Cashless NFC-based Payment in Festivals: LINDDUN Privacy Threat Model

Cashless NFC-based Payment in Festivals: LINDDUN Privacy Threat Model Dimitri Van Landuyt October 22,2025 Cashless payment is becoming increasingly ubiquitous and with this overall trend, also the adoption of non-bank-led payment solutions keeps increasing. In this document, we provide the standalone application description of an abstracted payment system used in the context of mass events such as festivals. These payment systems commonly use of parallel festival-specific currency (voucher or token-based) and use contactless communication technology such as NFC for payment convenience. The abstracted payment system described in this document is based on a survey of technologies adopted in diverse festivals and the technical information system architecture in support of such payment operations. We first present the overall case description, consisting of two distinct Data Flow Diagrams (dfds) and a step-by-step explanation of the main functioning of this system. Then, we present the linddun privacy threat model for this case, which lists and describes the most prevalent privacy threats. 1Introduction This report presents a case study application of the linddun privacy threat modeling framework. It is comprised of two parts: (i) an indepth case description, and (ii) detailed threat descriptions. Part I of this report is based on the work conducted within the context and scope of the master’s thesis entitled ‘Cashless Payment at Festivals: A Security and Privacy Threat Modeling Analysis’ by Mustafa Kurto˘glu, Michaël Teugels and Joachim Wyckmans1,2, supervised by 1Kurtoglu2025. 2The content presented in this report mainly corresponds to Section 7.2.2, and 7.3, in conjunction with Appendices A and B of the master’s thesis. Dimitri Van Landuyt and Jakob De Moor. This work was awarded a master’s thesis prize by the Faculty of Economics and Business of KU Leuven in 2025. This part of the report is structured as follows: First, a number of scoping decisions are explained and motivated, based on the availability of technical information, popularity, etc. More concretely, a representative festival payment system is chosen in Section 2. Then, Section 3introduces the main dfd models of the application, and discusses their elements and main flows. Section 3 shows the DFDs of the system, explains these in additional detail, and presents a DFD glossary. Part II is based on the combined threat model outputs of four distinct threat modelers: Dimitri Van Landuyt, Laurens Sion, Felix Schwickerath, and Tom Hüller. It consists of Section 4which presents the resulting linddun threat model for this application case. cashless nfc-based payment in festivals 2 Part I Case description 2Scope and inputs Unlike traditional payment environments, festival payment systems operate in temporary, high-volume settings, where payment infrastructure, data handling practices and security measures can differ significantly. To gain a deeper understanding of these systems, this section analyzes various festivals and their respective payment technologies, compiling key details into a structured dataset. Section 6.1 outlines the selection process of the festivals examined. Section 6.2 provides an overview of the festivals analyzed and their payment technologies, as well as the cashless payment providers analyzed and their privacy & data practices. 2.1Selection of Festivals Cashless payment systems at festivals vary widely, with different events adopting distinct technologies based on infrastructure, security requirements and user convenience. To analyze these systems, a dataset of various festivals is compiled. In selecting festivals for this study, a structured approach is followed to ensure a diverse and representative dataset. The selection criteria were based on four key considerations: •Availability of Data: One of the key factors in selecting festivals was the availability of publicly accessible information regarding their payment systems. Data was gathered from official festival websites and payment provider documentation to ensure the accuracy of this analysis. This ensures that the findings are based on verifiable data. •Diversity in Festival Genre and Size: The selected festivals represent a broad range of genres (electronic, rock, metal, pop, hip-hop) and sizes (from small 12,000-attendee festivals to large-scale events like Glastonbury and Coachella). This diversity ensures that this study captures a variety of festival payment use cases. •Belgium as a Festival-Dominant Country: Belgium has a rich festival culture and hosts some of the most well-known music events in Europe, such as Tomorrowland,Rock Werchter and Pukkelpop. The country has a high adoption rate of cashless payment systems at festivals, making it an ideal ecosystem to study the different payment technologies in use. Additionally, Belgium’s festival industry cashless nfc-based payment in festivals 3 operates under structured regulations, providing insights into how cashless payment systems function in well-regulated environments (e.g., the GDPR) or the use of proprietary payment systems, issued by the FOD Economie [3,1,2]. •Inclusion of International Festivals for Comparison: While Belgium serves as the focal point of scoping for this case study, festivals from other countries (USA, UK, Germany, Spain, Japan, Hungary and France) are also included in support of a more complete comparative analysis. 2.2Overview of Festivals and Payment Providers Table 3(in Appendix) provides an overview of the selected Belgian and international festivals, their location, size, payment technology and external payment provider. To enhance clarity, selected festivals are categorized. Examining the festival dataset reveals the following insights regarding payment system usage: Technology Categories of Investigated Festivals Percentage (%) NFC 69.6% Mobile Payment 21.7% Physical Systems (Coins, Vouchers, Tokens) 17.4% Regular Cards 17.4% Table 1: Analysis of Cashless Payment Systems Used by Investigated Festivals • A total of 23 festivals were analyzed, with 60.9% of them taking place in Belgium. As highlighted in Table 1, the most widely used payment technology is based on NFC. This observed trend aligns with the initial justification for focusing on Belgium, given its high adoption rate of cashless technologies at festivals. • Physical payment systems such as vouchers were found in 17.4% of festivals. While these traditional methods are still in use, they are gradually being replaced by more modern technologies. Events like Pukkelpop (Belgium) and Alcatraz Festival (Belgium) still use drink or food vouchers, which minimize digital security risks but introduce issues such as loss, counterfeiting and inefficiencies in tracking transactions [4]. Notably, some festivals offer multiple payment options, which were counted in all relevant categories. To better understand how festival payment systems operate, a selection of payment providers is analyzed, offering cashless payment solutions relevant to the European festival landscape. Table 3(in cashless nfc-based payment in festivals 4 Appendix A.2) presents an overview of their cashless payment technology offerings and stated privacy/data practices, based on publicly available information. An analysis of these providers reveals variations in their stated practices. While some explicitly claim GDPR compliance (e.g., NFCtron,Playpass/Weezevent) and offer user control features (e.g., apps for balance checking or refund requests), others emphasize organizerfocused data analytics and insights derived from tracking attendee transactions and behavior (e.g., Tappit and Oveit). Several providers did not explicitly mention GDPR compliance in the reviewed materials. Furthermore, differences in implementation, such as wristbands vs mobile-based payments or registered vs unregistered usage, impact the level of security and data exposure. Understanding these providers’ approaches helps assess the risks and benefits of various festival payment systems, although actual compliance and internal data handling practices require deeper investigation beyond publicly available statements. 3Modeling of Data Flow Diagrams We provide an abstraction of the information systems used in the context of a cashless NFC-based payment system. Some assumptions and scoping decisions: 1. The payment service is operated by a third-party technology and service provider (the ‘Cashless Payment Provider’). This is an organization that provides the hardware (NFC wristbands and NFC terminals) and implements the functionality for topping up and payment in the in-festival context. 2. Realistically (e.g., in a transition phase), and depending on the context, there may or may not alternative payment means available (e.g., cash, bank-led payment). In this case study, the cashless, NFC-based payment is the only option offered to a festival attendee. 3. Festival attendees have to top-up their account balance, which is a payment transaction. This can be done during the festival, or beforehand. 4. As payment transactions occur in high frequency and volume in a festival, a system of vendor payment settlement is implemented at lower frequency: during the festival, all payments are recorded by the system, but they are settled in large volum or in bulk, i.e. the actual payments to the vendors occur at fixed intervals (e.g, end cashless nfc-based payment in festivals 5 of day/festival). This process is also called ‘deferred net settlement’ (DNS). 3.1Data Flow Diagrams Rather than focusing on the specific communication technology used and the specifics of the communication protocols, the DFD models focus on the broader information system, involving the steps to (i) register attendees at the basis of their festival ticket, (ii) linking a payment wristband to such attendee, (iii) the procedure to top up the festival account balance via a third-party payment providers, and (iv) and performing purchases and in-festival transactions. Figure 1details the overall process of Vendor registration. Figure 2 then presents the first DFD that depicts the flows related to registration and activation of the Festival attendee into the relevant systems, which is highly analogous. trust boundary external entity process data store data flow DFD LEGEND V1.1. write vendor record(Name,Email): VendorID V1.2 activate vendor account (Name,Email,BankAccount,VendorID) Vendor Registration V2. link terminal(VendorID, Terminal_ID) V1. register(Name,Email,BankAccount) : VendorID Vendor Registration DB Festival Organizer V1.2.1. register(Name,Email,BankAccountVendor) Create Vendor Account Cashless Payment Provider Cashless Account DB V2.1. register NFC payment terminal(VendorID, Terminal_ID) Link NFC Payment Terminal Vendor Festival Vendor Figure 1: DFD of the contactless Festival Payment system: Vendor registration and Vendor payment terminal activation. Figure 3then presents the DFD of the festival payment system that illustrates the flows related to topping up the account balancing and performing contactless payments at the festival. Finally, Figure 4presents the process of payment settlement to the Vendors. cashless nfc-based payment in festivals 6 trust boundary external entity process data store data flow DFD LEGEND A1.1.write attendee record(Name,Email,TicketNb): AttendeeID A1.2. activate cashless account (Name,Email,AttendeeID) Attendee Registration A2. link bracelet(AttendeeID, NFC_ID) Festival attendee A1. register(Name,Email,TicketNb) : AttendeeID Festival Registration DB Festival Organizer A1.2.1. register(Name,Email,AttendeeID) Create Cashless Account Cashless Payment Provider Cashless Account DB A2.1. register NFC bracelet(AttendeeID, NFC_ID) Link NFC Bracelet Figure 2: DFD of the contactless Festival Payment system: registration and activation. trust boundary external entity process data store data flow DFD LEGEND TU.1 request top-up(AttendeeID, amount) P2. payment confirmation(NFC_ID, Amount) Festival attendee TU1.1. read attendee information(AttendeeID):Tuple<Name,Email> TU1.2. request payment transaction(Name,Email, Amount,Destination):TransactionID TU1.4. increase balance(AttendeeID,Amount) Top-up Service Cashless Payment Provider Cashless Account DB B1. update balance (AttendeeID, Amount): boolean B2. log transaction (DateTime, AccountID,Amount,Description) Update Cashless Balance Third-party Payment Processor TU1.3. payment authorization(TransactionID) Payment Processor Transaction Log NFC Payment P1. initiate NFC payment (VendorID, RefId, Amount) Vendor Festival Vendor P3. decrease balance(AttendeeID,Amount):boolean Figure 3: DFD of the contactless Festival Payment system: transactions (top-up and payment). cashless nfc-based payment in festivals 7 trust boundary external entity process data store data flow DFD LEGEND VS1. list vendor open transactions(VendorID): Tuple<Name,Email,BankAccount,RefID[], Amount[]> VS2. request payment transaction(Name,Email, Amount,Destination):TransactionID VS4. close balance(VendorID, RefID[], TransactionID) Settlement Service Cashless Payment Provider Cashless Account DB Third-party Payment Processor VS3. payment authorization(TransactionID) Payment Processor Figure 4: DFD of the contactless Festival Payment system: settlement of Vendor payments. 3.2Data Flows: Step by step Vendor registration and activation. The following data flows are used to register vendors in the system. These steps may occur in preparation of the festival, and may only be executed for legitimate vendors and within the boundaries of a legal contract with the festival organizer. V1.The Vendor registers their name, contact details and bank account information V1.1.This information is stored in the Vendor Registration DB operated by the Festival Organizer. V1.2.The Festival Organizer automatically registers the Vendor with the Cashless Payment Provider. V1.2.1.The Vendor information is recorded in the Cashless Account DB. V2.The Vendor associates their NFC-capable payment terminal to their account3.3We do not model any form of authentication or authorization of the Vendor in these systems, as these concerns are considered out of scope of this privacy threat model. V2.1.The NFC payment terminal information is recorded in the Cashless Account DB and linked to the vendor (VendorID). Festival attendee registration and activation. The following data flows are used in the process of registering at the festival and activating the cashless payment modalities, as depicted above in Figure 2. These steps may occur in preparation of the festival, e.g. at home, via a website, or upon gaining entrance at the festival. cashless nfc-based payment in festivals 8 A1.The Festival attendee registers or checks in at the festival (e.g., ticket verification or registration booth) by presenting a valid ticket (TicketNb) and means of identification (here the Name, and Email4). 4This may be extended or broadened to other identifiers, e.g. the social security number (SSID). A1.1.This leads to the write attendee record data flow, which leads to persisting or updating the record and activation of the ticket in the Festival Registration DB A1.2.Then, as part of the registration process, the festival system redirects to the system of the Cashless Payment Providers, more specifically to activate the cashless account (activate cashless account data flow to the Create Cashless Account process). A1.2.1.This leads to the initial registration of the Festival attendee in the Cashless Account DB database of the Cashless Payment Provider, with Name,Email and AttendeeID. A2.After handing a physical NFC bracelet to the Festival attendee, the registration of that bracelet (and association to the Festival attendee) happens via the link bracelet data flow to the Link NFC Bracelet process. A2.1.The NFC payment bracelet information is recorded in the Cashless Account DB and linked to the festival attendee (AttendeeID). Top-up transactions. The following data flows are used in the process of topping up the account balance as depicted in the top half of Figure 3. TU1.The Festival attendee requests a top-up (request top-up data flow). TU1.1.The Top-up Service process fetches the relevant information (Name,Email) in the Cashless Account DB, based on the provided AttendeeId. TU1.2.The Top-up Service process then sends a payment request to the External Payment provider, by requesting a payment transaction (request payment transaction which returns a TransactionID) and requests a financial transaction (request payment transaction data flow) of the given Amount from the Festival attendee to the Destination account of the Cashless Payment Provider. TU1.3.The Payment Processor issues a callback via payment authorization with the same TransactionID indicating success of the request financial transaction. cashless nfc-based payment in festivals 9 TU1.4.The Top-up Service process issues a increase balance for AttendeeID with the exact Amount paid to the Update Cashless Balance process. B1.The Update Cashless Balance process updates the balance for the festival attendee with AttendeeID in the Cashless Account DB, through the update balance data flow. B2.The transaction is logged in the Transaction Log data store through the log transaction data flow.] item[] Festival payments. In-festival payments happen as follows through the following data flows depicted in the bottom half of Figure 3. P1.The Vendor initiates the transaction by entering RefId and Amount P2.The Festival attendee confirms the payment, by tapping the wristband to the payment terminal. P3.The account balance is updated accordingly; the account balance is reduced with the paid amount: B1.The Update Cashless Balance process updates the balance (negatively) for the festival attendee with AttendeeID in the Cashless Account DB, through the update balance data flow. B1.b The same data flow Update Cashless Balance is used to positively update the balance of the Vendor’s account in the Cashless Account DB. B2.The transactions are logged in the Transaction Log data store through the log transaction data flow. Vendor payment settlement. Finally, the flows depicted in Figure 4 implement the following logic: VS1.At a predefined time slot (e.g., end of day), the Settlement Service initiates the process. For each Vendor (VendorID), a list of open (unpaid) transactions is fetched, with per transaction the RefId and Amount and the vendor details (Name,Email, BankAccount). VS2.The Settlement Service process then sends a payment request to the External Payment provider, by requesting a payment transaction (request payment transaction which returns aTransactionID) and requests a financial transaction (request payment transaction data flow) of the given Amount to the Vendor’s BankAccount. cashless nfc-based payment in festivals 16 References [1] Belga News Agency. Festival organisers not allowed to make profit from own payment systems.https://www.belganewsagency.eu/ belgian-festival-organisers-not-allowed-to-make-profitfrom-own-payment-system. Accessed: 2025-04-25.2024. [2] Maïthé Chini. Cashless wristbands? Belgian festivals not allowed to make profit from own payment systems.https://www.brusselstimes. com/1079010/cashless-wristbands-belgian-festivals-notallowed - to - make - profit - from - own - payment - systems. Accessed: 25 April 2025.2024. [3] FOD Economie. Het gebruik van eigen betaalmiddelen op evenementen: guidelines voor organisatoren.https://economie.fgov.be/ nl/themas/ondernemingen/guidance/andere-sectoren/hetgebruik-van-eigen. Accessed: 2025-04-25.2024. [4] Yong Wang, Christen Hahn, and Kruttika Sutrave. “Mobile payment security, threats, and challenges”. In: 2016 Second International Conference on Mobile and Secure Services (MobiSecServ). 2016, pp. 1–5.doi:10.1109/MOBISECSERV.2016.7440226. cashless nfc-based payment in festivals 17 A List of festivals A.1Belgian Festivals Alcatraz Festival Size Info: https://www.vrt.be/vrtnws/nl/2024/08/09/metalfesti val-alcatraz-in-kortrijk-verwacht-recordopkomst-van-55/ Accessed: 2025-03-27 Technology Used: https://www.grimmgent.com/festival-guides/ #food-drinks Accessed: 2025-02-15 Couleur Café Size Info: https://www.bruzz.be/ice/ice/couleur-cafe-2024-z o-waardevol-als-divers-festival-met-ruimte-voor-onbewaakte-m omenten-2024 Accessed: 2025-03-27 Technology Used: https://www.couleurcafe.be/nl/praktisch/faq Accessed: 2025-03-27 Dour Festival Size Info: https://www.brusselstimes.com/1151094/the-34th-dou r-festival-ends-on-a-high-note-averaging-over-44000-visitor s-per-day Accessed: 2025-02-15 Technology Used: https://www.dourfestival.eu/en/faq/ Accessed: 2025-02-15 External Payment Provider: https://www.dourfestival.eu/en/ter ms-and-conditions/ Accessed: 2025-05-19 Graspop Metal Meeting Size Info: https://festileaks.com/festival/graspop/2024/ Accessed: 2025-02-15 Technology Used: https://www.graspop.be/en/info/cashless Accessed: 2025-02-15 External Payment Provider: https://www.graspop.be/en/info/ter ms-and-conditions Accessed: 2025-05-19 Les Ardentes Size Info: https://www.belganewsagency.eu/festival-les-arden tes-in-liege-expects-to-welcome-around-220000-people Accessed: 2025-02-15 Technology Used: https://lesardentes.be/info/cashless cashless nfc-based payment in festivals 18 Accessed: 2025-02-15 External Payment Provider: https://lesardentes.be/terms-and -conditions?lng=en Accessed: 2025-05-19 Lokerse Feesten Size Info: https://festileaks.com/festival/lokerse-feesten/2 024/ Accessed: 2025-02-15 Technology Used: https://www.lokersefeesten.be/nl/praktisch /eten-drinken Accessed: 2025-02-15 External Payment Provider: https://weezevent.com/en-gb/story/ lokerse-feesten/ Accessed: 2025-05-19 Pukkelpop Size Info: https://www.pukkelpop.be/en/about-pukkelpop Accessed: 2025-02-15 Technology Used: https://www.pukkelpop.be/nl/info/veelgeste lde-vragen Accessed: 2025-02-15 Rampage Open Air Size Info: https://www.vrt.be/vrtnws/nl/2024/07/05/dit-wordt -rampage-open-air/ Accessed: 2025-03-27 Technology Used: https://www.rampageopenair.eu/faq Accessed: 2025-02-15 External Payment Provider: https://www.rampageopenair.eu/inte rnal-regulations Accessed: 2025-05-19 Rock Herk Size Info: https://dumpmagazine.be/ShowNews/Festival_report__ Rock_Herk_2024 Accessed: 2025-02-15 Technology Used: https://rockherk.be/nl/praktisch Accessed: 2025-02-15 Rock Werchter Size Info: https://www.brusselstimes.com/584386/rock-werchte r-90000-daily-visitors-and-100-artists-over-four-days Accessed: 2025-02-15 Technology Used: https://www.rockwerchter.be/nl/cashless cashless nfc-based payment in festivals 19 Accessed: 2025-02-15 External Payment Provider: https://www.rockwerchter.be/nl/c ashless Accessed: 2025-05-19 Suikerrock Size Info: https://www.demorgen.be/nieuws/suikerrock-krijgt-m eer-dan-100-000-bezoekers-over-de-vloer~b639776c/ Accessed: 2025-02-15 Technology Used: https://www.suikerrock.be/praktisch/ Accessed: 2025-02-15 External Payment Provider: https://www.suikerrock.be/algemene -voorwaarden/ Accessed: 2025-05-19 Tomorrowland Size Info: https://www.tomorrowland.com/home/article/tomorrow land-belgium-2023-aftermovie/ Accessed: 2025-02-15 Technology Used: https://faq.tomorrowland.com/hc/en-us/sect ions/360007281732-Cashless Accessed: 2025-02-15 External Payment Provider: https://belgium.tomorrowland.com/e n/sales-info/your-privacy/privacy-policy/ Accessed: 2025-05-19 TW Classic Size Info: https://festileaks.com/festival/tw-classic/2024/ Accessed: 2025-02-15 Technology Used: https://www.twclassic.be/nl/cashless Accessed: 2025-02-15 External Payment Provider: https://www.twclassic.be/en/condit ions-of-sale?_gl=1*cg2fx0*_up*MQ..*_ga*MjkwNjQ3NDMzLjE3NDc2N jc2MDA.*_ga_HBZ7RJPKZ3*czE3NDc2Njc1OTkkbzEkZzAkdDE3NDc2Njc1O TkkajAkbDAkaDA. Accessed: 2025-05-19 wecandance Size Info: https://www.nieuwsblad.be/cnt/dmf20240812_94070182 Accessed: 2025-02-15 Technology Used: https://wecandance.be/info-faq/ Accessed: 2025-02-15 External Payment Provider: https://wecandance.be/terms-condi tions/ Accessed: 2025-05-19 cashless nfc-based payment in festivals 20 A.2International Festivals Balaton Sound (Hungary) Size Info: https://www.maximaltrips.com/blog/balaton-sound/w hy-balaton-sound Accessed: 2025-02-15 Technology Used: https://balatonsound.com/en/festival-info# !/8979/how-to-top-up-a-wristband Accessed: 2025-02-15 External Payment Provider: https://festipay.com/author/marci/ #:~:text=Ingenico%20Group%2C%20the%20global%20leader,Sound%2 0Festival%20and%20VOLT%20Festival. Accessed: 2025-05-19 Coachella (USA) Size Info: https://english.elpais.com/culture/2024-04-12/coac hella-2024-will-be-one-of-the-most-latino-editions-in-histo ry-schedules-performances-and-where-to-watch-it.html Accessed: 2025-02-15 Technology Used: https://www.coachella.com/faq Accessed: 2025-02-15 FIB Bencássim (Spain) Size Info: https://festileaks.com/festival/fib-benicassim/20 24/ Accessed: 2025-02-15 Technology Used: https://weezevent.com/en-gb/weezpay/cashle ss/ Accessed: 2025-02-15 External Payment Provider: https://weezevent.com/en-gb/weezpa y/cashless/ Accessed: 2025-05-19 Glastonbury (UK) Size Info: https://festileaks.com/festival/glastonbury-festi val/2024/ Accessed: 2025-02-15 Technology Used: https://www.glastonburyfestivals.co.uk/inf o/ Accessed: 2025-02-15 Fuji Rock Festival (Japan) Size Info: https://en.fujirockfestival.com/2024/0730a/ Accessed: 2025-02-15 Technology Used: https://en.fujirockfestival.com/2024/guide cashless nfc-based payment in festivals 21 /faq/ Accessed: 2025-02-15 Lollapalooza (Germany) Size Info: https://www.fox32chicago.com/news/lollapalooza-202 4-kicks-off-grant-park-drawing-huge-crowds-top-artists Accessed: 2025-02-15 Technology Used: https://www.lollapaloozade.com/en/cashless agbs Accessed: 2025-02-15 External Payment Provider: https://www.lollapaloozade.com/en/ cashlessagbs Accessed: 2025-05-19 Rolling Loud (Global) Technology Used: https://europe.rollingloud.com/cashless-en/ Accessed: 2025-02-15 External Payment Provider: https://portugal.rollingloud.com/t erms/payment_plan_terms Accessed: 2025-05-19 Sziget (Hungary) Size Info: https://www.ticketfairy.com/word/2024/12/24/bigges t-music-festivals-of-2024-in-the-world/ Accessed: 2025-02-15 Technology Used: https://szigetfestival.com/en/festival-info Accessed: 2025-02-15 External Payment Provider: https://szigetfestival.com/en/fest ival-info#!/2380/paying-at-the-festival Accessed: 2025-05-19 Tomorrowland Winter (France) Size Info: https://winter.tomorrowland.com/en/ Accessed: 2025-02-15 Technology Used: https://winter.tomorrowland.com/en/my-brace let/cashless-information/ Accessed: 2025-02-15 Technology Used: https://winter.tomorrowland.com/en/practic al/general-terms-and-conditions/ Accessed: 2025-05-19 cashless nfc-based payment in festivals 22 Festival Name Country Size (/ day) Technology Used External Payment Provider Alcatraz Festival Belgium 18,000 Physical Vouchers - Couleur Café Belgium 24,000 Physical Vouchers / Payconiq - Dour Festival Belgium 44,000 NFC with QR Weezevent Graspop Metal Meeting Belgium 55,000 NFC with QR Undisclosed Les Ardentes Belgium 55,000 NFC with QR Weezevent Lokerse Feesten Belgium 15,000 NFC with QR Weezevent Pukkelpop Belgium 66,000 Physical Vouchers - Rampage Open Air Belgium 18,000 NFC with QR Undisclosed Rock Herk Belgium 12,500 Physical Vouchers - Rock Werchter Belgium 90,000 NFC with QR Weezevent Suikerrock Belgium 25,000 NFC Undisclosed Tomorrowland Belgium 67,000 NFC Undisclosed TW Classic Belgium 60,000 NFC with QR Undisclosed wecandance Belgium 13,500 NFC with QR Weezevent Balaton Sound Hungary 50,000 NFC / Regular Card / Mobile Payment Festipay Coachella USA 125,000 Regular Card / Mobile Payment - FIB Bencássim Spain 53,000 NFC with QR Weezevent Glastonbury UK 150,000 Regular Card / Mobile Payment - Fuji Rock Festival Japan 24,000 Regular Card/ Mobile Payment - Lollapalooza Germany 100,000 NFC Weezevent Rolling Loud Varies - NFC with QR Weezevent Sziget Hungary 70,000 NFC with QR Festipay Tomorrowland Winter France 4,000 NFC Undisclosed Table 3: Overview of Payment Systems at Selected Belgian and International Festivals. Sources for festival size and technology used can be found in Appendix A.1and Appendix A.2.