On Tue, 18 Dec 2012 12:08:05 +0000
Roland Perry wrote:
In message , at 10:37:27 on Tue, 18 Dec
2012, d remarked:
The problem with doing it for every transaction is that the card is
allowed to be removed from the RF field *before* the terminal has even
started its validation sequence.

In which case the transaction fails. Whats the problem?

But the transaction doesn't fail - that's the normal mode of use.

Huh? So the money gets deducted before any validation is done? Who designed
this system, some nursery school children?

B2003

In message , at 12:21:03 on Tue, 18 Dec
2012, d remarked:
The problem with doing it for every transaction is that the card is
allowed to be removed from the RF field *before* the terminal has even
started its validation sequence.

In which case the transaction fails. Whats the problem?

But the transaction doesn't fail - that's the normal mode of use.

Huh? So the money gets deducted before any validation is done?

No, the money is only deducted if the validation is successful.

The retailer's and the cardholder's account will be updated to indicate
a successful transaction; and a failed transaction will be flagged at an
online terminal (some milliseconds after the card has been removed). A
failed transaction at an offline terminal becomes a bad debt (for the
retailer/bank) and sorting that out is part of the swings and
roundabouts that permeates all card transactions (contactless or not).

The only thing that I believe doesn't happen, because it's basically a
read-only device, is the card being updated to indicate whether the last
transaction succeeded or not.

That's not too hard to understand is it?

--
Roland Perry

On Tue, 18 Dec 2012 12:32:46 +0000
Roland Perry wrote:
Huh? So the money gets deducted before any validation is done?

No, the money is only deducted if the validation is successful.

The retailer's and the cardholder's account will be updated to indicate
a successful transaction; and a failed transaction will be flagged at an
online terminal (some milliseconds after the card has been removed). A
failed transaction at an offline terminal becomes a bad debt (for the
retailer/bank) and sorting that out is part of the swings and
roundabouts that permeates all card transactions (contactless or not).

So no potential for abuse then. No, not at all...

The only thing that I believe doesn't happen, because it's basically a
read-only device, is the card being updated to indicate whether the last
transaction succeeded or not.

That's not too hard to understand is it?

The only thing thats hard to understand is how such a bloody awful design
got past the white board stage. Still, with the kind of bussed in morons
involved in system design these days I suppose I shouldn't be surprised.

B2003

wrote in message
...


That's not too hard to understand is it?

The only thing thats hard to understand is how such a bloody awful design
got past the white board stage. Still, with the kind of bussed in morons
involved in system design these days I suppose I shouldn't be surprised.

I think you misunderstand the motivation of such developments:

The Bank's requirements for the implementation of new way of taking money
from your account is not to do it in a way that lessens the risk of fraud.

It is to do it in a way that passes the fraudulent use risk onto the
customer.

tim

On Tue, 18 Dec 2012 15:04:39 -0000
"tim....." wrote:
wrote in message
...


That's not too hard to understand is it?

The only thing thats hard to understand is how such a bloody awful design
got past the white board stage. Still, with the kind of bussed in morons
involved in system design these days I suppose I shouldn't be surprised.

I think you misunderstand the motivation of such developments:

The Bank's requirements for the implementation of new way of taking money
from your account is not to do it in a way that lessens the risk of fraud.

It is to do it in a way that passes the fraudulent use risk onto the
customer.

Sadly you're probably right. Though in this case it seems like its the
shop that'll get stiffed. I'm surprised the retail sector want anything to
do with it.

B2003

Roland Perry wrote:

But the facility in question is being sold as an *alternative* to the
retailer having to install such a POS system with instant access to their
internal database of historical transactions.

Is it really? Can you quote some text suggesting that?

Every PayWave terminal I have seen so far has just been a more modern PDQ
machine/PIN pad connected in some way to the host ePOS system. The
capability may be as simple as the card generating a unique identifying
hash from the card number (assuming that such PDQ machines don't pass the
card number to the host). Not many shops now don't have any form of ePOS
at all.

Bus ticket inspections could be done by having the ticket machine print out
a ticket containing the last 4 digits of each credit card used during that
journey, perhaps. Or more technologically, communicate it to the
electronic gripping irons.

They could, yes. But *are* they? (Minor niggle: the Paywave terminals on
the buses don't have printers).

Aren't they just using the Oyster pads to read them? Those are part of the
ticket machine, which does have a printer.

If they are separate, like the Oyster pads at intermediate doors on the old
bendies, they are I suspect connected to the ticket machine by some means.

Neil
--
Neil Williams in Milton Keynes, UK. Put first name before the at to reply.

In message

..net, at 16:16:36 on Tue, 18 Dec 2012, Neil Williams
remarked:
But the facility in question is being sold as an *alternative* to the
retailer having to install such a POS system with instant access to their
internal database of historical transactions.

Is it really? Can you quote some text suggesting that?

"Retailers will be able to use data stored inside Visa payWave payment
card to deliver targeted messages at the point of sale. For example, a
coffee chain can recognize an infrequent customer that has not been to
the chain in over 30 days, and instantly print an offer at the bottom of
the card receipt, encouraging the customer to return soon. It can be
difficult and expensive for merchants to achieve a similar result using
existing data mining and direct marketing techniques, whereas with Visa
payWave, the feature is built into the payment transaction and the offer
is simply printed at the bottom of the receipt,"

Bus ticket inspections could be done by having the ticket machine print out
a ticket containing the last 4 digits of each credit card used during that
journey, perhaps. Or more technologically, communicate it to the
electronic gripping irons.

They could, yes. But *are* they? (Minor niggle: the Paywave terminals on
the buses don't have printers).

Aren't they just using the Oyster pads to read them? Those are part of the
ticket machine, which does have a printer.

Are they linked together sufficiently to be capable of printing such a
list?

--
Roland Perry

In message , at 13:56:28 on Tue, 18 Dec
2012, d remarked:
The retailer's and the cardholder's account will be updated to indicate
a successful transaction; and a failed transaction will be flagged at an
online terminal (some milliseconds after the card has been removed). A
failed transaction at an offline terminal becomes a bad debt (for the
retailer/bank) and sorting that out is part of the swings and
roundabouts that permeates all card transactions (contactless or not).

So no potential for abuse then. No, not at all...

Abuse by a holder of a merchant account will be dealt with fairly
rapidly. Non-holders can't process the transactions.
--
Roland Perry

wrote:

"Finished your journey? Touch the purple validator to ensure you
are charged the correct fare".

Or perhaps more logical one to signify that you are continuing it.

Even better, just close the journey if a touch-back-in doesn't occur within
the OSI time period, if necessary the next time the card is used. Don't
see why that's hard.

Neil
--
Neil Williams in Milton Keynes, UK. Put first name before the at to reply.

Neil Williams wrote:
wrote:

"Finished your journey? Touch the purple validator to ensure you
are charged the correct fare".

Or perhaps more logical one to signify that you are continuing it.

Even better, just close the journey if a touch-back-in doesn't occur within
the OSI time period, if necessary the next time the card is used. Don't
see why that's hard.

But there's also the issue of the journey time limit, which is where the
problem can arise. For example, let's say journey 1 lasts 80 minutes (90
allowed), and the next journey, from the same station, starts 15 minutes
later (20 mins OSI allowed). The Oyster system will try and combine these
into a single journey, but the combined journey may well exceed the allowed
time, leading to two incomplete journeys.