MSE News: Banks must take action over contactless card security flaw, says leading MP

jonesMUFCforever

nic_c wrote: »

We entrust the banks to look after our cash and keep it safe. Why should we need to second guess the banks. Having a card stolen is traumatic enough, especially having to scour statements in the short term for fraudulent transactions. Usually people want closure, but still having to be vigilant eight months later isn't closure.

It's like losing your house keys with address information, and the insurance company saying "don't bother changing your locks, just take inventory every day and if ever there anything missing you can start a claim"

Rubbish!
Only one person I know of has had this happen to them and that was through reading the Daily Mail.
No threads on these forums that I have seen.
No matter how old the transactions are surely you know if you carried them out or not?

nic_c

jonesMUFCforever wrote: »

Rubbish!
Only one person I know of has had this happen to them and that was through reading the Daily Mail.
No threads on these forums that I have seen.
No matter how old the transactions are surely you know if you carried them out or not?

But its not about how many you know, but the fact that the banks are saying it can happen and putting a stop to it. It's perceived risk. Banks are very unlikely to go under, doesn't stop the government having to put a Financial Compensation Scheme in place.

The banks are putting onus on us to detect them, when its their faulty implementations. Its easier for them not to have small transactions checked. If I entrust my money to them surely I should have the protection for it?

Contactless is for small payments and so you may make several each day, so that can mount up over the month. Its one thing noticing a large transaction like for a TV, and another checking which of the six visits I did to Asda last week were mine.

jonesMUFCforever

nic_c wrote: »

But its not about how many you know, but the fact that the banks are saying it can happen and putting a stop to it. It's perceived risk. Banks are very unlikely to go under, doesn't stop the government having to put a Financial Compensation Scheme in place.

The banks are putting onus on us to detect them, when its their faulty implementations. Its easier for them not to have small transactions checked. If I entrust my money to them surely I should have the protection for it?

Contactless is for small payments and so you may make several each day, so that can mount up over the month. Its one thing noticing a large transaction like for a TV, and another checking which of the six visits I did to Asda last week were mine.

So has it happened to you at all? Please be honest.
Has it happened to any of your friends or family - again be honest?

miller

nic_c wrote: »

Usually people want closure, but still having to be vigilant eight months later isn't closure.

Maybe literal closure of the account is a solution from a customer's viewpoint?

Though IIRC, credit card companies have re-opened "closed" accounts to debit recurring payments/CPAs (this should defninitely be their problem - closed should mean closed; the retailer can persue the customer for any contractual payments later, after the transaction has been declined).

nic_c

jonesMUFCforever wrote: »

So has it happened to you at all? Please be honest.
Has it happened to any of your friends or family - again be honest?

And the point being? Do people only lock their doors or install burglar alarms once themselves or someone they know has been burgled. Do you not have a password on your mobile or use 1111 as your credit card PIN simply because you have not had either of them stolen.

No you don't, because its about prevention and perceived risk. Banks tell us to minimise risk by taking preventative measures, like not writing your PIN down and covering the keypad when entering it, but they don't minimise risk by allowing contactless payments months after a card has been cancelled.

jonesMUFCforever

nic_c wrote: »

And the point being? Do people only lock their doors or install burglar alarms once themselves or someone they know has been burgled. Do you not have a password on your mobile or use 1111 as your credit card PIN simply because you have not had either of them stolen.

No you don't, because its about prevention and perceived risk. Banks tell us to minimise risk by taking preventative measures, like not writing your PIN down and covering the keypad when entering it, but they don't minimise risk by allowing contactless payments months after a card has been cancelled.

I thought so I have not heard of anybody I know either that have lost out as a result of this.

Ben8282

I had a contactless debit card stolen not long ago.
Without going into details of how the theft occurred, I reported it to the bank immediately and the card was cancelled before anybody could have had a chance to use it.
A small number of contactless transactions went through over the next 3 days. These transactions were made in places which use offline terminals. I won't name them but they are the same places as where when you use a card the transaction never shows up a pending; experienced forum members will know where I mean and it was the obvious places where the card was used.
The bank were excellent in their response and the transactions refunded immediately within minutes of my conversations with the banks fraud department.
The transactions then stopped, presumably as the card details had been put onto whatever look-out list gets downloaded to the terminals these days.
The Daily Mail are very good at exaggeration and scaremongering but I personally don't see this as a big problem.
An afterthought: In the days of manual charge forms and floor limits, stolen cards really could be used for years after being stolen!

eddddy

I guess banks might look at things this way...

1. Sometimes people report cards lost/stolen - and they get used by unknown fraudsters

2. A few people might report cards lost/stolen - and the owners find them again and unthinkingly/inadvertently use them again

3. A very few people might even report cards lost/stolen - with the intention of using them again - i.e fraudulently


So what action should a bank take when there is an offline transaction on a card reported lost/stolen?

- Maybe they should ask the cardholder for confirmation before debiting the amount?

- What if the cardholder doesn't reply?

- Would asking a cardholder first, instead of just debiting the amount, tempt some 'slightly dishonest' cardholders to tell fibs?

Oystercatcher_2

I always thought that my contactless credit card was protected by a maximum sales limit above which my PIN would be required. But just called in to pay for petrol at a filling station whose card reader was not working who were able to override the limit to take a large contactless payment without a PIN protection. Is this commonly known that contactless credit cards can by used by a retailer above the safety limit without a PIN ?

boo_star

Oystercatcher wrote: »

I always thought that my contactless credit card was protected by a maximum sales limit above which my PIN would be required. But just called in to pay for petrol at a filling station whose card reader was not working who were able to override the limit to take a large contactless payment without a PIN protection. Is this commonly known that contactless credit cards can by used by a retailer above the safety limit without a PIN ?

I would assume that any retailer who overrides the contactless limit will become liable for any fraudulent transactions.

If they want to take the risk, that's their problem.