Transport for London

Having recently returned from a trip to London, I thought it might be nice to register my “Oyster” card (the contactless card one can use on the London Tube, buses, etc.). That way I could potentially look at my balance and perhaps top up my card before my next trip.

The process for registering an Oyster card is complex. After asking for your card number, they want to confirm a recent trip you made with the card (presumably to prevent someone from registering a card they find somewhere). Fortunately, I was able to remember what station I started my last trip at, and passed that step.

Next they ask you to create a card security question and answer:

As has been frequently discussed, one’s mother’s maiden name is often readily obtainable, so this is a poor choice. That leaves a memorable date or place. These hardly seem specific enough — would I pick my birth date/place, wedding date/place, child’s birth date/place, or something else? This is not likely to be helpful in some later telephone conversation. It might as well just ask me to pick a password.

So having picked a nonsensical “memorable place”, the now ask for “Your details”, which includes name, address, telephone number, etc. It also has you choose a password (weak requirements here, only 6 characters with composition rules) and a six-digit security passcode for when you call their customer service (wasn’t that what the security question was for?). And then — another security question!

Again, poor choices — either readily discoverable answers if truthful (childhood nickname, location of first birthday, town of first job, name of first pet) or few likely choices (type of TV show: comedy, drama, action, …?)

It’s not at all clear what the relationship of this security question is to the one asked earlier. Presumably if I called their customer service I’d just have to answer whatever question they ask.

So again having made a creative answer to one of the questions, I tried to create an account. It turns out that you have to have a UK postal code to register your card; my California ZIP code won’t do. It would have saved me a lot of time if I knew that up front.