NFC TimesThe premier source for news, analysis and commentary on
Near Field Communication and all contactless technology

Large coffee shop chain Starbucks has announced it is expanding its iPhone mobile-payment service, enabling consumers to pay for their caffè lattes or caramel macchiatos by flashing a 2-D bar code on their phone screens.

The huge chain, which has more than 16,600 stores globally, most in the United States, announced yesterday it has expanded the mobile service to more than 1,000 U.S. outlets, located within Target discount retail stores. All are equipped with scanners to read 2-D bar codes that link to customers' prepaid Starbucks Card accounts.

The bar-code technology is an alternative to Near Field Communication, which requires handsets equipped with NFC chips–of which there are few available. The Starbucks m-payment service only requires the user to own an Apple 3G iPhone.

But among other things, payments and NFC industry observers point out that the service also requires expensive 2-D bar-code scanners in every store, and the technology is less secure than contactless chips.

Consumers can download the Starbucks Card Mobile app to their iPhones or iPod touches for free to use the payment service. The application also enables them to check their card-account balances and easily reload value into the accounts over the mobile network using preregistered credit cards. A separate app offers a store-locator service. Starbucks launched a trial of the mobile-payment app last fall in 16 stores in its home base of Seattle, Washington, as well as Northern California.

Contactless-Free Shops
The nationwide expansion–although amounting to fewer than 10% of Starbucks locations in the U.S.–is significant, and the chain is likely to expand further and branch out to other phone models, such as BlackBerrys or those supporting the Android operating system. And if Starbucks becomes attached to using bar-codes for payment, it could pose a challenge to NFC and other contactless-mobile technology.

Starbucks has resisted attempts for years by Visa Inc. and MasterCard Worldwide to convince it to accept contactless payment at its U.S. stores, in large part because it promotes its own prepaid store payment or gift card, said a source. If Starbucks were to invest in contactless terminals to accept cards and, later, mobile-contactless payment, it would do so to support the Starbucks Card, not Visa’s contactless application payWave or MasterCard's PayPass, said the source. But Starbucks has yet to install any contactless terminals in the U.S. to support its closed-loop payment scheme. Some Starbucks in a handful of countries outside of the U.S. do accept contactless payment, including payWave and PayPass.

As for NFC, there are still few phones available that support the technology. Meanwhile, bar codes are already used for mobile couponing and ticketing, since most phones can support the technology. A key reason mobile couponing hasn’t taken off, however, has been the cost of getting the scanners installed at the retail point of sale, say observers. Scanners that read UPC product bar codes often cannot read 1-D bar codes on phone screens. In addition, screen resolution differs among phone models.

For example, one U.S.-based loyalty-system provider, Tetherball, abandoned bar codes in favor of contactless stickers for its offer to fast-food chains and similar merchants, calling contactless more quick and reliable than bar codes.

But screen resolution is not a concern for Starbucks, which is offering the mobile-payment service only on iPhones, at least for now. It is also using 2-D barcodes, which can store more data than conventional bar codes. This requires higher-end optical scanners, however.

“It’s rather costly on the equipment side,” said Charles Walton, executive vice president and chief marketing officer at France-based chip supplier Inside Contactless, told NFC Times. That’s one reason it’s unlikely bar-code based mobile payment will spread broadly across retail chains, he contends.

But he said he doesn’t believe Starbucks’ use of bar codes will hurt prospects for mobile payment using NFC phones, contactless microSD cards or stickers consumers can attach to their handsets.

“I think what it does is it begins to move this whole industry to phone-based stuff for consumers,” Walton said.

Stealing Bar Codes
Still, mobile couponing using bar codes is one thing, payment is another. Security becomes more important when consumers are spending money. And although Starbucks Card accounts are strictly prepaid and can only be used at Starbucks cafés, the risk of losses from fraudsters attacking mobile-payment applications are obviously greater than for mobile coupons.

Mobile payment from NFC phones or other contactless chips in phones would be much more secure than bar codes because bar codes are easy to copy, noted NFC industry observers. A fraudster would basically just have to take a picture of the bar code to copy it.

"2-D bar codes have no encryption," Einar Rosenberg, CTO of NFC application house Narian Technologies, told NFC Times. "If it (bar code) doesn’t change dynamically, the bar code image could be easily stolen and taken into Photoshop to create a fake image that you could load up on your iPhone and, therefore, steal somebody’s money."

The Starbucks Card Mobile App could include a feature that changes the bar code images frequently to deter cloning. But if the changes are sent over the network, the effectiveness of the dynamic security would depend on the network connection, said Rosenberg. In any case, 2-D bar codes are not even as secure as magnetic-stripe payment cards, which are often copied.

“(There is) no authentication of either participant of the transaction possible without some form of network-based authorization,” said U.S.-based payments specialist Patrick Gauthier, formerly senior vice president for innovation for Visa International. "So your security with a 2-D code is about as good as what you get with mag-stripe (cards) without the benefit of the issuer-supplied cryptogram."

He added that no bank or open-loop payment card network, such as Visa or MasterCard, would support putting full track-2 magnetic-stripe data, including the cryptogram, in a 2-D bar code because of security concerns. "For that reason, I am highly skeptical of the Starbucks solution for anything other than a closed-prepaid product," said Gauthier. 

Starbucks Card Mobile accounts can be reloaded automatically from registered credit cards, which could create more losses if accountholders didn't report their phones–or bar codes–lost or stolen. Starbucks did not immediately respond to a request for comment on the security issues involved with the bar code-based payment. In its press material, the chain does say customers can lock their apps with a pass code.

The Bar-Code Challenge
Gauthier does see QR codes and other 2-D bar codes possibly challenging NFC. For example, 2-D bar codes could take the place of NFC’s service discovery mode, in which NFC phone users can tap their phones against RFID chips in smart posters to download data or open an Internet connection. This would require new phones packing NFC chips and posters embedded with RFID tags.

Instead, with most any camera phone, users can snap a picture of a 2-D bar code printed on a billboard or product package. They send the image over the network, where it’s checked against an online database. Requested data, such as arrival times for buses or companies located in a particular building or a list of pesticides used in the growing of a farm product, get sent back to the phone. QR, short for “quick response,” codes are popular in Japan among mobile subscribers. 

But using bar codes are more time-consuming than tapping NFC phones. Subscribers have to open the bar-code application, take the picture and hope the network isn’t already overloaded with data traffic, said Gauthier. He believes bar codes and contactless-mobile technology will likely coexist, as they do today in Japan.

“So while Starbucks’ (mobile-payment) expansion is great news for iPhone and coffee lovers, I don’t think it is very relevant in the long run,” Gauthier told NFC Times. “My sense, though, is that if logic prevails you will see a combination of 2-D and NFC.”

But bar code-based mobile payment does have one advantage over NFC. The technology is on the market today. Whether Starbucks sticks with it or eventually moves to NFC or any other mobile-payment technology will likely depend on just how fond customers become of paying for their lattes with their mobile phones.