In message , at 20:32:42 on Wed, 10 Sep
2014, Kevin Ayton remarked:
the current generation of CPC (aka EMV) cards can't be written to by
the 'transit application' in the gate or validator, but they are
updated by the reader. They contain a transaction counter and a
cumulative sum recording the contactless transactions.

But neither of these have any details about the individual transactions.

If either of these reach a set threhold then the card will require a
Chip'n'PIN transaction so that it can go online and ge tthe counters
reset. This is a design feature to minimise some of the risks if the
card is lost or stolen.

If all you do is buy a coffee at Starbucks (or whatever), then the
occasional Chip'n'PIN operation won't be a problem. IN the transit
world I'm not 100% sure whether the card can go on for ever, or whether
you will need to buy a coffee every so often.

My understanding is that transit operators such as TfL have managed to
negotiate an exemption (possibly at their own risk, but let's face it a
blagged journey on a tube train costs them nothing, a blagged Starbucks
coffee costs the franchisee real money).

I don't know exactly how this exemption has been implemented, but I
wouldn't be surprised if all TfL readers were excluded from the
requirement to increment either of the two counters mentioned.

Clearly, there's no possibility of anyone typing in a PIN.

If a card is reported (or maybe even suspected by usage patterns) to
have been stolen, then TfL will block it from being used any more by
having hot-lists at the gates. We know they do this because of the way
they describe what happens if you travel on a CPC card whose previous
day's journeys have run up a "bad debt" because the most recent
overnight funds transfer was refused by the bank.
--
Roland Perry