The truth about contactless payments in fitness bracelets

Hi, Habr.

Recently, I quite often come across a lack of understanding of Russian users regarding contactless payments in cheap wearable electronics and the role of the NFC chip in this functionality.

All sorts of news resources play an important role in this, the authors of which thoughtlessly (or specifically, as a sacrifice to clickbate) copy each other, thinking out interesting pieces. The situation is aggravated with announcements of new devices, such as Xiaomi Mi Band 4, and news about the soon arrival in Russia of the Xiaomi Mi Pay payment system, in cooperation with MasterCard.
This post would like to dispel the misunderstanding that has developed in RuNet on this topic.

At the moment, contactless payment at the checkout, using NFC, can only a few types of devices:

• Apple Watch with Apple Pay;
• Smart watch based on the operating system from Google (Android Wear, Wear OS) with Google Pay support;
• Samsung Smart Watch on Tizen OS with Samsung Pay;
• Fitbit Pay (not working in Russia) and, perhaps, a few not popular options.

In general, there are not many such devices on the market, and, most importantly, the price for them will be a minus for many people when choosing, along with low autonomy.

A couple of years ago, models with an NFC chip began to appear on the market of various fitness bracelets and semi-smart watches. Then it began ... Journalists confuse people with the possibility of contactless payment using Alipay, not understanding how it works, they promise a quick arrival of mobile payments for each wrist. And there is still no parish. Users want to believe that just about, and very soon their cheap Mi Band 3, prudently purchased in the version with NFC, will replace their wallet. But alas.

The vast majority of such gadgets are made in China, for the domestic market. Many followed by a global market. What is the situation with contactless payment in the domestic market of China? Two technologies should be highlighted here:

1. Payment by QR or barcode. This implementation is used everywhere by the Chinese. The essence is as follows. Almost every user has a smartphone with him. In the smartphone, with a probability of 99.9%, WeChat is installed “more than just a messenger”, with its e-wallet, or the Alipay application - almost an electronic bank from Alibaba group. For payment at the checkout using these applications on a smartphone, there are two ways. Consider them.

1.1 The user scans the seller's QR code using the camera of the smartphone. Enters the required amount, or it is already encrypted in the seller’s QR code. Further confirms the transaction (password or biometrics). Money is instantly deducted from the buyer's wallet in favor of the seller. This method cannot be used on the bracelet, due to the lack of a camera.

1.2 The user shows the seller his QR / bar code generated by the wallet application. The seller "picks up" him with his hand-held cash scanner. The amount is also instantly deducted in favor of the seller. What do you need a paying gadget for this? What he has is a display and some brains. Therefore, this payment method was implemented by the efforts of Alipay. Supported wearable device is attached to the Alipay application. A separate secure account is created for it in the wallet (with a limit on payment). A static pair of codes (QR and stroke) is assigned to the gadget and entered into it. Further payment takes place offline, without the participation of a smartphone. Transactions are transferred to the Alipay server from the store's cash register. Actually, this is the only method of paying for purchases in a store in China through such devices.

2. Great and mighty NFC. Here we will talk not only about payment, but also about other possibilities of bracelets with an NFC chip. We begin, of course, with payments. Here in the first place what? Right, Security. The same mibends cannot, with their tiny controllers and cheap NFC chips, provide a reasonable level of security so that the manufacturer entrusts them with the emulation of their users' bank cards. But, here's a transport card - this is another matter. They usually do not roll kilobaksy. Actually, this is one of the main goals of the NFC chip in MiBand-like trackers. The essence is as follows. The manufacturer cooperates with public carriers (metro, city buses). In the corporate application, in the NFC functions section, the user buys a transport card for his bracelet. Virtual, of course, but for real cost - about 20 yuan (~ 200 rubles) non-refundable deposit and the rest on the balance (there is already an amount at discretion). The card is recorded in the bracelet and then completely autonomously used to pay for travel. It is very convenient, since no unnecessary gestures are needed to trigger, just put your hand up to the reader - and payment is made. The map is replenished, just as conveniently, in the bracelet application, using the same WeChat or Alipay.

Another feature that accompanies NFC wristbands is the emulation of access cards. The function is useful and convenient, but, in the same China, in modern realities rather late. I will explain why. First, NFC operates at a frequency of 13.56 MHz. Accordingly, only cards with this frequency are supported. Secondly, the case is again safe. The bracelet can read and correctly emulate only cards without encryption and, as it turned out (thanks to the forum w3bsit3-dns.com), the length of the UID should be 4 bytes. Otherwise, even if you copy the card, the reader will not open the door at the entrance to you. Here manufacturers come in different ways. For example, the MiFit application simply will not allow you to copy an unsupported card. But the native application of the Hey + bracelet copies without a twinge of conscience, everything that it can, but does not guarantee correct operation. As practice has shown, so unsafe intercom or checkpoint in China must also be searched. I did not find.

In Russia, things are better in terms of use. For example, users of the same forum confirm normal operation with the Moskvyonok pass card and with some intercoms.

There is also another interesting opportunity - to create a “clean” card, go to the management company and register it in their system. I, unfortunately, failed to test for several reasons. One of them did not leave me a single chance - the same notorious MiFit from Xiaomi to create such a card asks for confirmation of identity using a Chinese ID, which I can not have. On the whole, Chinese security does not sleep. With the Hey + bracelet, these functions are open for use, MiFit simply refuses to activate NFC features for accounts registered outside of mainland China.

On this, perhaps, finish.

All of the above is based on personal experience and logical conclusions from it.

And the conclusions are: you should not expect payment systems to appear in the class of cheap fitness trackers, even with an integrated NFC chip. Even in the light of news about the imminent launch of Mi Pay in Russia. If the same Mi Pay and will appear in the future on one of the yet not represented Mi Band, then not earlier than it is run in the native Chinese domestic market. And this is no question.

I hope this article will be useful to the community, and the Internet as a whole. Healthy criticism is welcome.