iPhone NFC misinformation alive and well on reddit

Once in a while I get a surge of traffic from reddit and like to see which post was linked and the attached discussion. This was very hard to do before reddit added comment searches and even so it takes a few days before a new entry shows up in search results. The latest one was about iPhone X and NFC.

Question: What’s the difference between X and XS ? Which is better ? My second question: Recently I bought an X Japanese Version. Is it different from regular X ??

Answer 1: X to XS is Just a small minor cpu upgrade and minor antenna fixes making the iPhone bottom speaker/microphone holes assymetrical, if you bought a X from Japan and are planning to use it for commuting using apple pay there, make sure to check the production date, pre2018 iPhone X has a suica gate problems that got fixed with the Rev B iPhone X. iPhone X suica problem

Answer 2: Also, all Japanese iPhones have a different NFC reader, so they won’t work with non Japanese tap and pay terminals and other NFC points, eg on public transit and similar

Yikes, all the good and bad of reddit in one post. The question is a good one but the good natured answers are equally helpful and utterly misleading.

Answer 1 is a little off in that bad iPhone X NFC was not a Suica problem, NFC was unreliable across the board regardless of type (A-B-F) or protocol (EMV, FeliCa, etc.), with iPhone X NFC crapping out completely later on (after AppleCare expired naturally). The Rev B thing was just my made up name for units manufactured after April 2018 with reliable NFC. And even though most people have moved on to newer iPhone models with much superior NFC performance, the big bad iPhone X NFC problem continues to haunt users. For me, with 3 replacements and a lot of headaches, iPhone X was the worst iPhone ever. iPhone X users deserved a NFC repair program but never got one because at the time Apple Pay Express Transit was only available in Japan. Apple at its Tim Cookian worst.

Answer 2 is completely wrong. The poster has no idea what they are talking about. All iPhone models have the same NFC hardware. It doesn’t matter what country the iPhone was purchased in, it all just works in every Apple Pay supported region for all NFC flavors. That’s the beauty of Apple’s global NFC hardware strategy that began with iPhone 8 along with NFC switching savvy Apple Pay Wallet that Android has yet to match…not even Google Pixel.

Foreign VISA cards blocked for select Japanese mobile in-app and online payments

Notice: the situation is is on again/off again, latest updates here

SoftBank Payments network chart

When foreign issue VISA cards in Wallet stopped working for some kinds of Apple Pay in-app purchases from Japanese merchants starting on August 5, the first people to howl in pain were Apple Pay PASMO users who suddenly couldn’t recharge the stored fare balance or renew commuter passes with their Chase Sapphire VISA cards. Chase Sapphire still codes for 3x travel points on PASMO you see and long time resident Suica users had migrated to PASMO when JR East and VISA shut down 3x travel points.

I did the usual duty of talking with Mobile Suica support, official line: there should be no problem, contact the card issuer. I then contacted Wells Fargo card services support, official line: there should be no problem with your VISA, contact the merchant. Entirely expected of course but I did confirm that Mobile Suica transaction attempts were not even showing on the Wells Fago system. They said it might be a ‘communications issue’.

I suspected a larger issue than just Apple Pay and an Android Suica user confirmed the same non-JP VISA problem with Google Pay Suica. I also alerted IT journalist Junya Suzuki who focuses on mobile payments. His first thought was something might be going on with the VISA Japan merchant acquirer side of the payment network. Merchant acquirers are very secretive and nobody knows who is the merchant acquirer is for Mobile Suica/Mobile PASMO. Maybe they were tightening online transaction security…or something else. Everything was clear as mud though one source did say this:

An acquirer made the decision stopping handling cards issued in other countries. Acquirer are different between Apple Pay and Google Pay, so that’s why I said Apple Pay. Another guy suggests Apple or such acquirer may face money laundering issue by registering Apple Pay with pre-paid Visa cards or so.

A reader asked me if Japan was banning non-JP VISA cards across the board along with a screenshot of Universal Studios Japan advance ticket sales page with a red colored important notice on the top that said: “We apologize that currently Visa and Mastercard credit cards issued outside Japan are not available until further notice.”

The evidence pointed to a larger problem than just Mobile Suica and PASMO. The USJ wording also suggests that JTRWeb have their hands tied ‘until further notice’ and echos what JR East PR told Suzuki san about the non-JP VISA recharge problem being beyond their immediate control. Something seems to be happening with the VISA merchant acquirer…but in different highly selective ways. For example why does Apple Pay Suica work with foreign issue Mastercard and AMEX but not VISA, or why does foreign issue VISA work for Apple Pay in-app purchases with Japanese apps like Starbucks, but not in-app purchase with JR East for Suica recharge?

Phishing attacks and VISA Touch promotion
It’s helpful to examine the impact of phishing attacks that hit docomo, Line Pay, PayPay and other QR code payment services in late 2020, and JR East online services (Mobile Suica, JRE POINT, Eki-Net and VIEW card) in early 2022. Responses to phishing attacks has been slow, varied and vague. Companies like to say they value customer security but are short detailing what they’re doing about it.

Docomo quickly suspended, then killed off, their problematic docomo koza e-paymnet service. Then Japanese credit card issuers got serious and responded by upgrading to EMV 3-D Secure v2 for browser and mobile app payments (edit: EMV 3-D Secure is the EMV e-commerce browser and app authentication spec for all members but card brands use their own naming) and are due to phase out 3-D Secure v1 by October 2022.

JR East upgraded Suica App to 3-D Secure v2 for in-house credit card purchases and changed the JRE POINT Suica recharge process to make it more secure, but seemly little else. Scratch under the surface however and you’ll notice unannounced recharge security blocks even in Apple Pay Suica. There are also new limits for certain Japanese issue cards registered in Suica App. Recharge with Revolut VISA for example is now limited to 3,000 JPY per day despite the fact that Suica App uses 3-D Secure v2. Clear as mud…again.

Which brings up to the most important point of the whole problem: why is the VISA payment network not accepting foreign issue cards for Apple Pay Suica and Google Pay Suica recharge when those digital wallets offer the highest levels of secure online transactions out there? A bumpy 3-D Secure v2 transition might explain what’s happening for online sites who don’t support Apple Pay and have not updated to newer protocol. But the transition has been going on for a while now, and it doesn’t explain what’s happening with Apple Pay Suica/PASMO and Google Pay Suica (Osaifu Keitai) which have nothing to do with EMV 3-D Secure.

The timing is perfect however when you consider that VISA is heavily promoting ‘VISA Touch’ EMV contactless. It’s very convenient that Apple Pay Suica and PASMO are suddenly sidelined as easy payment options for inbound visitors.

The Apple Pay difference
The security issue doesn’t apply to Apple Pay. Apple Pay comes with the extra security and guarantees that Apple provides to issuers and merchants, once a card is added to Apple Wallet, it is cleared for all things Apple Pay (ditto for Google Pay). This is why a plastic contactless card that doesn’t work on TfL open loop transit gates works when it is added to Apple Wallet. It’s the Apple Pay difference.

So we circle back to foreign issue VISA again. Why are cards cleared for Apple Pay, cards that worked fine until August 5, suddenly not working? Is JR East shutting down recharge for foreign issue cards like Hong Kong Octopus and China T-Union do without telling us? So far JR East support says that all credit and debit cards that support Apple Pay in-app purchase are good to go. They certainly want inbound visitors to use Suica. What little evidence we have so far points to a change on the VISA merchant acquirer side. Everybody else seems to be doing what they always do and haven’t changed anything.

VISA has a history of not playing nice with Japanese stored value cards on mobile. JP issue VISA cards didn’t work for Apple Pay in-app purchases and Suica recharge until last year, it took VISA 5 years to ‘resolve’ that issue. VISA cards still do not work with Mobile WAON and Mobile nanaco on Android and Apple Pay, they likely never will. My take is that VISA is happy with people buying things with VISA, they are certainly happy with people borrowing money with VISA, but they are not happy with people using VISA to move money into stored value prepaid cards for making payments, earning points, etc., that are not VISA.

Who knows? VISA has played hardball in the Japanese market before, maybe they are doing so again. Perhaps they refuse to be an ATM-like recharge backend for Japanese e-money cards unless they also get ATM-like lending rate surcharges, or maybe they want to promote open loop VISA Touch and Stera Transit at the expense Mobile Suica market and mindshare. You get the picture.

Junya Suzuki thinks the VISA merchant acquirers might be coming under pressure from potential money laundering risks. I think people have the right to move their money where they want to, after all we’re only talking a max Suica balance of ¥20,000 here. Whatever the reason let’s hope it is fixed soon, though I have learned over the years that card brand payment issues are never simple. Time will tell. At the very least I think we can say this is another skirmish in the ongoing digital payment turf wars.


2022-12-03 UPDATE
JR East is working to resolve the unexplained problem with the VISA merchant acquirer, updating the entire JR East credit card system with a series of special maintenance downtimes. The work covered everything connected to credit card purchases: JR East station kiosks, VIEW ATMs, Mobile Suica, Eki-Net, etc.

After the last scheduled overnight maintenance session on November 30~December 1, foreign issue VISA cards started working again for Apple Pay Suica and PASMO recharge with some cards such as Wells Fargo but stopped again 2022-12-03.

Expect more developments the week of Dec 5, it might take some time before they are all working again. If not we’ll know for sure that VISA is making a power play in the Japanese market.

Apple Pay Suica recharge security block

JR East online services (Mobile Suica, JRE POINT, Eki-Net), along with many other online services that have accounts with credit cards, have been inundated with phishing attacks since the Russia-Ukraine situation erupted in February. It has gotten to the point that JRE POINT announced temporary security limitations on July 6: a temporary suspension of JRE POINT service recharge for Mobile Suica (via Suica App) and a 5,000 JRE POINT app barcode use limit per transaction (plastic JRE POINT card use remains unlimited). All JRE POINT services were later restored with new security enhancements.

There is another security limitation Apple Pay Suica users need to be aware of: credit/debit card recharge security block. This does not apply to cash recharge at station kiosks, convenience stores, 7-11 ATM, etc., but it can happen with multiple credit card recharges in a short period of time, i.e. heavy users. Unfortunately JR East does not reveal what conditions trigger a recharge security block that displays an error message: チャージをご利用できない状態です/ Recharge is not available. The Mobile Suica support page specifically states that JR East “cannot inform you about the conditions and contents of restrictions.” User reports suggest a general daily recharge limit between ¥5,000~¥10,000, however I think it also depends on the credit card issuer. My JR East JCB VIEW card for example has never run into any recharge limits in 5 years of heavy recharge use.

Apple Pay Suica recharge security block appears to be somewhat rare, but it is happening more with the recent Mobile Suica phishing attacks. In general Wallet app recharge tends to be more robust than Suica app recharge but security recharge block seems to affect all credit card recharge. The only user recourse appears to be contacting the card issuer or using the Mobile Suica member online Trouble Report Form (Japanese only). No word on Apple Pay PASMO but users should expect the same situation.

Mobile Suica registered account information can only be changed in Suica (iOS) and Mobile Suica (Android) apps by applying for an account update, it cannot be directly changed in the app, it cannot be changed via a web browser. This offers a level of account security but too many people fall for phishing emails. Even my internet savvy partner fell for a Mobile Suica phishing mail and have to get his credit card reissued.

The short term solution for JR East is to implement 2FA across all of their online services with a single login ID credential instead of the multiple service ID account mess we have now…hopefully soon. The longer term solution will be eliminating ID and password login altogether using Passkeys.

Cashless is fast and convenient? Point app mania reality check

My partner wanted to pick up some cheap t-shirts on bargain sale at Uniqlo yesterday. The Asagaya station building Beans shopping mall has all the latest cashless options but very bad network service so Uniqlo checkout was a comedy routine. First he brought up the Uniqulo app to get Uniqlo points, then I brought up my JRE POINT app to earn JRE POINT, then he finally paid with QR Code dBarai (docomo). But for each app launch and load we had to run to the store entrance to capture enough network connection for the apps codes to load. The staff is very used to this and suggest customers do so when apps didn’t load, patiently folding clothes while they run back and forth. I asked the cashier if this happens all the time. She smiled and nodded. “Cash is probably faster isn’t it?” She smiled and nodded.

Gosh, just when we thought cashless was going to free us from the so called inconvenient drudgery of cash along came smartphone reward point apps that bog down the whole cashless checkout experience, neatly killing off the supposed time saving advantage. You stand in line while the checkout customer fiddles with smartphone, digging around in an app to find the right coupon code thing. You feel smug until it’s your turn and the networks sucks, the discount coupon doesn’t load and bam, you’re holding up the line too. It has gotten to the point where Nikkei XTECH has provided an Apple Pay help article for faster checkout that explains the benefits of using Apple Value Added Services. Will Apple Pay VAS dPoint and Apple Pay VAS PONTA really help us? Probably not as they only work at LAWSON.

There is another checkout trend I see recently. With price increases everywhere people are using cash a lot more, even at places like in-station Beck’s Coffee Shop. Every customer has a Suica but more young people are keeping it in their pocket and plucking down ¥10,000 yen notes for ¥300 ice coffee. Why? I think it’s Kakebo culture at play, it’s easier to budget with cash payments and the small slightly inconvenient physical routines that accompany it. It’s not about doing everything with cash, but good old tsukae-wake compartmentalization helps keep focus and tamps down the impulsiveness when doing everything cashless. Another way of spreading the risk in these uncertain times.

iOS 16 Wallet: expanding the Apple Pay experience, aka Suica auto-charge for the rest of us

iOS 15 added big new features to Wallet, expanding digital keys from cars to include home, office and hotels and ID in Wallet driver licenses for the first time. There were smaller but important UI changes too. A new add card screen offered new categories making is easy to add transit cards regardless of the device region and quickly re-add previous Wallet items from iCloud. iOS 15 was all about Wallet to the extent that Apple now advertises it as a separate thing from Apple Pay with a separate web page, and even referred to Apple Pay as “one of the most important areas of Wallet” in the WWDC keynote. Very interesting.

iOS 16 moves the focus back to Apple Pay and making digital payments more useful, practical and universal. The WWDC22 Keynote announced Apple Pay Later, in-app ID card verification and key sharing. Apple Pay Later is one aspect of several new Apple Pay functions unveiled in the What’s new in Apple Pay and Wallet session.

Multi-merchant payments: In our online world we can never be sure how many sub-merchants are involved when we order something and how our card information is shared. In multi-merchant Apple Pay, multiple payment tokens are issued for each merchant in the same transaction, preserving user privacy, with the iOS 16 Apple Pay paysheet showing a breakdown of each sub-merchant charge. This feature works mostly on the backend, but showcases how smartly the Apple Pay Wallet team design features to ‘just work’ securely for merchants and customers.

Automatic Payments
My favorite iOS 16 feature as it addresses a lot of interesting use cases, much more than just Apple Pay Later installments which fall under:

Reoccurring payments, which include things like installments and subscriptions, basically any regularly scheduled payment. With the recent Starbucks Japan price increases, I decided to sign up for the new JR East Beck’s Coffee Shop subscription plan. Up to 3 cups a day for ¥2,800 a month. A pretty good deal for commuters like me. The Beck’s subscription service is subcontracted out to an interesting online business venture company called Favy that uses Sign in with Apple to create an account. Payment however is manual credit card entry with the onerous, ubiquitous 3D Secure sign-in. Pass issue and serving size selection (M=¥50, L=¥100 extra) is done in Safari. It works well enough, but canceling or getting payment details is a real Safari expedition. It would be a much better, and faster, customer experience doing it all in Apple Pay.

Automatic Reload: this is the real money feature for me because it plays on the classic snag of using Apple Pay Suica…recharge. All pre-paid cards are a catch-22. Japanese users love them because they like the “I know how much money I’m adding to my card” aspect of manual recharge, but there’s the inevitable, you know you forgot about it, bing-bong ‘please recharge’ transit gate alarm when Suica balance is short.

JR East offers Suica Auto-Charge (auto-reload) as a feature of their VIEW card. The auto-charge option works great with Apple Pay Suica but like all transit card auto-charge, it is tethered to the transit gate NFC system. This means the users gets instant, seamless auto-charge but only on the operator’s transit gates. Suica auto-charge does not work outside of the Suica and PASMO transit gates, not at store terminals, not in other transit card regions like JR West ICOCA. This limitation is a big customer complaint, I and many others would love Apple Pay Suica auto-charge to work everywhere.

Apple Pay automatic reload takes care of this problem very nicely. Suica would recharge anywhere because the card balance ‘trigger’ and reload process is done via Apple Pay instead of JR East transit gates and the Suica system. JR East could keep auto-charge exclusive to their VIEW cards as they do now or easily, selectively expand it. Either way they would greatly increase the usefulness of VIEW and Suica by supporting the new Apple Pay automatic reload feature. The possibilities are are pretty exciting.

Order tracking
Another very useful feature I think people will love using. The addition of QR/barcodes in the Apple Pay sheet is a first and will greatly shorten the order pickup~delivery process. The best use case of Apple Pay and bar codes that I can think of.

ID verification in apps
This is where ID in Wallet gets real. Wallet app has TSA airport checkpoint verification built-in but that’s not going to help all the government issuing agencies, not to mention software developers, around the world who want to implement digital ID verification to unlock various digital services.

JR East for example has centered their whole Super Suica MaaS Cloud initiative around ID PORT and the ability to match various region or age based services (discounts, special fares, etc.). In other words JR East and their sub-merchant or local government agency want to know where I live and how old I am. This is all provided on the Japanese government My Number digital identity card launching later this year on Android, and Apple Wallet later on. But I don’t want my personal details going everywhere. If the MaaS campaign app or website only needs to know that I live in Tokyo and am over 60, that’s the only info I want to give them. This is what the new PassKit ID request APIs in iOS 16 do: give apps only the information they need to perform a verification for a service and nothing more.

Key sharing
Nothing big here, but it does address one iOS 15 Wallet shortcoming for home, hotel keys which that could not be shared and expanded share options beyond mail and messages. I’m doubtful Apple includes office keys in the bargain but the fine print reads: available on participating car brands and access properties. We’ll find out when iOS 16 ships.

And then there’s Tap to Pay on iPhone. It’s really not an Apple Pay function to me because it turns iPhone into a very handy and portable NFC payment terminal, but it makes sense branding wise. Just say Apple Pay for making…and accepting payments. Anywhere the merchant has their payment provider POS app and a network connection, they are ready to go. This is big. Apple has lined up an impressive number payment providers in a very short time who are happy to leave all the hardware certification and secure element management to Apple and focus on software. I can practically feel the intense interest from Japan where local payment providers would love to leverage the global NFC capable iPhone for seamless EMV and FeliCa payment services. It could be an interesting Apple Pay year.