mobile payment transactions: ble and/or nfc? - ul 4 white paper - mobile payment transactions: ble...
TRANSCRIPT
Mobile Payment Transactions: BLE and/or NFC? White paper by Swen van Klaarbergen, consultant for UL Transaction Security’s Mobile Competence Center
White paper - Mobile Payment Transactions: BLE and/or NFC?
About the author
Swen van Klaarbergen is a consultant in the Mobile Competence
Center of UL TS. He is a researcher and consultant in the field of system
innovations, both focusing on the technical and business aspects of an
innovation. He has obtained a master’s degree in Integrated Product
Design with a focus on Product Service Systems. As a consultant with UL, Swen is involved
in projects around mobile payment implementations.
In this white paper, Bluetooth Low
Energy (BLE) technology is explained and
compared in relation to Classic Bluetooth
and NFC, as data transfer technologies in a
payment transaction context.
Because of BLE’s lower power consumption,
quicker connection set-up and larger
number of potential connections in relation
to the original Bluetooth technology,
Classic Bluetooth, BLE allows for indoor
mapping using beacons. It is also possible
to enable mobile in-store payment
transactions using BLE. In this white paper,
the use of BLE in a payment context is
explained on the basis of three scenarios.
The scenarios allow for a comparison
between BLE and NFC as payment
transaction technologies. The white paper
concludes with a statement that in a
payment context BLE can be regarded, not
as a substitute but as a potential addition to
NFC technology, especially with regards to
the wider shopping experience.
Introduction
Recently the combination of Bluetooth
Low Energy (BLE) and beacon technology is
popping up all over the news. Companies
that announced the use of BLE include
PayPal and Apple.
PayPal, with their PayPal Beacon product,
will use BLE for customers to check in into
stores automatically and even to make
hands free payment a reality. PayPal links
BLE to their recently launched payment
application, which already allowed for
ordering goods upfront to avoid waiting.
Apple recently show-cased the word
“iBeacon” during a keynote address for the
launch of the iPhone 5S and iOS7. iBeacon
would be an application supporting BLE
and enabling beacons to provide indoor
mapping and related services to iPhone
devices.
Estimote, a technology start-up producing
beacons, is among the companies looking
Mobile Payment Transactions: BLE and/or NFC?
page 2
Photo
1. Among other companies are Roximity Beacon and Kontakt
1
to capitalize on these announcements.
With their beacons, customers can be
welcomed when they arrive and navigated
through the store, while obtaining
coupons and other information.
An important question is whether BLE can
be a substitute for, or is complementary
to, NFC in a mobile in-store payment
transaction context. Since there are
multiple technologies that enable
mobile payment, and no technology has
seen mass adoption yet, it is still under
debate which technology will be the new
standard for mobile payment in the end.
BLE has the potential to be adopted by
customers and merchants because it is
positioned, for example by PayPal, as
easier in implementation, easier in use,
and able to create a new and complete
payment experience compared to other
payment technologies, among them NFC.
Adoption in the end is the most critical
parameter for a technology’s success.
And the availability of NFC and/or BLE
on (nearly) every smartphone is a critical
precondition for this. From a customer
adoption perspective BLE currently
may have an advantage over NFC, since
Android, Blackberry and Microsoft as
operating systems support both BLE and
NFC, but iOS only supports BLE.
This white paper first explains what
BLE is in relation to Classic Bluetooth
and NFC from a technical perspective.
Next, the white paper explains how
mobile payment transactions with BLE,
compared to NFC, take or can take place.
After this the pros and cons of a BLE and
NFC mobile payment transaction are
presented and compared to each other.
Lastly, the question above, in fact whether
BLE is a threat (a substitute rather than
a complement) to NFC, as a payment
transaction technology, is answered.
Data transfer technologies: BLE, Bluetooth and NFC
Here BLE is explained using Classic
Bluetooth (2.1 + EDR) and NFC as a frame
of reference; Classic Bluetooth because
it is the originating technology of BLE
and NFC since BLE mobile payment to an
extent has been positioned as a threat to
NFC payment.
BLE in relation to Bluetooth
With the launch of Bluetooth 4.0,
Bluetooth Low Energy (BLE) was included
in the 4.0 specifications. BLE is marketed
as Bluetooth Smart.
While Classic Bluetooth focuses on
continuous wireless streaming of data
at relatively high speeds, BLE focuses
on wireless data transfer with ultra-low
power consumption. This low power
consumption of BLE is achieved by shorter
standby times (increased sleep time),
quick connections (set-up and release ),
and lower peak power (when transmitting
data). This decreased power consumption
comes at the cost of lower data transfer
rates compared to Classic Bluetooth. BLE
therefore is not intended for streaming
audio and it is not capable of streaming
video.
Another difference is that Classic
Bluetooth can have up to 7 simultaneous
connections while BLE can simultaneously
connect to 20 devices (theoretically an
infinite amount). BLE can connect to
more devices because of the small data
packages and quick connection set-up.
Classic Bluetooth and BLE implement the
same pairing modes: pushing content is
possible but it can only be downloaded
with customers’ permission. Bluetooth
allows for 56-128bit encryption whereas
BLE utilizes 128bit AES cryptography.
Differences in use between BLE and
Bluetooth
These different characteristics allow
for other uses for BLE compared to
Classic Bluetooth. Because of its lower
power consumption, quicker connection
set-up and larger number of potential
connections, BLE is ideally suited for
indoor mapping using beacons (Figure 1
on next page). This is because BLE allows
for higher accuracy with fewer beacons,
and multiple simultaneous connections,
compared to Classic Bluetooth. When
combining BLE with beacon technology
and making use of its quicker connection
set-up and increased encryption
possibilities it is also possible to enable
payment transactions; contrary to
Bluetooth Classic as the connection set-up
with Bluetooth Classic is too slow and
there are weaker encryption possibilities.
Prior criticism with Classic Bluetooth was
that it is not always as interoperable as it
should be. However, it is expected that if
BLE will be used for payment transactions,
certification will be stricter and interoper-
ability will be better.
BLE in relation to NFC
BLE and NFC are both short range wireless
data transfer technologies, even though
the range at which BLE operates is much
longer: tens of meters compared to a few
page 3
White paper - Mobile Payment Transactions: BLE and/or NFC?
2. It is worth mentioning that contrary to Classic Bluetooth, BLE is not based on profiles (e.g. printing profile, audio distribution profile) but on attribute protocols (e.g. send data, give time), which allows for quicker set-up and connection.
3. According to for example BlueGiga, a company specializing in Bluetooth, in practice this is about 20 connections.
2
3
page 4
White paper - Mobile Payment Transactions: BLE and/or NFC?
centimeters for NFC. Both NFC and BLE are optimized for small data packages. BLE is
slightly more latent while potential data transfer rates with NFC are higher. Between
both technologies there are minor differences in power consumption. Whereas
NFC is focused on one-to-one data exchange, BLE allows for multiple simultaneous
connections. Both BLE and NFC utilize AES-128 bit data encryption and pairing modes.
Difference in use between BLE and NFC
When transferring data, BLE’s long range allows for increased convenience (more
flexibility), while NFC’s shorter range makes spying on the transferred data more
difficult, enhancing security when performing proximity transactions. Because of the
longer range and low power beacons, BLE is ideally used for position information about
a device in relation to its surroundings (mapping for example). The principle underlying
use for both technologies is different: with NFC customers are targeted based on their
range; with BLE based on their mapped position. A technical comparison between
Classic Bluetooth, BLE and NFC is presented in the table below.
Bluetooth 2.1 + EDR BLE NFC
Radio frequency 2.4 GHz 2.4 GHz 13.56 MHz
Distance/range ~10-100 meters ~10-50 meters ~0,04-0,10 meters
Application throughput
~2100 kbps ~300 kbps ~424 kbps
Maximum simultaneous connections
7 ∞ (20 in practice) 1
Latency (connection speed)
~1 second ~0,03 second ~0,1 second
Peak use current ~30 mA ~15 mA ~15 mA
Standby current ~1000 μA ~1 μA <1 μA
Table 1: Comparison between Bluetooth, BLE and NFC.
Payment
Both BLE and NFC are technologies for data transfer. Both enable proximity (nearby) and
peer-to-peer (device to device) payment. This section explains how BLE could and how
NFC already work(s) in an in-store mobile payment context.
The focus here is on in-store mobile payment: a customer in a physical store who
performs a wireless payment transaction with a handset. In addition, the focus is on the
transfer of data during the actual payment transaction; data transfer with the handset
before and after the transaction is outside of the scope of this white paper (e.g. for
mapping, couponing, etc. ).
4. NFC tags are an exception because they do not need their own power source, while for BLE anything compatible needs to be directly powered.
5. A Beacon from Estimote has a maximum radius of 50 meters but an optimized radius of only 10 meters.6. Nevertheless, note the information in the text box ‘BLE and/or NFC to change shopping?’.
5
Figure 1: These BLE beacons literally
serve as a beacon to other devices (e.g.
smartphones) in order to determine their
position. Devices use these beacons with
a known position to calculate their own
position, while the beacons can track the
position of devices as well. In the case of
BLE, multiple independent determinations
are made using triangulation which
involves the use of three beacons.
Beacon
X Beacon
Y
Beacon
Z
Cell phone4
6
NFC payment scenario
NFC is a technology through which
customers hold their handset near a POS
terminal to make a payment transaction.
In case a PIN is required: the customer taps
to pay, then enters a PIN on the handset
and then taps again to confirm payment.
To prevent this scenario with two taps, it
is also possible to pre-enter the PIN and
tap only once. Under certain conditions
(e.g. maximum limits) the customer may
perform a low-value payment transaction
that does not require PIN entry at all. Also,
with a NFC enabled device it is possible to
make a (low value) payment transaction
even if the device runs out of battery.
One of the main differences between a
NFC and a BLE transaction is the distance
over which a payment transaction can
occur. With NFC the customer really has
to hold the handset at a few centimeters
from the POS terminal to make a
connection. An important difference from
an infrastructure perspective is that a NFC
capable antenna is already an integrated
and certified part of a (growing) number
of POS terminals and even some ATMs; no
separate receiver (beacon) is required as is
the case with BLE.
BLE payment scenarios
Using BLE and beacons it is possible to
determine the customer’s location in a
store. From a transaction perspective it is
useful to know when someone is entering
a store (for automated check-in) or when
someone is near a POS terminal (for the
actual transaction).
Based on information currently available
about BLE, three different payment
scenarios can be presented, of which the
second scenario is based on an actual
(proposed) implementation by PayPal:
I. Replacing NFC with BLE – pay at cashier
with agreement on handset
II. PayPal Beacon Hands Free – pay at
cashier with verbal confirmation
III. “Take and Shake” – scan and pay on
your own, no cashier needed
The first scenario is based on replacing
NFC with BLE as the data transfer
layer for an otherwise similar payment
transaction. The second scenario is
based on information currently known
about PayPal’s Beacon, with a beacon
that connects to the cloud and a
pre-transaction authorization from the
customer. The final scenario is the most
revolutionary: shopping without a cashier
or POS terminal that needs to be accessed.
The scenarios are presented below.
Scenario I: Replacing NFC with BLE (BLE as
a new data transport layer)
The secure data (virtual card) are stored on
a handset SE. The handset connects over
BLE to the POS terminal, which is directly
connected to a payment network (figure
2). This is a card present transaction.
Scenario I exactly copies a contactless EMV
card present transaction, but the customer
pays over a BLE connection rather than
a NFC connection. The merchant still
selects/scans all the products as part of
the transaction. Because BLE works over
longer ranges the cashier then selects
the right customer from a list of most
likely customers based on their position
(i.e. place in queue). The customer gives
a transaction authorization on his/her
handset. This could include any form of
authorization, for example with Apple’s
TouchID (scanning fingerprints) when this
is secure enough.
Scenario II: PayPal Beacon Hands Free
The secure data (virtual card) are
processed and stored in the cloud. The
handset connects over BLE to a POS
beacon, which connects to the cloud
(figure 3). This is a card not present
transaction.
With scenario II, PayPal’s Beacon, it is
possible to check in and pay automatically
with participating stores, based on a
customer’s agreement. At the moment
a customer enters the store its mobile
device announces itself to a BLE beacon,
which on its turn sends a picture and
name to the cash register. This allows for
the cashier to greet the customer by name.
Customers can then shop in the store (or
they can order something at the counter)
page 5
White paper - Mobile Payment Transactions: BRE and/or NFC?
7. With BLE it is possible to have a card present transaction just as is the case with NFC. It should also be noted that the customer will need to opt in to use BLE; this is the case for all scenarios. 8. The difference between a POS terminal and a POS beacon lies in the fact that a POS terminal is expected to be visible for
interaction with the customer and a POS beacon not. It is important to note that it is possible to integrate BLE functionality into a POS terminal (possibly via a beacon or directly through a POS beacon, see also scenario III), but that for now it seems – at least for the PayPal implementation – that a beacon will link the
handset to the cloud (for authorization) using a customer account.
7
8
Figure 2 "Replacing NFC with BLE"
Figure 3 "Hands free"
page 6
White paper - Mobile Payment Transactions: BRE and/or NFC?
9. Hence, there is a double check: the presence of the customer’s handset and the linking of the customer to this device.
Figure 4 "Take and Shake"
and when they are done shopping (or
ordering) they move to the cash register.
Here the cashier recognizes the customer
from the picture that was previously sent
to the cash register. The merchant still
selects/scans all the products as part of
the transaction. Payment happens after
the cashier has confirmed the customer as
belonging to the mobile device, and after
a verbal confirmation by the customer. The
actual transaction takes place in the cloud
with a token drawn over a BLE connection
from the customer’s device. Basically it is
a card not present transaction with facial
recognition by the cashier and verbal
confirmation by the customer.
Scenario III: Take and Shake
The secure data (virtual card) are stored
on a handset SE. The handset connects
over BLE to a POS beacon, which is directly
connected to a payment network (figure
4). This is a card present transaction.
Please note that there are variations
possible were the POS beacon connects to
the cloud, which would make it a card not
present transaction.
With scenario III the customer scans its
own products in a store (using a QR/
barcode, RFID or any other option). Hence,
the scenario allows for actual payment
freedom since no merchant is needed for
selecting/scanning products. Payment for
these products can be authorized on the
handset over a BLE connection with a POS
beacon, anywhere in the store. The POS
beacon connects to a payment network,
and the payment transaction proceeds as
a card present transaction. Authorization
may vary (ranging from pressing ‘OK’ to
entering a PIN). In addition, customers
could for example be checked randomly
(by a person and/or digitally) upon leaving
the store.
BLE compared to NFC payment
transactions
The pros and cons of BLE compared to
NFC, in a payment transaction context,
are listed below. It should be noted that
any BLE or NFC capable device has other
possibilities, like for example Wi-Fi, which
could be used for mapping and connecting
to the cloud. However since both BLE and
NFC can make use of these additional
technologies, they are taken out of
the comparison here. Furthermore it is
important to note that BLE is just another
data transfer layer, allowing the same
levels of security at application level as
NFC and also allowing to be implemented
in direct connection to the POS and
payment network, if desired.
BLE vs. NFC: pros
When it comes down to a payment
transaction BLE in fact has one main
advantage over NFC: payment freedom.
Payment freedom
BLE makes it possible to connect to a
POS terminal or the cloud anywhere
in a store, even when it is a crowded
indoor location. This gives customers the
freedom to pay anywhere they want and
thus to avoid waiting lines (scenario III);
currently this would most likely be a card
not present transaction. Furthermore if
it includes an automated BLE connection
in combination with a pre-authorized
payment transaction, this would allow for
hands free payment transactions (scenario
II). A NFC payment transaction on the
other hand always needs a nearby POS
terminal and does not allow for hands free
payment transactions (a tap at least will
always be required).
Besides payment transactions both BLE
and NFC could change other aspects of
the shopping experience. A quick overview
can be found in the boxed text ‘BLE and/or
NFC to change shopping?’.
BLE vs. NFC: cons
NFC has four main advantages over BLE
when considering payment transactions:
it is more secure mainly because of the
shorter distance (which makes spying
more difficult), it more easily enables
card present transactions against lower
transaction fees compared to card not
present transactions, it is compatible in
a broader contactless environment, and
finally because it (presumably) requires
less investment in POS technology.
Security
With NFC, the short distance over which
a transaction occurs provides additional
visual security (the customer sees the
POS terminal which it communicates
with), which is lacking with BLE payment
transactions over longer distances (all
scenarios). With BLE it will also be easier to
spy on and interfere with secure data that
are being sent.
9
page 7
White paper - Mobile Payment Transactions: BLE and/or NFC?
10. This paper still uses card present and card not present terminology. But with recent developments it might be the right time for a change in the current terminology, rather talking about SE present (secure data on hardware SE, or on the handset OS) or SE not present (secure data in the cloud) transactions. 11. It should be noted that besides a card present or a card not present transaction it is also possible to have a mobile checking transaction. In certain cases the cost of such a mobile checking transaction is fixed (e.g. mobile iDEAL in
the Netherlands), whereas a card (not) present transaction could be a percentage of a transaction amount; in other words, there could be a tipping point in costs in favor of a mobile checking transaction, which may be relevant to consider for both NFC and BLE as data transfer technologies.
Another threat lays in Denial-of-Service
(DoS) attacks on POS terminals and
handsets using BLE.
An additional security problem with a
hands free payment transaction (scenario
II) in particular is that a proof of payment
(a ‘handshake’) is missing. A merchant
cannot prove all customers gave verbal
permissions for transactions, except when
the merchant records all transactions,
which has huge bottlenecks.
Card present or card not present
For a card present transaction to happen
BLE needs a similar set-up for hardware
and software (related to the POS
terminal and the handset) as NFC. The
main difficulty lies in the fact that the
used hardware and software should be
compliant with and be certified by the
existing payment networks. Given the
possible security issues as mentioned
above, it may be difficult to obtain these
certifications. And even if a BLE POS
terminal/beacon and handset get certified
in the end, this process still requires a large
amount of time, as it did for NFC.
It will require less time to enable a card
not present transaction using BLE, because
then there is no need to directly connect
to the existing payment networks. The
main problem then is cost, because
card not present transactions are more
expensive since they are less secure.
Hence, BLE is at a disadvantage compared
to NFC, because for NFC safer and cheaper
card present transactions are already a
reality.
Interoperability with contactless
NFC is compatible with most existing
contactless payment and transit systems
since they all operate at the same radio
frequency whilst BLE operates with a
different radio frequency band. Since
innovative technologies such as NFC
and BLE are expected to keep on being
backwards compatible with existing
payment (contactless) cards, NFC has an
advantage here.
Also, a NFC infrastructure is already
in place, both in payment and transit
industries. It is the reason why the
industry is investing in NFC as a
compatible technology. NFC is ahead of
BLE because of mature standards and
certification requirements with certified
hardware and software available on the
market as well.
Problems with accurate mapping
With NFC a customer and merchant are
linked to each other with a single tap. For
BLE another selection step is needed, to
select the right device (and customer).
In other words, with NFC the customer
identifies itself and its location to a
merchant and a transaction with a tap to
a POS. With BLE the customer is identified
because of its position, either by BLE
triangulation or BLE distance; this position
is then linked to a merchant. An additional
selection step is however needed to match
the customer with the right transaction.
Because of this selection, location
determination is needed in scenario I
and II, because if a customer’s position
is not known, and they just check in and
out, it is impossible for a cashier to select
their account quickly if there are tens or
hundreds of people in a store. A solution
would be to let a customer identify itself
by entering a code, but this rules out a
hands free payment transaction.
If this customer selection would happen
manually, e.g. as a default option by the
cashier, it could be prone to human error
by accident or on purpose. Automated
recognition, in addition to location
determination, using facial recognition
technologies, could rule out human
error, but it does not rule out all errors.
Both demand good quality pictures and
both require additional investments
in hardware and software. It should
be noted that implementing any type
of recognition that involves biometric
information or storage of a customer’s
movements has difficulties related to
privacy concerns of customers.
With scenario III location determination
or cashier selection is not needed because
the customer selects itself. With NFC,
location determination is not relevant in
any case because of the short range over
which the payment transaction occurs.
Conclusion
There might be a niche market for BLE
payment transactions because of the
payment freedom it could provide
(e.g. grab & go, pay without waiting).
However in crowded stores, stores where
a customer has never been before, large
stores, or for instance in public transport,
NFC has the advantage over BLE because
of reasons including security, cost and in-
teroperability of the payment transaction.
This conclusion can be elaborated on in
four points:
1. Even though BLE can be seen as just
11
10
12
12. Additional beacons can be a solution to alleviate this problem, because when it is crowded a signal is more likely to get blocked (lower Received Signal Strength Identification (RSSI)), while it is also more likely that another person will be present at a wrongly calculated position.
13. See also the comment made in footnote 11.
page 8
another data transfer layer and it has
similar security possibilities as NFC, the
longer distance over which a BLE payment
transaction can occur makes payment
transactions more vulnerable and
therefore less secure. This leads to risks
such as spying, hacking, DoS issues, lacking
visual feedback, etc.
2. For BLE, card present transactions
seem like a bridge too far especially
in the near future, because of the
required certification. Card not present
transactions are possible, but these are
less secure and therefore more costly.
3. The compatibility of NFC in a broader
contactless context, including contactless
payment cards, transit or access control
solutions, etc., makes NFC more widely
applicable. This already resulted in
established standards and infrastructure,
also across industries (payment and
transit), for example also with a view to
the number of contactless POS terminals
already rolled out.
4. Required investments for BLE payment
transactions, compared to NFC, are higher
at this moment in time. These investments
include beacons, POS terminal upgrades,
costumer selection tools e.g. enabling
automated facial recognition, etc.
In short, in UL’s view, compared to BLE,
NFC remains the preferred technology for
the in-store mobile payment transaction
itself, although BLE has the potential to
improve the overall shopping experience
around this secure payment transaction,
especially because of enhanced
location-based services to target
customers.
White paper - Mobile Payment Transactions: BLE and/or NFC?
BLE and/or NFC to change shopping?
It can be stated that there is more to shopping than just the payment transaction itself, where BLE and NFC can be used for other parts of the shopping experience as well.
Location-based services BLE can locate a customer’s position in, and near, a store over time, which allows for location-based marketing and information. Some examples are: convincing customers to enter the store when they pass by, providing customers with indoor directions and targeting a specific customer with a coupon (e.g. after spending some time at the coat section they receive a coupon for 10% off coats within the next 15 minutes).
An important difference why coupon pushing could succeed with BLE, although it failed with Classic Bluetooth, is that for BLE a customer can opt in per store to avoid spamming, which turned out to be an issue with Classic Bluetooth.
With NFC it is possible to have tags around a store, to provide additional information or to pick up coupons, which also allows for targeted marketing, but with more effort required from the customer. Yet, this additional effort could be reduced by using additional technologies to reach and locate customers without the need for them to scan tags throughout the store (using SMS, Wi-Fi, etc.).
Detailed payment statistics With BLE, if payment details are not only sent to the POS terminal, but in addition also to the cloud, it is possible to link specific purchases to a customer account, like for example with a loyalty card. This allows for gathering detailed payment statistics and subsequently targeted marketing and couponing based on previous purchases. With NFC this would require an additional tap, a supporting technology and/or a loyalty application that has access to these data.
13