Transit Agency Smart Fare Cards Explained (AES, Agency-Keyed)

A transit smart fare card is a contactless AES-secured 13.56 MHz smart card used to pay fares and carry ride entitlements on a public-transport network. It operates over the ISO/IEC 14443 standard, the same high-frequency air interface used by modern access-control cards, and it is tapped against a faregate or on-board validator.

What makes a fare card a fare card is not the plastic but the agency's data model and keys written onto it. The card stores products — a stored-value balance, a monthly pass, a transfer — in memory sectors protected by AES cryptography. That is why a regional transit smart card (marketed under names like EZfare or MyRide, depending on the agency) is a secure token rather than a simple readable ID: the value it represents is cryptographically protected against tampering and copying.

D23, D43, and D83 refer to the card's on-chip memory size, not its security level — all three use the same AES cryptography. The number after the D roughly tracks the memory: 2K, 4K, and 8K respectively. An agency chooses a size based on how many fare products and applications the card must hold, so a simple single-agency fare card needs less memory than a regional card that also carries parking or identity functions.

No — a valid transit fare card cannot be cloned or bought pre-loaded from a third party, because its fare data is protected by AES keys that only the transit agency's system holds. Cloning would require reproducing a per-card diversified key that is never transmitted in the clear, and any card not written with the agency's keys is simply an unrecognised blank at the faregate.

This is a deliberate anti-fraud design. Early contactless fare cards that relied on weaker or broken ciphers were, in fact, defeated — which is exactly why agencies moved to AES-secured smart cards with mutual authentication and diversified keys. The practical upshot for a rider is that replacement fare cards come from the transit authority or its official outlets, and are then loaded and keyed by the agency's fare system.

Blank AES-secured smart cards can be manufactured and supplied, but they become fare cards only when the transit agency encodes them with its keys and fare applications. Security ID Systems does not supply agency-keyed fare cards, and no legitimate third party can, because the keys never leave the agency's fare system.

Where we can help is the open, non-fare credential layer around a transit operation — 125 kHz proximity for staff doors and depots, and card-serial-number or generic Wiegand credentials for facility access that reads a plain identifier. Those formats we supply as fully compatible, encoded credentials that read identically on your existing readers, separate from the agency-keyed fare product.