RTL Nieuws made a number of ‘free’ trips with virtual disposable cards in recent weeks. They are easy to make via a free app. You can use this to travel via OVpay. This is the successor to the public transport chip card, with which you can also check in with a bank card or smartphone. RTL Nieuws has decided not to mention the name of the app used.
Valid ticket
No balance is required to travel with OVpay: travel costs are only debited at night. Travelers can bypass payment by removing the virtual card after checkout. A normal bank card is blocked if a debit is unsuccessful. But the virtual card no longer exists. Travelers can simply create a new disposable card for their next trip.
During a check, conductors only see that you have checked in and where this happened. It therefore appears as if the traveler has a valid ticket like any other. In this video you can see what happens when a conductor checks a disposable ticket:
It takes less than 5 minutes to download the app and register. Making a disposable card takes less than a minute at a time.
“By using the latest technology, checking in and out in public transport remains safe and reliable,” writes Translink (the company behind OVpay) as a reason to replace the public transport chip card with OVpay. “We will only introduce it nationally when we are sure it works. It has to be good and it has to be reliable.”
“This is very painful,” responds IT expert Brenno de Winter, who demonstrated at the introduction of the public transport chip card that the pass could be cracked. “If you develop a new system, you have to know how it can be abused. If people do this en masse, you have a problem. Try to track them all down.”
What is OVpay?
The public transport chip card will disappear. The transport companies have set aside 100 million euros for successor OVpay, which also includes checking in with a bank card. For example, more than 60,000 card readers and gates had to be replaced or modified. Until now it is only possible to travel at full fare.
OVpay is available almost nationwide. Only in the tram and bus of the RET in Rotterdam and on the trains of Blauwnet in Overijssel is it not yet possible to check in with a (digital) bank card. That is expected to be the end of May, says Translink.
Virtual payment cards come in handy, for example, to make a one-off purchase at a web shop. That it is also possible to simply travel ‘free’ with this was tipped off to RTL Nieuws by Brian Sommer.
“The strip card was replaced by the public transport chip card. And now that it finally works, they are going to do something else,” he sighs. “So much money is put into it. That can’t be true, can it?”
He tried to raise the problem with Translink, but only received a response to his e-mail after RTL News pointed out the message and asked questions.
OVpay will not be adjusted
Translink says in a response to RTL Nieuws that it knows the method of digital disposable cards, but is not taking any measures to make abuse more difficult or impossible.
“Fortunately, most travelers are in good faith, but we are not naive and, as with all other payment systems and industries, there are unfortunately attempts at fraud.”
The company, together with the Payments Association, which represents the banks, warns that banks can tackle fraudsters. “Ultimately, the damage will still be recovered from those cardholders,” the organizations write. “They can be banned for a long time by card issuers (by banks) from the bulk of their services.”
De Winter expects that Translink will certainly try to track down a number of fraudsters. “That becomes difficult when there are thousands of them, but you only have to take 25 to have an impact. That scares you. Because if you get caught, you have a big problem. It is more difficult to open a bank account or an insurance policy or take out a mortgage.
OVpay is currently used for about 4 percent of all journeys by public transport. Should large-scale abuse take place via the payment cards of one bank, all payment cards of that bank can be blocked for OVpay, Translink continues. It is then no longer possible for any customer of that bank to travel with their bank card.
Although the bill for abuse will lie with the transport companies, the OV-NL sector association does not want to respond.
Accountability
During all trips that RTL Nieuws made for this research with virtual disposable cards, people also checked in in a different way. All journeys are therefore made with another valid ticket in addition to the disposable ticket.
We have decided not to mention the app used, so as not to give a manual to people who want to exploit the vulnerability in OVpay. Yet we publish about this, because it only takes a few minutes to circumvent an investment of 100 million euros. The public transport companies are ultimately the victims: they miss out on money, without conductors being able to check this.
