Contactless Payments: Frequently Asked Questions

SMART CARD TERMINALS

The questions and answers below apply only to contactless payment using contactless smart card technology, as implemented by American Express, Discover Network, MasterCard and Visa.

General

1. What are contactless payments?
Contactless payments are simply payment transactions that require no physical contact between
the consumer payment device and the physical point-of-sale (POS) terminal. In a contactless
payment transaction, the consumer holds the contactless card or device in close proximity (less
than 2-4 inches) to the merchant POS terminal and the payment account information is
communicated wirelessly (via radio frequency (RF)).
In the United States, the term “contactless payments” refers to the use of payment products
currently supported by American Express® (ExpressPay), Discover® Network ZipSM MasterCard
(MasterCard® PayPass™), and Visa Contactless.

2. What is RF?
Radio frequency (RF) waves are the frequencies within the electromagnetic spectrum associated
with radio wave propagation. Many wireless communications technologies are based on RF,
including radio, television, mobile phones, wireless networks and now, contactless payment cards
and devices.

3. Is contactless payment technology the same as RFID technology?
No. There is a wide range of RF technologies used for a variety of applications. Each RF
technology supports different operational parameters, RF frequencies, read ranges and security
and privacy features based on the application. For example, RFID technologies are used in
manufacturing, shipping and object-related tracking and are designed to operate over long ranges
(e.g., 25 feet). Applications using RFID typically have minimal built-in support for security and
privacy. On the other hand, the contactless smart cards that are used for making payments are
designed to operate at a short range (less than 2-4 inches) and can support the robust security
capabilities of the contact smart cards typically used for financial services and other applications
where strong security is a requirement.

4. What are the benefits and advantages of contactless payments?
There is significant momentum in the marketplace to add the option to make payments via
contactless payments to charge, credit, debit, prepaid, and gift cards in both consumer and
corporate card programs. Initial results indicate that contactless payment provides significant
benefits for all stakeholders. Benefits and advantages of contactless payments include:                

a.  Consumers like the speed and convenience of contactless payments. They no longer need
to swipe their cards or carry cash for lower value transactions.
b.  With contactless payments, financial institutions can increase transaction volumes by
capturing transactions typically made using cash. In addition, they can differentiate
themselves with innovative new form factors to enhance loyalty and retention.
c.  Contactless payments use the international standard ISO/IEC14443 for contactless
communications that is being adopted worldwide for financial payments and leverage the
existing payments infrastructure which has supported payment cards for more than 40 years.
d.  Contactless payment cards are backed by the major payment brands -- American Express,
Discover Network, MasterCard and Visa. Since mid-2005, over 17 million cards have been
issued by some of the largest financial issuers in the U.S. and around the world.
e.  Acceptance of contactless payments is being adopted by a wide range of retail segments
where speed and convenience are critical to the merchant service model. Over 35,000
merchant locations now accept contactless payment cards and devices. Acceptance of
contactless payments has resulted in higher throughput, increased spend per transaction and
greater customer convenience for merchants.
f.  In addition to the security measures already embedded within the traditional payment card
infrastructure, new security measures have been incorporated to mitigate possible risks
resulting from contactless payments. Cardholders and merchants are also protected by
specific programs developed by the card brands and banks to further minimize liabilities
related to fraud and misuse.

5. Is contactless payment technology more appropriate for credit cards or debit cards?
Contactless payment technology is a feature that can be added to any payment card product (e.g.,
credit, debit, prepaid). Contactless technology is now being used in both credit and debit
products. The choice of which type or product is better suited to contactless technology is
determined by the issuer and their business strategy.

Market Information

6. How many contactless cards have been issued in the United States? What are the
expectations for growth in the market?
Industry sources estimate that over 17 million cards have been issued in the United States since
mid-2005. The number of contactless cards in 2007 could be two or three times the 2006 volume
as more portfolios become enabled, renewal cycles expand the penetration of contactless
payments within existing portfolios, and new acquisitions occur. However, as with any new
technology, it is very difficult to predict future volumes.

7. Which financial payment card issuers are issuing contactless payment cards and
devices?
U.S. issuers who have adopted contactless payment technology as of January 2007 include
Advanta, American Express, Bank of America, Citibank, Citizens Bank, GE Consumer Finance,
HSBC Bank, JPMorgan Chase, KeyBank, Meijer Stores, US Bank and Wells Fargo.

8. How does the emergence of biometric technology compete with contactless
payments?
The nature of different acceptance venues, multiple stakeholder goals, perception of value-add,
consumer access, and readiness determine the type of deployment for emerging technologies.
Many contactless payment programs benefit from the speed and convenience of contactless
technology while leveraging the existing payment infrastructure. Biometric payment pilot
deployments seek to validate goals unique to biometric technology and its stakeholders. Both
technologies are exploring new ways to add convenience and value to payments.

Contactless Payment Operation

9. Is the information passed in a contactless payment transaction the same that would
appear in the track data of a magnetic stripe card?
Contactless payments leverage the same track data format but do not use exactly the same data
elements. Please contact American Express, Discover Network, MasterCard or Visa about the
specific implementations.

10. If a consumer has multiple contactless cards in a wallet or multiple contactless key
fobs, how does the contactless transaction work?
If multiple contactless devices are held within proximity of a reader, anti-collision will prevent
multiple devices from being read. In order to ensure a deliberate card read, a single contactless
device must be placed within range of the reader.

11. How are tips and gratuities handled in contactless transactions (for example, at a
restaurant)?
Tips and gratuities are handled in the same way as they would be with traditional payment cards,
where the tip is included as part of the overall total amount before the transaction is processed.

Signature Waiver

12. When are signatures not required for contactless transactions?
American Express, Discover Network, MasterCard, and Visa, in concert with their issuers, have
implemented new programs and rules designed to encourage adoption of contactless payments.
These programs are typically aimed at transaction scenarios where the transaction value is low
(typically below $25) and cash is the predominant form of payment. While the specific programs
differ by payment brand and may by specific to any given issuer and/or merchant implementation,
these programs may include the following features:
a.  The consumer signature is not required.
b.  A customer receipt is only required upon cardholder request.
c.  The merchant retains full chargeback protection for transactions that meet the program
requirements.

Contactless payment can also be used for transactions greater than $25. For example,
pharmacy chains accept contactless payment and frequently have higher valued transactions.
For these transactions, a signature is most likely required by the merchant to maintain full
chargeback rights. Some merchants do extend the benefit of “no signature” for larger-sized
transactions to their customers. However, these merchants typically would have made the
business decision to take on the additional risk that may be associated with these transactions.

Merchant Benefits and Implementation

13. How much time does contactless payment technology save versus traditional card
payments? Are there any quantifiable benefits for merchants with regard to
contactless versus magnetic stripe payments?
Chase has reported that customer time at the POS is reduced 30-40%, and American Express
has reported that contactless transactions are 63% faster than cash and 53% faster than using a
traditional credit card. MasterCard found the most significant time savings were realized in the
drive-through environment where 12-18 seconds were shaved off the purchase time as compared
to cash. Merchants implementing contactless payment have confirmed that there are time
savings.

14. Is there a common acceptance mark for contactless payments at the merchant pointof-
sale?
Yes. American Express, Discover Network, MasterCard, and Visa have
agreed to use a common contactless symbol to communicate the
acceptance of contactless payments, based on the ISO/IEC 14443
standard, for global use at POS terminals. The contactless symbol helps
consumers and merchant staff to easily understand how and where to
present contactless cards and other devices so that they interact correctly with the terminal.

15. What is the cost to the merchant to upgrade its point-of-sale to accept contactless
payments?
There is an incremental cost to merchants to accept contactless payments. The actual expense
is dependent upon the merchant’s existing infrastructure and its choice of contactless acceptance
solution, for example: peripheral or integrated. Merchants should contact their acquirer or
terminal vendor for exact costs.

16. Can the same POS terminal be used for accepting all payment brands' contactless
payment cards and devices?
The same POS terminal can be set up to accept payment from all American Express ExpressPay,
Discover Network, MasterCard PayPass and Visa Contactless contactless cards and devices;
implementation will depend on the payment brands accepted by the merchant. Merchants should
consult their POS vendor or merchant acquirer for additional information.

17. What POS systems are capable of accepting a contactless payment device?
The devices listed below are some of the devices available. There may be others and certainly
manufacturers are developing new devices with contactless capabilities.

Technical Questions

18. Can contactless payment transactions be identified from other transactions in the
payment system?
Yes, the payment brands have implemented new indicator requirements and other means to
uniquely identify contactless payment transactions from traditional, contact payment transactions.
Please consult with the payment brands for specific payment brand requirements.

19. Are there any differences when personalizing contactless payment cards versus
magnetic-stripe-only cards?
Yes. There are additional personalization processes for contactless payment cards since
payment data and security keys are loaded onto the contactless smart card chip. Most major
personalization bureaus support the contactless process. Issuers should contact their
personalization vendor for changes and additions to their existing process for embossing and
encoding.

Contactless Payments Security

20. Are contactless payment transactions secure?
Yes. Contactless payments, as implemented by American Express, Discover Network,
MasterCard and Visa, are secure. The financial payment networks used to process contactless
payments are the same networks that process millions of magnetic stripe transactions securely
today. The primary difference is that the contactless payment device (card, fob or other form
factor) uses radio frequency technology to send payment account information to the merchant’s
point-of-sale terminal instead of requiring the payment card's magnetic stripe to be physically
read. Contactless payment devices are designed to operate at very short ranges (less than 2-4
inches) with the POS, and can include additional security elements to further enhance security.
The financial payments industry has designed multiple layers of security throughout the traditional
credit and debit payment systems to protect all parties involved in a payment transaction. Most of
these protective measures are independent of the technology used to transfer the consumer
payment account information from the payment card or device to the merchant POS terminal and
are used for both magnetic stripe and contactless transactions. For example, for online
authorizations, risk management and fraud detection systems are used to detect potential
fraudulent activity for any credit or debit card payment transaction. Consumers are further
protected by the liability protection programs offered by the various payment brands and their
issuing banks for transactions that may have been made fraudulently using their credit or debit
accounts.

21. How are contactless payment transactions made secure?
For contactless payments, the financial industry uses added security technology both on the
contactless device as well as in the processing network and system to prevent fraud. While
implementations differ among issuers, examples of security measures that are being used include
the following:
a.  At the card level, each contactless card can have its own unique built-in secret “key” that
is used to generate a unique card verification value or a cryptogram that exclusively
identifies each transaction. No two cards share the same key, and the key is never
transmitted. Contactless cards employ standardized encryption technology, 128-bit (e.g.
Triple DES).
b.  At the system level, payment networks have the ability to automatically detect and reject
any attempt to use the same transaction information more than once. Thus, even if a
fraudster should "read" the information from a contactless transaction, or even numerous
transactions from the same card, this information would be useless.
c.  Many contactless payment cards and devices do not transmit the name of the cardholder,
limiting the amount of information that is communicated during the transaction. The
cardholder name is part of the existing magnetic stripe data common on most traditional
credit cards.
d.  Some contactless payment cards and devices do not include the cardholder's account
number, but use an alternate number that is associated with a payment account by the
issuer's backend processing system. This alternate number would not be able to be
used in other payment transactions (e.g., with a magnetic stripe card or on the Internet).
In addition, cardholders control both the transaction and the card throughout the transaction.
Cardholders do not have to surrender either a card or their account information to a third party
during a contactless transaction.

22. What steps can consumers take to protect their contactless payment cards?
As with all credit and debit payment cards, consumers can minimize any risk of having their
payment card data read by a potential thief by taking common precautions such as not leaving
their contactless payment card or key fob unattended for a length of time.

Form Factors and Card Cost

23. What other form factors are available for contactless payment?
Contactless payment technology enables new, innovative form factors beyond standard-sized
cards. While card form factor is most common today, issuers and payment brands have
introduced a variety of new form factors, including fobs, mobile phones, mini cards, wristwatches
and wristbands -- all enabled with contactless payment.

24. What is the cost differential to the bank to have a contactless payment card vs. the
traditional magnetic stripe card?
There is an incremental cost for a contactless payment card, with the cost driven by the card
volume and design. Alternative form factors, such as fobs and mini cards, are typically more
 expensive than contactless cards but also depend on quantity, design and packaging. Card
vendors can provide more information about the cost of contactless cards and devices.

25. Where can I find information on the cards that are approved for contactless payment?
MasterCard and Visa have defined specifications and certification processes to assist card
manufacturers and silicon providers to develop market-ready products. Once a product is
approved by MasterCard or Visa, it appears on their respective lists of approved products which
are regulary updated to include new products.

American Express, as an issuer, negotiates directly with specific vendors for the development of
products meeting its specifications and therefore does not publish a list of approved products.
Discover Network offers specifications for all card manufacturers or silicon providers to develop
products that must pass their testing and certification requirements. 

Future Capabilities

26. Can contactless payments be used to pay transit fares?
Two pilot projects, MTA New York City Transit and Utah Transit Authority, are evaluating the use
of contactless financial payment devices to pay fares directly at subway gates and on buses,
respectively. Additional information on these pilots can be found in the Smart Card Alliance
Transportation Council white paper, "Transit and Contactless Financial Payment:

In addition, since the late 1990s, U.S. transit agencies have made significant investments in
contactless smart card-based automatic fare collection (AFC) systems. Currently, projects are
under way in major metropolitan areas in North America to deploy fully integrated contactless
smart card-based transit fare systems, where a contactless smart card as the fare medium.
These projects use contactless technology that is unique for transit fare collection, rather than the
technology used in the contactless financial payment cards offered by American Express,
Discover Network, MasterCard and Visa. 

27. Will contactless payment cards be used anywhere other than the traditional, face-toface
point-of-sale?
Contactless is growing in those acceptance venues that require fast throughput and are cash
heavy. Contactless can also expand to emerging channels such as unattended, mobile, transit
and other non-retail-based merchant payment settings. While complimentary applications, in
addition to the core payment function, can increase the value of the card, deployment within an
overall system requires other considerations to be examined, including: payment brand
approvals, terminal integration, back-end system development and deployment, and card
personalization and application deployment.

28. Can mobile phones be used for contactless payments?
The industry has already seen the first instances of mobile phones being used to conduct
contactless payments. Several pilots have been launched in the U.S. and in other markets
around the world. Typically, these offerings leverage Near Field Communication (NFC)
technologies to deliver contactless payment capabilities. For more information about mobile payments, please see the Smart Card Alliance report, “Mobile Payments at the Physical Point-of-Sale: Assessing U.S. Market Drivers and Industry Direction.”

International, EMV and Contactless

29. Is contactless payment EMV-compliant?
Contactless payment is being delivered around the world by the payment card brands and their
issuing and merchant customers by leveraging the existing payment card infrastructure as its
basis for implementation. In the U.S., the existing magnetic stripe processing infrastructure is
being leveraged to deploy contactless payment per the specific program specifications of the
payment brands. Likewise, countries where the payment schemes are predominately chip-based
and have implemented EMV leverage the contactless EMV specifications as published by
MasterCard, Visa and the other payment brands. Regardless of whether magnetic stripe or EMV
is the core payment card infrastructure being leveraged, contactless payment program
specifications developed by the payment brands are designed to be globally interoperable at the
point-of-sale. Contactless EMV programs have been launched in the United Kingdom, Turkey, Taiwan, Malaysia, Mexico, Lebanon, Korea and South Africa. Some contactless EMV implementations use dual-interface smart card chips for use in contactless and contact modes.

SMART CARD TERMINALS