Whitman says McDonald's and its owner-operators (80 percent of its stores are franchised) are working to get all 13,700 U.S. McDonald's locations ready to accept the PayPass and ExpressPay cards soon. McDonald's, he explains, has agreements only with MasterCard and American Express to use their
RFID payment platforms, not with Visa. Although the RFID cards all use the same air-interface
protocol, the terminals McDonald's uses can't read Visa cards unless
firmware is installed to decrypt the Visa Contactless security.
CVS Pharmacy accepts ExpressPay payments at all 5,300 of its stores; at select locations, it also accepts the Chase blink RFID-enabled MasterCard and Visa cards. AMC Theatres, Boater's World, Duane Reade, Loews Cineplex Entertainment, Meijer retail supercenters, Regal Entertainment Group, 7-Eleven, Ritz Camera and Sheetz also accept ExpressPay at some or all locations. Many of these retailers accept the Chase blink RFID-enabled MasterCard and Visa cards.
Consumers can identify retailers that accept their RFID-enabled cards by matching the ExpressPay, PayPass or Visa Contactless logo (or issuer-specific logo, such as the Chase blink logo) on the card with the same logo on the point-of-sale terminal. If the terminal does not show the logo, it won't accept the card.
American Express began pilot tests of its ExpressPay system in 2002, completing them in 2004 (see
AmEx Expands RFID Payment Trial). The results of the tests showed that, on average, ExpressPay transactions were 63 percent faster than using cash, with consumers involved in the tests citing convenience and simplicity of use as two of ExpressPay's major benefits. For merchants, important advantages include reduced transaction and service time for customers on the go.
Some consumers and privacy advocates express concern that thieves will someday be able to eavesdrop on these RF transmissions and decrypt them, in order to steal account information (account number, account holder's name and card expiration date) as it is transmitted. Early last year, cryptography specialists from the
Johns Hopkins University and
RSA Laboratories announced they had found a weakness in the data protection used in the
Texas Instruments DST
tag, which is embedded in Speedpass payment devices, as well as in car theft-deterrent systems (see
Attack on a Cryptographic RFID Device). The ExpressPay, PayPass and Visa Contactless payment systems, however, use a strong data
encryption method that hackers have not apparently found a way to compromise.