mobile payment transactions: ble and/or nfc? - ul 4 white paper - mobile payment transactions: ble...

Mobile Payment Transactions: BLE and/or NFC? White paper by Swen van Klaarbergen, consultant for UL Transaction Security’s Mobile Competence Center

White paper - Mobile Payment Transactions: BLE and/or NFC?

About the author

Swen van Klaarbergen is a consultant in the Mobile Competence

Center of UL TS. He is a researcher and consultant in the field of system

innovations, both focusing on the technical and business aspects of an

innovation. He has obtained a master’s degree in Integrated Product

Design with a focus on Product Service Systems. As a consultant with UL, Swen is involved

in projects around mobile payment implementations.

In this white paper, Bluetooth Low

Energy (BLE) technology is explained and

compared in relation to Classic Bluetooth

and NFC, as data transfer technologies in a

payment transaction context.

Because of BLE’s lower power consumption,

quicker connection set-up and larger

number of potential connections in relation

to the original Bluetooth technology,

Classic Bluetooth, BLE allows for indoor

mapping using beacons. It is also possible

to enable mobile in-store payment

transactions using BLE. In this white paper,

the use of BLE in a payment context is

explained on the basis of three scenarios.

The scenarios allow for a comparison

between BLE and NFC as payment

transaction technologies. The white paper

concludes with a statement that in a

payment context BLE can be regarded, not

as a substitute but as a potential addition to

NFC technology, especially with regards to

the wider shopping experience.

Introduction

Recently the combination of Bluetooth

Low Energy (BLE) and beacon technology is

popping up all over the news. Companies

that announced the use of BLE include

PayPal and Apple.

PayPal, with their PayPal Beacon product,

will use BLE for customers to check in into

stores automatically and even to make

hands free payment a reality. PayPal links

BLE to their recently launched payment

application, which already allowed for

ordering goods upfront to avoid waiting.

Apple recently show-cased the word

“iBeacon” during a keynote address for the

launch of the iPhone 5S and iOS7. iBeacon

would be an application supporting BLE

and enabling beacons to provide indoor

mapping and related services to iPhone

devices.

Estimote, a technology start-up producing

beacons, is among the companies looking

Mobile Payment Transactions: BLE and/or NFC?

page 2

Photo

1. Among other companies are Roximity Beacon and Kontakt

1

to capitalize on these announcements.

With their beacons, customers can be

welcomed when they arrive and navigated

through the store, while obtaining

coupons and other information.

An important question is whether BLE can

be a substitute for, or is complementary

to, NFC in a mobile in-store payment

transaction context. Since there are

multiple technologies that enable

mobile payment, and no technology has

seen mass adoption yet, it is still under

debate which technology will be the new

standard for mobile payment in the end.

BLE has the potential to be adopted by

customers and merchants because it is

positioned, for example by PayPal, as

easier in implementation, easier in use,

and able to create a new and complete

payment experience compared to other

payment technologies, among them NFC.

Adoption in the end is the most critical

parameter for a technology’s success.

And the availability of NFC and/or BLE

on (nearly) every smartphone is a critical

precondition for this. From a customer

adoption perspective BLE currently

may have an advantage over NFC, since

Android, Blackberry and Microsoft as

operating systems support both BLE and

NFC, but iOS only supports BLE.

This white paper first explains what

BLE is in relation to Classic Bluetooth

and NFC from a technical perspective.

Next, the white paper explains how

mobile payment transactions with BLE,

compared to NFC, take or can take place.

After this the pros and cons of a BLE and

NFC mobile payment transaction are

presented and compared to each other.

Lastly, the question above, in fact whether

BLE is a threat (a substitute rather than

a complement) to NFC, as a payment

transaction technology, is answered.

Data transfer technologies: BLE, Bluetooth and NFC

Here BLE is explained using Classic

Bluetooth (2.1 + EDR) and NFC as a frame

of reference; Classic Bluetooth because

it is the originating technology of BLE

and NFC since BLE mobile payment to an

extent has been positioned as a threat to

NFC payment.

BLE in relation to Bluetooth

With the launch of Bluetooth 4.0,

Bluetooth Low Energy (BLE) was included

in the 4.0 specifications. BLE is marketed

as Bluetooth Smart.

While Classic Bluetooth focuses on

continuous wireless streaming of data

at relatively high speeds, BLE focuses

on wireless data transfer with ultra-low

power consumption. This low power

consumption of BLE is achieved by shorter

standby times (increased sleep time),

quick connections (set-up and release ),

and lower peak power (when transmitting

data). This decreased power consumption

comes at the cost of lower data transfer

rates compared to Classic Bluetooth. BLE

therefore is not intended for streaming

audio and it is not capable of streaming

video.

Another difference is that Classic

Bluetooth can have up to 7 simultaneous

connections while BLE can simultaneously

connect to 20 devices (theoretically an

infinite amount). BLE can connect to

more devices because of the small data

packages and quick connection set-up.

Classic Bluetooth and BLE implement the

same pairing modes: pushing content is

possible but it can only be downloaded

with customers’ permission. Bluetooth

allows for 56-128bit encryption whereas

BLE utilizes 128bit AES cryptography.

Differences in use between BLE and

Bluetooth

These different characteristics allow

for other uses for BLE compared to

Classic Bluetooth. Because of its lower

power consumption, quicker connection

set-up and larger number of potential

connections, BLE is ideally suited for

indoor mapping using beacons (Figure 1

on next page). This is because BLE allows

for higher accuracy with fewer beacons,

and multiple simultaneous connections,

compared to Classic Bluetooth. When

combining BLE with beacon technology

and making use of its quicker connection

set-up and increased encryption

possibilities it is also possible to enable

payment transactions; contrary to

Bluetooth Classic as the connection set-up

with Bluetooth Classic is too slow and

there are weaker encryption possibilities.

Prior criticism with Classic Bluetooth was

that it is not always as interoperable as it

should be. However, it is expected that if

BLE will be used for payment transactions,

certification will be stricter and interoper-

ability will be better.

BLE in relation to NFC

BLE and NFC are both short range wireless

data transfer technologies, even though

the range at which BLE operates is much

longer: tens of meters compared to a few

page 3


2. It is worth mentioning that contrary to Classic Bluetooth, BLE is not based on profiles (e.g. printing profile, audio distribution profile) but on attribute protocols (e.g. send data, give time), which allows for quicker set-up and connection.

3. According to for example BlueGiga, a company specializing in Bluetooth, in practice this is about 20 connections.

2

3


centimeters for NFC. Both NFC and BLE are optimized for small data packages. BLE is

slightly more latent while potential data transfer rates with NFC are higher. Between

both technologies there are minor differences in power consumption. Whereas

NFC is focused on one-to-one data exchange, BLE allows for multiple simultaneous

connections. Both BLE and NFC utilize AES-128 bit data encryption and pairing modes.

Difference in use between BLE and NFC

When transferring data, BLE’s long range allows for increased convenience (more

flexibility), while NFC’s shorter range makes spying on the transferred data more

difficult, enhancing security when performing proximity transactions. Because of the

longer range and low power beacons, BLE is ideally used for position information about

a device in relation to its surroundings (mapping for example). The principle underlying

use for both technologies is different: with NFC customers are targeted based on their

range; with BLE based on their mapped position. A technical comparison between

Classic Bluetooth, BLE and NFC is presented in the table below.

Bluetooth 2.1 + EDR BLE NFC

Radio frequency 2.4 GHz 2.4 GHz 13.56 MHz

Distance/range ~10-100 meters ~10-50 meters ~0,04-0,10 meters

Application throughput

~2100 kbps ~300 kbps ~424 kbps

Maximum simultaneous connections

7 ∞ (20 in practice) 1

Latency (connection speed)

~1 second ~0,03 second ~0,1 second

Peak use current ~30 mA ~15 mA ~15 mA

Standby current ~1000 μA ~1 μA <1 μA

Table 1: Comparison between Bluetooth, BLE and NFC.

Payment

Both BLE and NFC are technologies for data transfer. Both enable proximity (nearby) and

peer-to-peer (device to device) payment. This section explains how BLE could and how

NFC already work(s) in an in-store mobile payment context.

The focus here is on in-store mobile payment: a customer in a physical store who

performs a wireless payment transaction with a handset. In addition, the focus is on the

transfer of data during the actual payment transaction; data transfer with the handset

before and after the transaction is outside of the scope of this white paper (e.g. for

mapping, couponing, etc. ).

4. NFC tags are an exception because they do not need their own power source, while for BLE anything compatible needs to be directly powered.

5. A Beacon from Estimote has a maximum radius of 50 meters but an optimized radius of only 10 meters.6. Nevertheless, note the information in the text box ‘BLE and/or NFC to change shopping?’.

5

Figure 1: These BLE beacons literally

serve as a beacon to other devices (e.g.

smartphones) in order to determine their

position. Devices use these beacons with

a known position to calculate their own

position, while the beacons can track the

position of devices as well. In the case of

BLE, multiple independent determinations

are made using triangulation which

involves the use of three beacons.

Beacon

X Beacon

Y

Beacon

Z

Cell phone4

6

NFC payment scenario

NFC is a technology through which

customers hold their handset near a POS

terminal to make a payment transaction.

In case a PIN is required: the customer taps

to pay, then enters a PIN on the handset

and then taps again to confirm payment.

To prevent this scenario with two taps, it

is also possible to pre-enter the PIN and

tap only once. Under certain conditions

(e.g. maximum limits) the customer may

perform a low-value payment transaction

that does not require PIN entry at all. Also,

with a NFC enabled device it is possible to

make a (low value) payment transaction

even if the device runs out of battery.

One of the main differences between a

NFC and a BLE transaction is the distance

over which a payment transaction can

occur. With NFC the customer really has

to hold the handset at a few centimeters

from the POS terminal to make a

connection. An important difference from

an infrastructure perspective is that a NFC

capable antenna is already an integrated

and certified part of a (growing) number

of POS terminals and even some ATMs; no

separate receiver (beacon) is required as is

the case with BLE.

BLE payment scenarios

Using BLE and beacons it is possible to

determine the customer’s location in a

store. From a transaction perspective it is

useful to know when someone is entering

a store (for automated check-in) or when

someone is near a POS terminal (for the

actual transaction).

Based on information currently available

about BLE, three different payment

scenarios can be presented, of which the

second scenario is based on an actual

(proposed) implementation by PayPal:

I. Replacing NFC with BLE – pay at cashier

with agreement on handset

II. PayPal Beacon Hands Free – pay at

cashier with verbal confirmation

III. “Take and Shake” – scan and pay on

your own, no cashier needed

The first scenario is based on replacing

NFC with BLE as the data transfer

layer for an otherwise similar payment

transaction. The second scenario is

based on information currently known

about PayPal’s Beacon, with a beacon

that connects to the cloud and a

pre-transaction authorization from the

customer. The final scenario is the most

revolutionary: shopping without a cashier

or POS terminal that needs to be accessed.

The scenarios are presented below.

Scenario I: Replacing NFC with BLE (BLE as

a new data transport layer)

The secure data (virtual card) are stored on

a handset SE. The handset connects over

BLE to the POS terminal, which is directly

connected to a payment network (figure

2). This is a card present transaction.

Scenario I exactly copies a contactless EMV

card present transaction, but the customer

pays over a BLE connection rather than

a NFC connection. The merchant still

selects/scans all the products as part of

the transaction. Because BLE works over

longer ranges the cashier then selects

the right customer from a list of most

likely customers based on their position

(i.e. place in queue). The customer gives

a transaction authorization on his/her

handset. This could include any form of

authorization, for example with Apple’s

TouchID (scanning fingerprints) when this

is secure enough.

Scenario II: PayPal Beacon Hands Free

The secure data (virtual card) are

processed and stored in the cloud. The

handset connects over BLE to a POS

beacon, which connects to the cloud

(figure 3). This is a card not present

transaction.

With scenario II, PayPal’s Beacon, it is

possible to check in and pay automatically

with participating stores, based on a

customer’s agreement. At the moment

a customer enters the store its mobile

device announces itself to a BLE beacon,

which on its turn sends a picture and

name to the cash register. This allows for

the cashier to greet the customer by name.

Customers can then shop in the store (or

they can order something at the counter)

page 5

White paper - Mobile Payment Transactions: BRE and/or NFC?

7. With BLE it is possible to have a card present transaction just as is the case with NFC. It should also be noted that the customer will need to opt in to use BLE; this is the case for all scenarios. 8. The difference between a POS terminal and a POS beacon lies in the fact that a POS terminal is expected to be visible for

interaction with the customer and a POS beacon not. It is important to note that it is possible to integrate BLE functionality into a POS terminal (possibly via a beacon or directly through a POS beacon, see also scenario III), but that for now it seems – at least for the PayPal implementation – that a beacon will link the

handset to the cloud (for authorization) using a customer account.

7

8

Figure 2 "Replacing NFC with BLE"

Figure 3 "Hands free"

White paper - Mobile Payment Transactions: BRE and/or NFC?

9. Hence, there is a double check: the presence of the customer’s handset and the linking of the customer to this device.

Figure 4 "Take and Shake"

and when they are done shopping (or

ordering) they move to the cash register.

Here the cashier recognizes the customer

from the picture that was previously sent

to the cash register. The merchant still

selects/scans all the products as part of

the transaction. Payment happens after

the cashier has confirmed the customer as

belonging to the mobile device, and after

a verbal confirmation by the customer. The

actual transaction takes place in the cloud

with a token drawn over a BLE connection

from the customer’s device. Basically it is

a card not present transaction with facial

recognition by the cashier and verbal

confirmation by the customer.

Scenario III: Take and Shake

The secure data (virtual card) are stored

on a handset SE. The handset connects

over BLE to a POS beacon, which is directly

connected to a payment network (figure

4). This is a card present transaction.

Please note that there are variations

possible were the POS beacon connects to

the cloud, which would make it a card not

present transaction.

With scenario III the customer scans its

own products in a store (using a QR/

barcode, RFID or any other option). Hence,

the scenario allows for actual payment

freedom since no merchant is needed for

selecting/scanning products. Payment for

these products can be authorized on the

handset over a BLE connection with a POS

beacon, anywhere in the store. The POS

beacon connects to a payment network,

and the payment transaction proceeds as

a card present transaction. Authorization

may vary (ranging from pressing ‘OK’ to

entering a PIN). In addition, customers

could for example be checked randomly

(by a person and/or digitally) upon leaving

the store.

BLE compared to NFC payment

transactions

The pros and cons of BLE compared to

NFC, in a payment transaction context,

are listed below. It should be noted that

any BLE or NFC capable device has other

possibilities, like for example Wi-Fi, which

could be used for mapping and connecting

to the cloud. However since both BLE and

NFC can make use of these additional

technologies, they are taken out of

the comparison here. Furthermore it is

important to note that BLE is just another

data transfer layer, allowing the same

levels of security at application level as

NFC and also allowing to be implemented

in direct connection to the POS and

payment network, if desired.

BLE vs. NFC: pros

When it comes down to a payment

transaction BLE in fact has one main

advantage over NFC: payment freedom.

Payment freedom

BLE makes it possible to connect to a

POS terminal or the cloud anywhere

in a store, even when it is a crowded

indoor location. This gives customers the

freedom to pay anywhere they want and

thus to avoid waiting lines (scenario III);

currently this would most likely be a card

not present transaction. Furthermore if

it includes an automated BLE connection

in combination with a pre-authorized

payment transaction, this would allow for

hands free payment transactions (scenario

II). A NFC payment transaction on the

other hand always needs a nearby POS

terminal and does not allow for hands free

payment transactions (a tap at least will

always be required).

Besides payment transactions both BLE

and NFC could change other aspects of

the shopping experience. A quick overview

can be found in the boxed text ‘BLE and/or

NFC to change shopping?’.

BLE vs. NFC: cons

NFC has four main advantages over BLE

when considering payment transactions:

it is more secure mainly because of the

shorter distance (which makes spying

more difficult), it more easily enables

card present transactions against lower

transaction fees compared to card not

present transactions, it is compatible in

a broader contactless environment, and

finally because it (presumably) requires

less investment in POS technology.

Security

With NFC, the short distance over which

a transaction occurs provides additional

visual security (the customer sees the

POS terminal which it communicates

with), which is lacking with BLE payment

transactions over longer distances (all

scenarios). With BLE it will also be easier to

spy on and interfere with secure data that

are being sent.

9


10. This paper still uses card present and card not present terminology. But with recent developments it might be the right time for a change in the current terminology, rather talking about SE present (secure data on hardware SE, or on the handset OS) or SE not present (secure data in the cloud) transactions. 11. It should be noted that besides a card present or a card not present transaction it is also possible to have a mobile checking transaction. In certain cases the cost of such a mobile checking transaction is fixed (e.g. mobile iDEAL in

the Netherlands), whereas a card (not) present transaction could be a percentage of a transaction amount; in other words, there could be a tipping point in costs in favor of a mobile checking transaction, which may be relevant to consider for both NFC and BLE as data transfer technologies.

Another threat lays in Denial-of-Service

(DoS) attacks on POS terminals and

handsets using BLE.

An additional security problem with a

hands free payment transaction (scenario

II) in particular is that a proof of payment

(a ‘handshake’) is missing. A merchant

cannot prove all customers gave verbal

permissions for transactions, except when

the merchant records all transactions,

which has huge bottlenecks.

Card present or card not present

For a card present transaction to happen

BLE needs a similar set-up for hardware

and software (related to the POS

terminal and the handset) as NFC. The

main difficulty lies in the fact that the

used hardware and software should be

compliant with and be certified by the

existing payment networks. Given the

possible security issues as mentioned

above, it may be difficult to obtain these

certifications. And even if a BLE POS

terminal/beacon and handset get certified

in the end, this process still requires a large

amount of time, as it did for NFC.

It will require less time to enable a card

not present transaction using BLE, because

then there is no need to directly connect

to the existing payment networks. The

main problem then is cost, because

card not present transactions are more

expensive since they are less secure.

Hence, BLE is at a disadvantage compared

to NFC, because for NFC safer and cheaper

card present transactions are already a

reality.

Interoperability with contactless

NFC is compatible with most existing

contactless payment and transit systems

since they all operate at the same radio

frequency whilst BLE operates with a

different radio frequency band. Since

innovative technologies such as NFC

and BLE are expected to keep on being

backwards compatible with existing

payment (contactless) cards, NFC has an

advantage here.

Also, a NFC infrastructure is already

in place, both in payment and transit

industries. It is the reason why the

industry is investing in NFC as a

compatible technology. NFC is ahead of

BLE because of mature standards and

certification requirements with certified

hardware and software available on the

market as well.

Problems with accurate mapping

With NFC a customer and merchant are

linked to each other with a single tap. For

BLE another selection step is needed, to

select the right device (and customer).

In other words, with NFC the customer

identifies itself and its location to a

merchant and a transaction with a tap to

a POS. With BLE the customer is identified

because of its position, either by BLE

triangulation or BLE distance; this position

is then linked to a merchant. An additional

selection step is however needed to match

the customer with the right transaction.

Because of this selection, location

determination is needed in scenario I

and II, because if a customer’s position

is not known, and they just check in and

out, it is impossible for a cashier to select

their account quickly if there are tens or

hundreds of people in a store. A solution

would be to let a customer identify itself

by entering a code, but this rules out a

hands free payment transaction.

If this customer selection would happen

manually, e.g. as a default option by the

cashier, it could be prone to human error

by accident or on purpose. Automated

recognition, in addition to location

determination, using facial recognition

technologies, could rule out human

error, but it does not rule out all errors.

Both demand good quality pictures and

both require additional investments

in hardware and software. It should

be noted that implementing any type

of recognition that involves biometric

information or storage of a customer’s

movements has difficulties related to

privacy concerns of customers.

With scenario III location determination

or cashier selection is not needed because

the customer selects itself. With NFC,

location determination is not relevant in

any case because of the short range over

which the payment transaction occurs.

Conclusion

There might be a niche market for BLE

payment transactions because of the

payment freedom it could provide

(e.g. grab & go, pay without waiting).

However in crowded stores, stores where

a customer has never been before, large

stores, or for instance in public transport,

NFC has the advantage over BLE because

of reasons including security, cost and in-

teroperability of the payment transaction.

This conclusion can be elaborated on in

four points:

1. Even though BLE can be seen as just

11

10

12

12. Additional beacons can be a solution to alleviate this problem, because when it is crowded a signal is more likely to get blocked (lower Received Signal Strength Identification (RSSI)), while it is also more likely that another person will be present at a wrongly calculated position.

13. See also the comment made in footnote 11.

page 8

another data transfer layer and it has

similar security possibilities as NFC, the

longer distance over which a BLE payment

transaction can occur makes payment

transactions more vulnerable and

therefore less secure. This leads to risks

such as spying, hacking, DoS issues, lacking

visual feedback, etc.

2. For BLE, card present transactions

seem like a bridge too far especially

in the near future, because of the

required certification. Card not present

transactions are possible, but these are

less secure and therefore more costly.

3. The compatibility of NFC in a broader

contactless context, including contactless

payment cards, transit or access control

solutions, etc., makes NFC more widely

applicable. This already resulted in

established standards and infrastructure,

also across industries (payment and

transit), for example also with a view to

the number of contactless POS terminals

already rolled out.

4. Required investments for BLE payment

transactions, compared to NFC, are higher

at this moment in time. These investments

include beacons, POS terminal upgrades,

costumer selection tools e.g. enabling

automated facial recognition, etc.

In short, in UL’s view, compared to BLE,

NFC remains the preferred technology for

the in-store mobile payment transaction

itself, although BLE has the potential to

improve the overall shopping experience

around this secure payment transaction,

especially because of enhanced

location-based services to target

customers.


BLE and/or NFC to change shopping?

It can be stated that there is more to shopping than just the payment transaction itself, where BLE and NFC can be used for other parts of the shopping experience as well.

Location-based services BLE can locate a customer’s position in, and near, a store over time, which allows for location-based marketing and information. Some examples are: convincing customers to enter the store when they pass by, providing customers with indoor directions and targeting a specific customer with a coupon (e.g. after spending some time at the coat section they receive a coupon for 10% off coats within the next 15 minutes).

An important difference why coupon pushing could succeed with BLE, although it failed with Classic Bluetooth, is that for BLE a customer can opt in per store to avoid spamming, which turned out to be an issue with Classic Bluetooth.

With NFC it is possible to have tags around a store, to provide additional information or to pick up coupons, which also allows for targeted marketing, but with more effort required from the customer. Yet, this additional effort could be reduced by using additional technologies to reach and locate customers without the need for them to scan tags throughout the store (using SMS, Wi-Fi, etc.).

Detailed payment statistics With BLE, if payment details are not only sent to the POS terminal, but in addition also to the cloud, it is possible to link specific purchases to a customer account, like for example with a loyalty card. This allows for gathering detailed payment statistics and subsequently targeted marketing and couponing based on previous purchases. With NFC this would require an additional tap, a supporting technology and/or a loyalty application that has access to these data.

13

Contact details

UL Transaction Security

[email protected]

www.ul-ts.com

mobile payment transactions: ble and/or nfc? - ul 4 white paper - mobile payment transactions: ble...

Documents