Apple Pay Suica Express Transit and Security

fullsizeoutput_8861

Express Transit is one of the great features of Apple Pay Suica. Apple support says,

If your Suica card is set as your Express Transit card, simply hold the top of your iPhone or Apple Watch within a few centimeters of the ticket gate scanner when you enter and exit. Your iPhone or Apple Watch must be turned on, but it doesn’t have to be connected to a network. You don’t need to wake or unlock your device or open an app when you enter or exit the ticket gates. You’ll see Done and a checkmark on the display.

This works for store purchases too. iPhone X users still getting used to the Apple Pay double click side button Face ID gesture really appreciate the simplicity of Express Transit Suica. Express Transit is also secure:

  • Suica can only hold up to ¥20,000 at a given time
  • Express Transit is not enabled until the iPhone passcode is entered and Touch ID / Face ID is enabled after turning on the device
  • Express Transit is automatically disabled when Touch ID / Face ID is disabled

The video below illustrates Suica Express Transit security on iPhone X:

  • iPhone is powered on, Face ID not yet enabled
  • Face ID enabled, Express Transit off
  • Face ID disabled via the side buttons, Express Transit disabled

As the video is made to show, Apple Pay Suica without Express Transit is awkward and almost useless. Apple could improve the Apple Pay Face ID experience by making the default card selection more intuitive, or better yet automatically matching the right card type (Suica, iD, QUICPay) for the reader signal when paying at the cash register

One feature that Mobile Suica on Android Japanese carrier devices have over Apple Pay Suica is that Mobile Suica works on those devices even when the power is off. The recently launched Smart Octopus service on Samsung Pay Galaxy phones works the same way. Transactions are limited when power is off but it works. Samsung also recommends keeping the device off because once the battery is completely dead, so is Smart Octopus. It’s the same for Mobile Suica on Android.fullsizeoutput_895c

Reddit user FeliCa Dude posted an explanation of the FeliCa differences between Android Japanese smartphones with the ‘Osaifu Keitai’ software stack and iOS:

If you turn off your phone, you can still use the FeliCa services that you have provisioned. If your phone runs out of battery, you can still use your Mobile Suica, Edy, etc. The HLOS (ie: Android) doesn’t have to be running, because the inductive field of the card reader plus a small trickle of current from the battery is sufficient to power the CLF and SE.

Apple Pay is different: it’s a NXP NFC chip with embedded keys from FeliCa Networks, and it can’t function without iOS running.

Suica Auto Charge Security
Suica Auto Charge is one of the extra Apple Pay Suica features users can add with Suica App and a JR East View card. You might think that Suica Auto Charge used with Express Transit  is a security risk but Suica Auto Charge has some interesting security limitations:Apple Pay Suica Auto Charge

Auto Suica Charge only works on Suica and PASMO region transit gates. It doesn’t work on transit gates outside of the region, store purchases, vending machines, etc. This limits Suica Auto Charge to riding trains in the Tokyo area. If somebody swipes your iPhone only the Suica balance is at risk and you can disable Suica instantly by putting iPhone in Lost Mode.

Update
The new iPhone XS and iPhone XR have new Apple A12 Bionic powered NFC features: Express Cards with power reserve and Background Tag Reading. With power reserve you can use Apple Pay Suica on iPhone XS/XR for transit, purchase and recharge even with the battery run down. A review of Apple Pay Suica Express Cards with power reserve is here.

Advertisements