Deutschlandticket retailers take on the ‘cyber mafia’

GERMANY: Two waves of fraud have hit sellers of the Deutschlandticket monthly public transport pass, and the fightback against the criminals has been hindered by the lack of a central body with overall responsibility for the tickets.

The Deutschlandticket covers all local and regional public transport services across Germany. Other countries considering launching a similar product should learn from its mistakes, according to Nils Zeino-Mahmalat, Managing Director of VDV eTicketservice which co-ordinates standards for electronic ticketing systems in German public transport.

Speaking at the Transport Ticketing Global trade fair in London on March 4, Zeino-Mahmalat explained that while the Deutschlandticket is sold everywhere and valid everywhere, there is no central product owner. There are more than 80 regional transport associations and 700 operators across the country, and as a result the Deutschlandticket has more than 130 separate product owners.

The pass is only sold digitally, as a subscription currently costing €58 per month. There are now 14 million customers, and growing, and it accounts for more than 80% of operators’ revenues with sales of single tickets now ‘very rare’. The Deutschlandticket involves €10bn of revenue and €3bn of government support annually, which is ‘a lot of money’ and thus ‘of interest to criminals’.

Zeino-Mahmalat said ‘new products mean new responsibilities’, but these had not been legally defined. Different organisations have different levels of cybersecurity, even though ‘only one company leaving open a back door means someone can get in’.

He said there were two phases of criminal activity. The first involved individual attacks with manual processes. People bought tickets using false or stolen payment details and fraudulent direct debits, then resold them to others online. By the time the banks cancelled the payments, which took a few days, the tickets were already in the hands of passengers, and there was no mechanism