RFID Possible Major Issue

[M5ward]

Originally Posted by ktlm

Simple fix to avoid that. Don't let them put your credit card on your RFID. We never let them link our credit card to our KTTW card. Those cards just get taken in and out of pockets too many times to get in and out of parks, get fast passes etc. One year DH's actually got lost at Epcot, and I have found them at fast pass machines and handed them in to CM's before. We think DH's got dropped at a fast pass run. Thank goodness Guest Services was able to cut him a new one and we didn't have any credit card linked to it so no one could use it to charge anything before Guest Services deactivated it.

Agree! I don't think I will attach a credit card to the room key anymore. There was a chip scanner group working at a mall in Philly not too long ago. I carry all my cards (RFID and other) in a (supposedly) protective card case. It also helps protect magnetic strips...or so I like to think. We usually always use cash or gift cards anyway.

[TheRustyScupper]

Originally Posted by Lewisc

. . . Hitting total should automatically also clear folio.

. . . it is purposely set up not to clear the folio (room bill is the "folio")
. . . this way, the total can be added to the other room charges
. . . the guest can then see all charges, including the new one
. . . that is why "TOTAL" keys sare not meant to clear the folio

Originally Posted by doconeill

FYI, wdwmagic.com already reports they are applying the PIN code requirement to all purchases. So there has already been one "fix".

. . . this is true
. . . but only for purchases over $50
. . . this was the ointent and written policy all along
. . . otherwise, wave the chip, grab the bag, and off you go
. . . no pin code or signature required

[doconeill]

Originally Posted by TheRustyScupper

. . . this is true
. . . but only for purchases over $50
. . . this was the ointent and written policy all along
. . . otherwise, wave the chip, grab the bag, and off you go
. . . no pin code or signature required

No, the report was that they were requiring a PIN on ALL purchases now. Unless it changed back again.

[DVC4FUN]

I no longer put a cc attached either. When I first started going to wdw I did but then a few years ago after 2 trips in a row where I found a lot of charges that were not mine on my bill at check out that was it. No way will I have a cc on my room account again. Not to mention as others have said it is way too easy to loose the room key and its not like if I use the room key for payment they do not ask to see my id proving I am the holder of the card. I actually think from now on I will purchase disney gift cards for my disney trips. Especially since I can get them at a discount at BJs and other places.

[seashoreCM]

Originally Posted by doconeill

That's generally true for RFID and even old-fashioned credit card purchases...except credit card issuers allow vendors a certain degree of latitude to not require a PIN or signature.

If the credit card issuer gives vendors a certain degree of latitude then the issuer takes the loss if the customer disputes the charge. If the vendor simply takes such latitude then the vendor takes the loss if the customer disputes the charge.

Long long time ago (before self service was invented), there was a scam at gas stations where the attendant occasionally failed to push the "clear folio" button (caption/label was different) on the pump and ran up the previous driver's credit card charge and also collected and pocketed cash from that succeeding driver.

[ccgates]

Originally Posted by doconeill

No, the report was that they were requiring a PIN on ALL purchases now. Unless it changed back again.

I can verify this is correct as of right now. We got in last Thursday for marathon weekend and were told it was only for purchases over $50, but were actually forced to for everything charged to the room.

[lockedoutlogic]

I have to throw my two on this because of my experience doing billing at WDW...

The scupper is right that this could be a HUGE issue...and no, i have no faith in any easy fixes at WDW - at least not internally.

The "cast" make tens if not hundreds of thousand charge errors there a year. it is and has always been a major problem since they went to the resort charge system. And rectifying disputes is time consuming, inconvenient, and they have never devoted enough staffing, training time, or (frankly) concern to quality control when it comes to dealing with electronic charging/money.

Its a little dirty secret.

Now, I am 10 years past my "prime" when it comes to these things...so i can only hope that they have newer, better, more efficient ways of dealing with these things.

But just to give you a bit of techno history:
the resort system was DOS based until 2004 - i believe. DOS base systems were essentially eliminated on the front lines around 1995.
The resort reader system - Vingvision 2 - had been in practice for 5 years in major hotel chains before WDW adopted it. They have at least recently gone to the touch pads - but those are pretty simple devices these days.
The "windows" system that they use now...is probably very similar to the somewhat rudimentary one they implemented back in the last decade.

And remember - since almost all transactions are electronic now - there is no way or need to balance the registers - by and large - so mistakes go largely undetected at first and then are only noticed later and cause the need for more attention, fact gathering, credit adjustment later. That is not a staffing priority.

Think of one place on Earth where you can say that they care less about who you are when you charge and do it at such volume...all the while doing it in massively crowded areas surrounded by people from 200 different countries.
You probably won't find one. Credit fraud/ error is rampant - intentional and unintentional.

And don't forget training had gone (under my direct experience) from what was almost "months" to "a few days" in a very short amount of time. Hiring standards - due to lack of qualified, willing, or skilled candidates - fell with the training levels proportionally.

So could this be a huge problem - even if its counter intuitive?

You bet your rat's....

well...you get it.

The original poster doesn't tend to post these things lightly - i would give the benefit of the doubt that this has been thought out and is valid.

And some of the more experienced posters who offered the "quick fix" and "they'll figure it out"....who are you thinking of, exactly?

WDW is a large property - it has NEVER been a technologically competent property since perhaps EPCOT went on line. Everything put into place takes more time, costs a fortune, and often is poorly maintained or the victim of massive operator error.

Fast pass - worked - but it took forever to tweak
Dining system - worked - but they took forever to put it into e-form - and they bagged it in its best form (priority seating)
gps bus routing still doesn't work right - and its been 15 years in the making.

heck, now that i think about it - how long AFTER you could book a room online at marriot or holiday inn did it take for you to be able to get one at WDW?
5? 10 years?

Their own PRIVATE timeshare club has had that ability for a big fat 1-2 years...that's pretty pathetic.

My point is that don't assume that since this thing cost a fortune and certainly LOOKS cool ( i for one would volunteer to test it with any of its features wired to my swiss bank account (more like Canadian) at any moment - because this could ultimately lead to less staffing requirements that will allow more expansion/ offerings to the clientele) - doesn't mean that it wont have big flaws and problems that could take years to hash out.

And a final note on the "the employees will be reprimanded or fired if they screw up" sentiment...
That WDW is LONG gone...it was gone 20 years+ ago. The eisner expansion of the property never took into account how hard it would be to maintain a huge work force and keep the competent ones happy...it never assumed massive health care skyrockets - it never assumed that it would have to increase wages to keep quality people - so they abandoned that long ago.
WDW staff is just a staff - it is not "elite" by any stretch.

They could build an elite, comparatively low cost staff with the glut of young kids coming out of school with no professional job prospects these days - but they've yet to see how it could be done.

Until then, trust all warning about potential problems in the system - they aren't just random musings.

[doconeill]

I understand all about legacy systems...until recently I had to keep a Windows 95 box running to run our door key entry system, because it couldn't be replaced without replacing all the readers, controllers, etc. It had been running (not continuously, mind you) for 15 years. And my dad brought me in to try and resurrect a computer that monitored one of the machines in a pulmonary function testing lab. It was a PS/2 running OS/2 - long after the PS/2 and it's MCA bus architecture died. But it couldn't be replaced without replacing the very expensive equipment as well.

Because no one writes drivers to support old hardware any more. They force you to upgrade everything.

And I'm not really questioning what Rusty says...I have long trusted his posts.

What I'm having a problem understanding is why this particular problem even exists.

I'm an IT guy with some experience in retail. I'm not familiar with any current Point-of-Sale design that keeps a "folio" open after the charge is made and authorized. And I don't see why it is desirable to do otherwise. Want to add something after the charge goes through? It's just another transaction.

The POS register should forget everything about the charge info once the transaction is authorized. And even if it didn't, when the next guest presents their band/card/whatever, it should use THAT for the current transaction.

If this is a common practice in retail it is idiotic and the retailers should be called out on it.

[lockedoutlogic]

Originally Posted by doconeill

The POS register should forget everything about the charge info once the transaction is authorized. And even if it didn't, when the next guest presents their band/card/whatever, it should use THAT for the current transaction.

If this is a common practice in retail it is idiotic and the retailers should be called out on it.

I'm not sure all retailers do this...in fact - maybe none of them do...

But that doesn't mean that WDW wouldn't either by design or complete bonehead oversight

As Mr. Spock says "All things being equal, I would tend to agree...however, things are NOT equal"

[MorganK]

In regards to the PIN system...we were there this month and never asked to create a PIN. We made multiple purchases on our KTTW, some over $50. The only time we were asked to put a PIN in was at the Poly when we bought a Dole Whip, so just a few bucks no where close to $50! I told the CM we didn't have a PIN and she pushed the transaction through somehow.

[lockedoutlogic]

Originally Posted by MorganK

In regards to the PIN system...we were there this month and never asked to create a PIN. We made multiple purchases on our KTTW, some over $50. The only time we were asked to put a PIN in was at the Poly when we bought a Dole Whip, so just a few bucks no where close to $50! I told the CM we didn't have a PIN and she pushed the transaction through somehow.

This....THIS is the WDW we've all come to know and love.

I'm sorry to say - safety/security in electronic transactions was never a priority...often they don't even bother to pay it lip service.

It just cuts into the profits by slowing things down...err...I mean..."ruins the magic"

Right.

[doconeill]

Originally Posted by MorganK

In regards to the PIN system...we were there this month and never asked to create a PIN. We made multiple purchases on our KTTW, some over $50. The only time we were asked to put a PIN in was at the Poly when we bought a Dole Whip, so just a few bucks no where close to $50! I told the CM we didn't have a PIN and she pushed the transaction through somehow.

This was an RFID-enabled KTTW card? Just want to be sure.

[yitbos96bb]

Originally Posted by TheRustyScupper

1) The pin code applies for purchases OVER $50.
2) However, if the Clear is not done, the charge goes to the other person.
3) Whether pin code needed or not.

4) And, yes, skimmers are a potential problem.
5) A BIG potential problem.

NOTE: We used to have RFID chips for access to sensitive areas at
Company Headquarters (design labs, etc). However, these were so
easily skimmed, we went back to bar codes on ID cards.

The $50 minimum for the pin is incredibly poor security. Whomever came up with that should be fired.... Truthfully all should have the PIN but at least lower to $20.

[yitbos96bb]

Originally Posted by lockedoutlogic

I'm not sure all retailers do this...in fact - maybe none of them do...

But that doesn't mean that WDW wouldn't either by design or complete bonehead oversight

As Mr. Spock says "All things being equal, I would tend to agree...however, things are NOT equal"

I'm kind of surprised this isn't some kind of PCI violation...

[yitbos96bb]

The security pro and hacker in me REALLY wants to pentest these systems. I wouldn't do it, but it just seems like a lot of holes potentially exist.

Originally Posted by lockedoutlogic

I have to throw my two on this because of my experience doing billing at WDW...

The scupper is right that this could be a HUGE issue...and no, i have no faith in any easy fixes at WDW - at least not internally.

The "cast" make tens if not hundreds of thousand charge errors there a year. it is and has always been a major problem since they went to the resort charge system. And rectifying disputes is time consuming, inconvenient, and they have never devoted enough staffing, training time, or (frankly) concern to quality control when it comes to dealing with electronic charging/money.

Its a little dirty secret.

Now, I am 10 years past my "prime" when it comes to these things...so i can only hope that they have newer, better, more efficient ways of dealing with these things.

But just to give you a bit of techno history:
the resort system was DOS based until 2004 - i believe. DOS base systems were essentially eliminated on the front lines around 1995.
The resort reader system - Vingvision 2 - had been in practice for 5 years in major hotel chains before WDW adopted it. They have at least recently gone to the touch pads - but those are pretty simple devices these days.
The "windows" system that they use now...is probably very similar to the somewhat rudimentary one they implemented back in the last decade.

And remember - since almost all transactions are electronic now - there is no way or need to balance the registers - by and large - so mistakes go largely undetected at first and then are only noticed later and cause the need for more attention, fact gathering, credit adjustment later. That is not a staffing priority.

Think of one place on Earth where you can say that they care less about who you are when you charge and do it at such volume...all the while doing it in massively crowded areas surrounded by people from 200 different countries.
You probably won't find one. Credit fraud/ error is rampant - intentional and unintentional.

And don't forget training had gone (under my direct experience) from what was almost "months" to "a few days" in a very short amount of time. Hiring standards - due to lack of qualified, willing, or skilled candidates - fell with the training levels proportionally.

So could this be a huge problem - even if its counter intuitive?

You bet your rat's....

well...you get it.

The original poster doesn't tend to post these things lightly - i would give the benefit of the doubt that this has been thought out and is valid.

And some of the more experienced posters who offered the "quick fix" and "they'll figure it out"....who are you thinking of, exactly?

WDW is a large property - it has NEVER been a technologically competent property since perhaps EPCOT went on line. Everything put into place takes more time, costs a fortune, and often is poorly maintained or the victim of massive operator error.

Fast pass - worked - but it took forever to tweak
Dining system - worked - but they took forever to put it into e-form - and they bagged it in its best form (priority seating)
gps bus routing still doesn't work right - and its been 15 years in the making.

heck, now that i think about it - how long AFTER you could book a room online at marriot or holiday inn did it take for you to be able to get one at WDW?
5? 10 years?

Their own PRIVATE timeshare club has had that ability for a big fat 1-2 years...that's pretty pathetic.

My point is that don't assume that since this thing cost a fortune and certainly LOOKS cool ( i for one would volunteer to test it with any of its features wired to my swiss bank account (more like Canadian) at any moment - because this could ultimately lead to less staffing requirements that will allow more expansion/ offerings to the clientele) - doesn't mean that it wont have big flaws and problems that could take years to hash out.

And a final note on the "the employees will be reprimanded or fired if they screw up" sentiment...
That WDW is LONG gone...it was gone 20 years+ ago. The eisner expansion of the property never took into account how hard it would be to maintain a huge work force and keep the competent ones happy...it never assumed massive health care skyrockets - it never assumed that it would have to increase wages to keep quality people - so they abandoned that long ago.
WDW staff is just a staff - it is not "elite" by any stretch.

They could build an elite, comparatively low cost staff with the glut of young kids coming out of school with no professional job prospects these days - but they've yet to see how it could be done.

Until then, trust all warning about potential problems in the system - they aren't just random musings.