Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Offline card payments should be possible no later than 1 July 2026

riksbank.se

Post reply on HN
Print view View original

551–560 of 581 posts

Re: Offline card payments should be possible no later than 1 July 2026

#551

Post by m11a »

loeg wrote: post #116
wcoenen wrote: post #109

Pedantically speaking, offline card payments are already possible _now_. E.g. see the Square documentation about that.[1] However, it requires that all the parties involved (issuer, acquirer, payment network, merchant) allow it, and there are certain limits. One of the linked documents[2] in the riksbank press release has more details about what they expect from these parties. [1] https://squareup.com/help/us/en/arti…

Fundamentally it's all extensions of credit, right? The question is who is taking on credit risk in these transactions and how is everything settled when the power comes back. Presumably, everything is somewhat reversible and there is some dispute resolution process.

Right. IIRC, the acquiring bank would send an authorisation advice to the issuer when it comes back online. An auth advice is like notice that a payment happened, the issuer doesn’t really get a say in rejecting it (as it does for an authorisation). For the most part, anyway.

If that transaction brings the customer into a negative balance, it’d be between the bank and customer to figure that out. Especially if the customer has no overdraft facility and isn’t supposed to be able to go negative, and isn’t able to easily recover the payment, or the customer is considered vulnerable, then the bank will often just swallow the loss.

Re: Offline card payments should be possible no later than 1 July 2026

#552

Post by boricj »

ExoticPearTree wrote: post #537
mrtksn wrote: post #9

It's not about paying by cash but paying by card offline. How is this going to be implemented I wonder. On planes they often accept credit cards even when there's no internet. I assume this is a trust in-credit-based system because they don't accept debit cards, i.e. if you are worth being trusted with a card you can have your sandwich now and we will take care of the bank processing once we are on the ground. So may…

> It's not about paying by cash but paying by card offline. How is this going to be implemented I wonder. Considering that the card has memory on it, you can store there how much balance you have when you do an online payment. The bank can send back your available balance, so you cannot spend offline more than you have. I can't think about anything simpler than this.

You could store money digitally on a card. Moneo did that until 2015 and it was used in France as a wallet for paying meals in school canteens for tertiary education. That system was phased out just as I left university.

I remember writing an app in Java to read the balance on a card with my laptop which had a built-in smartcard reader, because I was too lazy to go to a station. Everyone in the classroom then promptly asked me to check their balance... and a few asked if I could top it up somehow.

Re: Offline card payments should be possible no later than 1 July 2026

#553

Post by lxgr »

avianlyric wrote: post #539
lxgr wrote: post #506

Earlier quoted context omitted.

EMV has been using asymmetric cryptography for a long time now, even though it's strictly optional in the specs. Older cards indeed didn't have it for cost reasons, and online-only cards theoretically have no strict need for it even today, but practically, a symmetric-only card is a non-starter these days for several reasons. You won't be able to ride the Tube in London or Subway in NYC with a card that does not supp…

> You won't be able to ride the Tube in London or Subway in NYC with a card that does not support it, for example. Those systems all perform online auths at the gate, they don’t rely on offline transactions at all. Asymmetric encryption is used to prove the identity of the card itself, I.e. prove it’s a real card owned by a real issuer. But it’s not used to sign the transaction itself. Transaction cryptograms, the cr…

> Those systems all perform online auths at the gate, they don’t rely on offline transactions at all.

No, there's not enough time for online authorizations at transit turnstiles. They do the online auth as fast as possible, and if it does not go through they put the card on a denylist [1].

But since it would be possible to just make up random valid card numbers on the spot, they do enforce successful offline authentication – using asymmetric cryptography.

> Asymmetric encryption is used to prove the identity of the card itself, I.e. prove it’s a real card owned by a real issuer. But it’s not used to sign the transaction itself.

In CDA, it is used to sign the entire transaction.

> Only the symmetrically encrypted transaction cryptogram is sent over the card network to the issuer. All of the asymmetric parts are only used locally by the terminal for validation, then thrown away.

That's true, but doesn't change the fact that offline authentication is an integral part of EMV. Also, the "then thrown away" part could relatively straightforwardly be changed by the networks if ever necessary. The CDA output provides actual non-repudiation.

> This may seem very strange from a technical perspective, but only because people think that the technical elements of card networks is what prevents fraud.

I'd say it's just a historically grown legacy system, and it would have been too disruptive to retrofit asymmetric cryptograms into it (with its vastly larger cryptograms and every byte of transmission data coming at a premium).

If EMV were redesigned from scratch, it would 100% just use the CDA-style cryptogram for transaction approval as well.

> In reality fraud, at least between network participants, is entirely prevented using legal contracts, escrow accounts, and the simple fact that the benefit of abusing the technical measures to commit fraud is simply not worth the consequences.

On this part I'd agree. The most important factor here is that the type of fraud that could exploit this "symmetric/asymmetric gap" requires a malicious terminal or merchant.

That's not really a common threat scenario in EMV, since fraudulent merchants could already do many other things (such as e.g. tapping commuters' wallets using a concealed POS terminal for low-value payments), and becoming a fully trusted merchant has relatively high entry barriers as a result.

I do suspect that this could change, with EMV becoming more and more accessible for very small merchants using cheap mobile terminals or even regular contactless-capable smartphones. But as I've mentioned, it's not too hard to address these issues using policy.

[1] https://content.tfl.gov.uk/aac-20141217-part-1-item12-contac...

Re: Offline card payments should be possible no later than 1 July 2026

#554

Post by dijit »

Symbiote wrote: post #526
tom_ wrote: post #200

Earlier quoted context omitted.

I've never handled a £50 note. (I am young enough that if you gave me £1 for every year I've never handled one, I wouldn't be able to afford one. But I am old enough that I could dip into my lifetime of savings to make up the difference.) A friend's dad showed me one when I was at school - that's it. He seemed amused I hadn't seen one before, then after making a minor show of it, as if it was some precious, rare item…

I saw them every day when I worked in central London. The shop staff were no more discerning than with smaller notes. But when the bill is £45, there's no problem anyway.

There was an ATM near Spitalfields that used to dispense £50 notes, so I had a small stack of them.

I felt like I was very cool considering how rare they are.

Re: Offline card payments should be possible no later than 1 July 2026

#555

Post by netsharc »

ricardobeat wrote: post #483
tempay wrote: post #448

Earlier quoted context omitted.

Some transit systems work by putting a hold on your card for a nominal amount. When you finish your journey it then only claims the cost of your journey

Thankfully that’s not the system GVB uses, it’s incredibly annoying to have these transactions and reversals when trying to do your own accounting.

Holds don't really show up in the monthly statement. At least not in the cards I've had. It's a functionality for merchants to say "I'd like to charge this customer up to $500, would she be good for it?". If the CC company says yes, then the merchant knows they can do so. E.g. car rental companies do this for potential damages. Up to a week the merchant can charge the actual amount (usually less) or just release the hold.

Re: Offline card payments should be possible no later than 1 July 2026

#556

Post by lxgr »

avianlyric wrote: post #544
lxgr wrote: post #503

Earlier quoted context omitted.

> The reason I can confidently claim the SCA drove the migration of online transactions is because I was responsible for the technical implementation of SCA for a bank Ok, "nothing to do with it" was too strong: I don't doubt that SCA was the death knell for many offline implementations. However, I've seen online-only cards in the field by many banks well before SCA became effective. And on the other hand, I also kno…

> Huh? If you have worked on this stuff, surely DDA and CDA ring a bell? They're both based on asymmetric cryptography, and they absolutely allow the terminal to dynamically verify whether a given card is authentic or cloned, without having to go online. Yes I was a little wrong here. My most recent experience in this area is dealing with messages on the issuer side. It’s been a while since I’ve done anything serious…

Ah, so you're talking about the edge case where the terminal claims to have, but did not actually, perform ODA? Yes, that's somewhat of a gap in the EMV protocol. As I've mentioned in my other comment, I could see CDA eventually becoming mandatory, as well as keeping the entire CDA output terminal-side. That trace does provide non-repudiation.

There are other ways too to stop "sloppy terminal processing", but as far as I understand they're not cryptographically secure in a way that would provide an unambiguous and third-party verifiable protocol trace.

I suspect that all of that is a big reason why the networks don't love offline processing if it can be avoided.

And I couldn't agree more to your last paragraph – the industry does have an unfortunate history of propping up questionable security engineering with legal threats. But I'm slightly more optimistic on EMV, at least some implementations: Decades later, we can actually have some nice things :)

Also, thanks for the anecdote! Helped me confirm a theory I had on the motivation for a particular obscure protocol feature that I have so far not found solidly explained anywhere in the literature.

Re: Offline card payments should be possible no later than 1 July 2026

#557

Post by mercutio2 »

renhanxue wrote: post #299
dumbfounder wrote: post #260

Earlier quoted context omitted.

There are businesses that attract people that use cards fraudulently and the business gets flagged demand eventually dropped. Gas stations in less desirable neighborhoods in the US have this issue and some only take cash.

Credit card fraud is not nearly as common in Europe as it is in the US. Additionally, and specifically in Sweden, the fees that banks charge businesses for handling cash (picking it up and depositing it at the end of each business day) have increased significantly in the last decade or two. This has been a significant factor in driving businesses away from cash - it's just expensive for them to deal with.

Are you sure Europe has less credit card fraud? When is your data from?

The US has a much less secure system specifically because there was much less credit card fraud in the US than in Europe.

Chip and PIN was an attempt to combat the rampant fraud in Europe.

It may be true at this point, I haven’t been tracking recently, but it wasn’t in the past.

Re: Offline card payments should be possible no later than 1 July 2026

#558

Post by mercutio2 »

swiftcoder wrote: post #356
smegger001 wrote: post #242

Earlier quoted context omitted.

I know its not uncommon at small business to ad a surcharge for using cards on purchases below a certain dollar value rather than a discount for cash.

This is explicitly forbidden by almost all card processing networks (and by the government, in many countries). If you report a business who is doing this to the card processor, they'll likely get their card processing privileges suspended.

I thought they changed the rules around this ~6 years ago, and it’s now allowed (at least in the US)?

Re: Offline card payments should be possible no later than 1 July 2026

#559

Post by OJFord »

Tuna-Fish wrote: post #480
OJFord wrote: post #194

Earlier quoted context omitted.

UK perspective: - bank transfer - bank transfer - cash - cash - direct debit - bank transfer or PAYE - direct debit - standing order (recurring bank transfer) - direct debit - card - ? You pay your employer what you were paid for jury service? Bank transfer I guess, but also probably illegal - would likely be deducted on payslip (because tax & accounting implications of below market value gift) or via a third-party t…

> ? You pay your employer what you were paid for jury service? Bank transfer I guess, but also probably illegal That happens when you are salaried and your company pays you your normal salary for the time you are in jury duty. They already paid for your time, they are entitled to the (generally much lower) compensation that the state pays you.

Oh I see. It's kind of just reversed here then - it's not paid, but if your employer doesn't pay you (i.e. gives you unpaid time off for it) then you can claim capped loss of earnings.

Seems like it would be easier in US case just to reduce pay though, time off at 80% or whatever rather than full and then request it paid back...

Re: Offline card payments should be possible no later than 1 July 2026

#560

Post by sverhagen »

netsharc wrote: post #555
ricardobeat wrote: post #483

Earlier quoted context omitted.

Thankfully that’s not the system GVB uses, it’s incredibly annoying to have these transactions and reversals when trying to do your own accounting.

Holds don't really show up in the monthly statement. At least not in the cards I've had. It's a functionality for merchants to say "I'd like to charge this customer up to $500, would she be good for it?". If the CC company says yes, then the merchant knows they can do so. E.g. car rental companies do this for potential damages. Up to a week the merchant can charge the actual amount (usually less) or just release the…

Holds are a credit card feature, GVB is a Dutch transit authority, so they're more likely to be talking about bank cards, ie. debit cards, which I don't think support holds in that same sense.
Post reply on HN