The EMV Express Transit Security Trade-off

The Practical EMV Relay Protection paper authored by Andreea-Ina Radu, Tom Chothia, Christopher J.P. Newton, Ioana Boureanu and Liqun Chen, outlines a potential weakness with VISA cards when used with Apple Pay Express Transit. The BBC reported the issue which was then widely reported on Apple news sites. The authors and the BBC both frame the security issue as known by Apple, who say it’s a VISA system problem, and VISA who say the hack is only a lab project, not a real world problem. Ionut Ilascu on BleepingComputer had a concise summary:

The tests were successful only with iPhone and Visa cards. With Mastercard, a check is performed to make sure that a locked iPhone accepts transactions only from card readers with a transit merchant code.

Trying the method with Samsung Pay, the researchers found that transactions are always possible with locked Samsung devices. However, the value is always zero and transport providers charge for tickets based on data associated with these transactions.

The findings of this research have been sent to both Apple and Visa in October 2020 and May 2021, respectively, but neither fixed the problem.

Apple Pay with VISA lets hackers force payments on locked iPhones, BleepingComputer

Apple Pay uses a GlobalPlatform licensed secure element while Samsung Pay Knox technology uses a Trusted Execution Environment (TEE), it’s a flimsy apple vs orange comparison. A meaningful comparison should have compared iPhone with another secure element device, like Pixel using VISA. Because of the limited scope, it feels like an attention grabbing ploy as it involves iPhone, rather than meaningful security research.

The security paper authors concluded: “While either Visa or Apple implement a fix for the problem, we recommend users to not use Visa as a transport card in Apple Pay. If your iPhone is lost or stolen, activate the Lost Mode on your iPhone, and call your bank to block your card.” In other words, turn off the Express Transit Card option for VISA cards.

It is not Apple’s problem to fix but Apple set themselves up for this.

Steve Jobs said it best: designing anything is about choices and trade-offs. The Apple Pay that launched in 2014 was designed for credit cards with bio-authentication to authorize payment transactions. This changed in 2016 with the arrival of Suica, the first transit card on Apple Pay, and Express Transit. Express Transit and Express Mode emulate the way that transit cards and student ID are designed to work. The FeliCa and MIFARE protocols used for these cards are very secure and have a long history of safe prepaid smartcard use.

For a time, the Apple Pay security protocol design was clearly defined: EMV bank payment cards required bio-authorization for transactions while transit cards, ID cards and digital keys worked in Express mode without it.

All was good until iOS 12.3 and the arrival of EMV Express Transit that changed the rules so that credit cards could act like express mode transit cards too. No more Touch ID or Face ID authentication for using Apple Pay bank cards on Transport for London (TfL) and New York OMNY transit gates. It sounded like a good idea but Apple decided to promote these services by making EMV Express Transit ‘on by default’ when adding a credit/debit card to Wallet.

As any careful watcher of the OMNY rollout will tell you, there have been plenty of Express Transit problems, especially for MetroCard users. Most of whom have no idea Express Transit was a default on option. Express Transit issues continue to crop up as they did for Apple Card users recently with problems on the Mastercard network and Goldman Sachs side. Open loop transit comes with more downsides than promoters like to admit.

It boils down to this. When Apple activated EMV Express Transit and make it a default on, presumably to promote all kinds of Apple Pay cards for transit…cards that were never designed for it, it made Apple Pay susceptible to any and all bank card network security issues and glitches. Instead of Apple service quality or secure dedicated transit cards, the user ends up with bank and card company service level quality at the transit gate. In other words, EMV Express Transit quality is up to banks, not Apple nor the transit agency. It’s their card, they call the shots. That’s the trade-off that won’t go away.

VISA Japan finally signs on with Apple Pay (Updated)

UPDATE 5/11/21
Visa JP finally officially joined Apple Pay


Japanese credit card otaku tweeted late last night that the Apple Pay Wallet animation started displaying VISA, which it never did until now. Sure enough, VISA displays in the add card animation for the Apple Pay Japan region on iPhone, Apple Watch and iPad. Wallet only displays supported card brands for the selected Apple Pay region so the change indicates VISA JP is officially on board.

The trouble is we don’t know what that means without a press release from VISA Japan, Apple, or Japanese card issuers. So far we don’t have one. All we have are 2 questions that will hopefully be answered later today or the next few days.

Does it mean current iD/QUICPay VISA cards in Wallet fully support Apple Pay features?
A quick check adding a digital Kyash VISA prepaid card to my Wallet did not show anything new, just the same limitations: no VISA logo, no In App (Suica recharge) or web purchase support, no EMV/FeliCa dual mode. That doesn’t mean anything by itself: virtual Kyash VISA still has the limitations but it may be different for major VISA issuers like SMBC and MUFJ.

Does it mean that Apple Pay is simply matching the EMV only VISA Touch cards already on Google Pay from Sony Bank and others?
This seems more likely but also flies in the face of Apple Pay Japan encouraging ‘it just works anywhere’ dual mode EMV/FeliCa support for Wallet issue. If we don’t get announcements from VISA Japan or Apple, it could be a slow dribble of VISA Touch announcements from VISA JP card issuers, not much fun.

What I really want to know is: did VISA Japan blink, or Apple?

VISA Touch issuers currently on Google Pay

UPDATE 11/24
Somebody in Cupertino uploaded a new JSON payload to Apple Pay servers too soon. After showing in Wallet for almost 24 hours, VISA disappeared from the add card animation lineup around 6 pm JST. With a gaff this long at least we know VISA support is coming to Apple Pay Japan soon and likely with the Line Pay Apple Pay card announced in September for launch ‘later this year’.

Tokyo Cashless 2020: Blame the Japan Cashless Payments mess on VISA and EMVCo, not FeliCa

1️⃣ Dear JR East, we need a new Suica Charge App
2️⃣ Consumption tax relief with the CASHLESS rebate program
3️⃣ Are Apple Maps and Siri really Apple Pay level ready for the Tokyo Olympics?
4️⃣ > Blame the Japan Cashless Payments mess on VISA and EMVCo, not FeliCa

Tokyo Cashless 2020 is a series covering all things cashless as Japan gears up for the big event. If there is a topic that you’d like covered tweet me @Kanjo


Japanese journalist Akio Iwata just published a piece explaining why VISA has not signed with Apple Pay in Japan. It is paywalled and I have not read it, but Japanese readers noticed similar points in my earlier piece Why Visa refuses to join Apple Pay Japan and tweeted about it. The subject is timely and worth visiting again after the events of the past year.

Some western business journalists and industry pundits look at the Japanese payments market and write about failure: the failure of FeliCa to be universally accepted, the failure of Japanese society to use cashless payments instead of hard cash. It’s a kind of cut and paste narrative construct journalism that you see too much of these days, like the recent Financial Times piece, or worse the NFC TIMES. The narrative is persuasive enough to blind some Japanese journalists as well.

This kind of reporting plays to the expectations of a certain readership, but it completely fails to capture or explain the massive changes happening in Japan right now, set in motion by the arrival of Apple Pay in late 2016. The bulk of the cut and paste argument is that FeliCa failed to take off in Japan and because Japan failed to switch to the EMV ‘world standard’, that’s why we have the current messy situation. End of story. I don’t buy this argument at all.

FeliCa was around long before the EMVCo consortium got it’s NFC act together in the early 2000s. NFC-A is Philips, NFC-B is Motorola, NFC-F is Sony. The ISO/IEC 14443 standard was supposed to include NFC-F but the ISO ultimately decided not to include it. EMVCo created the EMV contactless standard on ISO/IEC 14443 NFC A/B.

With lots of help from JR East, NFC-F was added to the ISO/IEC 10373-6 and GSMA/GCF (Global Certification Forum) TS. 26, TS. 27 specifications. From April 2017 GCF certification for all NFC mobile devices requires NFC-A, NFC-B and NFC-F support.

It is this later development, and especially the fruit of that development, Apple Pay Suica, that I believe is unacceptable to VISA and by extension EMVCo. VISA cooperates with Apple Pay in other countries because it promotes EMV, VISA refuses to cooperate with Apple Pay in Japan because it promotes FeliCa. Instead of promoting bank card use and new services VISA is promoting technology.

I have long suspected that VISA simply does not want anything to do with Apple’s support of the Global NFC standard put in place by the NFC Forum and GSMA/GCF in 2017. It’s not only Apple…VISA refuses to support dual mode (EMV/FeliCa) Docomo iD/NFC for Android Osaifu Keitai users abroad which Mastercard, American Express and JCB do. VISA simply wants to bide time until NFC Pay/EMV contactless support in Japan is everywhere and then simply ignore FeliCa (NFC-F) all together…

Unfortunately this strategy has only accomplished one thing: it provided an opening for QR Code payment system players…

Why Visa refuses to join Apple Pay Japan

My argument is simple. The VISA and EMVCo mindset is stuck in the one size fits all single mode plastic card era. This is easy to understand as the plastic card issuing business is a very lucrative one.

But like all things there is a downside: instead of embracing the full promise of global NFC digital wallets that can match the best NFC technology for the job with multiple mode cards that do everything and ‘just work’ everywhere, we have the contactless payment turf wars which are really just plastic era fighting moved to a digital arena.

Instead of pursuing the advantages of digital wallets that merge the best of native transit cards on the front end with the best of bank cards on the back end, where they perfectly complement each other, we have bank cards fighting to be everything, which they are not and will never be. This is why Apple markets Apple Card as ‘a new kind of credit card, created by Apple, not a bank.’ It’s the reason why Apple Card is Mastercard brand, not VISA.

In Japan specifically we have VISA refusing to join Apple Pay Japan and for the most part Google Pay, and VISA Japan key player Sumitomo Mitsui fighting on and off with Mobile FeliCa key player Docomo. And the result? None of this nonsense helped strengthen VISA Japan’s market position one bit. On the other hand VISA’s arrogance pulled all the other card companies down with it and provided a huge opening for the Japanese QR Code players like PayPay.

When I wrote Why Visa refuses to join Apple Pay Japan the frenzy of Japanese QR Code payments was just getting underway. Over a year later I think this conclusion is stronger than ever and the only one that explains the reality of the current market. VISA may like to think that the Tokyo Olympics is the last great opportunity to finally kill FeliCa. That’s not going to happen.

Only by setting aside the past and embracing the multimode digital future with forward looking cooperation, can VISA (and by extension EMVCo) help bring order to the payments chaos of the Japanese market. Only cooperation can deliver the promise of cashless payments to Japan, and strengthen the long term market opportunities for all players.

Visa Japan Finally Ready to Sign on to Apple Pay Japan?

IT journalist Junya Suzuki was answering a question of mine regarding dual mode (EMV/FeliCa) credit/debit cards which are somewhat mainstream, even on Docomo dCard, but the plastic issue Sumi Trust Visa contactless cards are EMV only.

I guess Visa Japan still wants to promote payWave (banded as Visa Touch in Japan) over better customer service. Because if Visa was promoting better customer service, they would offer dual mode for plastic cards and Apple Pay like Mastercard and American Express do.

Visa Japan has yet to sign directly with Apple Pay, the reason why Japanese issue Visa cards don’t work for Apple Pay Suica Recharge, but there may be hope. Suzuki san’s tweet suggests Visa Japan might finally sign with Apple Pay, “in the very near future.”

I certainly hope so, but given that Visa Japan has ‘been in discussions with Apple’ to officially join Apple Pay Japan since the service launched in October 2016, and have done nothing the whole time, I’ll believe it when I see it.

What the Hell is VISA Up To in Japan?

VISA is the least consumer friendly card company in Japan. Period. Mastercard, American Express and JCB are making it easy for Japanese customers to use their cards in mobile wallets (Apple Pay, Osaifu Keitai) both domestically and abroad with NFC Switching. NFC certification requires both NFC-A and NFC-F. Smartphones can do it all, how nice.

Except VISA does not want to play nice, they want to play market politics. Witness VISA’s latest boneheaded move reported by Masakazu Tatara on his excellent EPayments JP site: Visa is pulling the plug on Mobile Visa payWave (NFC-A EMV contactless). The last holdout is Sumitomo Mitsui who will terminate service at the end of December 2018. VISA on the iD and QUICPay (NFC-F FeliCa) contactless payment networks remains in place as does plastic card payWave.

As Tatara san asks, what is VISA up to? His quick review of the Mobile VISA payWave spec is helpful and remarkably similar to the Mobile FeliCa spec.

The secure methods for storing Mobile VISA payWave transaction information are:

  1. A mobile device with an Embedded Secure Element (eSE)
  2. HCE (Host Card Emulation in the cloud)
  3. A “Mobile eSE” SWP SIM
  4. A NFC Contactless Payment Sticker

As Tatara san explains, it is the #3 SIM card option that is really being phased out.  #1 includes Apple Pay and Osaifu Keitai devices. The recently released Google Pay Japan is simply an alternative Osaifu Keitai front end that entirely dispenses with the dead HCE-F. As if this was confusing enough, VISA Japan has not signed on with Apple Pay Japan or Google Pay Japan, nor is VISA payWave compatible with the Osaifu Keitai standard. This leaves #2 and #4 as the only real Mobile VISA payWave Japan options going forward. Good luck with that.

Japanese media has speculated that the Sumitomo Mitsu and Mizuho financial groups want to promote QR Code contactless payments over NFC and the death of Mobile VISA payWave proves that QR is winning the contactless payment turf war. Don’t believe it.

In Japan, aka the contactless payment turf war epicenter, the battle line is stored value vs. credit card with stored value cards the clear winner. This week’s Mizuho Suica announcement is proof of that. There isn’t any money for Japanese merchant support of EMV contactless because most inbound tourist business is mainland Chinese who only want to use QR code contactless AliPay and WePay which Japanese will never use.

So where is VISA going in the Japan market? One guess: the success of Apple Pay Suica and the release of the Global FeliCa iPhone/Apple Watch has VISA at a momentary standstill. Because if Google follows Apple’s lead and releases a Global FeliCa Pixel 3 with NFC switching, things will get very interesting. The more Global FeliCa becomes a ho-hum checkbox feature with every smart device, the more VISA Japan will have to play nice with Apple Pay and Google Pay or risk being shoved aside.

Which brings us back to FeliCa again. To outsiders it looks like the Japanese contactless payments market goes round and round, but it doesn’t. VISA Japan goes round and round playing market politics never moving forward, and that does damage. Last month I wrote:

It would be much better for customers if smart device manufacturers bundled all the major middleware stacks (EMV, FeliCa, MIFARE, China Transit, CEPAS) and simply called it Global NFC. Real Global NFC.

Until the industry does a better job of integrating NFC hardware and the various middleware pieces into a virtual whole, NFC confusion will continue to be a problem.

It would be much better for customers if the credit card industry stopped the contactless payment turf wars and started delivering solutions that help customers instead of sowing confusion.

UPDATE 2019
A reader in the know reports says that payWave on SIM cards is pretty much dead everywhere because the “secure element wars are over.” That’s interesting in light of Huawei offering FeliCa Osaifu Keitai service via Docomo with a SIM card. But that is a Docomo thing more than a Huawei thing.

UPDATE 2021
VISA JP finally signed on with Apple Pay, just in time before the start of the Tokyo Olympics.