"Integrating Secure and Smart Card Technologies into On-line Cashless Gaming Solutions for Clubs and Casinos
- The Importance of Building a Flexible, Customer Driven Platform -
Cashless gaming has become a euphemism for using plastic cards to store or access monetary value for use in traditional gaming / poker machines. The ramifications of introducing a card in this context are wider reaching than one might first suspect.
The gaming industry is interested in systems that make it easier for people to play machines. Features which promote the use of other leisure and entertainment services on offer and/or make it easier for operators to manage their facilities are desirable options.
The replacement of cash is not, in fact, the central issue, so the term, "cashless gaming" is perhaps misleading. In reality we are looking at the advantages of plastic card based gaming systems. Whether or not cash is partly or completely replaced will be determined through the natural evolution of the market.
The following are broad parameters that a card based gaming system must satisfy. Whilst not exhaustive, these parameters are critical to viable system introduction:-
2. SYSTEM CONCEPT AND HISTORY
The last few years have seen a marked increase in the trend toward installing on-line gaming machine monitoring and management networks. Motivation for the installation of such networks has either come from individual gaming managers focused on maximising the performance of their installed base of gaming machines or Government jurisdictions focused on ensuring that gaming operations are well regulated and taxation revenues well controlled. The traditional use of such networks for promotional concepts has thus expanded to encompass these higher level demands.
Given this trend - a card based gaming system may be viewed as a further natural extension of these networks. The card based gaming system provides players with a centralised host account which is accessed from the gaming machine by inserting a plastic card with a machine readable secure ID number. The number accesses the appropriate account and the system down loads the account balance to the machine's credit meter as an on-line transaction. The machine is then played just as it is today. Once play is complete and the player chooses to cancel his/her credits, the system transfers all remaining credits back to the central account. We refer to such a gaming transaction as "Account Play".
With the card now used as an implicit part of gaming cashflow, card utilisation rates will be much higher than has been the case with traditional promotional systems. This new card usage profile will pave the way for the introduction of Return On Investment (ROI) link and bonus systems providing progressive rewards and incnetives linked to players' Accounts. Increased turnover will result in addition to reduced venue costs and better customer service.
Account Play requires the network to transport actual value rather than loyalty points and management data. Network security must therefore be appropriately enhanced. The communications network is already closed and must now be encrypted and shielded such that it cannot be physically or virtually interfered with. There are State wide networks that already meet these security criteria by virtue of their regulated compliance.
The Account Play concept was first introduced in Victoria, Australia by Tabcorp Holdings Ltd (Licensed State Gaming Operator) in 1992. Over 8000 Account Play machines were installed across 250 sites with a total of over 6 million cards issued making this the largest card based gaming operation in the world.
Being an on-line network, Tabcorp's system architecture did not demand off-line memory storage capability on the card, save for the ID number. Importantly, the ID number could not be susceptible to duplication, alteration or erasure. The card technology chosen to meet these requirements was Watermark Magnetics. To date, there has not been one instance of card fraud in Tabcorp's system - testimony to the quality of overall network security and, in particular, Watermark Magnetics card security.
Tabcorp's solution was not easily transportable to the Club / Casino environment as it was structured around a mainframe based wide area network rather than a stand alone venue model. Nevertheless, its basic concept, with some key implementation modifications, was precisely what the NSW Club market wanted.
3. VENUE MODEL
To determine the most appropriate implementation of Account Play within an individual gaming venue, Security Magnetics Pty Ltd (SM) embarked upon an intensive consultative process focusing on the leaders of the NSW Club industry and, in particular, the members of the Club Gaming Council of Australia, an organisation recognised for its proactive position with respect to new gaming technologies and systems.
This process involved understanding the core business of Clubs in NSW and precisely what they needed out of a card based gaming system. The results were definitive and very simple.
We begin with any one of the existing player tracking and loyalty networks. Most Clubs, not all, take advantage of the promotional aspects of these systems. Some of the leading Clubs are using these systems primarily for on-line data retrieval and machine management.
The presence of these networks defines the operating environment - ON-LINE. The overwhelming trend in Club gaming is the installation of such on-line environments. Similarly, Australia's Casinos either have installed or intend to install such monitoring / promotional systems.
Accepting that one can adequately secure the data network, we must now look at the key system parameters, namely : security, cost effectiveness and non-threatening convenience and how the system can be configured to meet those requirements. Importantly, the Account Play strategy is independent of the on-line network chosen. All suppliers of such networks eg Aristocrat, IGT, Tattersalls, VLC etc can adapt their systems to facilitate the following Account Play structure:-
3.1 Each machine is fitted with a card reader. Ideally the reader should be fully integrated rather than residing as an add on box to the side of the gaming machine.
3.2 The reading device should be fully motorised. This achieves three objectives.
3.2.1 It makes usage of the system very easy (people are used to ATMs and so will not experience any functional/operational difficulties).
3.3 Cards are used as a means of identification only. No value is stored on the card. This offers two major benefits:-
3.4 To eliminate the risk of card number duplication which would result in unauthorised player account access, the card technology chosen is Watermark Magnetics. Watermark Magnetics technology was developed by Thorn Secure Science International over 25 years ago. Watermark tape laminated onto a plastic card, in the same way a magnetic stripe is applied to credit cards, provides each card with an individual ID that cannot be copied, altered or erased. Having been exhaustively tested by a number of internationally recognised laboratories and adopted for access control by the British Ministry of Defence, The Australian Department of Defence, British Telecom and many other high security facilities around the world, Watermark Magnetics has established a solid reputation as a secure card technology. This technology offers the card based gaming application, and provided Tabcorp with, a number of benefits:-
4. ACCOUNT PLAY - MARKETING ISSUES
The model described in Section 3 works. This, however, is not enough. No matter how technically perfect a system may be it is only as good as the turnover it generates relative to existing gaming products.
The following section shows that when introduced by professional gaming managers, Account Play has the potential to both increase turnover and reduce overhead costs - a very attractive proposition for venue managers.
Experience from Victoria however, suggests that if such a system is introduced incorrectly, it can have a negative effect on turnover. We have learned from the Victorian experience and have modified the marketing model accordingly.
4.1 Traps for the uninitiated
When Tabcorp first introduced Account Play gaming in Victoria they were instructed by the Government of the day that the gaming machines should not be recognisable as traditional NSW Poker Machines. Further, the games themselves should be similarly unrecognisable. By introducing a machine that looked more like an ATM than a gaming machine, only accepted cards (not coins or notes) and ran games developed in-house - Tabcorp Ltd successfully achieved its objectives and was rewarded with staggering financial results from 220 machines at a single "Tabaret" site located in the Melbourne CBD.
The rules of the game were then changed allowing an expansion of gaming into Clubs and Hotels throughout the State. Also, another operator was allowed entry (Tattersalls). Tabcorp and Tattersalls were each allowed 50% of the installed machine base. Tabcorp already had an Account Play system of its own which it proceeded to roll out. Tattersalls purchased a monitoring network and its quota of gaming machines from existing industry suppliers.
When put up against traditional gaming machine products that had been developed over the last 40 years in NSW, the Tabcorp gaming package ran second. As the card was the most easily identifiable difference between the two products, the concept of card based gaming (or cashless gaming) was publicly blamed. The real problem was that the Tabcorp designed machines and games were intentionally different from proven gaming machine products. When forced to compete with proven products, Tabcorp's inexperienced game designers not only had to battle with more seasoned companies, but had an ATM rather than a gaming machine to work with. So, ironically, it was despite the use of cards rather than because of them, that the Tabaret system ran second.
In addition to the basic product problems, the marketing strategy was flawed. It was confrontational to ask of the players that they make a choice between card and coin machines. People do not want to think about such matters - they simply want to play their favourite machine. Had all payment options been on their favourite machine, the story would have been very different.
4.2 Venue and Player Motiviation
Card based gaming offers several benefits to both the venue operator and the player.
It is therefore incumbent on the Venue to introduce its new strategy in such a way that the players satisfy their own objectives, by delivering the desired operational outcomes to the venue. This can be achieved with a phased introduction and enhanced customer service.
4.3 Account Play - Venue Introduction
Rather than replace coin mechanisms and bill acceptors with card readers, card readers are added to the existing, popular machines to complement traditional payment options. Whereas before the card was limited to providing players with bonus points etc, now the card has other uses.
A typical player would enter the venue and begin play by feeding a machine with coins or inserting a note into the machine's bill acceptor. In the past if a player won a jackpot or simply wanted to move to another machine there were three options:-
Common to all three scenarios is inconvenience for the player, machine down time and overhead costs for the operator. With a card reader on each machine and a modified Account Play network, the following scenario is possible without the player ever being required to consciously choose between cards and cash.
As for (c) above but the system now detects whether or not a valid card is present. If not, an attendant is automatically paged. When the attendant comes to the machine, he/she inserts a card into the reader and completes the cancel credits. This automatically opens an account against the Watermark Number in the central system and transfers the credit meter total to that account. The player is then handed the card and the attendant explains that they can simply put that card in another machine to immediately transfer their credits to that machine or they can go to the cashier with the card, hand it over and cash out their credits.
Importantly, at no stage is the player required to choose between playing with cash or playing with the card. Nor is the player required to give ID unless they choose to avail themselves of the other benefits on offer. Over a short time it will become intuitively obvious to the player that it is simply easier to use the card. Through natural evolution, the coin mechanism will disappear leaving a bill acceptor and a card reader. It is now evident in the NSW gaming environment that the rate of change will be determined individually by each venue. Until cash is eliminated from the general community (not likely for a long time), this will remain the most practical and cost effective machine configuration.
The venue can continue to offer all sorts of benefits to identified card holders but will also offer anonymous cards for those who do not want their spending habits tracked. The elimination of coins, book pays and ticket printers will substantially reduce venue overhead costs and the elimination of machine down time will further act to increase turnover. Accidental overpays and/or fraudulent activity will be virtually eliminated by removing the human element from pay out processes.
Players will no longer need to bother with coins and will have the added convenience of rapid secure machine payouts/transfers and the added incentive of built in promotions and benefits associated with the card.
The critical issue is the provision of an environment that allows choice and lets the players dictate the pace of change as demonstrated by their usage patterns and as monitored by the venues' on-line systems.
4.4 Value Added Card Marketing Ideas
The Watermark card is introduced into venues to provide a secure mechanism enabling Account Play. Once circulating within the venue, the card can be put to many more uses.
5. ISN'T THERE A TREND TOWARDS SMART CARDS ?
Smart card technology facilitates a whole new range of innovative, beneficial card based opportunities. To its detriment, over eager proponents have represented the technology as a solution for a number of applications for which it is not ideally suited. The media have latched onto a number of these issues and in the process have misrepresented some excellent applications.
The "cashless society" is no more a likelihood today than the "paperless office" of the mid to late '80's. This classic misconception has driven many to argue that the Electronic Purse (EP) card is ideal for replacing cash in gambling venues.
Our work with smart cards has centred on the telecommunications industry with the supply of SIM cards for GSM mobile phones. We are also working with the Financial industry, the Health Sector and with a range of specialist companies focused on Internet access control and the portability of X.509 Digital Signatures for secure Electronic Document Interchange and e-commerce. For these applications, smart cards provide a secure, cost effective solution to a number of complex issues. Common to all is the requirement for off-line, secure data processing.
Security Magnetics Pty Ltd is uniquely positioned to provide the full range of card technologies available. Our focus is therefore on providing consultative services to various industry sectors so that the right card technology selection can be made for a given application specification.
The specification presented in Sections 2 - 4, clearly demonstrates that smart cards do not present a cost effective solution to the specific requirements of the gaming industry. There is a need, however, to explore this issue further.
One of the most common questions asked by machine manufacturers and venues alike is, " How will the emergence of EP cards impact the gaming environment and would it not make sense to take advantage of the wider community infrastructure by adapting the internal gaming environment to utilise the same card ?"
On the face of it this sounds reasonable. It is not until one studies the security architecture and performs a cost benefits analysis on such an approach that the proposition becomes more and more difficult to support. Moreover, the basic premise ie that there will be a wider community infrastructure for EP's, is yet to be proven.
The needs of venues with respect to card based systems implementing Account Play cannot be met by current EP schemes. The following sub-sections summarise the prevailing logic and explain the ultimate inter-relationship between closed, Account Play venue systems and open EP schemes.
5.1 Card Costs - Too High
The reloadable EP cards cost several dollars per card.
Why pay for technology and features that need not and will not be used?
It is inconceivable that a gaming venue would purchase large volumes of cards at such a price, particularly for anonymous players, without requiring a deposit to ensure the card's return. Such an obstacle violates the basic requirement that the system should be non-threatening and easier (not more difficult) to use than cash. More than that, the venue ideally wants to give away as many cards as it can both to promote the venue and to offer potential sponsors an attractive advertising proposition.
It has further been suggested that chip cards could provide secure access into an account using the same system architecture as the proposed Watermark solution. This would simply involve using the "unique" serial number of the chip card as an account identifier. It should be noted that chip serial numbers are burnt into the silicon by the module manufacturers of which there are a large number around the world. Opportunities for serial number duplication without the knowledge of the original card supplier may be difficult to control.
The true security strength of chip cards is not in the unique aspects of their serial numbers but rather their ability to engage a cryptographic authentication session with the terminal. These solutions involve more expensive microprocessor cards and require sophisticated key management procedures to ensure on-going security levels are maintained.
Clearly the cost and complexity of these solutions are unnecessary. In any event there are some practical issues summarised in Sections 5.2 – 5.5 that should also be considered.
5.2 Complex Third Party Security
The security of EP systems (including Key generation and distribution) is controlled by the EP Scheme operator which may be a Financial Institution, Transport company or perhaps a Telecommunications company. Therefore, to rely on such systems, the gaming venues would be handing the security of their revenue streams (and the control of their card base) to a third party - a scenario strongly rejected by the NSW Club industry and unlikely to appeal to casino operators.
EP cards expire as a result of the key management mechanisms employed to ensure system security. Again, this third party control restricts venue operations.
Venues may choose to run a closed system of their own to eliminate the third party influence. The venue would thus establish its own EP scheme internally. This would result in increased card costs (as volumes would be lower) and increased management and software overheads. But the whole premise of introducing an EP was that it offered card holders usage beyond the confines of the venue ? This would therefore be a self defeating proposition.
5.3 Card Value Limits
An EP model is predicated on the basic assumption that one spends money at a merchant's premises. Fundamental to the security architecture of these systems is the limitation of stored value eg a maximum of $500 to be stored in the Purse. A jackpot exceeding the value limit could not be written to the card. An Account Play architecture would therefore be required to handle such circumstances. This then becomes a circular argument as the necessity for an on-line network obviates the need for value storage on the card. We therefore return to the on-line architecture proposed initially.
5.4 Money Walks
Assuming that a venue and third party EP scheme operator were able to reduce the card costs, give the venue control over security and card expiry requirements and facilitate the loading of winnings onto the EP card (despite the serious security implications) would such a system be acceptable to venues ?
The motivation behind introducing a card based gaming system at the outset was reduced operating costs, better customer service, improved security and increased turnover.
Increased turnover will result from the fact that there is less machine down time and that once money is in a gaming account it is destined to be turned over through the machines. If that money resides on a stored value card rather than in the venue's account there are two very clear negatives from the venue's perspective.
The first is that the venue is not making money on the float - in fact the EP scheme operator is. The second is that the EP card allows the player to exit the venue and spend the money on a wide variety of goods and services for which the venue receives no profit.
Both these issues highlight the necessity for a closed, venue specific system which gives venues complete control over their money.
5.5 Physical Reliability - Case Study
Casinos in Sun City, South Africa have recently de-commissioned a contact smart card based gaming system in favour of a contactless smart card solution due to the unacceptably high maintenance and card attrition rates associated with the physical aspects of the technology.
Dirt from drinks and cigarette ash was found to impair proper chip contact and the nature of the chip coupling devices made them very difficult to keep clean. Attacks on the chip module were also a problem. Their change to a contactless smart card technology certainly eliminated these problems but at $12 per card, the cost of their system (now running on app. 1500 machines) is several multiples of the Watermark solution with no substantial off-setting gains.
Experience in Victoria confirms that there are no such physical impairments with the Watermark solution. A simple, low cost read head cleaning regime has resulted in excellent read reliability complementing the very high levels of reader electromechanical reliability.
5.6 Venue Integration of Open EP Schemes
So we accept that gaming venues will run their own closed (internal), on-line Account Play systems and that the most cost effective card technology for that purpose is Watermark Magnetics.
"Does that mean that the gaming venues will be disadvantaged as more and more merchants begin accepting EP cards for all sorts of small payments ?"
There is no reason why a gaming venue cannot accept payments from an EP just as the venue currently accepts payments in cash. Given that such EP schemes remain several years away from being commonplace, it is not appropriate to invest in substantial infrastructure to support them as it is most likely that between now and then there will be several changes in the technology and rationalisation amongst scheme operators.
EP payments may initially take one of two forms with respect to the gaming operation. The first and most obvious implementation is for venues to install an EP terminal at the cashier. Players could then present their EP to the cashier and request any one of coins, notes or an Account Play card with that value loaded against the card's Watermark Number in the central system. The second alternative is for the venue to install card/coin dispensing machines which accept the EP card as a payment option for coins or pre-initialised Account Play cards.
These options are practical and cost effective as they do not require the venue to second guess which particular EP product will be successful nor does it involve a third party in the security of the gaming operation. Installing EP terminals at Bars, Bistros etc would also be an option - a decision the venue will make based on the cost of the terminals and the number of EP cards in circulation throughout the wider community.
EP terminals would be installed by venues as and when they were necessary, with no need to invest in infrastructure ahead of time. If there were a way, however, of making a relatively inexpensive provision for their likely eventuality, this may be a prudent investment. The one international set of standards that all contact based smart cards conform to is the ISO 7816 series (there is no current international standard for contactless cards).
A motorised Watermark Magnetics reader has been developed with a facility at the rear of the reader to install a set of ISO 7816 compliant contacts providing for the acceptance of compliant chip cards. No assumption has been made about the type of chip card (other than it will be a contact rather than a contactless technology) or the particular EP scheme.
This development will mean that venues only need install the one card reader at the cashier station which will handle both the Account Card and the EP card and, moreover, will have the intelligence to decide which of the two different types of cards have been inserted and process them accordingly. Simplicity is of paramount importance and this approach ensures that cashiers are not encumbered with a confusing array of terminals and readers etc.
Venues that install this reading device, will have the option of the ISO 7816 contacts upgrade at any time it is believed to be of benefit. Until then, there is no cost penalty for having the facility. Consultation with the industry suggests that this is the preferred option.
Account Play systems may be securely and cost effectively introduced by implementing Watermark Magnetics technology.
Careful marketing consideration will ensure a systematic evolution of player preference, ultimately resulting in the elimination of coins from gaming venues. This will enhance venue operating efficiency, improve internal security and provide players with a cleaner, more convenient playing environment.
Gaming machines of the future will feature bill acceptors and card readers providing total player privacy and maximum convenience. If and when EP schemes are commonplace, venues will take advantage of dual Watermark / Smart card reading devices and accept payments at cashiers and/or Account card dispensing machines to maintain maximum player convenience.
Venues will find that the increased functionality of Account Play cards will enhance cross promotional activity and provide an additional source of income through ROI links, Loyalty schemes, sponsorship, advertising and the collectors market.
All of these benefits are available to gaming venues cost effectively and with very high levels of security by virtue of the on-line machine operating environments being introduced by individual venues and State run jurisdictions alike.
Machines were originally introduced into NSW with spinning reels, handles and coin payouts. Today there are no handles, machines use video screens, tokenisation and bill acceptors have all but eliminated the traditional coin feeding of machines and book pays and ticket printers are replacing hoppers - exploding the myth that people wont play without coins falling into a tray. The Account Play system concept described in this paper is very simple and clearly represents the natural evolution of gaming machine network facilities.
Most important of all is that the added convenience and security for the player, and greater cost efficiencies and revenue generating opportunities for the venue operator, ensure success.
For further information please contact:-
Designed & created by Justin French.