> During a swipe, the MetroCard is read, re-written to, then check-read to verify correct encoding... Each MetroCard stored value card is assigned a unique, permanent ten-digit serial number when it is manufactured. The value is stored magnetically on the card itself, while the card's transaction history is held centrally in the Automated Fare Collection (AFC) Database... Whenever the card is swiped at a turnstile, the value of the card is read, the new value is written, the customer is let through, and then the central database is updated with the new transaction as soon as possible. Cards are not validated in real time against the database when swiped to pay the fare.
There's also an old NYT article [2]:
> But since the main computer communicates regularly with both the turnstiles and the booth computers, false cards have so far all been invalidated after they have been used once... Some hackers believe that because the turnstiles, the token booth computers and the mainframe computer, respectively, upload and download information at six-minute intervals, the length of time that a passenger can transfer without paying may actually be 18 minutes more than the advertised two hours, if the timing is right... ''I believe that, fundamentally, a system as complicated as the Metrocard cannot be absolutely secure,'' he said. ''What we have to make sure is that the hack won't scale. If a few people ride for free, that's no big deal.''
[1] https://en.wikipedia.org/wiki/MetroCard#Technology
[2] https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hac...
There are only turnstiles that can be jumped at the entrances that are manned by an attendant 24/7.
Haven't seen it in a few weeks though. It's expensive to be posting two cops near every turnstile entrance.
On that note: the city actually spends more on the NYPD for fare evasion than they could possibly recover from it[1]. I'd rather the city just give every teenager a free card instead, and spend the savings on a tipline for complaints about NYPD officers on their phones[2].
[1]: https://nyc.streetsblog.org/2019/11/14/mta-will-spend-249m-o...
[2]: https://www.thecity.nyc/2022/7/11/23204575/new-york-answered...
They were chasing and catching literally everyone. Well, the cops at the turnstile would radio the cops on the platform if they ran.
The people caught were really pissed about it too. Lotta loud arguing every time I went into the subway since they were catching people constantly. Granted I live in a neighborhood where people jump the turnstiles a lot.
Yeah, no shit. Fraud is YOUR problem. Not mine.
Similar scenario: chicken in the grocery store that advertises itself as "antibiotic and hormone free". No chicken in the grocery store has added antibiotics or hormones; it's illegal.
A-F have to all apply.
Visa, Mastercard, Amex, and Discover all additionally enforce $0 credit card liability on the banks that use their networks.
You'll only see the $50 thing on debit cards, and every bank I've used has waived that to give credit card-style protection.
On debit cards, the statutory limit is actually significantly higher ($500) if you don't report the fraud within two business days, and unlimited after 60 days, but as you say, I don't know of any bank that actually makes use of that provision.
EMV (chip) bank cards can default to local authorization mode if the transaction value fits your profile if the pinpad can't communicate upstream.
Nothing worse than folks not able to buy/use your system because it is "offline".
I doubt they do this, but if the data's encrypted with a good cipher used correctly, all you'll be able to detect is that it's changed.