EMV cards and EMV technology in Public Transport Ticketing

The closed loop system was initially launched by some pioneering public transport companies. This led to the smart card used, being exclusive to these companies’ network. Passengers have to carry several such cards to travel on different networks. The banking industry, using similar smart card technology, saw the opportunity of using the bank credit and debit cards to access transport system. Enter the EMV bank cards and technology in the public transport ticketing industry.

In this article, we delve into the integration of the EMV card and the EMV technology in public transport ticketing system,

Close and Open Loop System

To better understand the role of the EMV cards, we make a brief incursion into the world of Closed Loop and Open Loop Ticketing system in their simplified form. We have covered this in a previous article (1).

Closed Loop ticketing system makes use of rechargeable smart cards as fare media for travelling on public transport. As these can only be used on the Transport Providers’ network, passengers have to carry several such cards for multiple journeys on other transport networks. As well, he has to watch up the balance and top up the card as necessary.

With the Open Loop system, the Transport Provider accepts the debit and credit smart cards of banking institutions to access its transport network.

For the Transport Provider, the issue, processing, and cost of managing the smart cards are shared with the banks. For the passenger, he need not carry several smart cards for each transport operator. He can conveniently use the bank credit and debit smart card he daily uses for shopping to travel on the transport networks.

The Debit and Credit bank cards in use are universally almost all EMV cards.

The EMV Cards

So, what are the EMV cards? EMV – which originally stood for Europay, Mastercard and Visa- developed the EMV payment method  and the technical standard for smart payment cards and for payment terminals which can accept them. A near-field-communication (NFC) chip embedded inside the smart card makes contactless payment possible if the transport terminal is also NFC equipped. The technology also makes payment much more secure, older types of technology had numerous security flaws.

That technology has now been brought into the world of public transport. The bank card, in addition to the bank application, has been made to contain a public transport application. The contactless element of the EMV card (sometimes referred as cEMV) is important as it increases throughput at transport terminals.

The EMV card is designed to work seamlessly with the transport operator’s fare collection system while maintaining the security standards of EMV technology. The technology thus allows passengers to tap their way onto public transport vehicles using only their bank card. The bank card becomes their ticket.

It is just so much convenient for passengers. It is reported that over 90% of bank cards in circulation in many developed countries are EMV cards. Even the widely used Rupay bank cards in India uses the EMV technological standard and can be used in transport applications.

Mobile phones and Digital EMV Cards

Smart phones are already known to store payment methods in a digital format as mobile wallet apps. The mobile wallet is easily linked to a transport system for paying for public transport.

Modern phones embedded with an NFC chip can, without contact, connect with a NFC reader at a transport gate or terminal, transmitting a digital signal containing relevant payment information. The mobile phone thus mimics the behaviour of a contactless EMV card.

When an EMV bank card number is used for payment purposes using a mobile phone, a technique of tokenisation is used, where the card number is replaced with a unique identifier (token), not exposing the full card details. Mobile wallets like Apple Pay, Google Pay, and Samsung Pay allow users to store digital versions of their EMV cards on their phones

Some smart phones have an added layer of payment security. Such phones have a Secure Element (SE) technology using cryptographic techniques to store sensitive payment information like EMV bank card details, in an encrypted format.

Benefits of EMV for public transportation

For the passenger, the benefit of the use of EMV bank cards for travelling on public transport is evident. He does not need to buy any ticket in advance, nor top up smart cards.  He can use the contactless bank cards (or the mobile contactless payments) that he uses in his daily life, to travel on the transport system.

For the Transport Operator, with more use of the EMV bank cards, it can reduce the expensive process of issuing and managing smart cards, reduce large stocks of cards, and reduce the number of Ticket Vending Machines, which are expensive to buy and maintain.

The PCI DSS Certification

A prime reason for a Transport Provider to use the EMV technology is its enhanced security features. EMV cards are primarily designed to prevent fraudulent transactions.

Public Transport ticketing systems process credit card numbers, expiry dates and several other sensitive cardholder data. These data need to be protected as well. The Payment Card Industry Security Standard Council, an organisation within the banking sector, has developed a standard to that effect. Thus, transport payment terminals are made to be certified to a standard called the Payment Card Industry, Data Secure Standard (PCI DSS).

Thus, adhering to this certification means that the system is geared to prevent leakage of sensitive data about holders of payment cards and other electronic payment tools. This brings additional trust to passengers using bank cards on transport systems.

It is a requirement that transport system using EMV cards must have its payment related infrastructure and system certified to the PCI DSS standard.

White-label EMV card for unbanked passengers

The benefits of introducing bank cards to the transport system are evident. But what about those who do not have a bank card?  Or those who have bank cards but do not want to use them on public transport terminals for security and privacy reasons. In the first group, there would be youths and the underaged who cannot open bank accounts.

In such cases, the Transport Provider operates a system of smart cards under its name. Such cards in use are traditionally of the Mifare, Calypso, Felica, C-Purse types. These smart cards can be topped up and used by the unbanked passengers on the transport network of the Transport Provider.

EMV has come up with its own such smart card, the White-label EMV Card. It is not a bank payment card but a rechargeable smart card. Instead of being issued by one of the banks, the White-label EMV card is issued by the Transport Provider. It would be branded in its name. The card can only be accepted within the Transport Provider’s system. The transaction is processed without interaction with the bank payment network.

This would allow the Transport Provider to offer the smart cards to unbanked passengers.

In practice, the Transport Provider would have to operate two systems, a closed loop system for its own smart card system and an open loop system for the EMV bank card use. If it uses the Calypso, Felica type cards for its own smart card system, then there would be two disparate systems and technologies.

EMV offers Transport Providers the use of a single technology that incorporates the EMV White Label system and the EMC bank card system. This single technology system generates savings to the Transport Provider in terms of support services and in the ticketing infrastructure.

Though the EMV White Label card has similar security features to the EMV card, still the Transport Provider has some responsibility for data security. The Transport Provider may be having access to the cardholder data for refund and troubleshooting purposes.

It is thus essential that the Transport Provider has its system certified to the PCI DSS standard.

Challenges of the EMV Ecosystem

The EMV ecosystem is complex, with many participants, technology, and regulations, while being well-established, safe, and extensively used throughout the payment industry. It is therefore crucial for Public Transport Providers hoping to profit from this to first grasp these intricacies. There are several challenges on the way, the main ones being the technical elements.

There is first the technical challenge of integrating the EMV technology to a legacy infrastructure, mostly closed loop system, if the Transport Provider does have one. This can be quite complex and costly.

Secondly, the EMV transactions require real-time authorisation, which may be challenging in environments with limited connectivity.

Thirdly, compliance to the PCI DSS standard may need significant investment in security infrastructure.

There is as well, the inherent costs of certification, operational fees, and the ongoing expenses associated with transaction fees for EMV system implementation.

Conclusion

The evolution from the closed loop system where the Transport Provider was issuing and managing the smart cards to an open loop system where bank cards are being accepted as a fare media demands enhanced security. Credit cards and debit cards contain sensitive information that should be protected by the Transport Provider.

The EMV ecosystem provides such security. Furthermore, the requirement to conform to the PCI DSS standard enhances the security of data. The EMV system has as well addressed the issue of the unbanked through the White Label EMV cards.

The adoption of the EMV system and technology does not come without intense challenges, including the payment of transaction fees. These are not given to all public transport companies, particularly in developing countries.