Hello, Habr.
Recently, I often encounter misunderstandings among Russian users regarding contactless payments in cheap wearable electronics and the role of the NFC chip in this functionality.
This is largely influenced by various news resources, whose authors thoughtlessly (or perhaps intentionally, sacrificing to clickbait) copy each other, adding interesting features. The situation is exacerbated with the announcements of new devices such as the Xiaomi Mi Band 4 and the news about the upcoming arrival of the Xiaomi Mi Pay payment system in Russia in partnership with MasterCard.
With this post, I would like to dispel the misunderstanding that has arisen in the Runet on this topic.
Currently, only a few types of devices are capable of making contactless payments at the register using NFC:
- Apple Watch with Apple Pay;
- Smartwatches based on Google's operating system (Android Wear, Wear OS) with support for Google Pay;
- Samsung smartwatches on Tizen OS with Samsung Pay;
- Fitbit Pay (not operational in Russia) and possibly a few other lesser-known options.
Overall, there are not many such devices on the market, and, importantly, their price will be a drawback for many, alongside their low battery life.
A couple of years ago, various fitness bracelets and semi-smartwatches began to emerge with NFC chips. That's when it all started... Journalists confuse people with the possibility of contactless payment through Alipay, not understanding how it works, promising the imminent arrival of mobile payments on every wrist. But that arrival has yet to happen. Users want to believe that their affordable Mi Band 3, thoughtfully purchased in the NFC version, will soon replace their wallet. But alas.
The vast majority of such gadgets are produced in China for the domestic market. Many later expand into the global market. So how does contactless payment work in the domestic Chinese market? Here, two technologies should be highlighted:
1. Payment using a QR code or barcode. This implementation is used widely in China. The essence is as follows. Almost every user has a smartphone with them. On that smartphone, there is a 99.9% chance that they have installed "more than just a messenger" WeChat, with its electronic wallet, or the Alipay app — essentially an electronic bank from Alibaba group. There are two methods for payment at the checkout using these apps on a smartphone. Let’s consider them.
1.1 The user scans the seller's QR code using the smartphone camera. They enter the required amount, or it is already encoded in the seller's QR code. Then, they confirm the transaction (using a password or biometric). The money is instantly deducted from the buyer's wallet in favor of the seller. This method cannot be used on a bracelet due to the lack of a camera.
1.2 The user shows the seller their QR/barcode generated by the e-wallet app. The seller "scans" it with their handheld cash register scanner. The amount is also instantly deducted in favor of the seller. What does the payment gadget need for this? What it has — a display and some processing capability. Therefore, this payment method was implemented with the efforts of Alipay. The supported wearable device is linked to the Alipay app. A separate secure account (with a payment limit) is created for it in the wallet. A static pair of codes (QR and barcode) is assigned to and stored in the gadget. Then, payment occurs offline, without the involvement of a smartphone. Transactions are sent to server Alipay from the store's cash register. In fact, this is the only method of payment for purchases in stores in China using such devices.
2. The mighty NFC. Here, we will discuss not only payments but also other capabilities of bracelets with NFC chips. Let's start, of course, with payments. What's most important here? Correct, security. Those weak Mi Bands, with their flimsy controllers and cheap NFC chips, cannot ensure a reasonable level of security for manufacturers to trust them with emulating users' bank cards. However, transport cards are a different story. They typically do not hold large amounts of money. Essentially, this is one of the main goals of the NFC chip in Mi Band-like trackers. The concept is as follows. The manufacturer collaborates with public transport operators (metro, city buses). In the official app, within the NFC functions section, the user purchases a transport card for their bracelet. A virtual one, of course, but for a real cost—about 20 yuan (~200 rubles) as a non-refundable deposit and the rest for balance (the amount can vary). The card is recorded on the bracelet and is then used autonomously for fare payment. It's very convenient because no extra motions are needed; just bring your hand to the reader—and the payment is made. The card can also be topped up easily in the bracelet app using the same methods as WeChat or Alipay.
Another function that accompanies bracelets with NFC chips is access card emulation. This is a useful and convenient feature, but, in China, it is rather delayed by modern realities. Let me explain why. First, NFC operates at a frequency of 13.56 MHz. Consequently, only cards with this frequency are supported. Second, it’s again a question of security. The bracelet can only read and correctly emulate cards without encryption and, as it turns out (thanks to the 4pda forum), the UID length must be 4 bytes. Otherwise, even if you copy the card, the reader at the entrance won't open the door for you. Manufacturers take different approaches here. For instance, the MiFit app simply won't let you copy an unsupported card. But the native Hey+ app shamelessly copies everything it can but does not guarantee correct operation. As practice has shown, finding such an unsecured intercom or access point in China is quite rare. I haven’t found one.
In Russia, the situation is better in terms of usability. For example, users on the same forum confirm the normal operation with the 'Moskvyonok' pass card and some intercoms.
There is also another interesting possibility – to create a 'clean' card, go to the management company, and register it in their system. Unfortunately, I was unable to test this for several reasons. One reason left me with no chance – the infamous MiFit from Xiaomi requires verifying identity using a Chinese ID for creating such a card, which I cannot provide. Furthermore, overall, Chinese security is vigilant. While the Hey+ bracelet has those functions available, MiFit simply refuses to activate NFC functionalities for accounts registered outside mainland China.
I'll conclude on this note.
All of the above is based on personal experience and logical conclusions drawn from it.
The conclusions are as follows: one should not expect the emergence of payment systems in the realm of cheap fitness trackers, even with an integrated NFC chip. Even in light of recent news about the upcoming launch of Mi Pay in Russia. If Mi Pay does appear in the future on one of the yet-to-be-released Mi Bands, it won't be before they test it on the domestic market in China first. And that's not even on the horizon.
I hope this article will be useful to the community and the Runet as a whole. Healthy criticism is welcome.
Source: habr.com
