Ensignbus £10 contactless limit and Apple Pay / Google Pay ban

[Starmill]

As I said, Ticketer isn't the issue, nor is the authorisation and nor is it about forged tickets.

Given you didn't say what you think that the issue is, it's not an enormous surprise that most people didn't take much notice of your post!

 

[martin2345uk]

I don't get how Apple Pay etc. is more open to fraud than just the contactless cards themselves?

 

[323235]

I read a lot of business news but I’ve only ever heard bus companies make a big issue of contactless fraud in the last couple of years. There’s been countless articles about contactless flaws too in recent years.

I would have always considered Apple Pay and Google Pay to be safer than bank card contactless.

 

[Bletchleyite]

I believe that it is. How else would you use it given the bus doesn't have a chip and pin machine? "Oh sorry, the transaction hasn't gone through because you need to use your card's chip. We don't take cash any more and this is the last bus of the day so I guess you'll have to walk home."

What Ensignbus appear to be doing is trying to move the fraud risk from them to the card issuer, as £10 is still the limit in transport mode. However I imagine that splitting one ticket sale into two transactions to get it under £10 purely to evade the fraud risk is also a breach of the card scheme's rules...

What will be happening is that people are paying for tickets with cards that don't have enough money in the relevant account. The transaction then declines but of course the customer is long gone as it won't post immediately.

It sounds like you are actually correct:

https://www.ukfinance.org.uk/system/files/UK-Finance-Contactless-Transit-EMV-Framework.pdf is the lengthy detail of the framework, it fits Model 1. Further down in the document under Model 2 it appears it is bank liability for transactions under £10 if authorisation is not completed.

It thus seems I was correct in terms of the issue, i.e. that the lack of online authorisation for these larger transactions IS the issue. So Ticketer could fix it by online authorising all transactions over £10. This would slow boarding slightly but would prevent the issue of seasons etc on a card that doesn't have funds. Though even without that it would strike me that if the debit failed later you could just cancel the season and blacklist the card.

However it does seem doing two transactions is not playing the game, so don't expect this to last once the card companies twig its essentially borderline fraudulent purpose of moving liability to the bank.

It is worth noting that transit mode isn't the only non PIN fallback mode, vending machines can also do it but do do an authorisation before the product is dispensed. Toilet access is the same which causes some delays at the barrier.

 

[Contains Nuts]

I have noticed that Ticketer does seem to have a bit of a quirk when it comes to authorising card payments - it seems to do them on a batch basis shortly after you sit down, and only for 10p rather than the real amount. It could well be that this two transaction thing is a workaround to allow that to take place and potentially bar the card before the second one.

It is an odd setup, though, and I don't entirely get why it doesn't authorise on the spot, it takes a second or two when online. But then there are many odd things about Ticketer that don't make sense; it has been a big success in getting card acceptance widespread, but the design leaves a lot to be desired in many ways.

(Transit mode requires no authorisation, but transit mode isn't used for ticket sales in advance, only for tap in style operation)

Given this is part of my job (which shall remain anonymous), here’s the proper reason for the 10p charge…

When Littlepay processes a transaction for settlement, a pre-authorisation amount needs to be sent to the issuing bank first in order to verify the card for contactless payments. This is to ensure the card has not been reported lost or stolen before Littlepay attempt to take payment from the card.

This pre-authorisation amount is usually £0.10 for UK MasterCards and can be up to £1 for MasterCards outside of the UK. This is effectively a holding fee on the card while we wait to authorise the full payment amount on the card.

For Visa cards, the pre-authorisation amount is £0.00 and should not be visible on a customer's account. The pre-authorisation value is never sent for settlement from the card, and if this is still visible on a customer's account, they should speak to their issuing bank to investigate.

Depending upon the operator the full amount may be requested fairly quickly after the transaction takes place, but for most large operators this is part of an overnight process so tap-on-tap-off payments can be aggregated.

 

[Bletchleyite]

Given you didn't say what you think that the issue is, it's not an enormous surprise that most people didn't take much notice of your post!

I can see why the poster doesn't want to publicise the details lest they be misused, but a clue might help it be taken seriously. "I know but I'm not telling you" is sadly a common contribution to threads on here, and it is essentially valueless.

 

[Contains Nuts]

It sounds like you are actually correct:

https://www.ukfinance.org.uk/system/files/UK-Finance-Contactless-Transit-EMV-Framework.pdf is the lengthy detail of the framework, it fits Model 1. Further down in the document under Model 2 it appears it is bank liability for transactions under £10 if authorisation is not completed.

It thus seems I was correct in terms of the issue, i.e. that the lack of online authorisation for these larger transactions IS the issue. So Ticketer could fix it by online authorising all transactions over £10. This would slow boarding slightly but would prevent the issue of seasons etc on a card that doesn't have funds. Though even without that it would strike me that if the debit failed later you could just cancel the season and blacklist the card.

However it does seem doing two transactions is not playing the game, so don't expect this to last once the card companies twig its essentially borderline fraudulent purpose of moving liability to the bank.

It is worth noting that transit mode isn't the only non PIN fallback mode, vending machines can also do it but do do an authorisation before the product is dispensed. Toilet access is the same which causes some delays at the barrier.

The issue with Ticketer doing online authorisations is that with it being a mobile system it doesn’t always guarantee a data connection, so effectively this wouldn’t work 100% of the time, particularly in rural areas.

 

[Bletchleyite]

Given this is part of my job (which shall remain anonymous), here’s the proper reason for the 10p charge…

Cheers, that makes sense.

The issue with Ticketer doing online authorisations is that with it being a mobile system it doesn’t always guarantee a data connection, so effectively this wouldn’t work 100% of the time, particularly in rural areas.

True, but it'd only need to do it for over £10 which isn't going to be all the time.

 

[Starmill]

"I know but I'm not telling you" is sadly a common contribution to threads on here, and it is essentially valueless.

It is, unfortunately. My advice to anyone thinking of posting "I know and I'm not saying" is simply to say nothing at all. It's generally better that way.

 

[GusB]

It is, unfortunately. My advice to anyone thinking of posting "I know and I'm not saying" is simply to say nothing at all. It's generally better that way.

Indeed. I believe it's in everyone's interests that such information is shared. This is not the sort of thing that should be covered by "commercial confidentiality". Either cough up and share what you know, or don't bother posting at all; the "I know more than you do, but I'm not telling you" mentality is frustrating.

 

[markymark2000]

I believe unscrupulous individuals are buying multiple high-value season tickets (on different buses) paid by contactless card. They are then reselling the tickets at reduced prices. However, subsequent payment to Ensign is being declined by the banks, presumably on grounds of "insufficient funds".

The problem seems to revolve around who takes the risk (and what the upper limit is) on contactless card payments on-bus - the merchant (Ensignbus in this case) or the issuing bank in cases where the accountholder has insufficient funds.

Same sort of thing happened in Manchester and hence a number of tickets over there can't be bought with card.

 

[Tetchytyke]

ANPR based freeflow tolling would allow a significant staffing cut so would save them money, hence why it is likely

I'm a big fan of ANPR-based tolling, as I drive a foreign-registered car

The issue with Ticketer doing online authorisations is that with it being a mobile system it doesn’t always guarantee a data connection, so effectively this wouldn’t work 100% of the time, particularly in rural areas.

It only needs to be for tickets over £10, so it wouldn't happen for everyone.

And on rural buses there's always the fall back of trying again in an area with mobile signal.

 

[Dai Corner]

When Littlepay processes a transaction for settlement, a pre-authorisation amount needs to be sent to the issuing bank first in order to verify the card for contactless payments. This is to ensure the card has not been reported lost or stolen before Littlepay attempt to take payment from the card.

This pre-authorisation amount is usually £0.10 for UK MasterCards and can be up to £1 for MasterCards outside of the UK. This is effectively a holding fee on the card while we wait to authorise the full payment amount on the card.

For Visa cards, the pre-authorisation amount is £0.00 and should not be visible on a customer's account. The pre-authorisation value is never sent for settlement from the card, and if this is still visible on a customer's account, they should speak to their issuing bank to investigate.

What's the advantage in doing a 'pre-authorisation' ? The fare is known before that happens so why not attempt to authorise the full amount before issuing the ticket?

 

[zero]

In some cases, notably TfL, the amount may not be known at the time of tap.

 

[Dai Corner]

In some cases, notably TfL, the amount may not be known at the time of tap.

Indeed. That's 'Model 2' in the UK Finance document linked to above.

Ensignbus use 'Model 1' which is the same as a purchase in a shop except that there's no way to enter a PIN so it's never asked for.

 

[RT4038]

Do any bus ticket machines do an online authorisation in real time? My Stagecoach Vix ones never come through on the same day.

No, because it takes too long and too many bus stops do not have good signal coverage. That is why there is a problem.

 

[Starmill]

No, because it takes too long and too many bus stops do not have good signal coverage. That is why there is a problem.

Yes, precisely.

 

[Bletchleyite]

Maybe this should be taken as a prompt to move away from season products and towards capping?

 

[Taunton]

However it does seem doing two transactions is not playing the game, so don't expect this to last once the card companies twig its essentially borderline fraudulent purpose of moving liability to the bank.

More than that, it's against the card merchants agreement to take multiple small transactions for a single sale, just like it was against the rules in the old cheque guarantee £50 limit days of taking multiple cheques for the sale. It's surprising it's even got this far.

 

[Contains Nuts]

What's the advantage in doing a 'pre-authorisation' ? The fare is known before that happens so why not attempt to authorise the full amount before issuing the ticket?

The same back-office payment handling system is used for capping, so I think it treats every incoming transaction the same way.

 

[scosutsut]

Also card transactions come with a charge per transaction, if Ensign split every transaction over £10 they'll increase the fees they pay... I hope someone has done their sums.

 

[Cesarcollie]

Also card transactions come with a charge per transaction, if Ensign split every transaction over £10 they'll increase the fees they pay... I hope someone has done their sums.

Yes but the charge is largely a percentage based on the value of the ticket sold. So x% of £10 + x% of £10 is the same cost as x% of £20….

 

[Bletchleyite]

Yes but the charge is largely a percentage based on the value of the ticket sold. So x% of £10 + x% of £10 is the same cost as x% of £20….

Isn't it normally the case that debit cards tend to be a flat fee and credit cards a percentage?

 

[Starmill]

Yes but the charge is largely a percentage based on the value of the ticket sold. So x% of £10 + x% of £10 is the same cost as x% of £20….

Not if they pay a minimum fee per transaction.

Of course, given they're publicly advertising something which appears likely to break the card scheme rules it will end up costing them rather a lot more than that in the long run when they get pulled up on it.

 

[Cesarcollie]

Isn't it normally the case that debit cards tend to be a flat fee and credit cards a percentage?

Not sure about normally but not with Littlepay who are the merchant for most if not all Ticketer users.

Not if they pay a minimum fee per transaction.

Of course, given they're publicly advertising something which appears likely to break the card scheme rules it will end up costing them rather a lot more than that in the long run when they get pulled up on it.

Ah okay if you know best!

 

[RJ]

I've noticed all kinds of odd things with pre-authorisations since a few months ago and wondered how long it would take for firms to do something about it. The margins in operating stage carriage services aren't huge - indeed many have to be subsidised and it doesn't take much in the way of revenue leakage to really hurt an operator. Even ticket barriers present similar opportunities which means TfL and the TOCs are probably also aware of the issues, but it doesn't look like a stop has been put to it - but as it unravels and gains more publicity, something will probably have to give.

Enough time has passed for bad actors to set up ways to obtain a pecuniary advantage from this - people setting up ways to profit from it and passengers who don't mind saving money through illegal means.

I hope the industry manages to get on top of it without upsetting legitimate customers.

 

[GusB]

I wonder how much of this is due to the fact that transactions aren't debited on the spot. I've noticed that the last few times I've used contactless with Stagecoach, the transactions haven't actually gone through until after much later in the day (after 7pm if it's local journeys only - presumably this coincides with the time that the bus returns to the depot). In the meantime, there's no "hold" on the funds, and therefore it's possible to spend the same amount of money twice.

 

[TTS]

I wonder how much of this is due to the fact that transactions aren't debited on the spot. I've noticed that the last few times I've used contactless with Stagecoach, the transactions haven't actually gone through until after much later in the day (after 7pm if it's local journeys only - presumably this coincides with the time that the bus returns to the depot). In the meantime, there's no "hold" on the funds, and therefore it's possible to spend the same amount of money twice.

Which is exactly what is claimed has been happening at EnsignBus. Multiple purchases of high-value season tickets with the same card. Tickets then sold at discount prices "down the market". When transactions are presented to the payment processor (later in day or overnight), the issuing bank declines them. As the risk for high-value (over £10?) non-authorised transactions rests with the merchant (Ensignbus), the latter is then out of pocket. Hence, they've stopped selling them. Given the low margins on bus fares, one can hardly blame them.

Whether the Ticketer system can blacklist such tickets (assuming seasons are barcode-scanned on Ensignbus) I do not know. But that would make the exercise fruitless for fraudsters.

The issue is "contactless" and where the risk lies for high-value purchases. The problem with on-bus sales of these is that online authorisation is too slow or in areas of poor reception, slow or impossible. So, there is a risk.

 

[Bletchleyite]

Blacklisting the tickets if the authorisation declines would seem an obvious fix. Time for Ticketer to get on it if it doesn't already!

 

[johncrossley]

Seems crazy to sell high value tickets on the bus in cash. Not only does it make the bus trip slow, it puts the bus driver at risk of robbery. Season tickets need to be off bus. Several technologies to choose from. Smartcard, contactless capping and mobile app.