MSE News: Regulator to tackle contactless card security flaw after MSE investigation

RedDwarf82 · 30 March 2017 at 12:25PM

"Finally some, but not all, card issuers have systems which identify and block cancelled card transactions before they are debited from customer accounts."

Some card issuers charge customers for transaction they know (or they decide not to know) are fraudulent in the hope that the customer will not notice so they can keep the money... i.e. card issuers are committing fraud.

"card issuers are committing fraud", can the FCA please say it (and then force them to refund it for customers that didn't notice, and finally fine them for it).

Reaper · 30 March 2017 at 2:40PM

A simple technical solution is to download the "Hot List" of cancelled cards to the terminals and update it on the occasions when it is online.

7 million numbers might sound a lot but a simple list of digits doesn't take much space and can easily be compressed, and a sorted list should be speedy to check.

Maybe that's the technical fix they refer to. I hope so.

miller · 30 March 2017 at 2:41PM

VT82 wrote: »

Seems like a very good result. An easy answer would have been to force banks to take the hit when offline payments are made on a stolen contactless card, by having them cross-reference against the list of cancelled cards and refunding them to the customer automatically.

AFAIUI this happens in the TfL cases mentioned earlier in this thread (at the gateline or bus validator) i.e. the card is checked against known stolen ones locally.

badmemory · 30 March 2017 at 7:34PM

Reaper wrote: »

A simple technical solution is to download the "Hot List" of cancelled cards to the terminals and update it on the occasions when it is online.

Exactly.

I would love to know just how many (or would it be the total value of) transactions before you need to put in your pin. They used to say 3 but is it actually 3, 6, 10 or even 20? I've easily made it to 6 before I've used it for over £30.

With a cancelled card the banks know that it is fraudulent before it hits your account, therefore it should never actually hit your account. But if it didn't then they wouldn't stand a chance of slipping some through unnoticed.

Pincher · 31 March 2017 at 12:23AM

The Oyster card only allows me to charge up to about £80.

Why don't they just make Contactless a voluntary charging facility?

You use an ATM to charge or authorise a set limit, to suit your own lifestyle. If you know you use £30 a week on coffee etc. , you just have to top it up once a week at an ATM.

Obviously, you can make the charged amount £0 for cards you don't want to use for Contactless.

To go beyond the charged/authorised amount, when paying, you just use Chip and PIN.

miller · 31 March 2017 at 11:39AM

They certainly could make cards more configurable via an online interface/mobile app etc.

NJB62 · 5 April 2017 at 1:05PM

I believe the best immediate resolve, is to transfer the credit balance to a splinter account (i.e. another account held with the same bank) via on-line banking.
The lost contactless card would then be useless.

northwalesd · 5 April 2017 at 7:05PM

Pincher wrote: »

Why don't they just make Contactless a voluntary charging facility?

I think if they did that, take up would be much lower than it has been so far. It's not a solution I'd use.

Former_MSE_Faye · 7 April 2017 at 1:08PM

The card scheme says it's "reviewing options" including one which would force almost all contactless payments 'online'...

Read the full story:
'Amex reviewing payment processes in bid to tackle contactless card security flaw'

Click reply below to discuss. If you haven’t already, join the forum to reply. If you aren’t sure how it all works, read our New to Forum? Intro Guide.

Pincher · 8 April 2017 at 11:04AM

This whole thing stinks of hidden charges.

Do the card providers get a cut for every transaction?

They could have set the Contactless spend limit to zero by default from when the whole thing was launched. I would have designed it so you can set a limit yourself by going to an ATM.

The way it's done suggests that they want you to impulse buy as much as possible, so they get a fee somehow.

Since I get 1% cashback on Amex, I cannot believe Amex gets nothing per transaction.

MSE News: Regulator to tackle contactless card security flaw after MSE investigation

Comments

Confirm your email address to Create Threads and Reply

🚀 Getting Started

Categories

Is this how you want to be seen?

Get our FREE Weekly email full of deals & guides - and it’s spam-free