Mobile Payment Transactions: BLE and/or NFC? White paper by Swen van Klaarbergen, consultant for UL Transaction Security s Mobile Competence Center

Transcription

1 Mobile Payment Transactions: BLE and/or NFC? White paper by Swen van Klaarbergen, consultant for UL Transaction Security s Mobile Competence Center

2 Mobile Payment Transactions: BLE and/or NFC? About the author Swen van Klaarbergen is a consultant in the Mobile Competence Center of UL TS. He is a researcher and consultant in the field of system innovations, both focusing on the technical and business aspects of an innovation. He has obtained a master s degree in Integrated Product Design with a focus on Product Service Systems. As a consultant with UL, Swen is involved in projects around mobile payment implementations. In this white paper, Bluetooth Low Energy (BLE) technology is explained and compared in relation to Classic Bluetooth and NFC, as data transfer technologies in a payment transaction context. Because of BLE s lower power consumption, quicker connection set-up and larger number of potential connections in relation to the original Bluetooth technology, Classic Bluetooth, BLE allows for indoor mapping using beacons. It is also possible to enable mobile in-store payment transactions using BLE. In this white paper, the use of BLE in a payment context is explained on the basis of three scenarios. The scenarios allow for a comparison between BLE and NFC as payment transaction technologies. The white paper concludes with a statement that in a payment context BLE can be regarded, not as a substitute but as a potential addition to NFC technology, especially with regards to the wider shopping experience. Introduction Recently the combination of Bluetooth Low Energy (BLE) and beacon technology is popping up all over the news. Companies that announced the use of BLE include PayPal and Apple. PayPal, with their PayPal Beacon product, will use BLE for customers to check in into stores automatically and even to make hands free payment a reality. PayPal links BLE to their recently launched payment application, which already allowed for ordering goods upfront to avoid waiting. Apple recently show-cased the word ibeacon during a keynote address for the launch of the iphone 5S and ios7. ibeacon would be an application supporting BLE and enabling beacons to provide indoor mapping and related services to iphone devices. Estimote, a technology start-up producing 1 beacons, is among the companies looking Photo page 2 1. Among other companies are Roximity Beacon and Kontakt

3 to capitalize on these announcements. With their beacons, customers can be welcomed when they arrive and navigated through the store, while obtaining coupons and other information. An important question is whether BLE can be a substitute for, or is complementary to, NFC in a mobile in-store payment transaction context. Since there are multiple technologies that enable mobile payment, and no technology has seen mass adoption yet, it is still under debate which technology will be the new standard for mobile payment in the end. BLE has the potential to be adopted by customers and merchants because it is positioned, for example by PayPal, as easier in implementation, easier in use, and able to create a new and complete payment experience compared to other payment technologies, among them NFC. Adoption in the end is the most critical parameter for a technology s success. And the availability of NFC and/or BLE on (nearly) every smartphone is a critical precondition for this. From a customer adoption perspective BLE currently may have an advantage over NFC, since Android, Blackberry and Microsoft as operating systems support both BLE and NFC, but ios only supports BLE. This white paper first explains what BLE is in relation to Classic Bluetooth and NFC from a technical perspective. Next, the white paper explains how mobile payment transactions with BLE, compared to NFC, take or can take place. After this the pros and cons of a BLE and NFC mobile payment transaction are presented and compared to each other. Lastly, the question above, in fact whether BLE is a threat (a substitute rather than a complement) to NFC, as a payment transaction technology, is answered. Data transfer technologies: BLE, Bluetooth and NFC Here BLE is explained using Classic Bluetooth (2.1 + EDR) and NFC as a frame of reference; Classic Bluetooth because it is the originating technology of BLE and NFC since BLE mobile payment to an extent has been positioned as a threat to NFC payment. BLE in relation to Bluetooth With the launch of Bluetooth 4.0, Bluetooth Low Energy (BLE) was included in the 4.0 specifications. BLE is marketed as Bluetooth Smart. While Classic Bluetooth focuses on continuous wireless streaming of data at relatively high speeds, BLE focuses on wireless data transfer with ultra-low power consumption. This low power consumption of BLE is achieved by shorter standby times (increased sleep time), 2 quick connections (set-up and release ), and lower peak power (when transmitting data). This decreased power consumption comes at the cost of lower data transfer rates compared to Classic Bluetooth. BLE therefore is not intended for streaming audio and it is not capable of streaming video. Another difference is that Classic Bluetooth can have up to 7 simultaneous connections while BLE can simultaneously 3 connect to 20 devices (theoretically an infinite amount). BLE can connect to more devices because of the small data packages and quick connection set-up. Classic Bluetooth and BLE implement the same pairing modes: pushing content is possible but it can only be downloaded with customers permission. Bluetooth allows for bit encryption whereas BLE utilizes 128bit AES cryptography. Differences in use between BLE and Bluetooth These different characteristics allow for other uses for BLE compared to Classic Bluetooth. Because of its lower power consumption, quicker connection set-up and larger number of potential connections, BLE is ideally suited for indoor mapping using beacons (Figure 1 on next page). This is because BLE allows for higher accuracy with fewer beacons, and multiple simultaneous connections, compared to Classic Bluetooth. When combining BLE with beacon technology and making use of its quicker connection set-up and increased encryption possibilities it is also possible to enable payment transactions; contrary to Bluetooth Classic as the connection set-up with Bluetooth Classic is too slow and there are weaker encryption possibilities. Prior criticism with Classic Bluetooth was that it is not always as interoperable as it should be. However, it is expected that if BLE will be used for payment transactions, certification will be stricter and interoperability will be better. BLE in relation to NFC BLE and NFC are both short range wireless data transfer technologies, even though the range at which BLE operates is much longer: tens of meters compared to a few page 3 2. It is worth mentioning that contrary to Classic Bluetooth, BLE is not based on profiles (e.g. printing profile, audio distribution profile) but on attribute protocols (e.g. send data, give time), which allows for quicker set-up and connection. 3. According to for example BlueGiga, a company specializing in Bluetooth, in practice this is about 20 connections.

4 centimeters for NFC. Both NFC and BLE are optimized for small data packages. BLE is slightly more latent while potential data transfer rates with NFC are higher. Between both technologies there are minor differences in power consumption. Whereas NFC is focused on one-to-one data exchange, BLE allows for multiple simultaneous connections. Both BLE and NFC utilize AES-128 bit data encryption and pairing modes. 4 Beacon X Beacon Z Beacon Cell phone Difference in use between BLE and NFC Y When transferring data, BLE s long range allows for increased convenience (more flexibility), while NFC s shorter range makes spying on the transferred data more difficult, enhancing security when performing proximity transactions. Because of the longer range and low power beacons, BLE is ideally used for position information about a device in relation to its surroundings (mapping for example). The principle underlying use for both technologies is different: with NFC customers are targeted based on their range; with BLE based on their mapped position. A technical comparison between Classic Bluetooth, BLE and NFC is presented in the table below. Bluetooth EDR BLE NFC 5 Radio frequency 2.4 GHz 2.4 GHz MHz Distance/range ~ meters ~10-50 meters ~0,04-0,10 meters Application throughput Maximum simultaneous connections Latency (connection speed) ~2100 kbps ~300 kbps ~424 kbps 7 (20 in practice) 1 ~1 second ~0,03 second ~0,1 second Peak use current ~30 ma ~15 ma ~15 ma Standby current ~1000 μa ~1 μa <1 μa Figure 1: These BLE beacons literally serve as a beacon to other devices (e.g. smartphones) in order to determine their position. Devices use these beacons with a known position to calculate their own position, while the beacons can track the position of devices as well. In the case of BLE, multiple independent determinations are made using triangulation which involves the use of three beacons. Table 1: Comparison between Bluetooth, BLE and NFC. Payment Both BLE and NFC are technologies for data transfer. Both enable proximity (nearby) and peer-to-peer (device to device) payment. This section explains how BLE could and how NFC already work(s) in an in-store mobile payment context. The focus here is on in-store mobile payment: a customer in a physical store who performs a wireless payment transaction with a handset. In addition, the focus is on the transfer of data during the actual payment transaction; data transfer with the handset before and after the transaction is outside of the scope of this white paper (e.g. for 6 mapping, couponing, etc. ). page 4 4. NFC tags are an exception because they do not need their own power source, while for BLE anything compatible needs to be directly powered. 5. A Beacon from Estimote has a maximum radius of 50 meters but an optimized radius of only 10 meters. 6. Nevertheless, note the information in the text box BLE and/or NFC to change shopping?.

5 White paper - Mobile Payment Transactions: BRE and/or NFC? NFC payment scenario NFC is a technology through which customers hold their handset near a POS terminal to make a payment transaction. In case a PIN is required: the customer taps to pay, then enters a PIN on the handset and then taps again to confirm payment. To prevent this scenario with two taps, it is also possible to pre-enter the PIN and tap only once. Under certain conditions (e.g. maximum limits) the customer may perform a low-value payment transaction that does not require PIN entry at all. Also, with a NFC enabled device it is possible to make a (low value) payment transaction even if the device runs out of battery. One of the main differences between a NFC and a BLE transaction is the distance over which a payment transaction can occur. With NFC the customer really has to hold the handset at a few centimeters from the POS terminal to make a connection. An important difference from an infrastructure perspective is that a NFC capable antenna is already an integrated and certified part of a (growing) number of POS terminals and even some ATMs; no separate receiver (beacon) is required as is the case with BLE. BLE payment scenarios Using BLE and beacons it is possible to determine the customer s location in a store. From a transaction perspective it is useful to know when someone is entering a store (for automated check-in) or when someone is near a POS terminal (for the actual transaction). Based on information currently available about BLE, three different payment scenarios can be presented, of which the second scenario is based on an actual (proposed) implementation by PayPal: I. Replacing NFC with BLE pay at cashier with agreement on handset II. PayPal Beacon Hands Free pay at cashier with verbal confirmation III. Take and Shake scan and pay on your own, no cashier needed The first scenario is based on replacing NFC with BLE as the data transfer layer for an otherwise similar payment transaction. The second scenario is based on information currently known about PayPal s Beacon, with a beacon that connects to the cloud and a pre-transaction authorization from the customer. The final scenario is the most revolutionary: shopping without a cashier or POS terminal that needs to be accessed. The scenarios are presented below. Scenario I: Replacing NFC with BLE (BLE as a new data transport layer) The secure data (virtual card) are stored on a handset SE. The handset connects over BLE to the POS terminal, which is directly connected to a payment network (figure 2). This is a card present transaction. Figure 2 "Replacing NFC with BLE" Scenario I exactly copies a contactless EMV card present transaction, but the customer 7 pays over a BLE connection rather than a NFC connection. The merchant still selects/scans all the products as part of the transaction. Because BLE works over longer ranges the cashier then selects the right customer from a list of most likely customers based on their position (i.e. place in queue). The customer gives a transaction authorization on his/her handset. This could include any form of authorization, for example with Apple s TouchID (scanning fingerprints) when this is secure enough. Scenario II: PayPal Beacon Hands Free The secure data (virtual card) are processed and stored in the cloud. The handset connects over BLE to a POS 8 beacon, which connects to the cloud (figure 3). This is a card not present transaction. Figure 3 "Hands free" With scenario II, PayPal s Beacon, it is possible to check in and pay automatically with participating stores, based on a customer s agreement. At the moment a customer enters the store its mobile device announces itself to a BLE beacon, which on its turn sends a picture and name to the cash register. This allows for the cashier to greet the customer by name. Customers can then shop in the store (or they can order something at the counter) page 5 7. With BLE it is possible to have a card present transaction just as is the case with NFC. It should also be noted that the customer will need to opt in to use BLE; this is the case for all scenarios. 8. The difference between a POS terminal and a POS beacon lies in the fact that a POS terminal is expected to be visible for interaction with the customer and a POS beacon not. It is important to note that it is possible to integrate BLE functionality into a POS terminal (possibly via a beacon or directly through a POS beacon, see also scenario III), but that for now it seems at least for the PayPal implementation that a beacon will link the handset to the cloud (for authorization) using a customer account.

6 White paper - Mobile Payment Transactions: BRE and/or NFC? and when they are done shopping (or ordering) they move to the cash register. Here the cashier recognizes the customer from the picture that was previously sent 9 to the cash register. The merchant still selects/scans all the products as part of the transaction. Payment happens after the cashier has confirmed the customer as belonging to the mobile device, and after a verbal confirmation by the customer. The actual transaction takes place in the cloud with a token drawn over a BLE connection from the customer s device. Basically it is a card not present transaction with facial recognition by the cashier and verbal confirmation by the customer. Scenario III: Take and Shake The secure data (virtual card) are stored on a handset SE. The handset connects over BLE to a POS beacon, which is directly connected to a payment network (figure 4). This is a card present transaction. Please note that there are variations possible were the POS beacon connects to the cloud, which would make it a card not present transaction. Figure 4 "Take and Shake" With scenario III the customer scans its own products in a store (using a QR/ barcode, RFID or any other option). Hence, the scenario allows for actual payment freedom since no merchant is needed for selecting/scanning products. Payment for these products can be authorized on the handset over a BLE connection with a POS beacon, anywhere in the store. The POS beacon connects to a payment network, and the payment transaction proceeds as a card present transaction. Authorization may vary (ranging from pressing OK to entering a PIN). In addition, customers could for example be checked randomly (by a person and/or digitally) upon leaving the store. BLE compared to NFC payment transactions The pros and cons of BLE compared to NFC, in a payment transaction context, are listed below. It should be noted that any BLE or NFC capable device has other possibilities, like for example Wi-Fi, which could be used for mapping and connecting to the cloud. However since both BLE and NFC can make use of these additional technologies, they are taken out of the comparison here. Furthermore it is important to note that BLE is just another data transfer layer, allowing the same levels of security at application level as NFC and also allowing to be implemented in direct connection to the POS and payment network, if desired. BLE vs. NFC: pros When it comes down to a payment transaction BLE in fact has one main advantage over NFC: payment freedom. Payment freedom BLE makes it possible to connect to a POS terminal or the cloud anywhere in a store, even when it is a crowded indoor location. This gives customers the freedom to pay anywhere they want and thus to avoid waiting lines (scenario III); currently this would most likely be a card not present transaction. Furthermore if it includes an automated BLE connection in combination with a pre-authorized payment transaction, this would allow for hands free payment transactions (scenario II). A NFC payment transaction on the other hand always needs a nearby POS terminal and does not allow for hands free payment transactions (a tap at least will always be required). Besides payment transactions both BLE and NFC could change other aspects of the shopping experience. A quick overview can be found in the boxed text BLE and/or NFC to change shopping?. BLE vs. NFC: cons NFC has four main advantages over BLE when considering payment transactions: it is more secure mainly because of the shorter distance (which makes spying more difficult), it more easily enables card present transactions against lower transaction fees compared to card not present transactions, it is compatible in a broader contactless environment, and finally because it (presumably) requires less investment in POS technology. Security With NFC, the short distance over which a transaction occurs provides additional visual security (the customer sees the POS terminal which it communicates with), which is lacking with BLE payment transactions over longer distances (all scenarios). With BLE it will also be easier to spy on and interfere with secure data that are being sent. page 6 9. Hence, there is a double check: the presence of the customer s handset and the linking of the customer to this device.

7 Another threat lays in Denial-of-Service (DoS) attacks on POS terminals and handsets using BLE. An additional security problem with a hands free payment transaction (scenario II) in particular is that a proof of payment (a handshake ) is missing. A merchant cannot prove all customers gave verbal permissions for transactions, except when the merchant records all transactions, which has huge bottlenecks. Card present or card not present For a card present transaction to happen BLE needs a similar set-up for hardware and software (related to the POS terminal and the handset) as NFC. The main difficulty lies in the fact that the used hardware and software should be compliant with and be certified by the existing payment networks. Given the possible security issues as mentioned above, it may be difficult to obtain these certifications. And even if a BLE POS terminal/beacon and handset get certified in the end, this process still requires a large amount of time, as it did for NFC. It will require less time to enable a card not present transaction using BLE, because then there is no need to directly connect to the existing payment networks. The main problem then is cost, because card not present transactions are more expensive since they are less secure. Hence, BLE is at a disadvantage compared to NFC, because for NFC safer and cheaper card present transactions are already a reality. 11 Interoperability with contactless NFC is compatible with most existing contactless payment and transit systems 10 since they all operate at the same radio frequency whilst BLE operates with a different radio frequency band. Since innovative technologies such as NFC and BLE are expected to keep on being backwards compatible with existing payment (contactless) cards, NFC has an advantage here. Also, a NFC infrastructure is already in place, both in payment and transit industries. It is the reason why the industry is investing in NFC as a compatible technology. NFC is ahead of BLE because of mature standards and certification requirements with certified hardware and software available on the market as well. Problems with accurate mapping With NFC a customer and merchant are linked to each other with a single tap. For BLE another selection step is needed, to select the right device (and customer). In other words, with NFC the customer identifies itself and its location to a merchant and a transaction with a tap to a POS. With BLE the customer is identified because of its position, either by BLE triangulation or BLE distance; this position is then linked to a merchant. An additional selection step is however needed to match the customer with the right transaction. Because of this selection, location determination is needed in scenario I and II, because if a customer s position is not known, and they just check in and out, it is impossible for a cashier to select their account quickly if there are tens or hundreds of people in a store. A solution would be to let a customer identify itself by entering a code, but this rules out a hands free payment transaction. If this customer selection would happen manually, e.g. as a default option by the cashier, it could be prone to human error by accident or on purpose. Automated recognition, in addition to location determination, using facial recognition technologies, could rule out human error, but it does not rule out all errors. Both demand good quality pictures and both require additional investments in hardware and software. It should be noted that implementing any type of recognition that involves biometric information or storage of a customer s movements has difficulties related to privacy concerns of customers. With scenario III location determination or cashier selection is not needed because the customer selects itself. With NFC, location determination is not relevant in any case because of the short range over which the payment transaction occurs. Conclusion 12 There might be a niche market for BLE payment transactions because of the payment freedom it could provide (e.g. grab & go, pay without waiting). However in crowded stores, stores where a customer has never been before, large stores, or for instance in public transport, NFC has the advantage over BLE because of reasons including security, cost and interoperability of the payment transaction. This conclusion can be elaborated on in four points: 1. Even though BLE can be seen as just page This paper still uses card present and card not present terminology. But with recent developments it might be the right time for a change in the current terminology, rather talking about SE present (secure data on hardware SE, or on the handset OS) or SE not present (secure data in the cloud) transactions. 11. It should be noted that besides a card present or a card not present transaction it is also possible to have a mobile checking transaction. In certain cases the cost of such a mobile checking transaction is fixed (e.g. mobile ideal in the Netherlands), whereas a card (not) present transaction could be a percentage of a transaction amount; in other words, there could be a tipping point in costs in favor of a mobile checking transaction, which may be relevant to consider for both NFC and BLE as data transfer technologies.

8 BLE and/or NFC to change shopping? another data transfer layer and it has similar security possibilities as NFC, the longer distance over which a BLE payment transaction can occur makes payment transactions more vulnerable and therefore less secure. This leads to risks such as spying, hacking, DoS issues, lacking visual feedback, etc. 2. For BLE, card present transactions seem like a bridge too far especially in the near future, because of the required certification. Card not present transactions are possible, but these are less secure and therefore more costly The compatibility of NFC in a broader contactless context, including contactless payment cards, transit or access control solutions, etc., makes NFC more widely applicable. This already resulted in established standards and infrastructure, also across industries (payment and transit), for example also with a view to the number of contactless POS terminals already rolled out. 4. Required investments for BLE payment transactions, compared to NFC, are higher at this moment in time. These investments include beacons, POS terminal upgrades, costumer selection tools e.g. enabling automated facial recognition, etc. In short, in UL s view, compared to BLE, NFC remains the preferred technology for the in-store mobile payment transaction itself, although BLE has the potential to improve the overall shopping experience around this secure payment transaction, especially because of enhanced location-based services to target customers. It can be stated that there is more to shopping than just the payment transaction itself, where BLE and NFC can be used for other parts of the shopping experience as well. Location-based services BLE can locate a customer s position in, and near, a store over time, which allows for location-based marketing and information. Some examples are: convincing customers to enter the store when they pass by, providing customers with indoor directions and targeting a specific customer with a coupon (e.g. after spending some time at the coat section they receive a coupon for 10% off coats within the next 15 minutes). An important difference why coupon pushing could succeed with BLE, although it failed with Classic Bluetooth, is that for BLE a customer can opt in per store to avoid spamming, which turned out to be an issue with Classic Bluetooth. With NFC it is possible to have tags around a store, to provide additional information or to pick up coupons, which also allows for targeted marketing, but with more effort required from the customer. Yet, this additional effort could be reduced by using additional technologies to reach and locate customers without the need for them to scan tags throughout the store (using SMS, Wi-Fi, etc.). Detailed payment statistics With BLE, if payment details are not only sent to the POS terminal, but in addition also to the cloud, it is possible to link specific purchases to a customer account, like for example with a loyalty card. This allows for gathering detailed payment statistics and subsequently targeted marketing and couponing based on previous purchases. With NFC this would require an additional tap, a supporting technology and/or a loyalty application that has access to these data. page Additional beacons can be a solution to alleviate this problem, because when it is crowded a signal is more likely to get blocked (lower Received Signal Strength Identification (RSSI)), while it is also more likely that another person will be present at a wrongly calculated position. 13. See also the comment made in footnote 11.

9 Contact details UL Transaction Security page 9