CharlieCard and the AFC 2.0 Fare System Replacement
The MBTA issued its first CharlieCards on 4 December 2006 and still keeps the balance on the card — the weakness MIT students were sued for describing in 2008 and Medford high-schoolers cloned again in 2023, that time with the agency's help. Its replacement, awarded to Cubic for mid-2020, took bank cards in August 2024. Commuter rail still cannot tap.
Live
📅 since 2006
✔ Editor-reviewed
📊 Impact
The programme's hard numbers are its own schedule. The MBTA awarded the Cubic-John Laing consortium about $723M in November 2017 for full implementation by mid-2020. After the December 2019 reset, which scrapped the planned 'big bang' and added more than $200M, the amended contract reached $935.4M and the project $960.2M; in May 2024 the board moved full rollout from May 2024 to June 2026 and the contractual longstop from August 2025 to June 2027. The Massachusetts State Auditor reported on 16 January 2025 that the contract let deadlines be overridden without sufficient controls, and that the MBTA had not obtained the surety bond state law required, so it 'may not be able to recover money it paid for the $935.4 million contract in the event that the contract is not completed.'
🎓 Lesson
The vulnerability outlasted the lawsuit. Boston's flaw was never a secret — it was litigated in 2008 and demonstrated again in 2023 — and it persists because the value sits on the card rather than in a back office, which only the replacement system can change. Meanwhile the cheapest thing the MBTA changed was policy, not plastic: the income-eligible fare launched in September 2024 reached 44,875 riders in its second year, while the second-generation card promised for spring 2025 was still listed as coming soon in July 2026.
Evidence📊 Independent
Scale🗺️ Regional
Cost$935.4M contract, project estimated at $960.2M, up from about $723M at award in 2017
FundingDesign-build-finance-operate-maintain P3: Boston AFC 2.0 OpCo LLC, formed by Cubic Transportation Systems and John Laing, financed the build with $27.0M equity (John Laing $24.3M, Cubic $2.7M) and a $437.42M senior facility, and is repaid by the MBTA through availability payments over a 13-year concession backed by dedicated sales tax and local assessment revenue
Sources
↗ MBTA — Fiscal and Management Control Board awards contract to advance AFC 2.0 (20 November 2017)The operator's own award release and the baseline every later figure is measured against: the board approved 'the consortium of Cubic-John Laing for the design, integration, and implementation' at 'approximately $723 million, which includes operating costs through 2031.' The promise, in the MBTA's words: 'The new system will also allow all-door boarding on the Green Line and on buses', customers 'will be able to pay fares by tapping debit and credit cards', and 'The ability to tap and board the same way on all buses, trains, commuter rail and ferries.' On timing: 'MBTA customers will begin to experience the first elements of the new system late in 2019. Full implementation will occur by mid-2020.'
↗ WBUR — MBTA hitting reset on automated fare system rollout (9 December 2019)The reset, and the load-bearing source for what was postponed rather than cancelled. The original plan was for 'many of the features to come online in 2020 in a so-called big bang and for all-door boarding to begin in 2021'; after the board vote, all-door boarding 'now will not be piloted until three or four years in the future', and tapping a credit card at a fare gate was deferred with it. The revised plan carried 'more than $200 million in additional costs.' General Manager Steve Poftak: 'all three of those assumptions were off, and what we've done here is a course correction.'
↗ MBTA — Fare Transformation Program finalizes contract amendment (18 June 2020)The amendment itself: it 'incorporates improvements to the original AFC 2.0 contract based on feedback from customers, advocates, and policy makers', gives 'more time for both testing and installation of the new system and for customer migration with a more phased approach', and adds 'agreed-upon schedule milestones and incentives for milestone achievement.' Term: '10 years of operations and maintenance with options for 2 additional 5-year terms.' Also dates the one commuter-rail exception the card ever got: CharlieCard payment at all Zone 1A stations on the Fairmount Line from Monday 22 June 2020. The release gives no dollar figure, which is why the cost is carried from FHWA and the State Auditor instead.
↗ US DOT Federal Highway Administration — project profile, Massachusetts automated fare collection systemFederal authority source for the money and the structure: 'The amended contract totals $935.4 million, including both the full capital cost of the system and a ten-year stream of operations and maintenance payments.' Delivery is a 'Design-Build-Finance-Operate-Maintain P3 procurement model; 13-year Availability Payment concession' by Boston AFC 2.0 OpCo LLC, funded through an availability payment drawn on dedicated sales tax and a dedicated local assessment. Financing: $27.00M equity (John Laing $24.3M, Cubic $2.7M) and a $437.42M senior security facility. Also the source for the correction to a common assumption about this programme: the project was 'subsequently expanded in scope in the first half of 2020' — it was stretched and enlarged, not cut back.
↗ Office of the State Auditor of the Commonwealth of Massachusetts — audit of the MBTA Automated Fare Collection System 2.0 project (16 January 2025)The independent evaluation, covering 1 January 2018 to 30 September 2023. It puts the project at an estimated $960.2 million, 'which includes an approximately $935.4 million contract', and finds the agreement allowed deadlines to be overridden without sufficient controls, risking 'significant delays related to contract delivery' and 'overspending of public funds because of change orders, price escalation because of inflation.' The sharpest finding is the surety bond the MBTA did not obtain as state law required: without it 'the MBTA may not be able to recover money it paid for the $935.4 million contract in the event that the contract is not completed.' Two further findings — a $349,523 payroll variance between HR/CMS and FMIS, and incomplete cybersecurity awareness training — are recorded here but not carried in the entry.
↗ WBUR — No CharlieCard required: MBTA rolling out new fare system this summer (23 May 2024)Established press for the 2024 resequencing and the arithmetic of the delay: 'The original $723 million contract called for most features to launch in 2020, but the MBTA amended its agreement in a 2020 reset that pushed the total cost to $967 million', with officials then expecting about $926 million. The board approved a change that 'pushes the complete rollout deadline from May 2024 to June 2026' and the 'longstop date' 'from August 2025 to June 2027.' Phasing as planned at that point: contactless on subway, bus and Green Line in summer 2024; new CharlieCard, app and vending machines in spring 2025; commuter rail and ferries in spring 2026; Mattapan validators later because of a power availability issue. The $967M press figure and the auditor's $960.2M project estimate are close but not identical; the entry uses the auditor's.
↗ MBTA — New ways to pay: contactless payments accepted from August 1 (9 July 2024)Operator source for the date open-loop payment actually arrived: contactless debit and credit cards, phones and watches were accepted onboard buses, Green Line trolleys and Mattapan Line trolleys, and at all gated subway stations, from Thursday 1 August 2024 — four years after the mid-2020 date promised at award.
↗ MBTA — Tap to RideThe currency check, in the operator's own words in July 2026: 'Contactless payment is available on bus, subway, and ferry', while riders of the commuter rail 'should keep using your typical payment method.' Commuter rail — named in the 2017 award release as part of the promise — is still the mode that cannot tap. Also the source for what open loop does and does not carry: 'Existing transfer rules apply to travel between bus and/or subway with contactless payment.'
↗ MBTA — About the new Charlie systemThe second currency check. In July 2026 the page lists the new Charlie Card and Charlie fare vending machines under 'Coming Soon', not as available — the components the May 2024 plan put in spring 2025. The MBTA's framing: 'We're introducing the system in phases so we can test new features.' The page describes signing up for a Charlie Account 'to manage the cards and devices you use to pay your fare' but does not state that the new system is account-based, which is why the entry does not claim it.
↗ MBTA — CharlieCardOperator source for what the card costs and what it covers: 'You can get a free, blank CharlieCard at these locations', distributed through fare vending machines, city halls, libraries, Boys and Girls Clubs, retailers and the Charlie Service Center. Cards do expire — 'CharlieCard expiration dates are located on the lower right-hand corner, across from the serial number' — but there is no purchase fee and no forfeited deposit, unlike Manila's beep. Coverage: 'Not valid on Commuter Rail or ferry, except for the Fairmount Line.'
↗ MBTA — fares overviewEstablishes the absence that the comparison needs. In July 2026 the MBTA still sells a 1-Day Pass at $11.00, a 7-Day Pass at $22.50 and a monthly LinkPass at $90.00, and no fare-capping product appears anywhere in its fare material. Boston therefore sits with Chicago rather than with Los Angeles, which abolished passes for automatic caps in July 2023. Single fares as listed: subway $2.40, local bus $1.70, commuter rail $2.40-$13.25 by zone, ferry $2.40-$9.75 by route.
↗ Electronic Frontier Foundation — MBTA v. Anderson (case page)How the 2008 case ended, from counsel to the students: 'EFF represented the students in this matter and effectively settled the case', linking a 22 December 2008 release recording that the parties 'agreed to work together to identify and help improve security in the MBTA's Automated Fare Collection System' following dismissal of the federal lawsuit. Flagged conflict: the Wikipedia article states no settlement or formal dismissal is documented and that the restraining order simply expired. The entry follows EFF, which was a party.
↗ Wikipedia — Massachusetts Bay Transportation Authority v. AndersonTertiary, used for the procedural spine only. The MBTA sued Zack Anderson, Russell J. Ryan and Alessandro Chiesa on 8 August 2008, alleging under the Computer Fraud and Abuse Act that they 'transmitted programs to cause damage to (or attempted to transmit and damage) MBTA computers in an amount in excess of $5,000.' Judge Douglas P. Woodlock granted a temporary restraining order on 9 August barring the DEF CON 16 presentation; Judge George A. O'Toole Jr. declined to extend it on 19 August 2008. The order was also self-defeating: the slides had already gone to conference organisers and appeared on the court's own public docket.
↗ GBH News — Four teens hacked the MBTA for free rides. The agency says they're listening (23 August 2023)The load-bearing source for the claim that the underlying weakness survived the lawsuit. Matty Harris, Scott Campbell, Noah Gibson and Zack Bertocchi found the cards still 'store monetary value directly on the card itself rather than in a central database.' Harris on the state of it fifteen years on: 'it's kind of exactly the same way it was 15 years ago.' Campbell on the exploit, after cracking the checksum at the end of each data line: 'we were able to exploit that and actually edit the values... change the variable that contains the money so we can have a card with any amount of money we want up to like $300.' The institutional change is the other half of the story: the students went to MBTA chief information security officer Scott Margolis in January 2023, and the DEF CON talk went ahead with the agency's cooperation rather than a court order.
↗ DEF CON 31 — Boston Infinite Money Glitch: hacking transit cards without ending up in handcuffs (August 2023)Conference-archive listing confirming the talk, its title and its four speakers. The title is itself the comparison with 2008. Archive listing only, not a technical source; the vulnerability description in this entry comes from GBH.
↗ Boston Globe — Some Medford students hacked CharlieCards. Then they told the MBTA how they did it. (1 September 2023)Independent corroboration of the 2023 episode from the city's paper of record. Paywalled; headline, date and subject confirmed at search level, body not read. Carried only as a second outlet on a story whose facts come from GBH.
↗ MBTA — Income-Eligible Reduced Fare program continues to grow, serving nearly 45,000 riders (16 July 2026)Operator source for the entry's only rider-facing number, and the freshest source in the file. Enrolment reached 44,875 riders in FY26 (1 July 2025 to 30 June 2026), about 6% above the MBTA's own forecast, with roughly 95% of participants enrolling online. The programme launched on 4 September 2024 for riders aged 18-64 enrolled in an approved state assistance programme, with discounts of roughly 50% to 67% across bus, subway, commuter rail, ferry and The RIDE — a wider footprint than the CharlieCard itself has. Self-reported, so graded official, not independent.
↗ Wikipedia — CharlieCardTertiary, and used only where no operator page carries the fact: 'The card was introduced on December 4, 2006', and the original system runs on MIFARE Classic contactless chips. Also records that early cards expired three to five years after activation and later versions run ten years, which the MBTA's own page corroborates in principle by printing an expiry date on the card. The launch date should be replaced if an MBTA or MassDOT primary source is found.
📎 Cite this project
1001 Smart Cities (2026). “CharlieCard and the AFC 2.0 Fare System Replacement” — Boston, United States. The Smart City Atlas. https://1001smartcities.org/projects/boston-charliecard/ (last verified 2026-07-26). Data: CC BY 4.0.
The underlying data is free to reuse with attribution — see the open data page.
🔗 Related projects
🇺🇸 Ventra: Chicago's Open-Loop Fare System and Its Broken Launch · Chicago
Cubic's Chicago system took bank cards from day one in 2013, and the CTA withheld all payment until it met three 99% benchmarks.
🇺🇸 Clipper: One Card for Two Dozen Bay Area Operators, and the Rebuild That Ran Late · San Francisco
Cubic rebuilt both: the Bay Area cut over in December 2025 and stalled; Boston took bank cards in 2024, but commuter rail still can't tap.
🇺🇸 TAP: One Fare Card for Los Angeles County, and the Caps That Came With It · Los Angeles
Los Angeles scrapped its passes in 2023 for automatic caps; Boston still sells a $90 monthly LinkPass and caps nothing.
🇺🇸 EASY Card, contactless bank cards and a daily fare cap · Miami
Miami went halfway: bank taps stop at $5.65 a day, while the discount and pass products stay on the agency card, as they do here.
→ Open this project in the interactive atlas · → 🚲 Mobility category · 🚩 Report an error