riskier tier, where checking will happen more frequently.

Cole also noted that Opal card payment rules, like free trips after eight rides in a week, are applied at the back end, so they should continue under a new payments regime.

Is it secure?

The minister and the ticketing provider both worked hard to allay concerns that the new payments capability would open up yet another avenue for criminals to skim sensitive financial data from credit card users.

Constance pointed out that “across the retail sector there is already the ability to swipe your credit card at the counter”.

He said the government was making sure that "as we deal with those financial institutions those same safeguards are put in place”.

Cole insisted that there was “no specific risk to this environment compared to other contactless payments,” pointing out that the Opal system is already certified to accept credit and debit card payments via ticket vending machines.

However, the summit’s star guest, Apple co-founder and outspoken privacy champion Steve Wozniak, cautioned that no system will ever be foolproof.

“Every single system has flaws because software is written by humans,” he said.

Will it be worth the cost of implementation?

Transport for London’s customer experience chief, Shashi Verma, boasted that his city’s own, £68 million (A$125 million) transition to contactless payments in 2014 had paid for itself “in months”.

“It has reduced the commissions we paid to third parties to top up Oyster cards, it has increased revenue, it has allowed us to close ticket offices, and it has allowed us to take cash off the buses altogether. When you combine all of that, the annual savings are more than £100 million pounds,” he said.

What’s more, by erasing the need to obtain a special purpose smartcard, he said London had been able to lure some of the city’s last remaining non-users onto its heavily utilised public transport network, boosting patronage by one percent.

“Compared to what it cost us to put contactless in, the increase in revenue is overwhelming. It has paid for itself easily,” he said.