Chip Readers On MVMs

[SoulAce Transport]

I am posting this here for lack of an appropriate board to post this on. Since it seems like almost every store in the city uses chip readers for cards now, do you think that the MTA would install them in the MVMs? I know that it might cost a lot of money, but do you think it's a worthwhile investment right now, considering that new fare media is only a few years away?

 

 

Sent from my iPhone using NYC Transit Forums mobile app

[Kamen Rider]

Knowing the process the MTA has to go through to change so much as a light bulb, they probibly won't be upgrading the card reading compoents until they upgrade the machines for the new fare cards.

[azspeedbullet]

i want the MTA to make a better machine so that people cant jam the machine..soo annoying see a lot of broken machines.

[Mtatransit]

So annoying to see broken machine AND have people come up to you saying "swipes 2 dollars"

[Via Garibaldi 8]

I am so glad they're back in Grand Central by track 30. I just walk off of Metro-North, refill my Metrocard and keep it moving.

[QM1to6Ave]

I've been wondering about the chip issue. I thought all stores were mandated to use chips by now? How is the MTA exempt, or are they just not in compliance with the law?

[Lance]

I've been wondering about the chip issue. I thought all stores were mandated to use chips by now? How is the MTA exempt, or are they just not in compliance with the law?

The MTA is a government agency and is probably exempt from the mandate.

[QM1to6Ave]

The MTA is a government agency and is probably exempt from the mandate.

You'd think the government would lead by example. Guess not. 

[RestrictOnTheHanger]

On the one hand I would think that card present fraud wouldnt be a big percentage of revenue. On the other, it would help prevent cards from being skimmed via the stripe.

[Around the Horn]

So annoying to see broken machine AND have people come up to you saying "swipes 2 dollars"

 

It's funny. I keep hearing about these people selling swipes all over the system and I've never seen one...

[Via Garibaldi 8]

It's funny. I keep hearing about these people selling swipes all over the system and I've never seen one...

Well then you should take a trip to say Union Square or 125th street.  At Union Square, it isn't the entire station since there's an NYPD location there, but the side closest to Whole Foods is where they would usually be.  They will mess up just about all of the MVM machines on purpose so that they can hound you to take their swipe.  At 125th street, they will be there standing around.  The only thing that keeps them at bay is the NYPD presence.  If they are not around, be prepared to be hounded as you try to refill your card or get a new one.  Those are the two off of the top of my head that are really annoying. The other one is the entrance by 40th and 7th for the Times Square station.  The turnstile readers are atrocious there, and lately I've seen people asking for swipes, but I've never seen anyone giving them.  I'm sure there are numerous others in Brooklyn and the Bronx, and some other places too (i.e. Upper Manhattan).  I once got hounded for a swipe at the 207th street on the line.  Just ignored the person and kept going.  

[Dave2836]

I've been wondering about the chip issue. I thought all stores were mandated to use chips by now? How is the MTA exempt, or are they just not in compliance with the law?

Afaik, the chip just pushes liability of fruadulent transactions on whichever party is not compliant, i.e. the bank or the merchant. Everytime I've had to use my EMV card, my pin is required to complete the transaction.

 

So given the fact that a consumer always has 0% liability for fraudulent transactions, what incentive is there for me to enter my pin everytime I make a transaction? I'm not so eager to enter my pin into an MVM machine that lacks such a basic anti-theft device such as a PIN shield, mirrors, or surveilance cameras in a location with so many shoulder surfers.

[QM1to6Ave]

Afaik, the chip just pushes liability of fruadulent transactions on whichever party is not compliant, i.e. the bank or the merchant. Everytime I've had to use my EMV card, my pin is required to complete the transaction.

 

So given the fact that a consumer always has 0% liability for fraudulent transactions, what incentive is there for me to enter my pin everytime I make a transaction? I'm not so eager to enter my pin into an MVM machine that lacks such a basic anti-theft device such as a PIN shield, mirrors, or surveilance cameras in a location with so many shoulder surfers.

 

I have the exact same concerns. If I use my debit/bank card at the MVM, I press "credit card" because I'd rather enter my zip code than my bank PIN. 

[paulrivera]

I live near the , the and Metro-North, and I only pay cash at the line's machines. I end up forced to use the ol' debit card at the stop and I use eTix for MNR since I get hounded at both (subway=swipers, MNR=beggars) and the MVM's on the always get jammed by the skells. Worst case scenario, there are two Chase banks within walking distance of all three stops and I can get a new debit card on the spot.

[Via Garibaldi 8]

I live near the , the and Metro-North, and I only pay cash at the line's machines. I end up forced to use the ol' debit card at the stop and I use eTix for MNR since I get hounded at both (subway=swipers, MNR=beggars) and the MVM's on the always get jammed by the skells. Worst case scenario, there are two Chase banks within walking distance of all three stops and I can get a new debit card on the spot.

Since I buy a monthly pass for Metro-North, I still get that via the MVM. I have a new phone, but I still am not comfortable putting my monthly on it just yet. I try to get the pass at GCT to avoid any skells. Same is true of Metrocards. I've also noticed more and more beggars where exits exist with no station booths.

[rbrome]

... I'm not so eager to enter my pin into an MVM machine that lacks such a basic anti-theft device such as a PIN shield, mirrors, or surveilance cameras in a location with so many shoulder surfers.

 

 

All valid points, except the mirror. All MTA MVMs I've seen have a large mirror right across the whole top of the machine. 

[rbrome]

The card reader modules used in MVMs are fairly standard, and all of the newer ones support EMV chips and RFID. I would be shocked if they couldn't simply get the newer model of the same reader and drop it in with nothing more than a screwdriver. They only cost about one dollar. Seriously, see for yourself: 

 

https://www.alibaba.com/product-detail/manual-insert-RFID-EMV-chip-IC_60467108612.html

 

https://www.alibaba.com/product-detail/EMV-L1-Manual-Insertion-Card-Reader_60462757377.html

 

Not to say it's actually that easy. There's the software side, and getting the new software and end-to-end system certified by the banks is far from trivial. Labor and bank certification would make it a project of... I'd guess around $1-3 million. (Assuming sanity in MTA contract costs, but we know how that goes....)

 

But as the liability has shifted, the MTA runs a big risk by continuing to run a network of so many mag-stripe readers. MetroCards have a cash-like value on the street, so it's a tempting target for thieves. They can skim credit cards in non-touristy neighborhoods, go to MVMs, use duplicate cards with the zip codes where the cards were skimmed (assuming the person was local is a good guess), and use the MVMs to essentially launder the money. 

 

Under the new bank rules, the MTA would bear the liability, not the bank. So just one ring of thieves doing that for a little while would justify the cost of upgrading to chip readers. They should definitely do it. 

[bobtehpanda]

The card reader modules used in MVMs are fairly standard, and all of the newer ones support EMV chips and RFID. I would be shocked if they couldn't simply get the newer model of the same reader and drop it in with nothing more than a screwdriver. They only cost about one dollar. Seriously, see for yourself: 

 

https://www.alibaba.com/product-detail/manual-insert-RFID-EMV-chip-IC_60467108612.html

 

https://www.alibaba.com/product-detail/EMV-L1-Manual-Insertion-Card-Reader_60462757377.html

 

Not to say it's actually that easy. There's the software side, and getting the new software and end-to-end system certified by the banks is far from trivial. Labor and bank certification would make it a project of... I'd guess around $1-3 million. (Assuming sanity in MTA contract costs, but we know how that goes....)

 

But as the liability has shifted, the MTA runs a big risk by continuing to run a network of so many mag-stripe readers. MetroCards have a cash-like value on the street, so it's a tempting target for thieves. They can skim credit cards in non-touristy neighborhoods, go to MVMs, use duplicate cards with the zip codes where the cards were skimmed (assuming the person was local is a good guess), and use the MVMs to essentially launder the money. 

 

Under the new bank rules, the MTA would bear the liability, not the bank. So just one ring of thieves doing that for a little while would justify the cost of upgrading to chip readers. They should definitely do it. 

 

You have to keep in mind, they also have to pay people to switch out the readers and test them on-site; the readers don't install themselves. Also, the MTA is governed by state procurement laws; they can't just go out and buy things on Amazon or Alibaba.

 

If the MTA is just going to replace the machines anyways for the next-gen fare payment, why do the same job twice when you can do both at the same time and save money?

[rbrome]

You have to keep in mind, they also have to pay people to switch out the readers and test them on-site; 

 

 

That's what I meant by "labor". 

 

 

Also, the MTA is governed by state procurement laws; they can't just go out and buy things on Amazon or Alibaba.

 

 

Oh of course. When I referred to "project" and "contract", that's what I was referring to. 

 

 

If the MTA is just going to replace the machines anyways for the next-gen fare payment, why do the same job twice when you can do both at the same time and save money?

 

 

My understanding is that next-gen fare payment could be 5+ years away. That's a lot of time for a lot of fraud to be committed. My point is that the MTA could easily become a large target for this kind of crime. As retailers continue to upgrade to chip readers, MVMs are becoming the low-hanging fruit for mag-stripe fraud. I'm not sure what the exact timeline is where it becomes worth the cost, or what the probability is of fraud on that scale, I'm just trying to make a case that it's possible it would be worth the cost. 

[bobtehpanda]

My understanding is that next-gen fare payment could be 5+ years away. That's a lot of time for a lot of fraud to be committed. My point is that the MTA could easily become a large target for this kind of crime. As retailers continue to upgrade to chip readers, MVMs are becoming the low-hanging fruit for mag-stripe fraud. I'm not sure what the exact timeline is where it becomes worth the cost, or what the probability is of fraud on that scale, I'm just trying to make a case that it's possible it would be worth the cost. 

 

You could be right. IIRC, part of the reason why MTA is moving slowly is because stateside adoption of tap-and-go bank cards is so ridiculously behind the rest of the world. If the MTA were to start tomorrow, most people would have to use whatever card MTA is offering, but MTA is trying to get out of the fare payments business as much as feasibly possible.

[rbrome]

You could be right. IIRC, part of the reason why MTA is moving slowly is because stateside adoption of tap-and-go bank cards is so ridiculously behind the rest of the world. If the MTA were to start tomorrow, most people would have to use whatever card MTA is offering, but MTA is trying to get out of the fare payments business as much as feasibly possible.

 

 

Philly recently "solved" this by issuing fare cards that are also MasterCard debit cards. They claim they are also working with banks to make bank-issued cards compliant so they can double as official transit fare cards. 

 

US banks were actually somewhat aggressive to roll out plastic tap cards a while (8-10 years, I think?) ago, but they faced a backlash. People were afraid they'd be stolen electronically, by someone bumping into them, primarily on public transit, ironically. I recall people drilling holes in their cards to disable it, and buying the RF-blocking sleeves and wallets. So banks scrapped it. They've moved on. I don't expect that to come back. 

 

The new thing isn't plastic tap cards, it's phones.

 

You can use Apple Pay / Android Pay at turnstiles in Philly, Chicago, and London. That's the future.

 

The MTA will always have to sell its own card, though. I don't see any way they can ditch that any time soon. 

[bobtehpanda]

Personally, I think tap-and-go is better than phones, if only because my phone has so much battery life and I would rather not waste it on a Metrocard type service. A tap and go doesn't need a battery.

[Around the Horn]

Yeah, for me it's smartcard or bust. I don't trust Apple Pay, etc. at all...

[Via Garibaldi 8]

Personally, I think tap-and-go is better than phones, if only because my phone has so much battery life and I would rather not waste it on a Metrocard type service. A tap and go doesn't need a battery.

 

 

Yeah, for me it's smartcard or bust. I don't trust Apple Pay, etc. at all...

The solution is to link a card that you feel comfortable using.  My rule of thumb is to use something like an Amex if you have one.  When I don't use a debit card, I would use my Amex and it's great.  It isn't your money per se but the card's money, so you're more protected should something happen.  The problem with charge cards is technically, they have no limit, but you can always load a card with some small amount and have similar protection.

[rbrome]

Personally, I think tap-and-go is better than phones, if only because my phone has so much battery life and I would rather not waste it on a Metrocard type service. A tap and go doesn't need a battery.

 

 

It doesn't use any appreciable amount of battery life. The screen lights up for a couple of seconds; that's it. It's just as easy as a tap card, but far more secure. 

Yeah, for me it's smartcard or bust. I don't trust Apple Pay, etc. at all...

 

Why not? Unlike anything with a magnetic stripe, it's tokenized and protected by your fingerprint, which makes it far, far more secure than any plastic card.