Disney changes policy for MyMagic+ RFID 'touch to pay' PIN code requirements

[bgraham34]

^That^
And thats not different from the tags that are in all Key’s to the World now, and have been since what last year, or last summer. If your credit card was on that card they were equally at the minimal risk people are worried about now.

But your credit card information is not stored on the card its in the Disney system. Also if you purchased something with your card they usually want it signed or show an ID in some cases. Using the RFID wristband they wont require that, just a pin. So someone could usually steal the RFID information on the wristband. It is just a good security measure.

 

[RAXIP]

Great. I'm glad they realized someone could steal a card and with no pin needed, they could, very quickly, rack up quite a balance on someone's account with those less than 50.00 charges.

Pretty sure that is not the reason for the change, as the PIN is only necessary if you use the tap-to-pay system and is not needed if you swipe the card the old way.

The policy change probably has to do with this:
http://www.disboards.com/showthread.php?t=3042694

RFID Possible Major Issue

1) Training is now going on for RFID purchases.
2) There are some REALLY cool things, both for WDW and the guest.
3) But there is a major OOPS on its way.
4) At the end of a transaction, the casher has to hit a Clear Folio button.
5) This is different than Total button the casher will hit at end of purchase
6) If this button is not pushed.
. . . transactions are continued on the RFID chip (room charge)
. . . all future transactions are continued on the same RFID chip
7) So, as an example,
. . . Fred buys his souvenir, casher missed Clear Folio button, and Fred leaves
. . . Sue comes by and gets a souvenir - - - and Fred gets the bill
. . . Alfred comes by with a souvenir - - - and Fred is paying
. . . Nancy comes by for a souvenir - - - you guessed it, Fred is paying
8) Until Clear Folio is depressed, the same person pays for all transactions.

9) Word to the wise when making ANY purchase with RFID chip
. . . make sure you SAVE the receipt (even when buying a Coke at a cart)
. . . make sure the register person depresses the Clear Folio button

This is probably a temporary change until the POS system software can be updated.

 

[scmit02]

After two billion someone finally decided to run it past internal audit.

Ha...the death of nextgen...it wasn't SOX compliant.

 

[asianway]

Ha...the death of nextgen...it wasn't SOX compliant.

If that post from DIS is true sounds like it failed. How the HELL do you implement a point of sale system without thorough testing in a test environment before going live?

 

[BwanaBob]

If that post from DIS is true sounds like it failed. How the HELL do you implement a point of sale system without thorough testing in a test environment before going live?

It is all still in test modes... installing readers throughout property, yes. Go live?... pending.

 

[alissafalco]

Here is a simple example of the ease of stealing from an RFID http://www.ehow.com/how-does_5772197_do-scan-credit-cards-purse_.html

I recently saw a report by Georgia Tech students on how easy this is to do. The pin is a good thing.

Oh jeez, now I have to wrap my bag in tin foil??? What next?

 

[alissafalco]

With all the hoopla going on over the past few days at least this is a good thing. Punching in a 4 digit code should not slow down transactions in most cases.

Like the OP mentioned about CC and DC transactions at the grocery store, gas station or other retail locations do not require signature or authorization for charges under $50 in many locations now. I personally do not like this and rather sign or somehow prove it's me.

At all the gas stations on Long Island if you pay with your credit card you have to type in the billing zip code of your credit card for the transaction to go through. I used to think it was a pain to have to do, but now I dont think twice about it. To have to type in a pin # is even better security than a zip code. I think you should have to type in a pin for any charge you make on a card. That would bring down theft enormously. I wouldn't have a panic attack the next time I lost one of my credit cards.

 

[dreamfinder]

Was down there last week. Was a bit surprised when I checked in and they said the PIN was for $50+, and then a few days later when I actually tried to use the RFID it required the PIN.

 

[dreamfinder]

Just wondering how close do you have to be to make a charge with RFID's??? This isn't a matter of people walking to close to a charge machine and getting randomly charged is it??? I haven't seen this stuff in person yet so I may be way off base. BTW I don't like anything that makes it to easy to pay a pin is fine and just takes a second.

They have the sensitivity set to pretty low. You need to almost touch (if not touch) the sensor for it to be read. Tapping our door with my wallet w/KTTW inside wouldn't work, but if I opened the wallet so only a few pictures were between the card and the door, and then tapped, it would work.

This was a recent change and is still being communicated. Pin is required for all transactions right now.

Understandable since its pretty new. I was more perturbed when the BoG Lunch registers (that we had just swiped the Rose on to activate it) accepted the RFID KTTW (Mickey glowed green) but then the CM said "Nope, not working. You need to swipe it."

 

[larathydo]

Hey folks,

For the record, I'm presently staying at the Port Orleans Riverside resort and obviously was issued an RFID key card upon checkin. At no point was I asked to issue a pin, granted this was ~2-4 days prior to the announcement that the pin would become mandatory.

I went to the Fountain View ice cream shop in Epcot a day or so ago and it asked me for a pin code. I still didn't have one setup, so the cashier just swiped the card (by the way - they were asking me to put in my PIN code for a Snack entitlement, so looks like any food-related entitlements will eventually require the PIN too - haven't had that issue with Quick service, granted they weren't using RFID so far as I could tell yet). PIN verification for any merch purchases I can understand, but it feels stupid to have to put in a pin code for a 2.50 snack or whatever.

Perhaps someone else can confirm this is actually the case (not sure if its just an "excuse" because noone is familiar with the system yet) but my resort's front desk also mentioned that the deluxe resorts are only presently participating in the RFID pin code thing, so they told me to say to any vendor that our resort has not been setup for pin codes yet and they would need to be swiped?

It's too bad Disney can't wave that requirement for DDP entitlements for convenience/speed since food-related purchases as one would think they are not extremely expensive if you have to raise a dispute by someone making a charge to your card. Food queues can be long enough as it is, so it's too bad they don't keep the quick "tap" mentality of RFID.

In brighter news, I'm loving the cards to get in to our room (but unfortunately I'm using an AP to get into the parks, so I can't speak to that part of the experience)

 

[Cosmic Commando]

Understandable since its pretty new. I was more perturbed when the BoG Lunch registers (that we had just swiped the Rose on to activate it) accepted the RFID KTTW (Mickey glowed green) but then the CM said "Nope, not working. You need to swipe it."

How are we going to swipe our wristbands, then when the whole thing is running???

 

[Figment2005]

Pretty sure that is not the reason for the change, as the PIN is only necessary if you use the tap-to-pay system and is not needed if you swipe the card the old way.

The policy change probably has to do with this:
http://www.disboards.com/showthread.php?t=3042694


This is probably a temporary change until the POS system software can be updated.

I'm not sure what POS system that user was talking about or how old it is, but I have been using the new system at Epcot for about a month now and i have never had to hit a clear folio button at the end of a transaction
Besides educating the guests, the only complaint I have is that I can't take multiple types of payment for the same transaction. If a guest wants to buy 3 items, 2 with cash one with credit, I have to make 2 physical transactions instead of 1. This is what could potentially make the new system a hassle for guests.

 

[dreamfinder]

How are we going to swipe our wristbands, then when the whole thing is running???

At that point no swiping will be required. You will tap and go. (The rose is a tap as well, but only works on one side, something they neglected to tell us when they handed it to us). The POS RFID terminals have a CC swipe slot, a little LED display, a little keypad, and then the big glowing Mickey head. Guests that don't have RFID enabled payment methods, will be able to swipe their card in the swipe slot. The LED display tells you to enter your PIN, the keyapd is used to enter the pin (I'd imagine that would apply for debit transactions as well?) and the Mickey head is where you would tap the RFID enable payment methods. The tap works the same as a swipe. When you swipe a card the reader head gets the info from your card. With RFID the tap transmits the data the system needs to identify you and process the transaction.

 

[flavious27]

This was one of the only things that I had a problem with the wristbands. No one would be able to get your card number, but they could have found a way to make spoofed bands and then buy a large amount of stuff at DtD that would be sold later on. A PIN would stop that from happening.