Beware Pay by Phone Cashless Payment at Car Parks

Many cities across the world are switching over to Pay by Phone Cashless Payment at Car Parks. 

The market leader is Verrus (www.verrus.com) who has contracts in over 100 cities across UK & North America, including Birmingham, Manchester, Oxford, Westminster, York, Chicago, Dallas, Minneapolis, Seattle, Vancouver. 

In order to pay you have to use your Mobile Phone. You can set up an account beforehand via the internet, but if you are caught out in an unfamiliar location then you can set up an account there and then. 

However, this requires you standing in the middle of the street, with your phone in one hand, your credit card in the other, sending an unencrypted SMS text message. 

The message contains location (Parking Bay Number), duration of stay, your vehicle registration number, and your credit or debit card details. 

So if you want to park vehicle AB54DPN in location 8362 for 3 hours and your credit card number is 4929 1234 5678 9012 with an expiry of 0810 and security code of 279 then you send   ‘8362 3 AB54DPN 4929123456789012 0810 279’ [not my real details!] 

Verrus does not warn you that your SMS message is sent unencrypted; actually they reassure that it is safe because it is stored encrypted when it arrives at Verrus – and all the client Cities simply refer you to Verrus’ FAQs. I wonder if Verrus is storing the Security Code - because that is against PCI-DSS rules. 

As for additional costs – well it can get expensive : 

In the case instance of Westminster, in addition to the parking fee and paying for the SMS message, there is a service charge of 10-20p which is billed to your credit card. If you request an SMS text reminder when you’re running out of credit a further 10p service charge is added. 

If you have any problems juggling your texting whilst clenching your Credit Card in your teeth, you can always call to talk to a friendly person, but that’s via an 0870 number, costing you another 20-40p per minute from your cellphone.

If a subsequent attempt is made to charge your [registered] Credit Card and it fails for any reason (eg insufficient funds, card cancelled etc), then there is a chargeback fee of £15 (not sure how they aim to collect that if the Card is cancelled – I presume they get your home address from your Car Registration details?). 

Now how about the other risks : apart from the risk of eavesdropping where someone can scan and intercept your unencrypted SMS text message containing your Cardnumber, Expiry Date & Security Code, there’s an even better scam. 

Make a mock-up of a legitimate Pay by Phone notice, attach them to the back of traditional Parking Meters/Payment machines, but with your Mobile Phone number as the contact details, and you’ll have all the techno-savvy punters willingly texting you their Credit Card details, and not even know they’ve been ‘had’ until they come back to their car hours later to find they’ve incurred a parking fine for £60. You could probably harvest a 100 numbers an hour before the Parking Inspector comes around, and they’d be too excited at the prospect of generating all those Parking Fines to even notice the rogue signage. You of course discard the SIM at the end of the day and move on.    

Some locations are removing coin-operated Parking Meters, but retaining Credit/Debit Card readers; so in those instances its cheaper & safer to pay directly by Credit Card than add 10% or so to your Parking Fees. 

I did pay by Credit Card in Westminster outside the Natural History Museum and still got a Parking ticket. I presume so many people are using the Pay by Phone Service that the Parking Inspector simply looked me up on the computer, found no record of Payment and ticketed me. Unfortunately (for them), I did have the Credit Card Parking Receipt displayed on the dashboard, legible even in their own photos of my car supposedly illegally parked, so Westminster “gave me the benefit of the doubt” – excuse me there was no doubt! – and let me off. 

So hold on to those Credit Cards - don't leave home without them - and don't get seduced by new gimmicks.