How do TfL readers actually work?

[XAM2175]

If you still need to present a physical railcard then I agree. I thought the idea was to load a digital railcard into the Oyster account and automatically apply the discount without a card ever needing to be presented. If I've misunderstood then please ignore my posts on the matter.

I think that sort of Railcard-not-present system is what @zwk500 was proposing, but they haven't been back to confirm it yet. Certainly though I'm approaching it from the perspective that the current foundation of the system - Railcard and ticket are presented for inspection together during travel - has to stay the same.

 

[zwk500]

I think that sort of Railcard-not-present system is what @zwk500 was proposing, but they haven't been back to confirm it yet. Certainly though I'm approaching it from the perspective that the current foundation of the system - Railcard and ticket are presented for inspection together during travel - has to stay the same.

Yes, as @najaB describes. I must admit I hadn't considered the situation where somebody lends a friend their card, as I would t have thought many would want to hand their debit card out!

 

[Ken H]

Yes, as @najaB describes. I must admit I hadn't considered the situation where somebody lends a friend their card, as I would t have thought many would want to hand their debit card out!

What about 2 travelling together, wanting to pay with one debit card? Maybe one is a guest of the other, maybe a foreigner.

 

[Watershed]

Because the Railcard association cannot be written directly to the card, and there's no guarantee that Authorised Officers would have live access to the TfL accounts database whilst on patrol, it wouldn't always be possible under such a system to check that the bearer of the discounted card also holds the matching Railcard at the time of travelling.

It would theoretically be possible to work around this limitation by having the revenue inspection devices carry the full list of Railcard-to-contactless-card associations, which would flag a card presented for inspection as only being valid with the associated Railcard, but this would be a major software change on top of the changes that would be required to set up the overall Railcard-on-contactless system, and it would need close scrutiny to identify any potential security or data protection risks.

You could simply say that Railcard discounted fares only apply from the following day - to ensure all RPI devices have the new Railcard association in their database.

The problem is in no way technological. It's completely feasible to introduce something like this, and indeed it's what I expect TfL will do when they get rid of Oyster cards.

It's just that it would incur a certain cost, and TfL evidently don't have the requisite funding or interest to implement it.

 

[Bletchleyite]

Most things would be solved by taps and inspections being fully online, which with wifi coverage on all Tube stations and onboard inspections in zone 1 pretty much unknown can't be far off.

 

[zwk500]

At the moment, is it required for the contactless card to only be used by the holder or is it totally legitimate to let a friend borrow a debit card, say if you had visitors from a foreign country and they didn't want to get charged an international transaction rate?

 

[Bletchleyite]

At the moment, is it required for the contactless card to only be used by the holder or is it totally legitimate to let a friend borrow a debit card, say if you had visitors from a foreign country and they didn't want to get charged an international transaction rate?

It is a breach of your agreement with your bank to let anyone else, even family, use a credit or debit card with your name on it. If you do you'll be responsible for the full amount of any fraudulent transactions that arise as a result of doing so (e.g. if it's skimmed while they are making a payment or stolen from them). If you want someone else to be able to use your account, you can get an Authorised User card, I had one from age 16 with the understanding that it was strictly for buying myself out of trouble (e.g. a new train ticket if I missed an Advance ticketed train) and only if I told my Dad I'd done it before the statement turned up with the transaction on. I could also use it for non-emergency transactions if I asked first, e.g. it is safer (in terms of avoiding street crime) for me to use it to buy computer kit rather than walk down the street with hundreds of pounds in my pocket.

I believe, though, that the protection when making purchases on credit cards for "authorised user" cards is lesser for an authorised user than that for the account holder (i.e. Section 75), so be careful - but that may have changed since the 90s!

 

[najaB]

It is a breach of your agreement with your bank to let anyone else, even family, use a credit or debit card with your name on it.

While I don't doubt that may be the case for some banks, I've just checked the T&Cs for my account and it doesn't explicitly say so anywhere, and they say to contact them if you believe that "someone else is using your card or PIN without your permission" - the implication being that it is okay for someone to use it with your permission.

 

[Bletchleyite]

While I don't doubt that may be the case for some banks, I've just checked the T&Cs for my account and it doesn't explicitly say so anywhere, and they say to contact them if you believe that "someone else is using your card or PIN without your permission" - the implication being that it is okay for someone to use it with your permission.

Interesting - perhaps only some banks, then.

 

[XAM2175]

Yes, as @najaB describes. I must admit I hadn't considered the situation where somebody lends a friend their card, as I would t have thought many would want to hand their debit card out!

That's fair! But people will go pretty far for that sweet sweet 34% discount if they're given the chance You could impose a requirement that the name on contactless card match the name on the Railcard, I suppose, but I wouldn't want to bet that that was secure enough to rule-out the checks during travel.

You could simply say that Railcard discounted fares only apply from the following day - to ensure all RPI devices have the new Railcard association in their database.

Yeah that's what we established in the subsequent posts:

This would also be a question of acceptable leakage. If you design the system to be at the watertight end of things, you'd simply say "too bad - the discount takes effect at 0430 on the day after it's added to the card" because that unquestionably gives time for the on-device list to be updated by the time RPIs are clocking-on the next morning. At the other end, you'd allow same-day travel on the grounds that the list will probably be updated much sooner than the next morning, and that even if it isn't the maximum window of opportunity for exploitation of an improperly-transferred discount will never exceed 24 hours.

The problem is in no way technological. It's completely feasible to introduce something like this, and indeed it's what I expect TfL will do when they get rid of Oyster cards.

We agree on this. And as another poster noted, the expansion of contactless PAYG further into the ex-NSE area will almost certainly include work on this front.

At the moment, is it required for the contactless card to only be used by the holder or is it totally legitimate to let a friend borrow a debit card, say if you had visitors from a foreign country and they didn't want to get charged an international transaction rate?

As @Bletchleyite says, it's forbidden by most card issuers, but TfL themselves have no problem with it that I know of. For example, last time I was in London my mum was visiting from abroad and we had to take a bus trip, so I tapped in with my Oyster and used my bank card for mum - but obviously that's different in terms of potential risk to myself than just giving her the card in the morning and telling her to have fun!

 

[zwk500]

As @Bletchleyite says, it's forbidden by most card issuers, but TfL themselves have no problem with it that I know of. For example, last time I was in London my mum was visiting from abroad and we had to take a bus trip, so I tapped in with my Oyster and used my bank card for mum - but obviously that's different in terms of potential risk to myself than just giving her the card in the morning and telling her to have fun!

I'm trying to think now for likely fraud scenarios. In my head, I was thinking that the Railcard, TfL Account name and all cards on that account must match. Therefore if somebody is travelling and two journey histories are described for different cards on the same account, it would be fairly straightforward to have an algorithm flag it for further inspection. The scenario it doesn't prevent against in any way is if somebody stayed at home and gave their card to a friend/relative, such as if a younger sibling wasn't busy and their older sibling wanted to take advantage of the cheap fare.
These problems are always a bit of a balance between likelihood and benefit for both traveller and TfL. Maybe a simpler answer is a digital Oyster that can sit in the Apple/Google Wallet, with the railcard loaded onto it. A mid-journey scan would show that the person is claiming a railcard discount, and the RPO can verify the Railcard in the same way they do today.

 

[najaB]

Maybe a simpler answer is a digital Oyster that can sit in the Apple/Google Wallet, with the railcard loaded onto it.

Then what you've done is change a photo Oyster card from physical form into digital.

 

[Bletchleyite]

I genuinely don't think, in London, that fully online inspection (by RPIs) would be a problem. You could also have a photo associated to the contactless card then, added at the same time as attaching the Railcard. Scan and it'd appear on the screen.

However it would not surprise me if they "fixed" it by just removing Railcard acceptance. No other non-National Rail metro operation does, and even Merseyrail doesn't on the day tickets which are the most commonly used ones. The Overground could be removed from NR ticketing entirely, as per the way Merseyrail seems to be headed.

 

[XAM2175]

Maybe a simpler answer is a digital Oyster that can sit in the Apple/Google Wallet, with the railcard loaded onto it. A mid-journey scan would show that the person is claiming a railcard discount, and the RPO can verify the Railcard in the same way they do today.

Then what you've done is change a photo Oyster card from physical form into digital.

Exactly. The entire point of the exercise, as far as I see it, is to come up with a way of letting passengers claim a Railcard discount while using a bog-standard contactless card. Diverting that into a digital Oyster doesn't address the convenience factor, and I don't really like the idea of making possession of an NFC-enabled smartphone a prerequisite for accessing discounted travel.

 

[zwk500]

Then what you've done is change a photo Oyster card from physical form into digital.

As long as it can be issued digitally, access the payment authorisation and used to tap in/out, I don't see too much problem. £5-10 admin charge once, but then you can use your railcard on the tube? Most people would be perfectly happy to pay that, they'll make the charge back in savings quite quickly.
The advantage of contactless for me was 1. no need to top up, and 2. no separate card to remember to bring with me when I did go to London. I'm quite happy to pay a one-off fee to enable my railcard digitally, but I really don't want yet another piece of plastic in my pocket that would cost me money if I lost it. Bank cards in the wallet were bad enough.

Exactly. The entire point of the exercise, as far as I see it, is to come up with a way of letting passengers claim a Railcard discount while using a bog-standard contactless card. Diverting that into a digital Oyster doesn't address the convenience factor, and I don't really like the idea of making possession of an NFC-enabled smartphone a prerequisite for accessing discounted travel.

It wouldn't be a pre-requisite - the standard Oyster would still be available, which you can load railcards onto. But a digital oyster linked to your google wallet removes the need to top up, as well as usually being more readily to hand than a physical card in your pocket.

 

[Bletchleyite]

Exactly. The entire point of the exercise, as far as I see it, is to come up with a way of letting passengers claim a Railcard discount while using a bog-standard contactless card. Diverting that into a digital Oyster doesn't address the convenience factor, and I don't really like the idea of making possession of an NFC-enabled smartphone a prerequisite for accessing discounted travel.

If, in the present financial climate, it was that or remove Railcard validity entirely (which really makes no sense - just try using a BahnCard on the U-Bahn), which would you choose?

 

[XAM2175]

It wouldn't be a pre-requisite - the standard Oyster would still be available, which you can load railcards onto. But a digital oyster linked to your google wallet removes the need to top up, as well as usually being more readily to hand than a physical card in your pocket.

Okay, but now we've got an extra form of Oyster (with additional technical complication) and made no progress on using Railcards with contactless payment cards!

If, in the present financial climate, it was that or remove Railcard validity entirely (which really makes no sense - just try using a BahnCard on the U-Bahn), which would you choose?

With respect, that's a very contrived dichotomy. For a start outright removal would be an enormous political hot potato, especially considering that (to the best of my understanding) there will be a great many people using things like the 16-25 and Disable Person's Railcards to access employment, education, and services in London who don't meet the residency requirements for TfL's own schemes.

What I can envisage is a toss-up between "implement Railcards on CPC" or "leave things as they are", in which sure leave them as they are - but if the TfL contactless PAYG system is to be extended further into NR territory then there will be pressure to deliver the CPC functionality anyway.

 

[Bletchleyite]

With respect, that's a very contrived dichotomy. For a start outright removal would be an enormous political hot potato, especially considering that (to the best of my understanding) there will be a great many people using things like the 16-25 and Disable Person's Railcards to access employment, education, and services in London who don't meet the residency requirements for TfL's own schemes.

Will it? Merseyrail did it without more than a bit of irritated mumbling, and the day tickets do have their uses.

 

[XAM2175]

Will it? Merseyrail did it without more than a bit of irritated mumbling, and the day tickets do have their uses.

I have no knowledge of the Merseyrail happenings, but I feel reasonably confident in saying that a major change to NR Railcard validity in London will affect a much larger number of people and attract a much larger amount of attention - especially given the current tug-of-war between TfL and HM Government. Of course, I accept that that doesn't rule it out.

 

[zwk500]

Okay, but now we've got an extra form of Oyster (with additional technical complication) and made no progress on using Railcards with contactless payment cards!

I'm trying to find a pragmatic solution that avoids thr need for a physical oyster and topping up yet is technically feasible without being open to fraud.

 

[XAM2175]

I'm trying to find a pragmatic solution that avoids thr need for a physical oyster and topping up yet is technically feasible without being open to fraud.

Okay, but is there a need for this? If you enable discounting on contactless payment cards that would also cover smart devices.

 

[etr221]

In a sense this all comes down to 'transferability', and is an issue for any Oyster/contactless/etc. card using payg system. 'Touching' the card causes payment of the fare to be made from some account (this is the end result of a somewhat complex process). And the moment that the fare amount is going to vary between passengers (due to capping, priv discount, railcard, whatever), then you need a means of tieing passenger, card and account together; or accepting that the right fare will not be received from some passengers . So some Oyster cards are personalised for 'specific' passengers (with an identifying photograph, etc.). Not a possible soultion for bank cards.

Possibly the answer is a railway specific charge card - whether railway or bank issued - that the railway has the right and ability to restrict to personal use...

 

[XAM2175]

So some Oyster cards are personalised for 'specific' passengers (with an identifying photograph, etc.). Not a possible soultion for bank cards.

This is correct for many of the TfL-specific entitlements, and means that there will need to be a replacement for these forms of Oyster card when the current Oyster system is eventually replaced.

NR Railcards though can be used with generic non-personalised Oyster cards, hence the need to carry the Railcard and show it for inspection at the same time as the Oyster.

 

[Adsy125]

What's the difference between this and SWR's Tap2Go? On SWR somebody manually verifies the Railcard is genuine and adds it to your smartcard, but only on the back office. As far as I can tell there is no indication on the smartcard that a Railcard has been added, and the discounted fare is just deducted the next day like with contactless.

 

[etr221]

NR Railcards though can be used with generic non-personalised Oyster cards, hence the need to carry the Railcard and show it for inspection at the same time as the Oyster.

In this case is it still a "generic non-personalised Oyster card" (usable by anyone)? Or has it been personalised/registered, so usable only by the specific person - with the Railcard acting as identification?

 

[najaB]

What's the difference between this and SWR's Tap2Go? On SWR somebody manually verifies the Railcard is genuine and adds it to your smartcard, but only on the back office. As far as I can tell there is no indication on the smartcard that a Railcard has been added, and the discounted fare is just deducted the next day like with contactless.

The difference, as I understand it, is that Tap2Go is a railway-issued smartcard, whereas what's being discussed here are bank-issued payment cards (and their extension onto Apple / Google Pay-enabled devices).

In this case is it still a "generic non-personalised Oyster card" (usable by anyone)? Or has it been personalised/registered, so usable only by the specific person - with the Railcard acting as identification?

The card itself is generic non-personalised as far as appearance goes, unlike a Photocard Oyster which, as the name suggests, bears a photo of the person to whom it has been issued.

 

[zwk500]

Okay, but is there a need for this? If you enable discounting on contactless payment cards that would also cover smart devices.

As I mentioned earlier, the ideal would be enabling it on contactless payments. But you've told me that my proposal of tying Card, Railcard and TfL account together and processing the discount after the journeys have been completed is either not technically feasible or would be susceptible to fraud.
So is there a technical solution to enabling Railcards on Contactless payments that is feasible to be funded by TfL?

 

[Adsy125]

The difference, as I understand it, is that Tap2Go is a railway-issued smartcard, whereas what's being discussed here are bank-issued payment cards (and their extension onto Apple / Google Pay-enabled devices).

But there is still no checking of the railcard while traveling, which is something SWR clearly doesn't consider to be an issue, TfL could do the same.

 

[XAM2175]

As I mentioned earlier, the ideal would be enabling it on contactless payments. But you've told me that my proposal of tying Card, Railcard and TfL account together and processing the discount after the journeys have been completed is either not technically feasible or would be susceptible to fraud.
So is there a technical solution to enabling Railcards on Contactless payments that is feasible to be funded by TfL?

The thing about "processing the discount after the journeys have been completed" is a distraction, because contactless payment is only calculated and billed at the end of each day. The main question is whether or not TfL will seek to continue the current process of checking Railcards when they're being used for travel. If yes, we've already mentioned that to all appearances it would be technically possible to have revenue inspection devices carry a reference list of Railcard-discounted contactless cards.

Obviously though we can't be sure how TfL will approach the matter in future.

 

[Kilopylae]

no progress on using Railcards with contactless payment cards!

In fairness, is there any advantage of contactless over Oyster which an app doesn't share? Other than I suppose that tourists would have to download the app.