Ever since Google Pay rolled in, I’ve dreamed of the day when I could just leave my wallet home. This dream was crushed fast, when, in 2018, I’ve downloaded an app that was supposed to emulate NFC / RFID tags and cards. It was some sort of generic “Wallet” app (I think it was called just “Cards” or something simular). I’ve added my bus card to the app, went to the bus, tried to pay with phone and nothing. Luckily, I had my physical card in pocket, so the humiliation wasn’t so bad. This, however taught me that the bus card wasn’t just simple NFC tag with ID. Over next few years I’ve spend a lot of time trying to reverse engineer the card. Ultimately, Transdata (the authority over most of bus cards in Slovakia) rolled out a Google Pay implementation (albeit at that time it was useless to me, but we’ll get to it).

How paying fare works here.⌗

Before I’ll start explaining why this is so amazing, I should probably do some introduction to how fare system works in Slovakia. In Slovakia, there are two types of bus companies – MHD (Mestská Hromadná Doprava – City Public Transportation) – those provide bus service to inner city - urban transport. We won’t care about them in the scope of this article, mainly because they usually have their own fare systems, incompatible with the one we actually care in this article. The one we care are usually called SAD (Slovenská autobusová doprava - Slovak bus transport) – their job is to service suburbs, villages, and other areas. It is important to notice that neither MHD nor SAD is singular company. Every town usually have one – for example for city of Žilina there is MHD Žilina responsible for transportation inside of Žilina and then there is SAD Žilina responsible for areas outside of the town. SADs usually use a solution from company called Transdata, which gives them choice to integrate their cards to network, so, for example card issued by SAD Žilina works in SAD Prievidza’s bus and vice-verse. Now those cards issued are not a simple NFC tag with one text ID as a record. Those cards are NXP’s MiFare DesFire cards. The difference between standard NFC tag and NXP’s solution is, that regular NFC tag is dumb. MiFare cards have actual MCUs that do some cryptography and have apps! Yes, an RFID card with APPS! This is the reason why I couldn’t emulate it with that generic app. Each of those “apps” has their function – for example – holding the information about charge of the card – this is mostly legacy from the times when there was not widespread mobile internet connection and you used to charge you card only at POS in SAD building, or by giving money directly to driver, allowing internet independent card use. The card can also hold other types of info – for example – MiFare chips are being used in Slovak ISIC cards as a combo Student ID / Train card / Bus card – the issuer in this instance is directly Transdata, not any particular SAD, but since they all cooperate, it is possible to use the card on SADs.

Times change…⌗

In modern times, it is common to recharge bus cards online. So, how does it work? It’s quite simple. The first clue came from a warning on the transaction page, stating that it could take up to 30 minutes for the card to be charged after completing the transaction. Through my reverse-engineering adventures, I discovered that the terminal inside of bus synchronizes its internal database with the server and then writes out new data to app responsible for holding charge data. If there is no internet connection, the system refers to its internal database and if it sees difference between it and card, it will write it out (or maybe it uses the data already stored in card, I haven’t got this far yet). However, if the card is charged and immediately used, the terminal may not be aware of the new card status due to a lack of synchronization or an absent internet connection. In such cases, you’re out of luck. Hence, the 30-minute waiting period for card charging exists for this reason.  

How Google Pay changed it all⌗

About two years ago, Transdata announced, that trough theirs mobile app “Ubian”, SADs could issue a new type of card – “Virtual” card. When I first saw this, I was excited. It meant I can finally leave my wallet home, right? Well no. At that time, I’ve already started vocational (IT) school and they issued ISICs. Due to legal reasons, however, ISICs and other Student ID can be only issued as physical card, so yet again, I couldn’t just leave my wallet home. After that, I forgot about this and moved on. The idea of getting a virtual SAD card came to my mind again when I graduated and thus my StudentID was revoked. So, I decided to create the card and it acted just as I was expecting – like normal card with display showing real-time charge of the card. I started to tinker with this card though in unusual ways. At this point, I was familiar with Japan’s SUICA system and Transdata solution really reminded me of this. In Japan, you can charge your virtual SUICA card with physical money – you can use the machine that charges normal physical cards and instead of card, you put on the cardholder your phone – easy right? Well, I tried this in Slovakia and to my surprice – it works! This just cemented in my mind that the phone emulated full entire chip even with charging capabilities (or maybe when charging online, google pay creates “virtual” NFC channel and just sends APDU commands the same way as the terminal would? Could be, or it’s simple memory manipulation, who knows…). This really blew my mind. So, I started tinkering even more! In Žilina’s Mirage shopping mall, you get certain discount (usually 10-25%) for rides in SADs. For each 10 rides you are eligible for one coupon. I tried to print out one coupon with my phone and it worked as well! It showed correct amounts of rides and the most interesting part is that you could see when the terminal interfaced with card, because Google Pay popup would show up!

So, how is this better than rest of Europe?⌗

If you look at Wikipedia for Google Wallet and check „Fare payment method(s)“ column, you can see that most of the solution rely on Payment cards. But that’s nothing special, we emulated payment cards years ago! What sets this solution apart is its ability to integrate seamlessly into legacy systems and still finction flawlessly – similar to the Japanese Suica system!

Final remarks⌗

During this research, I contacted Transdata. Alongside the questions that I used in the article, I asked if they’re planning on releasing this on Apple Pay, as it’s not currently available. They mentioned that their partners are still working on this and clarified that the emulation of NXP cards is a product co-developed and co-launched by Google and NXP together. Since July, I switched to an iPhone, so I can’t use the virtual card yet again. But that’s fine, as I’m moving to a whole another country soon

Sources:

[1] Email to me by TransData, received 26. 7. 2023 12:25.

[2] Google Wallet. (n.d.). Retrieved August 30, 2023, from https://en.wikipedia.org/wiki/Google_Wallet