/image%2F8357444%2F20250531%2Fob_e5372f_safitexpers.jpeg)
/image%2F7127247%2F20260308%2Fob_98a95e_1578f1ae-de41-44e2-9c8c-be8e5b049430.png)
Table of Contents
- 🌐 Introduction
- 🇪🇺 I. Europe
- └─ France (Navigo)
- └─ United Kingdom (Oyster)
- └─ NL, DE, CH, IE
- 🌏 II. Asie
- └─ Japon (FeliCa)
- └─ Korea, China, Singapore
- └─ Malaysia, HK, Taiwan, Thailand
- 🌎 III. Amériques
- └─ New York, California, Massachusetts, Illinois
- └─ Canada
- 🌏 IV. Océanie
- └─ New Zealand
- 🕌 V. Middle East
- 🌍 VI. Africa
- 🚀 VII. Emerging Countries
- 🔬 VIII. Biometric Revolution
- 🛡️ IX. Cybersecurity 2026
- └─ Incidents & timeline
- └─ Solutions 2026
- ⚙️ X. Standards & Architecture
- 📚 Technical Glossary
- 🎯 Conclusion
- ✍️ About
Global ITS Contactless Payments 2026
Global overview of technical architectures, biometric innovations and cybersecurity challenges. From the end of MetroCard to the rise of contactless payments.
The era of frictionless mobility
Context: In 2026, intelligent transport systems (ITS) have reached a decisive turning point. The pandemic accelerated the shift to contactless, and today, over 60% of public transport transactions in developed countries are made without a dedicated physical card.
This article analyses:
Europe
System diversity and ongoing harmonisation
Passe Navigo & Liberté+
Île-de-France Mobilités
Le Navigo passe à l'ère 100% mobile avec 1,3 million d'utilisateurs sur Liberté+ depuis juin 2025. Lancement prévu au printemps 2026 des passes Annuel et Imagine R sur smartphone.
Oyster Card
Transport for London
Pionnier depuis 2003 avec RFID Mifare. En 2024, TfL a subi une cyberattaque majeure avec fuite de données de 5 000 clients. Le système évolue vers l'open payment avec contactless.
OV-chipkaart
Déploiement national
Déploiement national achevé en 2011. Système mature avec 98% d'adoption. Transition vers la carte virtuelle et le paiement direct par carte bancaire en cours.
Deutschlandticket
Tarif national unique
Abonnement mensuel national à 58€ (63€ prévu en 2026). Valable dans tous les transports locaux et régionaux d'Allemagne. Révolution tarifaire post-COVID.
SwissPass
Alliance SwissPass
Single card for all Swiss public transport. In 2027, the MyRide project could revolutionise the system with a single fare and variable discounts.
Leap Card
Transport for Ireland
Dublin and regional system. New zonal fare structure since April 2025. The TFI 90 Minute Fare allows unlimited transfers within 90 minutes.
Tarjeta Multi & T-Mobilitat
CRTM Madrid / ATM Barcelone
Madrid uses the Tarjeta Multi (MIFARE DESFire EV1) across 8 operators. Barcelona migrated to T-Mobilitat, based on open-source CIPURSE in 2024, with contactless bank card payment progressively rolling out in 2025-2026.
RicaricaMi / StonPass
ATM Milano / GTT Turin
Milan a supprimé les tickets papier en 2026. La carte RicaricaMi utilise MIFARE Classic (AES-128) et le paiement open-loop EMV est accepté depuis 2025. Rome déploie son système StonPass avec NFC sur les lignes A et B du métro.
Navegante (ex-Viva Viagem)
Metro de Lisboa / CP Fertagus
Rebaptisée Navegante en 2019, la carte repose sur le standard CIPURSE open source — l'un des premiers déploiements en Europe. Elle couvre 6 opérateurs (métro, bus, tram, ferry, train) sur une puce unique avec stockage des titres chiffré AES-128.
MOBIB
STIB-MIVB / De Lijn / TEC / SNCB
Déployée dès 2010, la carte MOBIB (MIFARE DESFire EV1) est interopérable sur les 4 opérateurs belges. En 2025, la STIB a activé le paiement open-loop EMV. La MOBIB Basic (gratuite, anonyme) est maintenue pour les usagers sans compte bancaire.
Asia
Radical innovation and mass adoption
Suica / FeliCa
JR East & partenaires
FeliCa technology remains the world benchmark with a record transaction speed (0.1 sec) and EAL6+ security. More than 92% of transactions are made via smartphone thanks to the Osaifu-Keitai ecosystem.
T-money
Séoul & métropole
Seoul is progressively deploying an open-loop EMV system for international tourists (2025-2030). Investment of 50 billion won to replace PayOn terminals. T-money available on Apple Pay.
T-Union
National interoperability
Interoperability across 336 cities with biometric payments in massive expansion. QR codes and facial recognition deployed in major metropolises. 70% of buses in Beijing.
SimplyGo / EZ-Link
Land Transport Authority
Full migration to SimplyGo in January 2026. The EZ-Link app has been permanently discontinued. Direct bank card payment is accepted across the entire MRT and bus network.
Touch 'n Go eWallet
Prasarana / RapidKL — Kuala Lumpur
The Touch 'n Go card (MIFARE Classic, 2002) covers buses, LRT, MRT, Monorail and RFID toll highways in the Klang Valley. Since 2019, the TnG eWallet NFC wallet integrates contactless and QR code payment, with 22 million active users in 2024.
Octopus Card
MTR Corporation — Hong Kong
A world pioneer launched in 1997, based on Sony FeliCa technology. Accepted on the MTR, buses, trams, ferries, as well as supermarkets, cafés and vending machines. The Octopus card is accepted at over 13,000 retail points. Usage: 35 million transactions per day in 2024.
EasyCard / iPASS
TRTC Taipei / Kaohsiung MRT
EasyCard (MIFARE DESFire EV1) covers Taipei MRT, HSR trains, Taoyuan MRT and intercity buses since 2023. Open-loop EMV migration is active on main lines. More than 200 retail partners (7-Eleven, FamilyMart) accept the card outside transport.
Rabbit Card / MRT Blue Line
BTS Skytrain / MRTA Bangkok
Bangkok has historically suffered from fragmentation: the Rabbit card (MIFARE Classic, BTS Skytrain) and the MRT Blue Line Card (MIFARE DESFire EV1, MRTA) remained incompatible until 2024. Rabbit now integrates Rabbit LINE Pay (QR + mobile NFC). A unified national card is planned for 2026.
# FeliCa Architecture (Japan) — World benchmark in performanceSmartphone → [FeliCa Chip] → [Terminal NFC] → [Réseau Mobile] → [Serveur Central] ↓ [Authentification AES dynamique — EAL6+] ↓ [Transaction complète : 0.1 seconde] Americas
Rapid modernisation and open-loop adoption
OMNY — MTA New York
Metropolitan Transportation Authority
Mission accomplished: the MetroCard was permanently retired on 31 December 2025. OMNY has reached over 93% of journeys on the MTA network (metro + bus). Extended to Bee-Line and NICE buses in 2025. Open-loop payment: contactless bank card, Apple Pay, Google Pay.
Clipper Card 2.0
511 SF Bay / BART / Caltrain
The Bay Area unifies 25+ operators (BART, Muni, Caltrain, AC Transit, SamTrans…) on a single card. Clipper 2.0, deployed between 2024 and 2025, introduces mobile NFC payment and open-loop EMV, replacing legacy terminals incompatible across agencies.
CharlieCard (MBTA Boston)
Massachusetts Bay Transportation Authority
Migration from MIFARE Classic to MIFARE DESFire EV3 completed in 2024. Open-loop EMV was deployed on buses in 2024, with extension to the 4 metro lines in 2025. The mTicket app has been merged into the new unified MBTA app (2025).
Ventra — CTA Chicago
Chicago Transit Authority / Pace / Metra
Ventra (MIFARE DESFire EV1) unifies CTA, Pace and Metra on a single card and app. Open-loop Visa/Mastercard accepted. The Ventra NFC app has been available on Android and iOS since 2023, with integrated mobile payment and real-time transfer tracking.
OPUS
STM Montréal
NFC migration planned for 2026. Launch of the virtual OPUS card in early 2026 with 4,000 Android testers. Visa/Mastercard bank card payment tests planned for 2026.
Oceania
Mature systems in transition
Opal Card
Transport for NSW — Sydney
A mature system with 1.4 million cards issued. The Opal Next Gen project is launched for 2027 (AUD $738M budget). Improved integration with digital services and concessionary fares on smartphone.
Myki
Transport Victoria — Melbourne
15-year contract signed with Conduent in 2023. Mobile Myki available on Google Wallet. Contactless bank card payment planned for early 2026. Fares updated in January 2026.
AT HOP Card
Auckland Transport — AT Metro
Deployed in 2012 (MIFARE DESFire EV1), the AT HOP covers buses, trains and ferries in the Auckland region. The card is mandatory for concessionary fares (student, senior). An open-loop EMV pilot was launched on rail lines in 2024.
Snapper Card
Metlink Wellington — Snapper Services
Launched in 2008 and based on FeliCa technology (unique in New Zealand), the Snapper card is incompatible with Auckland's AT HOP, illustrating national ticketing fragmentation. Metlink is studying a migration to open-loop EMV planned for 2026.
Middle East
Massive investment and full MaaS integration
Nol Card
Roads and Transport Authority (RTA)
One of the world's first full MaaS cards (2009). The Nol Card (MIFARE DESFire EV1) works on metro, bus, tram, taxi, abra (water bus), toll roads and parking — 14 transport modes on a single card. Apple Pay and Google Pay have been integrated since 2022.
Hafilat Card / Darb
SAPTCO / Arriyadh Development Authority
The Riyadh Metro (6 lines, 176 km) opened in 2024, one of the largest urban projects in the world. The Hafilat Card (MIFARE DESFire EV1) covers buses and metro. The Darb system manages RFID highway tolls, with metro integration planned for 2025.
Doha Metro Card
Qatar Rail — Doha Metro
The Doha Metro inaugurated in 2019 (MIFARE DESFire EV2, Qatar Rail) welcomed millions of fans during the 2022 FIFA World Cup. Contactless EMV (Visa/Mastercard) has been active since 2022. The Gold line was extended to the international airport in 2024.
Rihlati App / BFC Transit
Ministry of Transportation — Bahrain
Bahrain is modernising its bus network with the launch of the Rihlati app in 2024, enabling NFC payment on smartphones. Physical ticketing is migrating from MIFARE Classic to DESFire EV2. A modernisation programme supported by the Asian Development Bank is active through 2026.
Africa
Accelerated modernisation and international funding
MyConnect Card
MyCiTi BRT — City of Cape Town
Deployed in 2011 on the MyCiTi BRT network (MIFARE DESFire EV1), the MyConnect Card is mandatory: no cash accepted on buses. This cashless model is a pioneer in sub-Saharan Africa. The BRT network extension (Phase 2B) is planned for 2025.
Cairo Metro — Meeza Card
NAT Egypt / Thales — 3 lignes
Thales deployed a complete new ticketing system between 2022 and 2024 across the 3 Cairo Metro lines. NFC payment via the national Meeza card (Egyptian national bank card) is active. The metro serves 2.5 million users per day, the 3rd busiest network in Africa.
STAR Tram + Al Boraq TGV
Casablanca Tram / Rabat-Salé / ONCF
The trams of Casablanca and Rabat-Salé use MIFARE DESFire ticketing. The Al Boraq HSR (320 km/h, Kenitra-Tangier) uses e-tickets with open-loop Visa/Mastercard payment via the ONCF app. Tram-train interoperability is under development.
Dakard / BRT Dakar
CETUD — Bus Rapid Transit Dakar
The Dakar BRT, inaugurated in January 2023 (World Bank funded), is the first high-service BRT in West Africa. NFC ticketing (MIFARE Classic, Dakard card) has been deployed, with integration of the TER Dakar regional rail (2021) via NFC since 2024.
Emerging Countries
Technological leapfrogging and innovative alternative models
JakCard / Jak Lingko
TransJakarta / MRT Jakarta / LRT
The Jak Lingko platform unifies TransJakarta buses, MRT, LRT and angkot (minibuses) in a single MaaS app. The JakCard (Bank DKI, MIFARE Classic) integrates EMV since 2024. Payment via Gopay and OVO (QR code) across the entire network since 2022 — a unique super-app model in public transport.
Bilhete Único / BRT Curitiba
SPTrans São Paulo / URBS Curitiba
São Paulo processes 15 million transactions per day with the Bilhete Único (MIFARE Classic). Curitiba is the world pioneer of BRT since 1974. Integration of the instant payment PIX in public transport has been in testing since 2025, a global first in the sector.
Tarjeta CDMX / Metrobús
STC Metro / Metrobús / RTP CDMX
Since 2023, the Tarjeta CDMX (MIFARE DESFire EV1) unifies Metro, Metrobús, Trolebús and Tren Ligero on a single card. The network serves 4.4 million users per day on the metro alone. Mobile NFC payment is being tested on Metrobús lines since 2025.
Thẻ Metro HCMC / Hanoi Metro
MAUR Ho Chi Minh / MRB Hanoi
Ho Chi Minh City Metro Line 1 opened in December 2024, after 17 years of construction (JICA funding). MIFARE DESFire EV1 ticketing with NFC payment. VietQR, the Vietnamese banking QR standard, is being integrated into transport. Hanoi has been operating two metro lines since 2021.
VIII. The biometric revolution
2025-2026 marks the explosion of biometrics in public transport, radically transforming the user experience while raising new privacy concerns.
| Country / City | System | Technology | Adoption | Performance |
|---|---|---|---|---|
| 🇷🇺 Moscou | Troika + facial recognition | 3D cameras + AI | 500,000 registered | 170,000 trips/day |
| 🇻🇳 Vietnam | National rail system | Fingerprint + facial | National rollout | 3-5 sec/passager, >98% |
| 🇨🇳 Chine | Biometric T-Union | Facial recognition | 336 villes | Massive expansion |
| 🇦🇪 Dubaï | Contactless metro | Facial recognition | Pilot | Tests under way |
IX. Threats and vulnerabilities 2026
The transport sector has become the prime target for cyberattacks with 820,000 daily IoT attacks on average.
- Attacks via Bluetooth Low Energy on payment terminals
- Network infiltration via IoT sensors (temperature sensors, CCTV cameras)
- NFC card cloning via remote relay attack
- Denial-of-service attacks on ticketing validation systems
Security solutions 2026
Mutual Authentication
SAM (Secure Access Module) modules to prevent unauthorised devices on the network.
Post-Quantum Encryption
Tests under way in Seoul and Singapore. Hybrid deployments in production across 5G networks.
CIPURSE Standard
Protection against DPA/DFA (Differential Power/Fault Analysis) attacks with an open-source approach.
AI Detection
Behavioural monitoring with artificial intelligence to detect anomalies in real time.
X. Architectures and standards
Comparison of the main technical standards and their performance and security characteristics.
| Criterion | Calypso (Navigo) | FeliCa (Japon) | CIPURSE (Open) | MIFARE DESFire |
|---|---|---|---|---|
| Transaction Speed | 0.3 – 0.5 sec | 0.1 sec ✓ | 0.2 sec | 0.3 sec |
| Cryptography | AES-128 | AES dynamique | AES-128 + anti-DPA/DFA ✓ | AES-128/256 |
| Interoperability | Limited | Proprietary | Open Source ✓ | Moyenne |
| Implementation Cost | High | Very high | Moderate | Medium |
| Certification | EAL4+ | EAL6+ ✓ | EAL5+ | EAL4+ |
# Cloud Ticking Architecture — Modern data flow┌─────────────┐ NFC/5G ┌─────────────┐ HTTPS/TLS ┌─────────────┐│ Client │ ────────────→ │ Gateway │ ───────────────→│ Cloud ││ (Carte/App) │ │ Edge │ │ Central │└─────────────┘ └─────────────┘ └─────────────┘ │ ┌─────────────┐ ┌─────────────┐ │ │ IA/ML │←───│ Big Data │←────────────────┘ │ (Anomalies)│ │ (Analytics)│ └─────────────┘ └─────────────┘ Technical Glossary
Towards cyber-physical resilience
ITS embody the convergence of mobility and digital technology, but their security must be holistic. In 2026, three levels of protection are essential:
Hardware
EAL6+ standards and regular component audits to ensure the physical security of terminals.
Software
DevSecOps integration and continuous testing to reduce vulnerabilities in embedded systems.
Human
Social engineering training to prevent human errors within technical teams.
"Absolute security does not exist — only a dynamic balance between innovation and cyber-resilience."
We value your feedback
Have you observed other developments in intelligent transport in your region? Share your experience in the comments or on social media with the hashtag #SafeITExperts.
/image%2F7127247%2F20260413%2Fob_68be55_image-7127247-20260309-ob-d3a73d-kerne.png)
/image%2F7127247%2F20260412%2Fob_b9f899_9f17b9a2-4f24-4470-ad66-7d7c6be51c09.png)
/image%2F7127247%2F20260412%2Fob_76dc2e_9f17b9a2-4f24-4470-ad66-7d7c6be51c09.png)
/image%2F7127247%2F20260412%2Fob_b1b994_3adbf5c5-b5c0-4fe5-9662-f97b031a64c1.png)
/image%2F7127247%2F20260413%2Fob_68be55_image-7127247-20260309-ob-d3a73d-kerne.png)
/image%2F7127247%2F20260412%2Fob_b9f899_9f17b9a2-4f24-4470-ad66-7d7c6be51c09.png)
/image%2F7127247%2F20260412%2Fob_76dc2e_9f17b9a2-4f24-4470-ad66-7d7c6be51c09.png)
/image%2F7127247%2F20260412%2Fob_b1b994_3adbf5c5-b5c0-4fe5-9662-f97b031a64c1.png)