Sumanth Kamath (CDS’26) was one of two BU alumni who discovered a technology glitch that allows some MBTA patrons to ride for free.

MBTA

Boston University Alums Uncover a Glitch Enabling Free MBTA Rides

The transit system’s tap-to-pay technology saves time, but it has a bug

It’s supposed to be easy, but not free.

Two Boston University alumni discovered a glitch in the MBTA’s tap-to-pay technology that can enable patrons onto the transit system’s platforms without paying their fare. The technology was ballyhooed as a time-saver on its rollout two years ago: tap a credit/debit card or your phone’s digital wallet on a turnstile screen, and—voilà—you’re in.

But Sumanth Kamath (CDS’26) and Damodhar Pai (MET’25)—who earned master’s degrees in data science and computer science/cybersecurity, respectively—discovered that some riders paying with their digital wallet might be allowed through the fare gate, then have their payment later declined. 

The glitch, Kamath says, occurs because of a “design gap” stemming from the multiple parties and processes involved in tap-to-pay.

“Transit systems are designed to be extremely fast,” he says. “When someone taps a phone or card at a fare gate, the gate usually cannot wait several seconds for the bank to fully approve or reject the payment. Instead, the system often lets the rider through first and settles the payment afterward.” 

Digital wallets, he adds, “do not expose the real card number to the transit system. They use a substitute card number,” known as a token.

“The transit system may rely on that token to decide whether a card should be allowed, blocked, or charged later,” Kumath says. “In some cases, the identity the transit system sees can lose continuity. So even if a previous payment failed, the system may not reliably recognize that the next tap is tied to the same underlying card.” Erroneously seeing a new payment source, the technology allows the rider access, bypassing the standard “decline once, then block” protocol.

Pai first noticed the problem as a BU student in the winter of 2025, when he boarded a Green Line B train at the Sutherland Road stop in Brighton. He tried to pay with his phone. “The gate allowed me through, but the payment later showed as declined,” he says. “At first, I thought it was just a one-time payment issue.” 

He mentioned the matter to Kamath, and they jointly investigated to see if the glitch was indeed a one-off. They tested more than a half dozen debit cards and their digital wallets and found the glitch often repeating.

They alerted the MBTA, which issued a statement in response to the Terriers’ discovery: “The MBTA is committed to protecting the systems that support our riders and daily operations. To strengthen cybersecurity and build public trust, we have established a Vulnerability Disclosure Program (VDP), which provides a safe and structured way to encourage responsible disclosures. As a result, we gain valuable insights that help us fix issues before they can be exploited. The VDP has been a significant success since its inception nearly four years ago, allowing us to engage and collaborate with the public.”

Without access to internal MBTA data, Pai and Kamath can’t know how often riders are getting T service for free. While the transit agency hasn’t said publicly when or how the issue might be resolved, Kamath believes a fix likely requires cooperation across multiple parties: “the MBTA, its fare-system vendor Cubic, payment networks, card issuers, and wallet providers. 

“A stronger fix would involve making sure the system can recognize the same underlying payment account, even when tokenized wallet credentials change or reset, so that a declined payment cannot be treated as a clean new credential.”

Kamath and Pai, of course, discourage riders from this digital version of turnstile hopping. “We came forward,” Kumath says, “because transit systems depend on fare revenue, and if this type of issue exists, the responsible parties should understand it and work together to fix it.”