Madrock

Guardian Technology Pages
28 September 2006
The Guardian

“Your card has been declined.”
“What? No way, there’s plenty of money in that account!”
“I’m sorry, madam, but it’s refusing the transaction.”
“It’s your card reader, that card worked fine in Boots five minutes ago.”
“The card has been declined. Do you have another one?”
The casual eavesdropper might infer that I - the protesting woman in that dialogue - am financially irresponsible, that my credit card is maxed out or my debit card has reached its overdraft limit. In fact, it’s far more likely that the reader on the chip and pin machine is throwing a strop. There is a machine at WH Smith in North End Road, Fulham, that hates my debit card and never accepts it. I’ve given up trying there. But it’s not the only one.
Self-service machines have sprung up everywhere, sprouting card readers and keypads. But watch closely and you will find that more often than not, there is an angry person muttering and swearing at the machine while a queue forms. Watch a little longer and you’ll see that queue evaporate - and reform at the counter in front of a human being.
This happened to me and my partner in France recently when we pulled into a petrol station in Epernay. In our desperation, we pulled up at an empty pump, wondering vaguely why it had no queue while others did.
Why? Because before it would dispense petrol, it wanted a credit card and pin. We fed it mine and I keyed in the number, only for it to be spat out with terrifying admonitions in French about the card being refused. I wiped the strip and tried again. Same reaction, causing a moment’s panic: we’d spent a bit on that card - did my bank think it was stolen? Was it blocked?
So we tried my partner’s card. Same thing. And then the penny dropped that the pumps with the queues were the old-fashioned ones where you fill the car up and then pay at the till. Clearly the locals knew all about these pumps.
Mind you, it was a miracle we got to France at all. When we arrived at the Eurotunnel terminus we joined a queue of cars for the automatic check-in. I am not the most patient of queuers and within a short time I was railing about how slowly it was moving. A man in a bright yellow jacket was buzzing about from car to car. Finally we got to the head of the queue and fed in the card that was used to book the shuttle online.
It didn’t want to know. It spat the card out. We tried again and got as far as tapping in our reservation number. It spat it out again. The chap in the high-visibility jacket buzzed over to us and rolled his eyes, saying: “It’s been playing up all day.” He went into the booth with the card - and then we heard him saying over his radio that the whole system had gone down in protest.
As an idea, the technology is great. In practice, we have a long way to go before we can dispense with human beings who can override systems when good card readers go bad. Kate Bevan

© Copyright 2006. The Guardian. All rights reserved.

MIFARE and ISO/IEC 14443 Type A are not the same. While MIFARE is often viewed as an extension to or subset of ISO/IEC 14443 Type A, it is a proprietary encryption/conditional access protocol owned and licensed by Philips Semiconductors to multiple vendors of card ICs and reader ICs.

Because MIFARE has been so predominantly used with products employing ISO/IEC 14443 Type A technology, it has mistakenly become synonymous with the standard. However, ISO/IEC 14443 Type A is a completely open standard when used independently of the MIFARE encryption/conditional access scheme.

Many vendors are actively developing new technologies to address the increasing market need for secure contactless technologies for a wide variety of applications. Changes in government regulations will also provide opportunities for enhancing contactless technology performance. It is important to note, however, that standards development is a lengthy process so it takes time for new technology developments to be reflected in standards that help to drive the availability of interoperable solutions. A few examples of new technologies that are expected include:

• Changes to technology based on the ISO/IEC 15693 standard. Contactless cards supporting the ISO/IEC 15693 standard currently operate at 1.65 Kb/sec to meet FCC limits on sideband power in this frequency range. The FCC is expected to lift its restriction in late 2002, which would allow cards based on the ISO/IEC 15693 standard to improve their data rates.
• Changes for higher speed operation. ISO working groups plan to add higher speed modes of operation to ISO/IEC 14443. This will increase the speed supported by this standard from 106 Kb/sec to the 848 Kb/sec that has already been demonstrated by IC manufacturers.
• Alternative access control reader networking solutions. Wireless readers offer a significant advantage in lower costs of installation, particularly in older facilities. New security approaches can ensure strong authenticated channels between hosts or panels and new wireless readers. IP readers also permit direct connectivity to LANbased management and control applications.
• The ability for a single contactless chip in a card to operate in full ISO/IEC 14443 and ISO/IEC 15693 modes.

One risk with contactless cards is the ability for the card to be activated when it enters a reader’s RF range without the owner being aware of it. To prevent a contactless card activation without the card owner being aware of it, the application can be configured to always ask for the owner’s authorisation (password, PIN or biometric) before providing any user information or processing on the user’s behalf.

There is confusing terminology used in the market to refer to cards that can support a combination of technologies. Cards are described as multiple technology when multiple, independent technologies share a common plastic card and do not communicate or interact with each other (e.g., magnetic stripe and contactless or contact chip). Cards are described as having a “dual-interface” when the card has a single integrated circuit (IC) that can communicate with a smart card reader/terminal via either contact or contactless.

Images of RFID Tags

RFID Cloning

Interesting Links 

http://www.smh.com.au/news/technology/lost-in-transit-no-more/2006/11/30/1164777706811.html 

http://www.timesonline.co.uk/article/0,,2-2302505,00.html

http://en.wikipedia.org/wiki/RFID 

http://www.workpermit.com/news/2006_08_04/rfid_technology_cloned.htm

http://www.guardian.co.uk/idcards/story/0,,1950226,00.html 

from: http://prisms.cs.umass.edu/~kevinfu/papers/RFID-CC-manuscript.pdf

RFID-CC-manuscript.pdf

This is a great article, worth a read.

27 September 2006
Kommersant International

The New System will be Offered to 20 Banks<br>Yesterday, at a press conference dedicated to the five-millionth visa card issued by Sberbank, Visa International representative Oliver Hughes announced that a project introducing a system of card-to-card money transfers in Russia has launched its third stage. The project, called Visa Money Transfer (VMT), is now being tested in six Russian banks. Also yesterday, Rosbank announced its intention to participate in the trial. Twenty credit organizations have expressed interest in joining the program, of which ten will be included in the project within the next year. The trial phase of the program will last another six months, after which the VMT system is expected to be unveiled in its full form. The VMT system allows any Visa cardholder to electronically transfer or receive funds to or from another Visa cardholder via an ATM transaction. To make the transaction, all that is needed is the other cardholder’s card number. Though the company “at this point is not positioning the new service as an alternative to the system of traditional money transfers,” VMT promises to be competition for that system. The only restriction is that the laws of the Russian Federation permit such transfers to be made in Russia only in rubles. Market analysts believe that the success of the system will depend on Visa’s commission policies. Bank commissions for transfers stand at around 1%, and if Visa’s commission is more than 0.5%, it is predicted that banks will find it hard to do business within the project. According to some sources, the commission earned by the bank whose client sends the transfer will be 1% of the transfer sum. The bank whose client receives the money will make $0.48 on each transaction. The commission charged by the payment system will be $0.05 + $1. Many Russian banks have expressed interest in the project, but most for now are observing the program’s development from the sidelines, preferring to judge for themselves its power to attract customers. http://www.kommersant.com/photo/75/DAILY/2006/180/KMO_032838_00111_1h_t75.jpg
http://www.kommersant.com/photo/512/DAILY/2006/180/KNN_001535_00046_1m.jpg
http://www.kommersant.com/photo/512/DAILY/2006/180/KMO_073625_00010_1m.jpg
http://www.kommersant.com/photo/512/DAILY/2006/180/KMO_069500_00019_1m.jpg

© 2006 ZAO Kommersant Publishing House. All rights reserved. ЗАО Коммерсантъ. Издательский Дом. Все права защищены.

Recently I came across a new e-Commerce company called EFT Networks, which seems to have an exciting future in the Global Payments Market.

It looks like they have a good mix of consulting and solution design.

www.eftnetworks.com

Services

Electronic Payment

Designed to enable both credit card and direct debit, EFT Networks electronic payment solutions work effectively across multiple sales channels—including Web, Contact Call Centre, IVR and EFTPOS. Manage your payment processing system in-house or outsource, depending on your business needs.

Global Payments

International commerce requires fully integrated global payment and risk management solutions. Requirements span the gamut of payment acceptance considerations from accepting local payment types, pricing in local currencies and dynamically updating prices with changes in exchange rates (dynamic currency conversion), authorising and settling in multiple currencies, to managing fraud and compliance issues such as tax and export regulations. EFT Networks offers a single interface to the global payment network to handle all of these considerations as your business grows.

ICE - Reporting & Management

The EFT Networks Enterprise Business Center gives you a single, easy-to-use interface for managing and configuring payment processing services.

ICE caters for each area of the payment transaction cycle from authentication, authorisation, settlement, dispute resolution and reconciliation – enabling our clients to reduce transaction costs, eliminate fraud, minimise risk, maximise cash flow and increase profitability.

Integrations

EFT Networks provides flexible and secure payment and risk management integrations in to host and legacy systems as well as industry-leading software.

Using industry standards and protocols, our solutions can be customised to suit your exact business requirements

Products

ICE (Intelligent Communications Exchange)

At the core is our Intelligent Communications Exchange (ICE) which enables all known transaction enablers from EFTPOS to eCommerce to be routed directly to a client’s bank without intervention for real time acceptance and authentication.

The EFT Networks ICE operates under a philosophy of total System and Physical redundancy delivering the highest uptime rates possible, whilst the transaction network is protected using Solid State and Application Firewalls on all points of ingress and egress.

Every transaction processed through EFT Networks is encrypted using 128 bit Secure Socket Layer (SSL) encryption and submitted for authorisation through EFT Networks “Secure Virtual Private Network” (SVPN).

Our commitment to security is also reflected in our swift compliance with Card Schemes security initiatives such as VerifiedByVisa and MasterCard SecureCode.

EFT Networks comprehensive suit of online reporting tools combined with daily transaction reports will ensure that our clients always have access to up-to-date management information allowing Business Managers to make quick and well-informed business decisions. The decision making process is simplified even further with the power of daily reports that are customised to be imported into most existing legacy systems.

I have been astounded by the take-up by card holders and the push from the major banks in Australia, for customer to embrace the VISA Debit card instead of the traditional Credit Card.

This, although advantageous to the banks, provides a much higher risk to the card holder, especially if the card is used online or in a location where the card could be skimmed.

The problem and the advantage of the VISA Debit card is that it allows access to your savings account funds via a VISA transaction.

This sounds great in theory, as there is no need to transfer money from your savings account to periodically pay off the credit card.

The problem exists where the VISA debit card is skimmed or stolen and money is withdrawn from the card. These funds are taken directly from the card holder savings account and not credit, therefore this increases the risk to the card holder not being able to pay bills/mortgage/loans/etc.

In the traditional credit world, if the credit card was skimmed or stolen, the dept remains the responsibility and risk of the bank, until the fraudulent transaction is investigated.

With the VISA Debit Card this risk is placed upon the card holder, who is often convinced to get one of these cards through good television marketing, when opening a new account or establishing an off-set loan, with no idea of the associated risks.

I don’t like the increased risks associated with these cards not being explained adequately to the card holders so the card holder can make an educated decision as to where he/she uses the card (internet, phone, periodic utility payments, ISP charges, etc.)p>

This risk assumes that the card holder does not rely on credit only to live and does not have any savings to withdraw, but the banks may not give you a debit card anyway if this is the case.