Fraud and costs of the OV Chipkaart System

By Jeroen van der Ham 

Early this year, there was a storm surrounding the security of the OV-chipkaart. It soon emerged that there was quite a lot wrong with the security of the card itself. It turned out to be fairly simple to raise balances, lift blocks or make other adjustments to the card. Programmes had appeared on the internet that allowed the card to be modified, and journalists and MPs took advantage of them. Trans Link Systems (TLS), the central company behind the OV-chipkaart, said it found the abuse fairly quickly in its back-office system. To gather data, the cards were left untouched, but were blacklisted after about two weeks anyway and a report was filed. Since then, there have been some more fraud cases, but it is still limited to about 50 cases per day, according to TLS. Fraud with anonymous OV-chip cards can be detected and blocked, but tracing the culprit is difficult. However, thanks to the fraud detection system, this abuse would not be rewarding. Abuse against which little can be done at present is checking in at home. On trains, it is currently impossible to detect whether an OV-chip card has been legitimately checked in or not. Even in the back-office system, this kind of abuse cannot yet be detected.

Ultimately, for transport companies, the fraud is simple arithmetic. There was abuse with the paper ticket and there is now abuse with the OV-chip card. The latter is more difficult, but in most cases also quicker to detect and undo. Recharging balances at home is almost not worthwhile because the card will be blocked quite soon, after which a new card has to be used again. The same arithmetic is used to transition to the next generation card. The little abuse there is now outweighs the extra cost of rolling out the new card quickly. Unfortunately, what is not yet included in this sum is the cost of running and maintaining the fraud detection system. This is a system that was previously unnecessary and is now becoming a vital part of the entire OV-chipcard system. Fortunately, it is currently the case that misuse of cards does not harm legitimate customers. As far as we know, it is not possible to steal credit or data from others, or to disable OV-chip cards. However, the cost of misuse is ultimately borne by all customers; this was the case before. We must unfortunately conclude that those who want to travel anonymously will suffer. The abuse will be used as an argument to keep the price of the anonymous card high.

Source: Public transport chip card fraud report, Trans Link Systems, February 2011.