Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity.

[harrysintonen@infosec.exchange]

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity. The change covers payments for essential goods in physical trade, such as food, medicine, and fuel. Each country has made - or is in the process of making - the required changes to their related regulations to enable it.

The motivation for this change is to enable payments even in exceptional situations such as network disruptions due to sabotage or conflict. TL;DR: You can pay for essentials even if Russia cuts the cables.

Plans for this change were announced in May 2025: https://www.reuters.com/business/finance/nordics-estonia-plan-offline-card-payment-back-up-if-internet-cut-2025-05-07/

#resilience #preparedness #infrastructure #payments #banking

[harrysintonen@infosec.exchange]

Denmark has implemented this change now: https://www.nationalbanken.dk/en/news-and-knowledge/publications-and-speeches/other-publications/2026/status-of-the-card-payment-contingency-measure-in-denmark

Sweden should be done with the implementation by 1 July 2026: https://www.riksbank.se/en-gb/payments--cash/payment-preparedness/offline-payments/

[brie@venera.social]

@harrysintonen Cash works offline without special preparations.

[harrysintonen@infosec.exchange]

@brie Agreed, cash works, too. Nordics have been practically cashless for ages now, however, and while it is recommended to have reserves, many don't.

[vfrmedia@social.tchncs.de]

@harrysintonen @brie

even in UK banks had separate virtual private networks independent of the Internet operating over dedicated leased lines for many years.

the challenge is going to be more getting the data from the terminals in shops to the banks securely, especially if the LTE mobile network is disrupted in any way..

[crystalmoon@chaos.social]

@harrysintonen why not cash?

[harrysintonen@infosec.exchange]

@crystalmoon https://infosec.exchange/@harrysintonen/116397500903206960

[leffe@social.linux.pizza]

@harrysintonen

It will still be difficult to use payment systems from the US if they decide to put an embargo on us, like they threatened to do with Spain. We need EU based cards!

[jandi@mastodon.social]

@harrysintonen Sorry to ask before reading, but, are there links to the technical implementations in any of the articles?

If not, do you have any links?

If there are, I'd appreciate if you tell me (a "like" is enough). Sorry for the laziness ‍️

[harrysintonen@infosec.exchange]

@leffe Agreed. Currently only 37% of payments use national systems (and it's unclear how much dependencies on US systems those might have). https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr250228_1~7f0697af45.en.html

[leffe@social.linux.pizza]

@harrysintonen

We have a national payment system in Sweden called Swish, but it requires the use of an operating system from Apple or Google, and it doesn't allow accessibility software to be present. So in either case, we are quite vulnerable.

#svpol #eupol #Swish #BankID #a11y

[slotos@toot.community]

@jandi @harrysintonen Reqlly interested in this too. Not even the tech of it—I don’t expect any surprises there—but rather the organizational decisions behind them all.

[kallekn@mastodonsweden.se]

@leffe @harrysintonen Swish works fine on /e/OS. But it does require BankID. Which also works fine on /e/OS, at the moment at least.

[leffe@social.linux.pizza]

@kallekn @harrysintonen

Android apps that don't require logging in to Google for "security" reasons may soon be a thing of the past. I had /e/OS for a couple of years, but there were other necessary apps that wouldn't run, because they hadn't been installed by Google. It's a house of cards.

[kallekn@mastodonsweden.se]

@leffe @harrysintonen That's what I am afraid of when it comes to BankID for example. If it stops working, /e/OS is toast.

[leffe@social.linux.pizza]

@kallekn @harrysintonen

Oh, and even #MicroG as an alternative to Play Services still depends on Google infrastructure.

[toxy@mastodon.acc.sunet.se]

@kallekn @leffe @harrysintonen I’ve just bought a SailfishOS phone and hope I can get BankID working on it, presumably by sideloading the Android version.

[harrysintonen@infosec.exchange]

@jandi My understanding is that this is all based on the existing EMV technology and doesn't require new hardware. Basically it's just enabling existing features. Sorry, but I don't have technical specs for this.

@slotos
As for the regulation, each country has a slightly different process and bodies doing it. Usually it's the national central bank with some kind of payment council (that has participants from various stakeholders running the payment systems, for example https://www.nationalbanken.dk/en/what-we-do/safe-and-efficient-payments/the-danish-payments-council).

[kallekn@mastodonsweden.se]

@toxy @leffe @harrysintonen Please do tell if that works.

[leffe@social.linux.pizza]

@toxy @kallekn @harrysintonen

I had Sailfish too for a couple of years. Same problems.