Card, mobile credential, payment and security
User education, card material important to success
It may seem easy: tap the card against the reader and wait for the door to unlock. That’s the basic premise behind contactless smart cards for physical access control.
Contactless technology is touted as being more durable than magnetic stripe systems because there’s no direct contact with a reader that could cause damage to the card. All the components of a contactless card are safely tucked away inside the card body.
This is true, for the most part, but contactless issuers also need to make sure cardholders are properly educated on how to use and care for the card. This spring, Quinnipiac University, Hamden, Conn., experienced what seemed to be an unusually high number of problems with its contactless cards.
At most a couple hundred students have had issues, primarily when using the card to gain access to the dorms, says John Meriano, Quinnipiac’s section vice president for Administrative Services.
“It’s the strangest thing, it’s like we had this little hot spot of card problems,” said Meriano. “We were hoping that it was due to one rogue reader, but that wasn’t the case.”
Instead of being a technology problem he labels it a problem with educating the students on proper card maintenance.
Bending contactless cards can lead to problems with the antenna and chip, explains Meriano. There are still individuals who use their plastic cards to scrape ice of windshields, pry open doors and conduct a variety of other damaging acts. At Quinnipiac they even had a card come in with teeth marks, he says.
The failure rate of contactless cards can range from .25% to 5%, says Brad McGoran, principal engineer at Exponent Inc., a company that test cards and readers for durability, reliability and conformance to industry standards.
He explains that these rates are comparable to magnetic stripe cards because failure rates are less a product of the ID technology than the actual card.
“Failure rates of these technologies are dominated by the failure rates of the underlying card body itself,” McGoran says. “The failure of the card body can be expected to affect the magnetic stripe or contactless card equally. We have seen cards returned from the field that have suffered partial or full cracks through the card structure that in turn severed the magnetic stripe or embedded contactless antenna.”
HID Global estimates that its contactless cards can have a 10-year lifespan and some of the newer technology can last 20-years, explains Stephane Ardiley, senior product marketing manager at the company.
Like McGoran, she says that the key is the card body material. PVC is designed to last for two to three years but polycarbonate has a 10-year lifespan, Ardiley says. Composite cards made of a combination of PVC, polycarbonate and other materials can last five to 15-years.
For magnetic stripe environments, card fracture and surface wear are the dominant failure modes, McGoran explains. “Due to their usage profile, contactless cards do not generally experience the same amount of wear as magnetic stripe cards, but there is a trade-off as they do have their own distinct failure mode, namely chip and antenna breakage,” he says. “We have seen antenna and/or chip breakage occurring in some populations, especially when cards are subjected to abnormal stress.”
Magnetic stripe cards can suffer other failures beside damage to the physical stripe, Ardiley says. “The mag-stripe is sensitive to external magnetic fields,” she adds.
Blackboard, which supplies the campus card system at Quinnipiac, says that contactless has higher reliability and is faster than magnetic stripe, says Jeff Staples, vice president of marketing and business development at Blackboard. “Reliability of that transaction is important, whether the student is buying a soft drink or sitting outside the dorm at 2 am,” he says.
Exponent recommends cardholder education to help prevent failure of internal circuitry that can arise when cards are hole-punched, excessively bent or used as ice scrapers.
“From a durability perspective, Exponent has subjected purely contactless cards to a wide variety of tests in which the card structure has failed with relatively few corresponding adverse effects on the embedded chip itself,” McGoran says.
HID tests the chip and antenna on each card before it’s issued to make sure there’s no failure, Ardiley says. This means when a card fails it has to do with damage in the field or other issues. HID also offers issuers a lifetime warranty on it cards in case there is a problem.
Blackboard also tests its cards before they are issued to students and when cards come back they undergo a lab test to see what happened. Blackboard doesn’t offer a warranty but will resolve issues if there is a manufacturing problem.
Problems can also arise when the card uses both magnetic stripe and contactless, Staples says. One school had both technologies on the card and different departments used the IDs differently. One was using the magnetic stripe for physical access and had a hotel-style lock–one where the card is dipped down. With some students–likely those that used a bit extra torque on their dipping motion–this caused stress on the chip and antenna and lead to problems with the contactless interface.
Such issues convinced Blackboard to work proactively with schools to educate students on card care, Staples says. “You need basic requirements for care and handling … if I bend a contactless card excessively, there is a likelihood of damage,” he says. “We see improvement as deployments progress because students become aware of how to take care of these cards.”
Outside of problems with the cards, schools also need to know that the components of the systems–different readers–are interoperable, McGoran says. “Compliance of disparate components with industry standards does not always ensure interoperability of those components since the standards often are written to have flexibility,” he adds. The convenience of flexibility has the potential be the downfall of interoperability.”
Exponent recommends that schools purchase components from reputable manufacturers and to do testing to make sure they work properly in the system. “With proper pre-deployment component and system-level testing however, agencies and issuers can help guarantee the proper reliability, functionality and success of their programs,” McGoran says.
