Rejsekort

Rejsekort
Location	Denmark
Launched	Implemented
Manager	Rejsekort A/S
Currency	DKK; (also prices and balance are shown in EUR in rejsekort automats)
Stored-value	Prepaid card
Credit expiry	None
Auto recharge	Auto top-up
Validity	DSB; Movia; Copenhagen Metro Öresundståg;
Retailed	Online; Telephone; ATMs; Stations;
Website	rejsekort.dk

Rejsekort (Official translation: Travel card) is an electronic ticket system for public transport in Denmark. The system is a collaborative work between DSB, HUR, Ørestadsselskabet, and various regional bus companies, and work on it started on August 18, 2003. In June 2005, Thales Group and Accenture were chosen as suppliers.

The total cost of the system will be between €200 and €270 million.

Overview

The system has replaced the old zone ticket system. Instead, fares are calculated from the distance made from the beginning of the journey to the end, as the crow flies, so as to give a better correlation between price and distance travelled. Like the old system, the Rejsekort is designed to work universally for trains, buses, and metro trains.

Either a superpersonal, a personal or an anonymous card is issued to passengers. The superpersonal card has a picture of the owner on it, and only the owner (or the owner and one or more travelling companions) is able to use it. The personal card is attached to an owner, but everyone can use it, e.g., friends or family members. The anonymous card is not attached to an owner.

The card must be scanned ("checked in") at a card reader, either at a train platform or on board a bus, at the start and the end of each journey, and the system automatically calculates the price of the journey; failure to check in results in a fine. The money is deducted from a prepaid account; alternatively, a card can be signed up for a payment scheme so that the money is automatically deducted from the holder's bank account. The more trips a passenger makes per month, the less money each trip will cost. The old discount system worked that way, too; however, the system was limited to a set number of zones, while the new discount system applies nationwide.

There are no ticket gates at stations, because it would lead to closing many smaller entrances, and thus it would take longer time to check in, and it would be costly to introduce at the many small stations. Instead, a proof-of-payment system is used.

There has been criticism against the cost overrun and delay, and to some user problems. For example, people who forget to check out need to pay extra, and that the onboard GPS can give delayed position at when checking in, resulting in too high a price being charged. Receipts are not given, and the trips can be checked online only after a few days, making it hard to verify that the correct amount was paid.

It was expected that Skånetrafiken in Scania in Sweden would implement a system akin to the Danish. Therefore, the Rejsekort system was prepared to work with the Scanian, so as to allow passengers to easily travel over the Øresund Bridge. The current cross border paper tickets are also accepted on local traffic, and should do so also in the future. Skånetrafiken did in 2009 introduce a different electronic card system, which is incompatible with Rejsekort, leading to separate Danish Rejsekort check-in/check-out readers being installed at Øresundståg stops in Malmö (i.e. Hyllie, Triangeln, and Malmö C stations). The current Skånetrafiken system is electronic only for buses (card or QR code on the Skånetrafiken app), while for trains either an electronic ticket (card or app) or a paper ticket can be used. Neighbour counties in the north introduced the same system but under their own names.

The implementation of Rejsekortet is considered to be one of the biggest IT scandals in Denmark. This is due to the not very successful end product, the doubled price-tag and the extreme delay in the original project plan.

Technology

The original card technology is MIFARE Classic.^[1] The card has a 4 kilobyte electrically erasable programmable read-only memory (EEPROM) which can be written to using RFID. The original cards also contains a chip by NXP Semiconductors which implements a proprietary cryptography scheme called CRYPTO1, which was fully reverse-engineered in 2008.^[1] A Practical Attack on the MIFARE Classic was published in 2008 by a group at Radboud University Nijmegen.^[1]

Some newer cards issued from 2022 onwards use MIFARE DESFire EV2,^[1] which stores card contents encrypted. The contents of these cards cannot be read without the appropriate decryption keys, which are not public information.

On the original card technology, the ride history is stored unencrypted and can be read by anyone. There are mobile apps made by third parties which can achieve this.^[2]

Timetable for implementation

The Rejsekort system was tested between Roskilde and Tølløse in December 2007. Plans to roll the system out to the whole of Zealand in 2008 and 2009 have been shelved due to delays, and have instead been replaced with the following timetable:^[3]

Testing between Taastrup and Holbæk at the end of 2008
Rollout to paying customers between Taastrup and Holbæk at the start of 2009
South Zealand at the end of 2009
West Zealand in the beginning of summer 2010
Capital Region of Denmark (essentially Copenhagen and surrounding areas) in the autumn of 2010
North Jutland in the autumn of 2010
DSB's stations on Funen and the rest of Jutland in the autumn of 2010
The rest of the busses in Jutland and Zealand in the autumn of 2011, and soon after all railways in the capital.
In 2015 old paper punch cards aren't sold anymore, leaving rejsekort and more expensive single tickets as the main options.
Since 2018 it has been planned to replace MIFARE Classic with MIFARE DESFire.^[1] DESFire was shown to be vulnerable to side-channel attacks in 2011.^[4] More info at MIFARE#MIFARE DESFire attacks.
As of June 2022, the migration to MIFARE DESFire has begun for Rejsekort. Both card types are still in production and valid for travel.^[1]