Canada-based coffee and fast-food chain Tim Hortons has launched what is believed to be the first commercial NFC mobile-payments service using host-card emulation.
Tim Hortons is enabling customers to tap to pay with their BlackBerry 10 smartphones with a mobile version of the chain’s closed-loop Quickpay Tim Card, which is similar to the Starbucks Card from the rival coffee chain.
Tim Hortons announced the service Thursday, noting it is available in its new TimmyMe mobile app for the BlackBerry Q5, Z10, Z30 and Q10 smartphones. Users would register their reloadable Tim Card accounts in the app and would then be able to tap to pay at the majority of Tim Hortons locations in Canada and the U.S. on the same terminals that accept MasterCard PayPass and Visa payWave, a Tim Hortons spokeswoman told NFC Times.
The application would be stored in the app, not on a secure element. The chain has 3,500 locations in Canada and more than 800 in the U.S.
Although support by Google for host-card emulation in the latest version of its mobile operating system, Android 4.4, dubbed KitKat, is getting most of the attention, the technology has been available on the BlackBerry platform since 2011. The handset maker officially calls the technology virtual-card emulation, though has also referred to it as host-card emulation, the term used by Android, a BlackBerry source noted to NFC Times.
“This is a commercial launch, not a pilot or test,” said the BlackBerry source. “It is the first deployment of it's type that I'm aware of.”
Tim Hortons said it would expand the NFC service to Android 4.4 devices. It also announced trials of a 2D bar-code-based payments service for Apple and Android devices, including in some of its U.S. locations. The bar-code mobile payments service appears to be similar to the successful service using QR codes Starbucks rolled out in the U.S. three years ago.
Canada’s largest bank, Royal Bank of Canada, is testing its RBC Secure Cloud service, which also uses host-card emulation. That will probably use both Android and BlackBerry phones.
But some observers believe that when it comes to payments, host-card emulation is better suited to closed-loop schemes, which don’t require as much security as open-loop transactions, certainly those complying with the EMV standard.
Host-card emulation allows the NFC controller chip to communicate directly with the application processor in smartphones instead of only with a secure element–for NFC services that use card-emulation mode. It means payment and other applications, such as loyalty, couponing and ticketing, could be stored in apps or in the cloud and use the same contactless terminals that chip cards and secure-element-based NFC phones use.
That could enable service providers to avoid working with mobile operators and their NFC SIM cards, or device makers and their embedded chips.
The Tim Hortons spokeswoman told NFC Times that the implementation stores encrypted track-2 data for the card account on the phone.
“This allows for the security we require but also allows for offline usage of the payment app,” said the spokeswoman. “When a user taps to pay, we take the data from the encrypted store on the device and make it available through NFC using host-card emulation. Once the transaction is complete, we remove the track-2 data from the NFC (controller) chip, ensuring you can't accidentally pay.”
Clearbridge Mobile provided the BlackBerry 10 app and HCE implementation, according to the spokeswoman. First Data processes the transactions.
While such major payment schemes as Visa, MasterCard and American Express, are actively evaluating the technology, they have granted no waivers or certifications. A source told NFC Times that U.S.-based issuer Capital One, which dropped out of the Isis Mobile Wallet project last September, is believed to have pulled back from its pursuit of HCE implementation, waiting for the technology to mature.