Apple Pay Express Transit and Security

Express Transit is one of the great features of Apple Pay Suica and Express Transit is now available on other transit systems in China and the USA. This post focuses on Apple Pay Suica but Express Transit security works the same on all transit systems. Apple support says,

If your Suica card is set as your Express Transit card, simply hold the top of your iPhone or Apple Watch within a few centimeters of the ticket gate scanner when you enter and exit. Your iPhone or Apple Watch must be turned on, but it doesn’t have to be connected to a network. You don’t need to wake or unlock your device or open an app when you enter or exit the ticket gates. You’ll see Done and a checkmark on the display.

This works for store purchases too. iPhone X/XS/XR users who dislike the Apple Pay double click side button Face ID gesture really appreciate the simplicity of Express Transit Suica. Express Transit is also secure:

  • Suica can only hold up to ¥20,000 at a given time
  • Express Transit is not enabled until the iPhone passcode is entered and Touch ID/Face ID enabled after turning on the device
  • Express Transit is disabled when Touch ID/Face ID is disabled

The video below illustrates Express Transit security on iPhone X:

  • iPhone is powered on, Face ID not yet enabled
  • Face ID enabled, Express Transit off
  • Face ID disabled via the side buttons, Express Transit disabled

As the video is made to show, Apple Pay Suica without Express Transit is awkward and almost useless. Express Transit on iPhone requires Face ID/Touch ID to be activated and enabled. You will need to enter a passcode to re-activate Face ID/Touch ID and Express Transit in these situations:

  • The device has just been turned on or restarted.
  • After five unsuccessful attempts to match a face.
  • After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.
  • The device hasn’t been unlocked for more than 48 hours.
  • The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn’t unlocked the device in the last 4 hours.
  • The device has received a remote lock command.

Be careful if you wear a face mask, as you can easily disable Face ID without realizing it. I also find that putting iPhone X, XS, XR in a fairly snug pants pocket can sometimes press the side buttons enough to disable Face ID. Face mask users can mitigate this by turning off Raise to Wake or Face ID for unlocking iPhone, be sure leave it on for Apple Pay.

One feature that Mobile Suica on Android Japanese carrier devices had over Apple Pay Suica is the ability to work on those devices even in power reserve mode. Apple Pay Express cards finally added power reserve with A12 Bionic iPhone XS and iPhone XR.

Express Transit Security on Apple Watch
Apple Pay Express Transit security on Apple Watch is different from iPhone. There is no Face ID/Touch ID on Apple Watch, instead of that Express Transit on Apple Watch requires the passcode and Wrist Detection to be on and activated. Once Express Transit is activated on Apple Watch, it still works when removed from the wrist for up to 5 minutes. After the 5 minute mark Express Transit is disabled and requires the passcode to be activated again.

Apple Pay Suica Auto Charge

Suica Auto Charge Security
Suica Auto Charge is one of the extra Apple Pay Suica features users can add with Suica App and a JR East View card. You might think that Suica Auto Charge used with Express Transit  is a security risk but Suica Auto Charge has some interesting security limitations.

Auto Charge only works on Suica and PASMO region transit gates. It doesn’t work on transit gates outside of the region, store purchases, vending machines, etc. This limits Suica Auto Charge to riding trains in the Tokyo area. The daily Auto Charge limit is ¥20,000. If somebody swipes your iPhone only the Suica balance is at risk and you can disable Suica instantly by putting iPhone in Lost Mode.

Advertisements