The Mystery of Apple Pay Octopus and iPhone 7 FeliCa Support

There are a few remaining fuzzy spots in the Apple Pay Octopus saga. The story I broke back in December from trusted sources clearly had a Chinese New Year release target. The story went dark but busted wide open again with the Apple Pay JSON server code leak on June 25 that made it absolutely clear Apple Pay Octopus would finally arrive with iOS 13. Octopus Cards Limited (OCL) had no choice but to issue a premature press release stating ‘Apple Pay Octopus is coming, more details soon’ and nothing else.

Why the delay? It clearly was not the Smart Octopus in Samsung Pay exclusivity window that ended in December 2018. We may never know the whole story but I suspect that iPhone 7 FeliCa support is one reason for the delay, but certainly not the only one.

It makes sense for Apple and OCL to release Octopus that can be used on as many Apple devices as possible, the bigger the potential user footprint, the better. Octopus will work on Apple global NFC devices: iPhone 8/X/Apple Watch 3 and later. The important question is how badly do Apple and OCL want to add iPhone 7/Apple Watch 2 to the supported device list?

I previously wrote that Apple announced iOS 13 Core NFC enhanced tag support (FeliCa, etc.) for (all) iPhone 7 devices and later at WWDC19, but this does not sync with Apple Pay Suica device requirements: Apple is telling developers that all iPhone 7 models are good for NFC Read/Write FeliCa but telling customers that only iPhone 7 JP models are good for NFC card emulation FeliCa.

In a later post I quoted FeliCa Dude:

There are millions of NFC-F phones and devices outside Japan. That is because Type A and FeliCa are core requirements for NFC certification. If a phone supports NFC, it supports FeliCa.
What is required to be compatible with most payment terminals in Japan is an Osaifu-Keitai provisioned secure element: that can be a SWP-enabled SIM card (not available yet), the Mobile FeliCa chipset with embedded SE, or an iPhone 7 provisioned for Osaifu-Keitai.
The international iPhone 7s can do basic FeliCa read/write without encryption, because they embed a FeliCa-capable CLF <contactless frontend>. Apple has chosen not to provision them with Osaifu-Keitai keys, probably to avoid paying royalties to FeliCa Networks for each device.

This sparked some fascinating comments from Twitter user Lukas and, lo and behold, the very FeliCa Dude himself, an unexpected and pleasant surprise:

As always, the Dude delivers. Abide in the Dude, his knowledge and keen insight on all things NFC contactless and FeliCa is without peer. In a nutshell this means that OCL could offer Apple Pay Octopus on all iPhone 7 and Apple Watch Series 2 devices and add them to the Global NFC Apple device list…but will they? If OCL and Apple can supply the necessary keys in the over the air (OTA) iOS 13 release via the in-house Apple FeliCa keys server, all the better. Either way I think we will find out very soon, possibly as a ‘Apple Pay Octopus coming to Hong Kong’ side mention in the Apple Card release press kit.

Now that the FeliCa Dude has checked in, I hope he can find an appropriate outlet, blog or otherwise, to enlighten us, whatever the occasion. He is a far better writer than I will ever be. I’ve learned a lot from his writings, I know a lot of other people can too. The world needs to hear from the FeliCa Dude, not my cheap imitation.


UPDATE
FeliCa Dude has answered and posted the definitive take of iPhone 7 FeliCa support for all things from Octopus to iOS 13 Core NFC. We own him thanks for taking the time to cover all the angles in such detail.

The crucial section: “In my opinion there are only three reasons that Apple should not be able to bring Octopus emulation to iPhone 7:

  • If they are unable to allocate IDm (card unique ID) values to these non-blessed devices because that process is tangled up with FeliCa Networks
  • If they shot themselves in the foot and disabled their ability to interface their secure element to the FeliCa CLF (contactless frontend) in the PN67V on those non-Japanese iPhone 7 devices because they didn’t see Octopus coming.
  • They don’t feel like supporting iPhone 7 at all, not even the Japanese models: each device has a different generation of secure element, and additional development/testing/certification work may be required for them. This is again a combination of what Apple is willing to do and on which hardware platforms OCL is willing to authorize Octopus to be emulated on. It’s nothing to do with FeliCa Networks or Sony.”
Advertisements

Apple Watch Series 4 Tokyo Workout

Apple ads tailored for Japan are kinda rare so it’s nice that Apple Watch Series 4 gets a Tokyo workout ad for ‘closing your rings’ with a regular Tokyo workday:

  • Take the subway station stairs instead of the escalator. Bonus points for Oedo subway line users where the stations are built so deep you feel like you’re taking the stairs to Mt. Fuji to get to the exit.
  • Take the stairs instead of the elevator at the company office building, preferably an older office building with fewer floors.
  • Walk to the destination instead of taking a taxi. Everybody in Tokyo did this after the earthquake struck on March 11, 2011, a sight I will never forget.

Clever as the ad is, I still dock it a notch for failing to show that other great Apple Watch in Japan feature, Apple Pay Suica.

Apple Pay Express Transit and Security

Express Transit is one of the great features of Apple Pay Suica and Express Transit is now available on other transit systems in China and the USA. This post focuses on Apple Pay Suica but Express Transit security works the same on all transit systems. Apple support says,

If your Suica card is set as your Express Transit card, simply hold the top of your iPhone or Apple Watch within a few centimeters of the ticket gate scanner when you enter and exit. Your iPhone or Apple Watch must be turned on, but it doesn’t have to be connected to a network. You don’t need to wake or unlock your device or open an app when you enter or exit the ticket gates. You’ll see Done and a checkmark on the display.

This works for store purchases too. iPhone X/XS/XR users who dislike the Apple Pay double click side button Face ID gesture really appreciate the simplicity of Express Transit Suica. Express Transit is also secure:

  • Suica can only hold up to ¥20,000 at a given time
  • Express Transit is not enabled until the iPhone passcode is entered and Touch ID/Face ID enabled after turning on the device
  • Express Transit is disabled when Touch ID/Face ID is disabled

The video below illustrates Express Transit security on iPhone X:

  • iPhone is powered on, Face ID not yet enabled
  • Face ID enabled, Express Transit off
  • Face ID disabled via the side buttons, Express Transit disabled

As the video is made to show, Apple Pay Suica without Express Transit is awkward and almost useless. Express Transit on iPhone requires Face ID/Touch ID to be activated and enabled. You will need to enter a passcode to re-activate Face ID/Touch ID and Express Transit in these situations:

  • The device has just been turned on or restarted.
  • After five unsuccessful attempts to match a face.
  • After initiating power off/Emergency SOS by pressing and holding either volume button and the side button simultaneously for 2 seconds.
  • The device hasn’t been unlocked for more than 48 hours.
  • The passcode hasn’t been used to unlock the device in the last six and a half days and Face ID hasn’t unlocked the device in the last 4 hours.
  • The device has received a remote lock command.

Be careful if you wear a face mask, as you can easily disable Face ID without realizing it. I also find that putting iPhone X, XS, XR in a fairly snug pants pocket can sometimes press the side buttons enough to disable Face ID. Face mask users can mitigate this by turning off Raise to Wake or Face ID for unlocking iPhone, be sure leave it on for Apple Pay.

One feature that Mobile Suica on Android Japanese carrier devices had over Apple Pay Suica is the ability to work on those devices even in power reserve mode. Apple Pay Express cards finally added power reserve with A12 Bionic iPhone XS and iPhone XR.

Express Transit Security on Apple Watch
Apple Pay Express Transit security on Apple Watch is different from iPhone. There is no Face ID/Touch ID on Apple Watch, instead of that Express Transit on Apple Watch requires the passcode and Wrist Detection to be on and activated. Once Express Transit is activated on Apple Watch, it still works when removed from the wrist for up to 5 minutes. After the 5 minute mark Express Transit is disabled and requires the passcode to be activated again.

Apple Pay Suica Auto Charge

Suica Auto Charge Security
Suica Auto Charge is one of the extra Apple Pay Suica features users can add with Suica App and a JR East View card. You might think that Suica Auto Charge used with Express Transit  is a security risk but Suica Auto Charge has some interesting security limitations.

Auto Charge only works on Suica and PASMO region transit gates. It doesn’t work on transit gates outside of the region, store purchases, vending machines, etc. This limits Suica Auto Charge to riding trains in the Tokyo area. The daily Auto Charge limit is ¥20,000. If somebody swipes your iPhone only the Suica balance is at risk and you can disable Suica instantly by putting iPhone in Lost Mode.

Apple Pay Suica EX Quick Guide

JR Central offers the EX App for Shinkansen online eTicket purchases that can be linked with Apple Pay Suica for travel on Tokaido (Tokyo~Osaka) Sanyo (Osaka~Hakata) Shinkansen. EX has 2 different kinds of accounts that can link with Apple Pay Suica: smartEX and Express Reserve.

The 2 different kinds of EX accounts that link with Apple Pay Suica have some important differences:

  • Express Reserve: membership costs ¥1,080 a year but offers a wide range of ticket discounts. Registration is done via the Japanese language only Suica App and Express Reserve only accepts Japanese issue credit cards.
  • smartEX: membership is free but discounts are limited. Online registration is offered in Japanese language and English language and smartEX accepts a wide variety of credit cards from Japan and other countries.

EX App from the Japan App Store offers more features: Japanese and English support, login support for all EX services: Express Reserve (Express Card), smartEX and JR West Card, and Face ID/Touch ID support, but does not support direct account creation/registration.

EX downloaded on App Stores outside of Japan support smartEx account creation/registration in the app, but do not support or Express Reserve login or Face ID/Touch ID login.

All versions of EX do not support Apple Pay for In-App eTicket purchases.


smartEX Registration
To register and use smartEX you need 2 things: a Japanese transit card ID number and a credit card. Apple Pay Suica users must have Suica App installed to access their Suica ID.

I highly recommend preparing your Apple Pay Suica ID number before smartEX registration. Copy Suica ID in Suica App then paste it into Memo app. It will be one long 17 character alpha-numeric string starting with “JE”. Put a few spaces between JE and the following 15 character string so that you can easily copy just the last 15 characters without JE.

JR Central smartEX Registration guide here
The English language smartEX App registration process is different from the Japanese registration process: you do registration in the app itself.

  1.  Register name, birth date, email, password, credit card with credit card verification, and transit card ID. Be careful to copy and paste just the last 15 characters of your Apple Pay Suica ID explained above.
  2. Login with your password. Unlike the Japanese EX App, FaceID/Touch ID is not supported. However you can download and use EX from the Japanese App Store which offers full support and works in English.

Express Reserve Suica App Registration
Using Express Reserve with Apple Pay Suica requires a JR East View card or JR Central Express Card or Plus EX membership. This guide only covers JR East View card registration.

The Suica App sign up process is not difficult but requires decent Japanese reading ability, patience and a JR East View Card already registered in Suica App. With that in place and your 4 digit View Card PIN number on hand, tap the Suica App View Express menu, then tap View Express Register.

The View Express Register section will instruct you to enter 4 digits of your PIN number in a random order.

Once View Express Register is successfully completed wait 2 weeks for JR Central to send your View Epresss Express Reserve IC card.

JR Central IC
EX IC Card for View Card

After receiving your View Express IC card go to Suica App and tap Express Reserve. You are bumped to Safari and have to tap the agree-service connect button near the bottom. After tapping the button you are taken to the mobile Express Reserve login site.

Tap the text line just below the orange login banner that reads: “Mobile Suica users accessing Express Reserve for the first time touch here.”

This takes you through a quick registration process where you enter an email address and receive a mail with a special smartphone registration link. Tap the link then enter your View Card number/expiration date and a password. When completed you receive an Express Reserve member ID.

EX App
An interesting and important difference from smartEX is that registration via Suica App automatically registers the Apple Pay Suica card ID with the EX system.

Once registration is complete, use the EX App downloaded from the Japan App Store for Express Reserve Shinkansen ticket reservation and purchases. Be sure to login to EX App with your Express Reserve member ID and password using the Express Card sign-on option. You can also login with a smartEx account.

After login, Shinkansen eTicket reservation and purchase is the same. See the JR Central EX App online guide for instructions.

If you ride JR Central – JR West Shinkansen lines more than 1~2 times a year and have a View Card, Express Reserve ticket discounts are worth the registration via Suica App Express Reserve. Happy transit!