The NYNEX Change Card

by Kevin Daniel

NYNEX is currently testing a supplement to coin-operated telephones in New York City based on a disposable card technology called the "Change Card."  This article represents an analysis of this system based on information inferred from the dissection of several cards, and trials using the Landis+Gyr Type BTK12904 telephones installed in one of NYNEX's test sites.  Your mileage may vary.

  

The Change Card is a plastic card identical in size to a credit card which is dispensed from a vending machine, costs $5.00, and has an initial value of $5.25.  As calls are made using the card, the telephone subtracts value from the card and the value remaining is displayed both on the phone and the card.  Billed as freeing the customer from the burden of carrying a pocket full of loose change, I can imagine this system has a host of benefits for NYNEX such as: reduced consumer fraud, reduced employee fraud, calls paid for up front, and the transference of some billing operations from the central office to the individual telephones.

The Change Card is made from reflective infrared reader and electrical discharge writer technology.  On the face of the card is a highly reflective metallic strip covered by a protective layer of white infrared-transparent ink.  It is on this strip that all card validation and value information are encoded.  Validation bits are encoded as a series of areas of high and low reflectivity in the left-most 2 centimeters of the stripe.  Value information is encoded as the length of the high reflectivity area starting from the end of the validation section and extending to the right-hand edge of the card.

When a Change Card is first inserted into a telephone it is locked into place and scanned left-to-right by the phone's read/write head.  If the validation fails the card is immediately ejected, otherwise the scan continues until it hits the next area of high reflectivity.  A new card has a value stripe beginning at about 2.2 centimeters from the left hand edge and running 6 centimeters.  Upon placing a call the phone will fire a spark across the write head converting the underlying area of high reflectivity to low and scarring the white protective layer displaying remaining value to the user.  Value is removed immediately at the time of connection and then following each billing period until the call is terminated.

The system protects against fraud by performing a read-after-write sequence, if the write has not occurred the phone automatically and immediately terminates the call and ejects the card.

The system also protects against card tampering/damage by skipping over value bits which have been damaged or blown out of sequence, reducing the value of the card to that of the next readable value.  Other anti-fraud measures implemented on the test site devices include: physical capture of the card during calls, separation of the handset from the signal path prior to connection, and the blocking of 900 number calls.

The Change Card system is simple but highly evolved tamper resistant technology that would seem to have few possible areas of compromise.  Although currently only available in units of $5.25, who knows what secrets the validation codes hold.