Jan 23, 2006For patrons with American Express RFID-enabled ExpressPay cards, fast food can now be even faster at 12,000 U.S. McDonald's locations. That's because these stores are now accepting the cards, which use radio frequency to send encrypted account data to readers integrated in point-of-sale systems. ExpressPay transactions are quicker than paying with cash or conventional magnetic-stripe cards.
"Given that so many of our customers are all about speed of service and convenience, this is a perfect fit," says McDonald's spokesperson William Whitman. "We're hearing from our customers at front counters and drive-throughs that this is a convenience they appreciate."
American Express first started issuing its Blue line of credit cards with the 13.56 MHz, ISO-14443-compliant RFID ExpressPay inlays in June (see AmEx Adds RFID to Blue Credit Cards). It also embeds the inlay in its Clear card line, introduced in October. The Blue and Clear cards include a magnetic stripe for use in conventional credit card readers, as well. An embedded RFID tag is interrogated when the card passes within a few centimeters of RFID-enabled card readers integrated in point-of-sale systems. American Express Blue or Clear cardholders may also request an ExpressPay key fob.
McDonald's began testing RFID payments in 2002, with trials using Exxon Mobil's RFID payment system, Speedpass, as well as another proprietary system called FreedomPay (see Gilbarco: RFID Pumps Up Profits). After testing was completed, however, the restaurant chain did not roll out either system. Instead, in summer 2004, the company announced it would begin accepting payments via the MasterCard PayPass RFID platform, beginning with some 700 locations in Dallas, New York and Orlando, Fla. According to Whitman, all 12,000 McDonald's locations that accept ExpressPay cards also take PayPass.
Unlike American Express, however, MasterCard does not issue its own cards, so some banks already issuing MasterCard credit and debit cards are also issuing MasterCard cards with PayPass. Chase is issuing MasterCard PayPass-enabled cards, as well as Visa RFID-enabled cards with the Visa Contactless platform, branding the cards under the "blink" name (see Chase Offers Contactless Cards in a Blink). MBNA is also issuing PayPass-enabled cards, while Citibank is distributing PayPass cards and keychain fobs to its MasterCard credit and debit accountholders. HSBC Bank USA and KeyBank are currently issuing MasterCard debit cards with PayPass, as well.
Though the three RFID payment platforms—ExpressPay, PayPass and Visa Contactless—employ discrete encryption methods, they all use the same air-interface protocol described by the ISO 14443 standard. Consequently, all three can be read by a single RFID interrogator built into POS systems.
McDonald's uses RFID-enabled Omni 7000MPD payment terminals from VeriFone to accept the PayPass and ExpressPay cards. "The goal was to make sure we had a platform across the stores that was consistent, provided ease of use for customers, and was a platform that would let our owner-operators deploy the system without a lot of hardware and software investment," says Whitman.
CVS Pharmacy accepts ExpressPay payments at all 5,300 of its stores; at select locations, it also accepts the Chase blink RFID-enabled MasterCard and Visa cards. AMC Theatres, Boater's World, Duane Reade, Loews Cineplex Entertainment, Meijer retail supercenters, Regal Entertainment Group, 7-Eleven, Ritz Camera and Sheetz also accept ExpressPay at some or all locations. Many of these retailers accept the Chase blink RFID-enabled MasterCard and Visa cards.
Consumers can identify retailers that accept their RFID-enabled cards by matching the ExpressPay, PayPass or Visa Contactless logo (or issuer-specific logo, such as the Chase blink logo) on the card with the same logo on the point-of-sale terminal. If the terminal does not show the logo, it won't accept the card.
American Express began pilot tests of its ExpressPay system in 2002, completing them in 2004 (see AmEx Expands RFID Payment Trial). The results of the tests showed that, on average, ExpressPay transactions were 63 percent faster than using cash, with consumers involved in the tests citing convenience and simplicity of use as two of ExpressPay's major benefits. For merchants, important advantages include reduced transaction and service time for customers on the go.
Some consumers and privacy advocates express concern that thieves will someday be able to eavesdrop on these RF transmissions and decrypt them, in order to steal account information (account number, account holder's name and card expiration date) as it is transmitted. Early last year, cryptography specialists from the Johns Hopkins University and RSA Laboratories announced they had found a weakness in the data protection used in the Texas Instruments DST tag, which is embedded in Speedpass payment devices, as well as in car theft-deterrent systems (see Attack on a Cryptographic RFID Device). The ExpressPay, PayPass and Visa Contactless payment systems, however, use a strong data encryption method that hackers have not apparently found a way to compromise.
