Original URL: https://www.theregister.co.uk/2011/06/01/quick_tap/
El Reg pays by phone – mmmm, free cookies!
Slow tap dance for UK's first contactless payments
The UK's first pay-by-phone retail service launched last week, but based on our experience we won't be dumping our coins and notes any day soon.
Orange kindly sent us a Samsung Tocco Quick Tap – a spin-off of the feature-phone Tocco with added NFC to handle the payments. But before we could use Quick Tap to pay for something we needed a Barclaycard, and we also needed to create half a dozen passwords, PIN numbers and security prompts to ensure no one else could top up our balance for us.
To be fair, the first part of the process was registering our Barclaycard on line, which some customers might have already done, but even then there are various hoops through which one has to jump to get the service working. Once it is working then the payment itself was flawless, and we successfully bought chocolate cookies by waving a mobile phone – rather to the surprise of the shop staff.
To register a Barclaycard online one identifies oneself with an account number and credit limit, then one has to come up with a username (eight to 16 digits, at least one number) and a password (six numbers, no repetition, no date of birth and no sequences). The card then has to be registered with the Quick Tap payment service, which requires a security word (six to eight characters, no keyboard patterns and no repetition), and another security word (five to 16 characters, as before) followed by a four-number PIN.
Once you've managed that – and made copious notes to be eaten once memorised – you'll get a screen asking you for the number of the phone and the SIM identity, which the Quick Tap application on the phone will helpfully display.
Within the next couple of hours the phone is sent an activation code; ours arrived after about 20 minutes. That has to be entered into the website, and finally one can start charging up the account.
The Quick Tap application, which runs on the phone, is a J2ME app and that shows in the slow boot time. Enter the application and then click to add a Barclaycard Payment Service and it will trigger another J2ME app, with associated lag as the virtual machine instantiates again. Both applications also suffer from the Tocco's unresponsive touch screen, but one can get used to it.
The Barclaycard app asks for a PIN on launch. If the user tries to add some credit then the same PIN has to be entered again, which seems redundant – there is clearly a focus on security, or the appearance of security at least. That might allay the fears of the new user, but the process is painful and clunky in stark contrast to the process of spending the uploaded credit.
Due to a misunderstanding over shipping, we were left in Inverness to try the system, but Barclaycard advised us that at least two locations in the city would accept payments with a wave of the phone. One was a chemist, but as we weren't yet feeling ill we dropped into Inverness Subway to buy a cookie or two.
The staff at Subway were slightly bewildered by our request, but agreed that their terminal was emblazoned with the word "contactless". With the staff repeatedly pressing buttons and us waving the phone in the vicinity of the terminal we were able to complete the transaction within a minute or two.
Not waving but buying
The transaction itself was instant, the screen shown popping up next time we went into the Quick Tap application. Sadly the transaction didn't appear anywhere else – "recent transactions" still shows nothing and our remaining balance shows no money has been spent, despite the fact that we've eaten the cookies.
Next time will be much quicker, for us and the staff.
Paying for things works really smoothly, but the supporting services – both registration and management – clearly need a lot of work. The Tocco isn't responsive enough to show off the applications, which themselves suffer from the J2ME platform on which they run. NFC payments are more likely to appeal to the kind of early adopters wielding Android and iOS handsets, but with only two Android handsets supporting NFC (the Nexus S and Galaxy S II) it is not mainstream enough for Orange to support – yet.
Concerns about security will also dog deployment, and despite the enormously complicated registration process, the credit card is still only protected by a four-digit PIN.
A thief can use your charged-up credit without being challenged – each transaction can be up to £15 and there isn't a limit on the number of transactions. Once that balance is exhausted the thief will get three guesses at the PIN, and will be able to transfer money from the credit card if the PIN is guessed.
Barclaycard will provide a tenner of additional credit for those prepared to adopt early, but it is notable that the Quick Tap application has plenty of space for other payment systems to be added (with one being identified as the "default" payment system so one can tap and pay without selecting a card).
It will be a few months before anyone else commits to using the system, and we're not convinced the infrastructure is quite ready yet despite the point-of-sale process working so well. Proximity payments from phones will happen, and Quick Tap is the first in the UK, but like most first movers it's more than a little rough around the edges. ®