Security of contactless payment apps in the light of new proposed upper spend limit

Tokmon

robinwales said:

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

Why don't you use the fingerprint scanner instead?. It usually works better because you don't have to look right at your phone to unlock it plus the face unlock isn't very secure and could be tricked by a picture of you.

nyermen

jon81uk said:

ratechaser said:

I was a total ApplePay convert until I found that it can sometimes break the chain when it comes to retailer offers - can't recall if it was Avios or Virgin Miles, but my registered cards for earning in Caffè Nero would only work if used directly and not through ApplePay.

This is because Apple Pay doesn't actually give the retailer your card number, it uses a unique identifier each time. So if you have a cashback type offer that is dependant on the card number being looked up in a database you need to use the actual card.
I used to do the same to get the Virgin miles when shopping in store with Waitrose (although haven't been in a Waitrose store in ages!)

I'm not sure its a unique number every time - as it works on TFL throughout a day and they're able to link them together.  It's definitely a different number to your normal card however.  Also - I was able to enter something (I forget what, it's been a year!) into the oyster card website, and it tracked all my trips in my account too.  Number definitely changes when you re-register / change apple pay as I had to redo it when I changed watch.

sheramber

My husband could use Applepay  to pay for higher amounts in some shops. Lodi was one.
He asked Apple about it and they said they did not impose the limit on how much you spend contactless. It was the shop that set it.

huw01

The Santander App lets you deactivate the contactless function on any Masterard Debit or Credit Card 

Ballard

Tokmon said:

robinwales said:

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

Why don't you use the fingerprint scanner instead?. It usually works better because you don't have to look right at your phone to unlock it plus the face unlock isn't very secure and could be tricked by a picture of you.

Can phones be tricked in this way? I haven’t followed this closely but thought that they scanned your face in 3D to unlock. 

Nebulous2

sheramber said:

My husband could use Applepay  to pay for higher amounts in some shops. Lodi was one.
He asked Apple about it and they said they did not impose the limit on how much you spend contactless. It was the shop that set it.

My wife was told by a member of staff in Aldi that their limit for G-pay is £999, set by Aldi. I've no idea if that is correct or not, but it does work at over £100. 

colsten

Ballard said:

Tokmon said:

robinwales said:

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

Why don't you use the fingerprint scanner instead?. It usually works better because you don't have to look right at your phone to unlock it plus the face unlock isn't very secure and could be tricked by a picture of you.

Can phones be tricked in this way? I haven’t followed this closely but thought that they scanned your face in 3D to unlock. 

I agree, 3D face scan technology is a great deal safer than fingerprint technilogy. 2D technology can be fooled by good photos . Not sure whether you can still get phones with 2D.

Tokmon

colsten said:

Ballard said:

Tokmon said:

robinwales said:

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

Why don't you use the fingerprint scanner instead?. It usually works better because you don't have to look right at your phone to unlock it plus the face unlock isn't very secure and could be tricked by a picture of you.

Can phones be tricked in this way? I haven’t followed this closely but thought that they scanned your face in 3D to unlock. 

I agree, 3D face scan technology is a great deal safer than fingerprint technilogy. 2D technology can be fooled by good photos . Not sure whether you can still get phones with 2D.

The Samsung A71 definitely uses 2D face technology because it only has the one camera on the front and nothing else to allow the 3D technology to be used, even some of their high end phones use 2D. 

So personally i would say never use face unlock on a Samsung device. The A71 also has the in screen fingerprint scanner so I'm not sure why people would prefer the face unlock on this device anyway.

Ballard

Tokmon said:

colsten said:

Ballard said:

Tokmon said:

robinwales said:

There's already a thread on contactless limits here, but I didn't want to hijack the thread
https://forums.moneysavingexpert.com/discussion/6247154/contactless-limit
The proposal to increase the spend limit on contactless cards was reported on the BBC the other day here  https://www.bbc.co.uk/news/business-55826118 I was surprised at the number of objections to this proposal, with people voicing security fears. I've been using the G-Pay app for about a year which is linked to my Santander debit card, and last week Santander allowed credit cards (contactless) to also be added. A lot of people seem to think these apps, or how they are used are not secure. My smartphone (Samsung A71) has biometric security, which I have set, and a backup of a pin number. If someone found my lost phone, or stole it, I fail to see how they could use it for contactless purchases. You can't even open the homescreen unless it recognizes my face. If on the other hand I ditched the app and went back to using cards, and someone found my lost wallet they could go into the nearest store and buy what they wanted without any checks. Which do you think is more secure? The spend limit on G-Pay is unlimited, I think. You also get useful electronic receipts.

I appreciate not everyone has a smartphone, or debit/credit cards.

Why don't you use the fingerprint scanner instead?. It usually works better because you don't have to look right at your phone to unlock it plus the face unlock isn't very secure and could be tricked by a picture of you.

Can phones be tricked in this way? I haven’t followed this closely but thought that they scanned your face in 3D to unlock. 

I agree, 3D face scan technology is a great deal safer than fingerprint technilogy. 2D technology can be fooled by good photos . Not sure whether you can still get phones with 2D.

The Samsung A71 definitely uses 2D face technology because it only has the one camera on the front and nothing else to allow the 3D technology to be used, even some of their high end phones use 2D. 

So personally i would say never use face unlock on a Samsung device. The A71 also has the in screen fingerprint scanner so I'm not sure why people would prefer the face unlock on this device anyway.

I'd also steer clear of that. I'm surprised that the financial institutions allow this as the main security feature.

northwalesd

Tokmon said:

So personally i would say never use face unlock on a Samsung device. The A71 also has the in screen fingerprint scanner so I'm not sure why people would prefer the face unlock on this device anyway.

I've never tried the face unlock on my A71, but I will say the in-screen fingerprint scanner is absolutely dreadful!