Quick Reference (QR) Codes were first developed in the mid-1990s to track parts in assembly lines and their low cost and ease of development have made them attractive to multiple sectors ever since. QR Code prevalence has grown significantly since the ascent of smartphones and more recently under the pandemic, fueled by improved usability and a desire for more contactless experiences.
However, are they well suited to help transit operators and authorities deliver a better transport ticketing service for their passengers?
The rise and rise of QR Codes
It is no surprise that QR Codes have recently become more common. Since the onset of the pandemic, more consumers have become aware of the potential transmission risk from touching surfaces in public, increasing their desire for true touchless travel experiences. Many businesses have also encouraged patrons to go contactless wherever possible. A recent survey found that 67 percent of people believe QR Codes help make a contactless life a reality. In 2020, 72 percent of U.S. and U.K. consumers reported they had used a QR Code in the past month and by March 2021, approximately 60-65 percent of people were using QR Codes regularly for any given use.
Several public transportation agencies have deployed QR Codes for ticketing. Initially, they seem attractive. QR Codes are quick and cheap to develop and deploy – a bonus when working with tight budgets. Also, many consumers recognize them and they can be displayed and scanned by nearly every smartphone. However, these factors also contribute to their inherent security risks – more on this later. Compared to paper/token-based ticketing, QR Codes offer a step forward in providing a touchless experience for passengers.
However, the question of whether QR Codes are a viable long-term ticketing solution depends significantly on their ergonomics and security.
Usability and performance issues with ticketing
Supporting social distancing and better crowd management is a focus for transit agencies. Ticketing terminals are a crowding bottleneck, so a quick, seamless experience is essential for passenger flow. In the short-term, convenient ticket validation will help incentivize passengers back onto public transport. In the long-term, effective passenger flow enabled by frictionless ticketing will also help escalating crowds, as 70 percent of the world’s population could be set to be urbanized by 2050.
So, do QR Codes provide this experience? For ticket validation, users need to position a QR Code at the correct angle and distance from the reader. On Smartphones, they need to be opened, unlocked, have sufficient power and ensure the code displayed clearly and brightly. Not only is all this a hassle, but when things go wrong, it can create huge crowds in minutes.
QR Code readers at turnstiles are also highly vulnerable to degradation. Consequently, stations risk having ticketing gates being put out of action quickly, exacerbating crowding concerns.
Security threats of QR ticketing
Alongside poor ergonomics, the long-term unsuitability of QR Codes lies in their security. Fueled by their accessibility and low-cost means, QR Codes have become widely used by fraudsters and targeted by hackers.
If passengers need to scan a QR Code as part of a ticketing solution, there is a real risk they could become victims as they scan malicious codes to inadvertently download malicious software or make compromised payments. According to a consumer poll, 71 percent of people cannot tell the difference between a legitimate or malicious QR Code and 35 percent are unaware that QR Codes are used by criminals. In Japan, a well-known branch of convenience stores suspended its QR payments app for this very reason, and in China, QR Code pickpockets are a significant concern.
A crucial objective of ticketing systems is to reduce fraud and lost revenue. However, there’s a potential risk that hackers can exploit QR Code APIs to create fake tickets. This threat became a reality for a Manchester (UK) bus company in 2019. This incident saw hackers exploit a security flaw in the company’s ticketing app, which they claim was made easy as the operator had been more concerned about low-level threats, such as customers taking screenshots of QR Code tickets.
With cost a crucial factor for decision makers, the security issues of QR Codes for ticketing mean that despite low initial costs, longer-term spending may be higher as agencies deploy resources to mitigate risks and maintain passenger trust.
Now more than ever, operators and authorities need a solution with inherent strong security alongside frictionless ergonomics. Consequently, transit agencies could turn to NFC contactless solutions based around open standards to support a more future-proofed ticketing ecosystem.
NFC and open standards: the longer-term foundation for ticketing
Given the importance of a frictionless ticketing experience, the ergonomics of NFC support a more viable long-term solution compared to QR Codes. NFC ticketing validates transactions in only 120ms, meaning passengers only need to ‘tap-and-go’ whether they’re using a smartcard or a smartphone. NFC-contactless devices draw their power from the reading terminal – so even if a phone’s battery is flat, they are still usable and won’t leave passengers stuck. This quick, reliable validation compared to QR Codes helps ensure a smooth passenger flow at ticketing barriers, mitigating crowding now and in the future as urban populations grow.
Open standards are important as they support a scalable, cost-effective approach compared to black-box, proprietary solutions, which leave little flexibility and risk vendor lock in. The accessibility of open standards means smarter ticketing is open to any device and any solution, supporting seamless integration with additional services as urban transit transforms, such as with Mobility-as-a-Service (MaaS) and account-based ticketing (ABT). Also, as the technology and urban mobility landscape evolves, the ticketing community can respond effectively thanks to the innovative, competitive ecosystem fueled by open standards. Conversely, QR Codes have remained relatively static over the years and are unlikely to change in response to the challenges facing urban mobility.
In cities across 27 countries, the Calypso Networks Association ticketing community is helping provide the backbone to contactless ticketing solutions through open standards. In Montréal and Quebec, Canada, where the Société de transport de Montréal (STM) operates North America’s third-largest public transit network, 4.5 million Calypso-enabled OPUS smartcards support 1.6 million daily and 35 million monthly validations. Also, Calypso’s secure elements have helped reduce fraud for STM. Calypso technology has also helped gradually shift the city’s passengers away from cash and unlock a smarter ticketing ecosystem with features like remote fund loading, enabling greater flexibility and convenience for passengers.
Facing the future with confidence
QR Codes are a step in the right direction for digital ticketing, so it is likely that the industry may see more short-term deployments as networks seek a ‘quick-win’. However, as crowds return and the need for a more frictionless ticketing experience grows alongside robust passenger trust, QR Codes might not be viable. In the 1990s, studies assessing alternatives for paper and magnetic-based ticketing dismissed QR Codes in favor of chip-based technology. Very little has advanced since then that suggests QR Codes have overcome longstanding challenges.
To guarantee a future-proof ticketing solution that is scalable and cost effective, yet balances effective ergonomics and security, decision makers should look to NFC technology shaped by open standards. Whether it is for smartcards, m-ticketing or wearables, the accessibility of open standard NFC specifications presents a gateway for agencies to a smarter, integrated and secure ticketing ecosystem built on the sustainable foundations of passenger convenience, security and trust.
---------------
QR Code™ is a registered trademark of Denso Wave Incorporated.
Philippe Vappereau is the chairman of the Calypso Networks Association.
