Slashdot Mirror

Visa and MasterCard are now using payWave and PayPass, respectively, so that all the user needs to do is have his/her cards near (about 1cm or so) a dedicated area on the credit card machine in order to pay for the item, instead of either inserting (chip) or swiping (magnetic strip) the card. I'm not sure whether this constitutes as RFID, but the principles are the same.

PayPass FAQ page: http://www.paypass.com/faq.html

I'm not sure what the benefit of these are since you still have to take your card out of your pocket/wallet/handbag to swipe it over the scanner (only works within an inch). Anyone who has trouble swiping cards with mag stripes (which seems to be becoming a more-common problem as technology progresses) will likely think this a good thing - one swipe and that's it.

The issue of Card ID theft isn't really that much more than it already is.

I thought this was old news - Master Card has been pushing Paypass for around two years now.

I still don't see why it's such a big deal.

According to the Mastercard site, the RFID tags will carry exactly the same information as the magnetic strip. And while these cards may indeed return encrypted information, there is no challenge/response system. That's just not how they work. When you broadcast the correct radio frequency close enough to these tags, they just resonate and play back (over radio waves) a predetermined string, encrypted or not. If you have a matching reader at your disposal, you have the means to read every RFID within range. Where would you get such a reader? Why, you could steal one, buy one at a distressed business auction, or open a small store and order one from Mastercard. Think of the RFID tag reader just like the magnetic stripe reader, but you don't have to do the "swipe."

RFID as a cash-only card is useful and very successful in places like Hong Kong where you can buy your paper, pay the bus or your cinema ticket, but credit card information should not be available from RFID as there is no way to control who has access to the card information and when.
Having said that, I suppose the card company has made its studies and deemed that while there is a risk of card info being stolen, it is probably no worse than the current scheme. It should be easy enough to confirm: the merchant fee should be lower or the same as with the good old swipe method.
In the FAQ, they also imply that any payment above $25 would require the card owner's signature, so the risk of fraud remains low, but still higher than with a smartcard I think.

This card is not about RFID, it's about making card use in scenarios like drive-throughs easier. Also, it's currently limited to <$25 transactions currently according to the FAQ.

Assuming one likes the idea of small plastic transactions at all, I wonder if it wouldn't be a better idea to _combine_ 2 accounts in one card: one account for the higher-value mag-stripe, and an RFID account with a low credit limit that needs to be constantly replenished.

is not really about looking for another payment method. After all, it's easy enough to pull out a wallet. The new technologies are designed to help retailers build loyalty programs unique to their chains. Speedpass was one of the first applications. Their RFID keypass is not only about payment, it's about providing a service that makes loyal customers. Since a driver already has his keys in his hands, and he is often in a rush, a keychain fob makes sense. I think about 6 million Speedpass tags have been distributed. To my knowledge, fraud has not been a big problem. Companies like Visa and Mastercard have brought out better tag technology that will eventually allow retailers to offer rewards and loyalty points based on purchases, like the airlines. There's even a company in Virginia that offers retailers just the loyalty tag -- without the payment. The point here is that shopping will soon be more like that on Amazon: your purchases will be tracked in real time, and special offers (based on previous purchases or similar aggregate data) will be tailored just for you.

Sorry, here's a clickable link to paypass