RFID Possible Major Issue

In regards to the PIN system...we were there this month and never asked to create a PIN. We made multiple purchases on our KTTW, some over $50. The only time we were asked to put a PIN in was at the Poly when we bought a Dole Whip, so just a few bucks no where close to $50! I told the CM we didn't have a PIN and she pushed the transaction through somehow.

This....THIS is the WDW we've all come to know and love.

I'm sorry to say - safety/security in electronic transactions was never a priority...often they don't even bother to pay it lip service.

It just cuts into the profits by slowing things down...err...I mean..."ruins the magic"

Right.
 
In regards to the PIN system...we were there this month and never asked to create a PIN. We made multiple purchases on our KTTW, some over $50. The only time we were asked to put a PIN in was at the Poly when we bought a Dole Whip, so just a few bucks no where close to $50! I told the CM we didn't have a PIN and she pushed the transaction through somehow.

This was an RFID-enabled KTTW card? Just want to be sure.
 
1) The pin code applies for purchases OVER $50.
2) However, if the Clear is not done, the charge goes to the other person.
3) Whether pin code needed or not.

4) And, yes, skimmers are a potential problem.
5) A BIG potential problem.

NOTE: We used to have RFID chips for access to sensitive areas at
Company Headquarters (design labs, etc). However, these were so
easily skimmed, we went back to bar codes on ID cards
.

The $50 minimum for the pin is incredibly poor security. Whomever came up with that should be fired.... Truthfully all should have the PIN but at least lower to $20.
 
I'm not sure all retailers do this...in fact - maybe none of them do...

But that doesn't mean that WDW wouldn't either by design or complete bonehead oversight

As Mr. Spock says "All things being equal, I would tend to agree...however, things are NOT equal"

I'm kind of surprised this isn't some kind of PCI violation...
 


The security pro and hacker in me REALLY wants to pentest these systems. I wouldn't do it, but it just seems like a lot of holes potentially exist.

I have to throw my two on this because of my experience doing billing at WDW...

The scupper is right that this could be a HUGE issue...and no, i have no faith in any easy fixes at WDW - at least not internally.

The "cast" make tens if not hundreds of thousand charge errors there a year. it is and has always been a major problem since they went to the resort charge system. And rectifying disputes is time consuming, inconvenient, and they have never devoted enough staffing, training time, or (frankly) concern to quality control when it comes to dealing with electronic charging/money.

Its a little dirty secret.

Now, I am 10 years past my "prime" when it comes to these things...so i can only hope that they have newer, better, more efficient ways of dealing with these things.

But just to give you a bit of techno history:
the resort system was DOS based until 2004 - i believe. DOS base systems were essentially eliminated on the front lines around 1995.
The resort reader system - Vingvision 2 - had been in practice for 5 years in major hotel chains before WDW adopted it. They have at least recently gone to the touch pads - but those are pretty simple devices these days.
The "windows" system that they use now...is probably very similar to the somewhat rudimentary one they implemented back in the last decade.

And remember - since almost all transactions are electronic now - there is no way or need to balance the registers - by and large - so mistakes go largely undetected at first and then are only noticed later and cause the need for more attention, fact gathering, credit adjustment later. That is not a staffing priority.

Think of one place on Earth where you can say that they care less about who you are when you charge and do it at such volume...all the while doing it in massively crowded areas surrounded by people from 200 different countries.
You probably won't find one. Credit fraud/ error is rampant - intentional and unintentional.

And don't forget training had gone (under my direct experience) from what was almost "months" to "a few days" in a very short amount of time. Hiring standards - due to lack of qualified, willing, or skilled candidates - fell with the training levels proportionally.

So could this be a huge problem - even if its counter intuitive?

You bet your rat's....

well...you get it.

The original poster doesn't tend to post these things lightly - i would give the benefit of the doubt that this has been thought out and is valid.

And some of the more experienced posters who offered the "quick fix" and "they'll figure it out"....who are you thinking of, exactly?

WDW is a large property - it has NEVER been a technologically competent property since perhaps EPCOT went on line. Everything put into place takes more time, costs a fortune, and often is poorly maintained or the victim of massive operator error.

Fast pass - worked - but it took forever to tweak
Dining system - worked - but they took forever to put it into e-form - and they bagged it in its best form (priority seating)
gps bus routing still doesn't work right - and its been 15 years in the making.

heck, now that i think about it - how long AFTER you could book a room online at marriot or holiday inn did it take for you to be able to get one at WDW?
5? 10 years?

Their own PRIVATE timeshare club has had that ability for a big fat 1-2 years...that's pretty pathetic.

My point is that don't assume that since this thing cost a fortune and certainly LOOKS cool ( i for one would volunteer to test it with any of its features wired to my swiss bank account (more like Canadian) at any moment - because this could ultimately lead to less staffing requirements that will allow more expansion/ offerings to the clientele) - doesn't mean that it wont have big flaws and problems that could take years to hash out.

And a final note on the "the employees will be reprimanded or fired if they screw up" sentiment...
That WDW is LONG gone...it was gone 20 years+ ago. The eisner expansion of the property never took into account how hard it would be to maintain a huge work force and keep the competent ones happy...it never assumed massive health care skyrockets - it never assumed that it would have to increase wages to keep quality people - so they abandoned that long ago.
WDW staff is just a staff - it is not "elite" by any stretch.

They could build an elite, comparatively low cost staff with the glut of young kids coming out of school with no professional job prospects these days - but they've yet to see how it could be done.

Until then, trust all warning about potential problems in the system - they aren't just random musings.
 
Agree! I don't think I will attach a credit card to the room key anymore. There was a chip scanner group working at a mall in Philly not too long ago. I carry all my cards (RFID and other) in a (supposedly) protective card case. It also helps protect magnetic strips...or so I like to think. We usually always use cash or gift cards anyway.

I wouldn't trust those cases all that much. I've seen some interesting demos at some hacker cons...
 
PCI compliance is sidestepped, as its not a direct credit card transaction. It's merely a "room charge". Credit card transaction doesn't occur until you check out/check in. If you can't access credit card info from the pos, it likely isn't a PCI issue.
 


If it can result in fraudulent charges that the customer may dispute with the credit card company, it could still be a PCI issue. But it's the credit card companies themselves that allow no-verification transactions up to a certain amount, which varies from vendor to vendor.
 
So we don't HAVE to link a credit card to it correct? We're still able to pay for purchases with cash/debit/credit card at the store/restaurant?

We're planning our first trip and this is just adding to my list of stress ;)
 
So we don't HAVE to link a credit card to it correct? We're still able to pay for purchases with cash/debit/credit card at the store/restaurant?

We're planning our first trip and this is just adding to my list of stress ;)

absolutely...no problem

disney just encourages/embraces the room charge concept...supposedly for your "convenience" and "guest demand"...

they also use those reasons for every single decision...good or bad.

but anyone with a functioning ganglion knows that its for their benefit...i'll give you the two most obvious reasons:

1. Terminal Charges: the retailer (traditionally...american banks now seem to think they have the right to pass it on to us - even if we are deducting form our own money) pays a charge each time it processes a transaction through the network - the visa/mastercard and amex being the most widely used...
By using the room charge system - they "pool" your charges, then run it en masse...saving money on the aggregate

2. because a card with mickey mouse on it is not subconcsiously linked to YOUR money. people spend more on the roomie charges - big shocker. If you have to continually flash a visa logo...eventually the reality that you're getting big fat, interest bearing bills in 30 days sets in...and you ease back.
A cute mickey card - you don't...


now it will be a cute mickey wristband...for lots of tshirt, hats, stationary and iphone cases that will look quite silly back in wisconsin at the end of the week.
 
If it can result in fraudulent charges that the customer may dispute with the credit card company, it could still be a PCI issue. But it's the credit card companies themselves that allow no-verification transactions up to a certain amount, which varies from vendor to vendor.

It's not a PCI issue. Card holder data is sidestepped in the whole process. The non-verification transaction is to the room charge, not directly to the credit card. That is the the beauty of it. As mentioned above, your charges are pooled on your lodging folio. You then sign off on the whole charge at your front desk, likely on your reg card when you check in.

PCI compliance merely regulates card security. You may be thinking of the merchants credit card agreement which dictates the rules of credit acceptance. An RFID bracelet is no different than a kttw card, it's merely different media.
If a Cm could pull your un-truncated credit card number from the system, then you'd have a PCI issue.
 
I wouldn't trust those cases all that much. I've seen some interesting demos at some hacker cons...
Its false security. Anyone resourceful enough to build a skimmer is resourceful enough to acquire the info before it even becomes attached to your account/folio. There is no doubt a box full of the rfid bracelets waiting to be issued at any of the resort front desk areas. The bracelet likely has the code printed on the bracelet. An unscrupulous CM could just as easily hand that info over to a crook for a few bucks while no one is looking.
Ultimately there isn't a going to be a lucrative market for items that are going to be stolen. I doubt there is a band of gypsies that is acquiring cases of cheeseburgers from Pecos bill's using stolen rfid tags, then selling them on the black market.
Retail items may have some limited resale. Since these tags will be for lodging guests, I'm guessing a large majority of items will be sent back to their room and are not taken from the store by the buyer. Shipping to your resort accommodations provides a validation step.
So ultimately the big worry is worrying about gate admission and other experiences that the bracelet would gain you access to, and that will likely have other validation. I belt you'll find the bracelets will have some visual fraud detection features so gate workers have a better chance to see false ones.
You also find that you probably won't be able to load a gift card using the bracelet along with any other value transfers.
So I'm not saying it can't be done, but the risk versus the reward for it seems like it will be less of an issue than one might think. Crooks will take the path of least resistance that gives the largest gain. There are likely better opportunities to defraud folks in such a broad concentration of tourists, with less folks watching than a place like Disney.
 
Its false security. Anyone resourceful enough to build a skimmer is resourceful enough to acquire the info before it even becomes attached to your account/folio. There is no doubt a box full of the rfid bracelets waiting to be issued at any of the resort front desk areas. The bracelet likely has the code printed on the bracelet. An unscrupulous CM could just as easily hand that info over to a crook for a few bucks while no one is looking.

Several problems with this.

1) Attempting to use an RFID code that has not been activated will raise red flags

2) Attempting to use an RFID code that does not have charging privileges will raise red flags

3) The majority of the RFID codes will have a limited lifetime, and if obtained in advance the lifetime won't be known

4) Other information about the purchaser might be available at the POS terminal.

Much better to hang out at a retail location, pick someone that just made a purchase that fits the requirements, and skim.

An "unscrupulous" CM could probably just as easily associate an additional RFID code to the account. Or for that matter, they already have your CC and personal information, which is TONS more valuable to a thief.

It IS possible to cover the device in a material that would greatly reduce the range at which it can be read. Not perfectly though.
 
Several problems with this.

1) Attempting to use an RFID code that has not been activated will raise red flags

2) Attempting to use an RFID code that does not have charging privileges will raise red flags

3) The majority of the RFID codes will have a limited lifetime, and if obtained in advance the lifetime won't be known

4) Other information about the purchaser might be available at the POS terminal.

Much better to hang out at a retail location, pick someone that just made a purchase that fits the requirements, and skim.

An "unscrupulous" CM could probably just as easily associate an additional RFID code to the account. Or for that matter, they already have your CC and personal information, which is TONS more valuable to a thief.

It IS possible to cover the device in a material that would greatly reduce the range at which it can be read. Not perfectly though.
1-3 are all valid points but aren't what I was suggesting a crook would do.
Example would be for the crook to ask for the rfid's of a few guests checking in on that day. Adding another rfid tag to an account that was then used for fraud would track back to who assigned it to the account getting them in hot water.
Pci compliance will mean that very few people will have your full credit card info other than those that actually touch the card. Of course that is a risk any place you use your credit card. Ultimately that has nothing to do with the RFID technology. PCI compliance for a merchant the size of disney must be tested by external sources on a regular basis to make sure certain folks have access to non-encrypted credit card info as well as resisting outside threats.
My point is simply that there are low-tech ways to compromise the rfid technology, and one need not HAVE to skim the rfid's to compromise your account. Loss from folks gaming the rfid system will be no greater than the current KTTW key system. It is just different media.
In order to game the rfid system, you need to skim the rfid. Re-create the rfid, package it for use, then buy stuff in a way that can't be tracked and do it in the span of time someone is at the resort. As you pointed out, using one of somebody that isn't checked in or have active charging privileges will generate a red flag. What is going to be worth stealing that warrants that cost/risk?
I do not see where any identity theft issue can come from getting a guests RFID tag, do you?
 
I just have to say...i love this thread.

real things...technology, security, operations, and potential problems...

yes...there are problems all over WDW...and discussion isn't to just harp on them...somewhere deep down we all hope they are addressed & solved.

So much better than "How magical is Wishes?" and "Tell me about POR"

those have been covered 3.6 million times


ok...carry on:drive:
 
The more and more I think about this, the less likely I want to attach a card to the band. I usually use a debit card and Disney GCs when I go down, but the convenience of the band was luring. I guess I'll find out soon when I head down in a few weeks.
 
The more and more I think about this, the less likely I want to attach a card to the band. I usually use a debit card and Disney GCs when I go down, but the convenience of the band was luring. I guess I'll find out soon when I head down in a few weeks.

Hmm...that brings up another thought. But the way these threads have gone lately, a disclaimer:

I HAVE NO INFORMATION THAT THIS IS THE CASE, OR THAT DISNEY HAS EVEN THOUGHT OF THIS

Now that that is out of the way... ;)

What about a "loadable" feature on the bands? Rather than using a gift card, you could have the ability to load $20 or whatever onto the band to use much like a gift card.

Speaking of which, what I'd REALLY like is some sort of gift card-like feature for my kids, where I can do something like put $20 on the card but have a "leeway" for a bit more, so that they don't have a problem when they are a couple dollars short...but I'd want to be able to "unload" the remainder.

Or, for that matter, (RFID/PIN code issues aside) give them a room charge privilege with a similar limit.
 
Depends a little on their lost property laws. The tech is there. Some states will not allow you to "re-load" a gift card, only issue a new ones (banking regulation hurdle, but most states are coming around on this issue). Honestly, that would be a feature I'd be worried the most about skimmers. If the state does not allow re-loading, you'd either have to issue a new bracelet, or you could conceivably add a removable "charm" for the bracelet with gift card functionality(using mag stripe tech or rfid). Allowing children to be able to freely charge to a room can be an adventure for the parents and the CM helping them decipher. If they allow a credit card backing, and you choose a debit card, you really are asking for some pain if you allow your child to charge to it. Of course that is a parenting issue, rather than a tech issue.:laughing:
 
Depends a little on their lost property laws. The tech is there. Some states will not allow you to "re-load" a gift card, only issue a new ones (banking regulation hurdle, but most states are coming around on this issue). Honestly, that would be a feature I'd be worried the most about skimmers. If the state does not allow re-loading, you'd either have to issue a new bracelet, or you could conceivably add a removable "charm" for the bracelet with gift card functionality(using mag stripe tech or rfid). Allowing children to be able to freely charge to a room can be an adventure for the parents and the CM helping them decipher. If they allow a credit card backing, and you choose a debit card, you really are asking for some pain if you allow your child to charge to it. Of course that is a parenting issue, rather than a tech issue.:laughing:

My point is if I can place independent limits on the child charges (like my $20+overage idea), then it shouldn't be an adventure. Especially if they give me the itemized list by name.
 
*NikkiBell* said:
The more and more I think about this, the less likely I want to attach a card to the band. I usually use a debit card and Disney GCs when I go down, but the convenience of the band was luring. I guess I'll find out soon when I head down in a few weeks.

I would suggest that you never use a debit card at WDW...there are too many false charges and mistakes there on any given day to not make it worthwhile...
 

GET A DISNEY VACATION QUOTE

Dreams Unlimited Travel is committed to providing you with the very best vacation planning experience possible. Our Vacation Planners are experts and will share their honest advice to help you have a magical vacation.

Let us help you with your next Disney Vacation!











facebook twitter
Top