Plastc Card
plastc.com
plastc.com
[1] http://clover-developers.blogspot.com/2014/09/apple-pay.html
But yeah, they obviously found a way to implement ApplePay - hell, Apple probably did it for them.
Banks generally hate anything that takes away their branding. Less sleek of this -- i.e. reprogrammable Visa cards -- have been around for a few years but banks never supported them, again because of branding.
I also am not certain that Apple Pay "massively encourages" a single default card. It looked quite easy in the demo to display multiple cards and switch between them. Looked easier than taking a card out of a crowded wallet and putting it back in, actually.
• "Chip and PIN is Broken" (Murdoch/Drimer/Anderson/Bond, 2010) [PDF] http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.p...
• "Chip and PIN is Broken" (Murdoch, 27C3, 2010) [Video]: http://www.youtube.com/watch?v=Ks_w352BS-Q
• "Chip & PIN is definitely broken" (Barisani/Bianco/Laurie/Franken, 2011) [Video]: http://www.youtube.com/watch?v=JABJlvrZWbY ...and slides [PDF]: http://dev.inversepath.com/download/emv/emv_2011.pdf
In the demo they buy coffee, etc. with it. You couldn't buy something more expensive with it because the bank would deny the charge.
NFC is similar. You can use it for small transactions, but not larger ones.
And cloning is still almost impossible. The largest risk appears to be copying card details which allows the fraudster to use cards online or in countries that don't yet have Chip and PIN. Personally I would like to see separate account numbers and details on the Chip compared to the main card number - i.e. you could copy some of the chip details but this wouldn't actually let you get anywhere because the number would immediately be flagged if it was found anywhere else. You'd then have another card number (maybe the one actually printed on the card) that you could use online.
Or perhaps we could just scrap the whole card thing for non-physical use...
(And I'm saying this as a guy who makes some of his money at this game)
They are famous last words, but in this case they seem justified.
Knowing the transaction amount is not possible from the "sender" portion of a magstripe. You're simply handing over a credit card number. The credit card amount is negotiated over the phone/internet between the bank & merchant.
This means that the Plastc card likely has one hardcoded number that switches payments serverside. Similar to the Wallaby card or Google Wallet card.
This works perfectly fine with chip & pin. The merchant charges the Plastc card which in turn forward the transaction to the correct bank.
They clone the magnetic stripe part of a chip and pin card and then have their own chip and pin layer that they put on top.
In the UK the only reason you can't use magnetic stripe is because no shops allow it (if they do then they are completely reliable for the authenticity of that transaction) - if you could add a chip and pin layer on top of mag strip data then this might work (would still require a lot of fiddling and as far as I can see transactions would have to go via platc like google wallet).
They probably don't have to worry about fraud, since the barrier to entry is $155 and they charge your card immediately.
The only thing that might be tricky is whether they get the 'card present' rates or not.
"*Plastc card will be available to use across all participating locations and with all participating payments types following an over-the-air firmware update in 2015 to enable Chip and PIN and contactless payments."
Sounds like they are working on those partnerships.
If this is using the EMVCo tokenization stuff, which it is widely believed that Apple is using, I don't think they would have to partner with banks. They'd just have to register with a Token Service Provider.
Here's an interesting article on this: http://www.aviso.io/apple-pay-brings-new-problems-acquirers/
The chip contains an application for Plastc, this is (like Amex) always acquired by Plastc (and will probably then only be allowed at participating retailers). Part of the Issuer Private Data sent in the transaction is which one of your pre-registered accounts you wish to use. That account is then charged in the background. It would work a bit like a physical Paypal.
Because unless something major has changed, I can't see banks being keen to hand over private keys to third parties.
They may get the NFC component to work with all the providers which allow them to, just like you can currently use your phone to make NFC payments. :)
EMV and EMVco are the same thing. It's the standard also implemented by RFID cards such as Mastercard PayPass and apps like Google Wallet.
The interesting bit is how they're fitting the battery and getting anything remotely like reasonable life. Even down in the single digit micro-Amp consumption range (typical for low power microcontrollers plus some resistive touch), a battery small enough to fit inside a credit card will likely only have a few mAh, at best. This will lead to needing to recharge quite often if the bluetooth turns on or eInk screen updates more than once in a blue-moon.
Touch screen digitizing can be done resistively with overlaid wires over the screen. Their touch interface doesn't have to be super accurate, you only seem to touch in a few distinct locations.
A microcontroller is already inside every chip and pin card on the planet. They usually run Java. Yes, Java :)
Bluetooth is just more silicon to do the radio, not hard to stick it on the side of the microcontroller silicon or even have a two-die configuration with wire bonding between the dies. Go look at TI or Freescale 2.4 GHz radio+micro parts, same thing just there it's in a QFN or other solder-down package, but the dies themselves are quite small. A 2.4 GHz antenna is easy to fab out of printed silver or other printable conductive material onto plastic.
NFC is already in many credit cards for the whole "tap to pay" thing. It's just some extra silicon on the side of the microcontroller in existing solutions. Harvesting power from NFC is just some diodes and a resonant circuit along with loop antenna.
Realistically, such a piece of silicon plus the antennas plus the plastic card should only cost you single digit dollars in volume to manufacture. Adding an eInk screen like that is another couple bucks, at most. The $155 price point is probably so they can make back their up-front costs as getting customized silicon isn't cheap, nor is some of the development work they did to get all the features integrated.
If this concept takes off, I'd expect in 2-3 years that cards like this are issued by banks for free to customers. The cost of manufacturing really isn't that high.
EDIT: But getting enough battery packed in to avoid charging every day or two, that's really the novel part if they have real bluetooth operation.
Then - an antenna for bluetooth, NFC and for wireless charging? Combine those and you'll have issues. NFC requires a very small amount of 'wireless power'. Charging a battery requires a more serious amount. Having fried more than one NFC card here at work, I know how tricky it is to work with wireless tech. Good luck managing that.
There is no way this technology exists in the form-factor they're presenting or require. The dynamic magnetic stripe sure is possible, but not that small. You also seriously underestimate the cost of all this. For this to work, they need their own silicon - no way around that fact - which is very expensive, certainly because this is clearly not a product that many people will actually order. But from your pov, "just some more silicon" seems to be a walk in the park. I'm not aware of any e-ink displays avaiable with touch like they presented there. That would by the way need another separate controller. Oh look - more silicon!
This entire picture is not just a "couple bucks". It contains technology you find in current phones at an even smaller scale, with a much smaller target audience. Really - who is going to pay 155 bucks simply to have a plastic card?
To me it all looks like someone dreamed up an utopian payment solution for the US market and built a scam from it. It uses seriously outdated magnetic stripes which is irrelevant to most part of the world, and by the time it would actually be possible to make a stripped down version of this, hopefully NFC/EMV will have replaced this insecure mess and everybody will be paying with their phone.
Anyway - keep an eye on Cartes on 4-6 November - which is THE fair for payment related technologies. If it's not there, it doesn't exist.
Even if it did somehow exist today, isn't it overkill to load this much tech onto a single card, when you can just generate one-time card numbers on the fly?
Also, you could make the card thicker in areas where it doesn't matter (away from the stripe and the PIN
its like too little too late
I downloaded it and went frame-by-frame and you can see the card display contents move around with changing margins. It's all CGI.
Not that it's inherently wrong to do simulations, but this is notable because they don't include a "this is a simulation" disclaimer (AFAICS).
According to TNW "Plastc didn’t have a prototype for me to see during a meeting" and what they showed was a UI inside of a fake card.
http://thenextweb.com/apps/2014/10/07/plastc-one-payment-car...
Go look at the actual thinness of a credit card.
The battery would have to be 90% of the surface area even with e-ink.
This solution doesn't reduce the height or width of the encumbrance at all, and reduces the depth only by n*.76mm, where n is the number of cards that will be replaced. I don't get it.
This would let me get away with a much slimmer wallet and is therefore quite convenient. If it works.
And I don't really see why I should need or want more cards
For gift cards, I suppose it would be nice to have those all aggregated, but I do very little brick and mortar shopping, and virtually no impromptu brick and mortar shopping where having a library of loyalty cards with me at all times would be useful.
The same applies to loyalty cards. I do have a Macy's card, but they can just look that up for you at the store, so I don't carry it. I've probably lost the physical card.
You could also easily have 5 store credit cards (J. Crew, Banana Republic, etc.) for extra discounts, a few gift cards you haven't spent yet (Starbucks, Best Buy, etc.), an extra 3 credit cards (they have different promotions), a handful of loyalty cards for discounts (a couple supermarkets, three or four coffee shops, a couple of restaurants), various forms of ID and access cards (company, school, gym, apartment complex front door)...
You can see how it adds up. The reasons for almost all of them are discounts or extra value. Keeping track of all these cards and carrying them around could easily save you several hundred dollars a year if you're willing to do it.
Then there's your driver's license. Health insurance. Car insurance.
On top of that credit cards. You're a fool if you don't have a few different ones, because they have rotating reward categories that give you bonuses. I bet a get a few grand a year that most people don't. But even still, I only have 3. And 1 ATM card on the off chance I ever need cash.
Plus gift cards. On the one hand, you don't want to carry those on you all the time. On the other, you'd often use them impulsively so you can't just leave them at home.
It adds up quite easily. It isn't that I want to carry all those cards. It's that I get substantial rewards for doing so.
I've been minimizing my wallet, but still plenty of cardboard buy-5-get-1-free coffee cards somehow make their way into it. It really depends on the individual. In any case, I think that the idea of this one-card-to-rule-them all is wonderful. I realize it is wishful thinking, but I want to see them pull this off.
If you want to take advantage of these discounts, you build a significant stack of plastic.
For users, this must be some retro fad jumping the gun. Given the value of the transaction data going through this thing, it should be free at worst.
Good luck with that.
That being said, it's certainly attractive. If the 'bubble bursts' (whatever that means), I expect this is the kind of start up that will be first against the wall. Just remember frivolous != worthless.
With remote wipe, when I lose my card I just remote-wipe it and order a new one. Also, this card will warn me when I'm too far from it so I won't be as likely to leave it behind.
I do something similar already, where I never carry around the debit card associated with my primary checking account.
You have awful fraud protection and zero to near-zero rewards.
Banks will give you net-30 terms for no cost, reward you with many benefits, and give you fantastic protection from thieves AND retailers.
If you're a lady wearing jeans, this could make the difference in whether you need to bring a purse.
For me, it makes the difference re: whether I need to carry a wallet at all, or whether I replace it with a phone case that has a pocket for this and my drivers license.
...as opposed to your male, neuter, or enby wife, I suppose?
Credit cards are different. They are small, thin, and never run out of batteries.
It's going to be supported unless the merchant is happy eating fraudulent charges, which will make them a hotspot for people committing fraud. There's various dates for when that liability kicks in[1]. General trend is 2015 for PoS and 2017 for gas station pumps.
Not for any particular technical reason (although I'd be very interested to hear how they plan to make this work with Chip & PIN) but from a risk/liability perspective.
At the moment most banks that I'm aware of provide an online fraud guarantee and a credit card fraud guarantee, so as long as you keep your credentials secure, they'll pay back if you get defrauded (I know it's not quite as simple as that but for the purposes of this comment I think that'll do)
so the problem with this kind of product is that you're adding another company (plastc) to the trusted list, you're going to have to provide them with all the card details. So unless the banks agree to this not affecting your fraud guarantee, you'd be taking a real risk by using this solution.
For the banks to agree that there would need to be something in the deal for them, to compensate for the loss of branding on their cards and the additional fraud risk.
Loss of branding is a fair point, but I think this would reduce fraud risk. Automatically deactivating itself when lost or stolen more than makes up for the risk of trusting Plastc.
Plastc is $155 and you still have to:
1. pull something out of your wallet
2. select a virtual card
3. enter a PIN to unlock it
4. share your real card number with the merchant with all the fraud potential that carries
5. sign the receipt or enter your card's PIN (another PIN!)
Apple Watch is going to leapfrog all that so hard.
- it lives on your wrist
- it stays unlocked as long as it's on your body
- you just tap, no signing or card PINs
- it uses tokenization so you never have to worry about stolen card numbers
- it does craptons more stuff than payments too
One advantage Plastc has is it will work everywhere right away while Apple Pay needs NFC terminals. But those upgrades are happening thanks to chip-and-PIN.
2) I would like to know what target demographic, if any, that that ad was not intended to irritate.
But realistically, I think mobile payment systems are much more likely to succeed. Plus, I already have my phone with me anyway, and it doesn't seem too far fetched that it could provide all the info on my driver's license. So with that and widespread adoption of ApplePay (or whatever ends up succeeding in that space) I'm down to just leaving the house with my phone and whatever cash I want to carry.
What could possibly go wrong?
It's not either/or. Something like this or Coin are essentially interfaces for what will be legacy devices. If it were either/or, then mobile payments would certainly be the better solution.
- Remote RF-based attacks on the card.
- Attacks on the phone app.
- Leaks at the point credentials are transferred into the card. It turns out that most chip and pin cards do not use a public key/private key pair, with the private key inside the card. Visa actually recommends against this. (http://usa.visa.com/download/merchants/bulletin-chip-recomme...) So getting the credentials off a chip and pin card is possible.
- Leaks from the servers at "Plastc".
- Customer liability beyond US law limits for bank credit and debit cards. (What if it's Plastc's fault? The bank blames Plastc, and Plastc dumps the liability on the customer, citing their "it's never our fault" EULA).
- The device is a great tool for "carders". Previously, "carders" using stolen credit card info had to make sure nobody saw them putting a white card in the ATM. Using a stolen credit card required access to convincing-looking blank cards and an embossing machine. Now, with Plastc, anybody with a list of stolen card numbers can easily create fake cards. At least if businesses are willing to accept Plastc cards.
All I'm seeing is an expensive ($155?!) solution to a non-existent problem.
(And you'll still want a backup card in case it fritzes.)
Having any credit card number which you've ever used only usable for one single purchase would make fraud have to change to adapt. But you could probably sell such a thing easily today with all the recent loss of credit card number news. Granted, the vendor of such a card has to partner with a bank to enable this feature set, and then only a small number of people will want such a card as it imposes a new workflow for paying for things.
My concept is basically just "mobile payments" but enabling it for locations where merchants don't have the infrastructure yet. The added benefit is every transaction has a different card number, so merchants who store card numbers and get hacked provides no benefits to the thieves. Granted, any of the mobile payments things should be doing this kind of security thru obscurity, but I have no idea if they are.
This is not novel.
One of the costs associated with fraudulent card use is turning a set of number into a physical object. Several retailers will avoid the "Just write the number onto an existing card" approach by verifying that the last four digits on the card match the number on the magstripe, which increases the cost per cloned card by a reasonable margin. Using Plastc instead would break that assumption. It'll be interesting to see how merchants react.
But, more problematically, this answer:
> What happens if one of the cards stored on my Plastc Card is declined?
> The acceptance of any transaction has nothing to do with your Plastc Card. In this event, we recommend you contact your bank.
seems like a problem if the auth failure that comes back is one that requests that the merchant retain the card…
The only way I could imagine it would work is if you have the support of the bank that issued the card. However, I doubt any bank would agree to a scheme to allow a 3rd party to generate a clone of an EMV card.
At the end of https://www.plastc.com/wallet there's a list of participating banks, so I assume that's exactly how they do it.
There are brick and mortar businesses that don't even support credit cards. It could be a long time before all brick and mortar businesses support phone payments.
If 90-95% support this, and they will, very soon, that's plenty.
Do not give these people your money, nor the other tech companies that pull this kinda shit when so many real innovations are in the market.
I want to punch the designer in the face who ever thought this was a good idea.
Haha, no.
I turn my phone off at movie theaters and airplanes.
I rarely keep bluetooth on to save battery (I don't really use it save for once in a while) and I also quite often turn mobile data off unless I take my phone out to use it.
Sometimes it runs out of battery.
Quite often I keep my phone in a different room of my house than I am in, especially when it is charging.
Sometimes your phone breaks or malfunctions (hopefully not often).
Sometimes I just plain forget it.
It's easy to throw up a list of tech specs on a website, it's a lot harder to actually ship those features. I'm highly skeptical of their support for chip-and-pin. In my (uneducated on this matter) mind it seems like the ability to do this undermines a large security consideration with chip-and-pin. What's to stop a crook from swiping my card on his reader? Does this not just make it all the easier to clone cards?
Also the battery life is an annoyance. Not one that I couldn't live with (I look at my Pebble and Pulse battery levels every few days to determine if I need to plug it up at night) but Coin's approach to this problem seems cleaner. Coin was a reach for me, this is way out of what I would spend to "fix" this problem. Also as other's have said with Apple Pay entering the fray Coin is rapidly losing its appeal as neither Coin nor this card offer the consumer protection that Apple Pay does (like not giving them your real CC number).
My biggest concern would be pre-ordering anything like this for the time being. I was left pretty jaded with Coin promising for a year that they were running on time with shipping. Summer 2014 came and went and they finally admitted just two weeks after the previous update that they wouldn't be able to make it for at least another 6 months. Now this product is advertising a more advanced feature set to be released at around the same time. I wouldn't bet on it.
Another option is just proxying your card; their card has a valid chip & pin and credit card number, and when they process the charge, they pay for it by charging your actual card. If I recall correctly, the credit card companies don't particularly like this, but maybe things have changed recently.
On October 1, 2015 "Liability will shift to acquirers for domestic and cross-border counterfeit fraud card-present POS transactions if the merchant does not have an EMV-enabled POS device."
Over the next year nearly all merchants will switch over.
Here are my reasons:
NFC + EMV secure elements are issued by banks and can't be reprogrammed. You can't switch between them on the fly. You can only house "multiple" EMVs if you can by some grace of god magic convince the different banks, and Amex to take your card to their facility and program it with their secure info and then give it back to you.
E-ink displays are WAY thicker than they can fit in there. They are also made on GLASS substrate, much more fragile than something you want to put in your pocket. If you looks closely at the video the e-ink screen is faked by CGI. It doesn't perfectly register in the same location on every frame. There is a shake.
Driving an e-ink display requires high bias voltage, ~+/-20V. Often done via charge pumps with chips such as TI's TPS65180 (http://www.ti.com/product/tps65180). The chip alone (minus PCB) is thicker than a credit card and therefore a credit card slot. The switching capacitors you'd need to generate the voltage would also be too big to fit within that footprint.
Those 3 are:
* An personal AMEX cashback card, that gives me a very nice 5% back in certain categories, and 1% back on everything else.
* A Visa Airline miles card, for places that don't take AMEX or travel spending where I earn 2x or more miles.
* A business Visa credit card for the business my wife owns.
The other cards I'd carry if I wasn't annoyed by a thick wallet are:
* A Costco AMEX that gives me extra cashback at Costco.
* A couple store-specific Visa cards that give me nice benefits at stores where I shop at least semi-regularly.
* A work credit card for my work.
I'm a bit of a miles/cashback junkie, but I'll bet many people have at least a few cards they'd like to consolodate. The average American family has 8.
Like I said in another comment, I'd be thrilled if I could replace all those with one card, and I'd be happy to pay what Plastc is asking if it worked. But the most likely scenario I see for that happening is mobile payments a'la ApplePay.
One I use for everything, until their idiotic fraud department is confused as to how I'm spending money in Chicago after taking a flight to Chicago I bought with that card.
Another I use as a backup, for this situation.
Debit card, for extracting paper money from ATM machines.
It's not so much about use as it is about carry. I may use only 3 cards regularly, but I carry 13 in my wallet. Most of the lesser used cards are ID I have little choice but to carry or loyalty cards for places where I shop.
_IF_ the claims about chip and pin capability are true, I'd be able to pull out at least half of the cards in my wallet, which would be a significant amount of bulk.
Plus most door cards are 125Khz and NFC/credit cards etc use 13.5Mhz so I wouldn't expect it to be compatible.
You can't afford an expensive phone, but you can afford to spend $155 for the convenience of not carrying around 3-4 additional cards?
An Android phone with NFC is not as expensive as you think, and it will be cheaper by summer 2105. And by summer 2105, payments by phones/smart watches/wrist bands would be ready as well.
Situations: 1) someone steals your pin code (there are overlay devices for ATMs, could happen), after that they steal your card (they can't clone it since it does not have a magnetic stripe). They can't use it since it has locked itself (default state being locked, unlock before transactions).
2) Buy something online, specify that you buy with plastc, it guides you to a challenge response authentication page. Type the challenge in the card, type back the response to the page. They hack the site, get every credit card info and your money on your bank account remains safe.
(1) Durability was my biggest question -- how much flex and bend can this thing survive? How about being chewed on by a toddler, put through the washer and dryer (high heat), taken into a hot tub by mistake, dropped and stepped on with hard-sole shoes, etc.
(2) Ditto the other skeptical questions re: chip and pin.
(3) How big is the niche for this? I mean, I only have one debit card I use routinely and one credit card I use rarely. Carrying two plastic cards is not that big of a deal. I wouldn't pay $155 just to merge them into one card that can run out of battery power.
(4) Speaking of recharge... now there's another device I need to plug in or otherwise mate with some kind of charger? No thanks.
It seems like they are making an age-old start-up mistake. Swift death to the founders so they can move on to something far more interesting than a re-imagined credit card.
I have a sneaky feeling that Coin's long radio silence and pushed ship dates are them re-engineering to have chip & pin at launch.
I appreciate the point you're making in that stealing this one card is equivalent to stealing a whole wallet-full. But isn't it usually the case that you lose the whole wallet in one go?
http://www.emvco.com/images/EMVCo_WorldMap-9-2014.png
The other regions are:
(Region/percentage of cards/percentage of terminals)
Americas (excluding USA): 54.2 84.7 Europe: 81.6 99.9 Australasia: 17.4 71.7 Russia: 24.4 91.2
It's security theater...
Will retails at the mall accept these cards? Usually the bigger chains are picky about credit/debt cards.
I really can't see these things taking off.
No way you could make something as thin as a real credit card do all this in 2015 and have a battery, etc.
Maybe by 2020, but not yet.
How do they propose doing that ?
So if you set an hour, if your card hasn't been paired with your phone in over an hour it can erase itself. The phone probably rewrites the data as soon as it identifies the card again and the pin is entered.
Pick pockets aren't as common as they once were, at least in the U.S., but I never use my back pockets for anything. Even disregarding pick pockets, it's much easier to lose stuff that way, like when getting on and off a bus. So pocket space is at a premium for me, especially after I relented and bought a cell phone, which keep getting bigger and bigger. (And I would never keep my financial data on a cellphone, even if they promised it was safely embedded on a crypto chip... I just wouldn't trust them to have done it properly.)
Frankly, I think Plastc seems quite useful, at least superficially. The devil is in the details.
Apparently according to plastic, it is rechargeable, therefore once you buy it, you never have to buy another. Another interesting point was it's wireless rechargeable from the video, which is interesting.