Ensignbus £10 contactless limit and Apple Pay / Google Pay ban

[Bletchleyite]

I’m confused as well. I fully understand the £10 thing, but I still struggle to understand the Apple Pay situation.

Is it down to the fact that it is so easy to set up a virtual card, with nothing on it (or 10p or whatever is needed for Ticketer). There’s various Apps like Stocard and Revolut that will let you set up as many virtual cards as you want, top up and withdraw / spend money, and delete them for no reason?

The thing that's confusing me is the problem with regard to paying for parking at a parking machine, where an authorisation for the full amount is mandatory and always carried out. This is not transit mode.

 

[Mojo]

The thing that's confusing me is the problem with regard to paying for parking at a parking machine, where an authorisation for the full amount is mandatory and always carried out. This is not transit mode.

Maybe they don’t process the transactions in real-time? I get notifications on my phone through my bank app, in shops they always come through immediately via a push notification, but for my local council car park I never get them until a while afterward.

 

[jon0844]

The thing that's confusing me is the problem with regard to paying for parking at a parking machine, where an authorisation for the full amount is mandatory and always carried out. This is not transit mode.

You can pay for multiple days which means it's quite easy to spend a lot more than £10 on a machine. So it suggests there's something fishy going on during the authorisation, perhaps as you said before it means that even when authorised the merchant can still suffer a chargeback later.

If it's that, or something along those lines, then it's a big problem. Just as it would be if you found that someone could do a bank transfer to buy an item from you, say an expensive item like a car, then after a few hours simply reverse the transaction. Given the police have next to zero interest in such crimes, you'd be stuffed even if you went to the police/bank and said the person had now effectively stolen goods from you.

 

[LordCreed]

Sometimes Google Pay will decline a transaction for no apparent reason. A few months ago I caught some National Express West Midlands services and paid using my Android phone. I woke up in the morning to find that the transaction had been declined, despite there being ample funds in the linked bank account.

 

[Bletchleyite]

You can pay for multiple days which means it's quite easy to spend a lot more than £10 on a machine. So it suggests there's something fishy going on during the authorisation, perhaps as you said before it means that even when authorised the merchant can still suffer a chargeback later.

Out of transit mode an authorisation is always required, even for 1p - the £10 thing isn't relevant. And from experience parking meters, and even the 50p toilet use things in the Lake District, spend lots of time faffing doing one and if it randomly declines don't continue the transaction (they're usually SIM card based and signal can be variable). So it must be something to do with chargebacks happening that wouldn't be able to happen with an actual card.

I did do some Googling and found nothing - I'm surprised nobody has leaked it. I have no intention of misusing it myself, obviously, but it would be interesting to know, and if there is a flaw in Google/Apple Pay specifically I think that very much should be public so they are forced to spend some of their massive profits fixing it quickly.

 

[TTS]

Pepperpot80's posts 103 and 105 succinctly highlight the issue as I now understand it. It is being urgently addressed, again as I understand it. But like many technology issues, it's hard to pin the tail on the right donkey (or donkeys) ... tech companies, payment processors, banks ...

 

[philthetube]

Would there be a way for Ensign to insist that cards are registered with them before used for transactions over £10

 

[Bletchleyite]

Would there be a way for Ensign to insist that cards are registered with them before used for transactions over £10

I think it all comes down to what workaround Ticketer offers, as they could hardly give the drivers a printed list of card numbers and expiry dates.

 

[Cloud Strife]

I’m confused as well. I fully understand the £10 thing, but I still struggle to understand the Apple Pay situation.

Is it down to the fact that it is so easy to set up a virtual card, with nothing on it (or 10p or whatever is needed for Ticketer). There’s various Apps like Stocard and Revolut that will let you set up as many virtual cards as you want, top up and withdraw / spend money, and delete them for no reason?

I'm a bit late to this discussion, but I think this is the crux of the issue. Physical cards are subject to far more controls, but you can get up and running with Revolut within minutes. The system is set up to allow the use of disposable (i.e. one time) virtual cards through Apple and Google, and you can use up to 5 cards a day. Revolut are also a horrible company to deal with, which won't help matters.

Let's say you have ten phones and ten family members. That's potentially 50 virtual cards a day, with up to 81 pounds a time. Let's say you flog them for 40 quid each: you've got an easy 2000 quid in your pocket for a day's work.

There is a system used in Wrocław where no physical tickets are issued, the ticket purchased is simply connected to the card used. Wouldn't this make much more sense for public transport operators rather than a physical ticket?

 

[Purfleet Steve]

UPDATE: Apple & Google ARE being accepted again BUT with the £10 limit still in place

 

[JaJaWa]

Split transactions continue

Contactless Payment update affecting
Apple Pay & Google Pay from 8th August 2022
Following discussions with a number of parties involved in the contactless payment system, we are pleased to advise that we will be able to accept Apple Pay & Google Pay once again.
A reduced £10 Contactless limit will continue in place for all Contactless transactions (certain 7 Day tickets can be purchased using two transactions as listed below).
We are working hard behind the scenes with other parties to bring further solutions in that will reduce the need for the current limits we have had to put in place due to fraud.
The following season tickets remain available for
Contactless
purchase but via two transactions:
• Thurrock Adult 7 Day
• Thurrock Child 7 Day
• Thurrock & X80 Child 7 Day
• Thurrock/ Thurrock + X80 Family tickets
• Thurrock Student 7 Day*/ Thurrock + X80 Student 7 Day*
The following season tickets are available for CASH PURCHASE ONLY:
• Thurrock Adult 28 Day
• Thurrock Child 28 Day
• Thurrock & X80 Adult 7 Day
• Thurrock & X80 Adult 28 Day
• Thurrock & X80 Child 28 Day
• Thurrock Student 28 Day*/ Thurrock + X80 Student 28 Day*
*= From September
We thank you for your patience whilst we work through this
Ensignbus T 01708 86 56 56
www.ensignbus.com
@EnsignBusCo

https://twitter.com/EnsignBusCo/status/1555602118450577408

 

[Joe Paxton]

[...]
Is it down to the fact that it is so easy to set up a virtual card, with nothing on it (or 10p or whatever is needed for Ticketer). There’s various Apps like Stocard and Revolut that will let you set up as many virtual cards as you want, top up and withdraw / spend money, and delete them for no reason?

I'm a bit late to this discussion, but I think this is the crux of the issue. Physical cards are subject to far more controls, but you can get up and running with Revolut within minutes. The system is set up to allow the use of disposable (i.e. one time) virtual cards through Apple and Google, and you can use up to 5 cards a day. Revolut are also a horrible company to deal with, which won't help matters.

Let's say you have ten phones and ten family members. That's potentially 50 virtual cards a day, with up to 81 pounds a time. Let's say you flog them for 40 quid each: you've got an easy 2000 quid in your pocket for a day's work.
[...]

Likewise my strong suspicion from early on when reading this thread is that the issue is connected to the interplay between virtual card numbers (which can be 'disposable' or 'one time use' only) and mobile wallets such as Google Pay and Apple Pay.

 

[Cloud Strife]

Likewise my strong suspicion from early on when reading this thread is that the issue is connected to the interplay between virtual card numbers (which can be 'disposable' or 'one time use' only) and mobile wallets such as Google Pay and Apple Pay.

It seems so, doesn't it? I can see how he fraud works, although it is a pretty major failing that Apple/Google Pay works with virtual card numbers. I'm not sure, however, if virtual card numbers are different to physical card numbers.

This would explain why the ten pound limit is there, because it passes the buck back to the card issuer who are enabling the fraud in the first place.

Virtual card numbers aren't needed with Apple/Google Pay anyway.

 

[Mojo]

It seems so, doesn't it? I can see how he fraud works, although it is a pretty major failing that Apple/Google Pay works with virtual card numbers. I'm not sure, however, if virtual card numbers are different to physical card numbers.

Not sure I'd describe it as a failing of Apple or Google, after all that is the exact purpose of a virtual card!

 

[Dren Ahmeti]

I’ve accidentally tapped on at work via my Apple Watch in express transit mode and a card that had no money on it - Littlepay only checks whether the card is “alive” or not, I would presume.

Luckily, I could cancel my own tap-on

 

[Bletchleyite]

It seems so, doesn't it? I can see how he fraud works, although it is a pretty major failing that Apple/Google Pay works with virtual card numbers. I'm not sure, however, if virtual card numbers are different to physical card numbers.

You mean "can a merchant tell it's a virtual card"? No, they can't, it's just a card that hasn't been "printed out".

The method of ensuring you'll get paid is perfectly well known enough - run an authorisation, then the bank is obliged to pay the transaction whether they get paid for it or not. That Ticketer doesn't even attempt it for large purchases (as against tap-in tap-out), even if it let it go if it didn't have a signal*, is its failing.

* I'm not sure the fraudsters would be bothered taking rides on country bus services just to do this, it seems a lot of effort and would be just a bit obvious.

 

[Cesarcollie]

You mean "can a merchant tell it's a virtual card"? No, they can't, it's just a card that hasn't been "printed out".

The method of ensuring you'll get paid is perfectly well known enough - run an authorisation, then the bank is obliged to pay the transaction whether they get paid for it or not. That Ticketer doesn't even attempt it for large purchases (as against tap-in tap-out), even if it let it go if it didn't have a signal*, is its failing.

* I'm not sure the fraudsters would be bothered taking rides on country bus services just to do this, it seems a lot of effort and would be just a bit obvious.

It‘s not just Ticketer That’s how Transit mode works. Seeking authorisation as in a shop is impractiCal as in many cases there would be no signal. And if there was the process would slow down boarding too much. TfL, VIX, Parkeon are no different.

 

[XAM2175]

It‘s not just Ticketer That’s how Transit mode works. Seeking authorisation as in a shop is impractiCal as in many cases there would be no signal. And if there was the process would slow down boarding too much. TfL, VIX, Parkeon are no different.

But TfL aren't selling high-value periodical passes using transit mode!

 

[markymark2000]

But TfL aren't selling high-value periodical passes using transit mode!

TFL do verify funds don't they as they did it for Oyster with the '1 last trip' thing which was valid if you didn't have enough money on your card, you got 1 last trip and had to repay it later.

 

[Bletchleyite]

It‘s not just Ticketer That’s how Transit mode works

Selling high value season tickets is to me a misuse of Transit Mode. It is probably within the rules, but you are selling a physical, transferrable product with considerable value so it makes sense to run an authorisation.

The idea of Transit Mode is that you charge single fares up to a daily (or longer) cap and bill daily (thus it's under £10), then stop billing that week once the cap is reached.

Edit: I wonder if the fact that you're allowed to do this under Transit Mode actually legitimises the "double transaction dodge" they were doing on a technicality? That's an interesting thought.

Seeking authorisation as in a shop is impractiCal as in many cases there would be no signal.

In most urban settings there is a signal all the time, you can tell because the passengers are all sat there fiddling with their phones. Rural operators might need to think of another plan, but most buses aren't rural.

If the aerial in Ticketer machines is poor, then they need to start speccing an external aerial.

And if there was the process would slow down boarding too much. TfL, VIX, Parkeon are no different.

It would slow down boarding a bit, but would be easily offset (give or take a potential need to timetable the Monday morning peak slightly more loosely) by implementing tap-in and tap-out for single fares, removing the time spent conversing with the driver and faffing about exactly when to place the card on the reader. Fundamentally not everyone is buying a weekly season (though I realise this skews a bit towards Monday mornings), and hardly anyone at all is buying a monthly. If you cap the tap-in and tap-out at a weekly pass rate, then hardly anyone will buy an actual pass.

You could even be fairly clever and print the ticket THEN do the authorisation, blocking the barcode if it fails, so the authorisation would be being done in parallel with the driver faffing about with putting the ticket in the plastic wallet. The driver would then hand it over once the "green light" appeared.

 

[duncombec]

Selling high value season tickets is to me a misuse of Transit Mode. It is probably within the rules, but you are selling a physical, transferrable product with considerable value so it makes sense to run an authorisation.

The idea of Transit Mode is that you charge single fares up to a daily (or longer) cap and bill daily (thus it's under £10), then stop billing that week once the cap is reached.

Edit: I wonder if the fact that you're allowed to do this under Transit Mode actually legitimises the "double transaction dodge" they were doing on a technicality? That's an interesting thought.

I think there are some important points to be raised here:

Firstly, how many average customers even know that there is a Transit Mode, or if they do, how it works? I'd be fairly confident in assuming most people just know that they won't be asked for their pin, because there aren't pin pads. I find people who are still confused when they get asked to enter their pin on the random "is it still you" checks. As a result of which, is this issuing of season tickets using contactless simply to save drivers getting into "why can I pay for £100 quid's worth of groceries with contactless but not £80 quid for a bus pass" arguments?

Secondly, has the Transit mode framework been updated since the substantial rise in contactless limits over the last few years? the division of risk seems fairly fair when the limit was £30, but if the downloadable document mentioned upthread is anything to go by, it hasn't been updated since the rise first to £45, then £100.

Thirdly, and statements on this have been concerning me for a while: given Ensign are working with their providers, how do you/we know they haven't been given explicit permission to "double transact" as a temporary measure?

 

[Bletchleyite]

Thirdly, and statements on this have been concerning me for a while: given Ensign are working with their providers, how do you/we know they haven't been given explicit permission to "double transact" as a temporary measure?

We don't, but my experience of small bus operations is that "following the rules" is not something that usually tends to bother them, coupled with banks not generally being the most accommodative or helpful organisations to said small businesses. My view may be clouded by the awful Aylesbury-based "triad" (Red Rose, Redline and Z&S) whose behaviour is generally atrocious, of course, and I don't know Ensign well, but it is a general theme in the industry, and indeed in many small businesses in other industries too, e.g. those small businesses who didn't respect the legal exemptions from wearing a mask during COVID.

It wouldn't entirely surprise me if they said something like "if you keep your transactions below £10 we're liable" without actually saying to double-transact. It's also possible Ensign came back with "OK, then we'll switch to selling 4 day season tickets for (£<10)"* and the bank went "OK, fair enough, you've got us, do what you like".

* There'd be a lot of strength in doing this, not least getting rid of the "Monday rush" and accommodating people who don't work Fridays and don't use the bus at weekends.

 

[johncrossley]

We don't, but my experience of small bus operations is that "following the rules" is not something that usually tends to bother them, coupled with banks not generally being the most accommodative or helpful organisations to said small businesses. My view may be clouded by the awful Aylesbury-based "triad" (Red Rose, Redline and Z&S) whose behaviour is generally atrocious, of course, and I don't know Ensign well, but it is a general theme in the industry, and indeed in many small businesses in other industries too, e.g. those small businesses who didn't respect the legal exemptions from wearing a mask during COVID.

Ensign seem to have a good reputation on forums, unlike most smaller operators. However, any small operator, no matter how good, will be bound to be handicapped in certain ways due to being diminutive. If you are First or Go-Ahead, economies of scale will presumably be of an advantage when it comes to dealing with payment providers.

 

[Purfleet Steve]

Whilst EnsignBus are a small Service provider, they are still a big Company. They are a big player on the buying & selling side, do a lot of Private Hire & Rail Replacement service's (& was London Pride & City Sightseeing - being the 1st company to start this do this in London) so they are NOT a fly by night Company cutting corners, they would have spoken to someone before doing the current policy

 

[Man of Kent]

Whilst EnsignBus are a small Service provider, they are still a big Company. They are a big player on the buying & selling side, do a lot of Private Hire & Rail Replacement service's (& was London Pride & City Sightseeing - being the 1st company to start this do this in London) so they are NOT a fly by night Company cutting corners, they would have spoken to someone before doing the current policy

Indeed. A turnover of around £25m in a normal year. For comparison Transdev Blazefield's turnover is aorund £60m.

 

[johncrossley]

For comparison Transdev Blazefield's turnover is aorund £60m.

Of course, Transdev Blazefield is just a small part of a major corporation. EnsignBus, even including its other non-local bus operating activities, is tiny compared to the major transport groups.

 

[James H]

Further developments:

https://www.finextra.com/newsarticl...nline-banks-and-cut-mobile-contactless-limits

An Essex bus company has banned customers from Monzo and Revolut from using their smartphones to pay for fares and has slashed mobile contactless limits to just £10 following a spike in debit and credit fraud across the network.

 

[Bletchleyite]

Is blocking specific banks not definitely a breach of merchant agreement?

 

[Dai Corner]

Is blocking specific banks not definitely a breach of merchant agreement?

And how do they do it anyway?

 

[Bletchleyite]

And how do they do it anyway?

First N digits of the card number.