Contactless Card Not Secure and can't be cancelled

iyhr

On a rare journey on the London Underground, £8.25 was taken from my Contactless Card as I went through the barrier even though it was in an inside pocket of my handbag. I did not find out until I got my Bank Statement.
I rang NatWest who not only denied any responsibility for supplying a card that could be used without my knowledge or consent but refused to cancel the 'contactless facility' on my card unless I did it by using their Banking App!
I, like thousands of other bank customers do not use Banking Apps, nor do I want to.
I have been able to conduct my finances without NatWest having any telephone numbers for me (nor have they had for many years) so I never need to worry about a Bank Scam by phone.
I've checked my other Banks, including Nationwide, and they all offer ways to cancel contactless either by sending a new card or by removing the facility over the phone. .
I've also asked lots of other people, especially older people, who aren't even aware they have the contactless facility and that money can be taken from their card without them knowing.
I know that most people using this forum are using computers but can't something be done to protect those who don't?

yksi

Yes. It costs about 20 pence for a tiny silver card envelope which blocks RFIDs. But like educating people on phone scams, there is always some new thing which presents a hazard for people who can't/don't want to learn new things.

It sounds harsh, but there are limits to how long people should expect companies to indulge minorities who refuse to deal with progress in any way. Videotapes are no longer sold even though so many elderly people still have VCRs.

You are with a bank which provides technology that is normally what users want. NatWest has other good things (like the fact that your bank account number is not printed on your card). But if you don't want any contactless facility, and you refuse to install an app for even five minutes to switch it off, you can also vote with your feet.

I hear that you're concerned for the people who are unaware of the vulnerability. Since RFID shields are so inexpensive, it seems like banks could easily supply one when issuing a card. But it's the sort of cause that would need publicity. Maybe Jack Monroe would be interested?

MattMattMattUK

iyhr said:

On a rare journey on the London Underground, £8.25 was taken from my Contactless Card as I went through the barrier even though it was in an inside pocket of my handbag. I did not find out until I got my Bank Statement.
I rang NatWest who not only denied any responsibility for supplying a card that could be used without my knowledge or consent but refused to cancel the 'contactless facility' on my card unless I did it by using their Banking App!
I, like thousands of other bank customers do not use Banking Apps, nor do I want to.

This does sound slightly weird, being that in normal times I use the Underground a lot and have never had this issue, and when The Times tried to create this and similar scenarios they found it almost impossible, barring having a load of wire in your bag as well, are you sure you did not push your bag against the lower sensor as you went through?

Also, if you had had the banking app you would have been able to see transactions in real time and dispute it with TFL. 

iyhr said:

I have been able to conduct my finances without NatWest having any telephone numbers for me (nor have they had for many years) so I never need to worry about a Bank Scam by phone.

That is a bit like always travelling by horse to avoid the risk of a speeding fine, it is up to you if you wish to do it, but you also have to accept that the world moves on an not every location you visit will have a hitching post or stables.

iyhr said:

I've checked my other Banks, including Nationwide, and they all offer ways to cancel contactless either by sending a new card or by removing the facility over the phone.

Use one of them instead then?

iyhr said:

I've also asked lots of other people, especially older people, who aren't even aware they have the contactless facility and that money can be taken from their card without them knowing.

In theory it is a risk, but they are protected, the banks are liable for the cost of any fraud and the rate is very low, it is far easier to get people to hand over their life savings online/on the phone that going through the trouble of something which is physical and carries far higher risk of getting caught.

iyhr said:

I know that most people using this forum are using computers but can't something be done to protect those who don't?

Not just most people on this forum, but almost every adult (and most of the children) in the country uses computers, smart phones, tablets, etc. Those who do not use them are also protected in a financial sense, within the bounds that they may cause some self inflicted issues. You without a banking app are no less protected than someone with a banking app, because all but a tiny proportion of people do not and have no desire to disable the contactless option on their card. 

400ixl

For contactless to work it would have to be within a few centimetres of the reader on the barrier, so it is extremely rare for this to happen. The bigger risk is people with handheld payment devices, which is where it is a good idea to keep cards in RFID blocking wallet.

Making people aware of this is good, Although I don't know anyone, even the elderly who use a debit card who are not aware.

Can you not just request a non contactless debit card from Natwest by phoning them and asking for one. Many banks still do them.

https://www.thisismoney.co.uk/money/experts/article-7469565/Can-refuse-contactless-bank-card-dont-want-one.html

surreysaver

Would switching off the contactless facility actually work, though? On TfL, contactless is not done live, it is added up at the end of the day, and your account debited

born_again

iyhr said:

On a rare journey on the London Underground, £8.25 was taken from my Contactless Card as I went through the barrier even though it was in an inside pocket of my handbag. I did not find out until I got my Bank Statement.
I rang NatWest who not only denied any responsibility for supplying a card that could be used without my knowledge or consent but refused to cancel the 'contactless facility' on my card unless I did it by using their Banking App!
I, like thousands of other bank customers do not use Banking Apps, nor do I want to.
I have been able to conduct my finances without NatWest having any telephone numbers for me (nor have they had for many years) so I never need to worry about a Bank Scam by phone.
I've checked my other Banks, including Nationwide, and they all offer ways to cancel contactless either by sending a new card or by removing the facility over the phone. .
I've also asked lots of other people, especially older people, who aren't even aware they have the contactless facility and that money can be taken from their card without them knowing.
I know that most people using this forum are using computers but can't something be done to protect those who don't?

There is no way that the reader would process the payment that far away.

Sounds to me like you tapped your card on either the way in or out, but not at the other end. So TFL knows it has to charge the card. Only one tap & it will charge for within that area.

Rest assured money can not be taken without you knowing. 👍

surreysaver

born_again said:

iyhr said:

On a rare journey on the London Underground, £8.25 was taken from my Contactless Card as I went through the barrier even though it was in an inside pocket of my handbag. I did not find out until I got my Bank Statement.
I rang NatWest who not only denied any responsibility for supplying a card that could be used without my knowledge or consent but refused to cancel the 'contactless facility' on my card unless I did it by using their Banking App!
I, like thousands of other bank customers do not use Banking Apps, nor do I want to.
I have been able to conduct my finances without NatWest having any telephone numbers for me (nor have they had for many years) so I never need to worry about a Bank Scam by phone.
I've checked my other Banks, including Nationwide, and they all offer ways to cancel contactless either by sending a new card or by removing the facility over the phone. .
I've also asked lots of other people, especially older people, who aren't even aware they have the contactless facility and that money can be taken from their card without them knowing.
I know that most people using this forum are using computers but can't something be done to protect those who don't?

There is no way that the reader would process the payment that far away.

Sounds to me like you tapped your card on either the way in or out, but not at the other end. So TFL knows it has to charge the card. Only one tap & it will charge for within that area.

Rest assured money can not be taken without you knowing. 👍

If the passenger's handbag or whatever containing the card accidentally brushed a reader, it is quite possible for it to happen.

PRAISETHESUN

In the NatWest app, contactless can be disabled: Select your account --> Manage my card and Google Pay --> Car payment controls --> Contactless (switch "on" to enable the control). Outside of that, physically damaging the card (but not the chip or the magnetic strip) usually stops the contactless part working properly.

As for the unauthorised transaction, report it as fraudulent and let NatWest sort it out.

molerat

PRAISETHESUN said:

In the NatWest app, contactless can be disabled: Select your account --> Manage my card and Google Pay --> Car payment controls --> Contactless (switch "on" to enable the control). Outside of that, physically damaging the card (but not the chip or the magnetic strip) usually stops the contactless part working properly.

As for the unauthorised transaction, report it as fraudulent and let NatWest sort it out.

OP is aware that it can be done through the app but they don't, "like thousands of others " want to use it nor do they want NatWest to have their mobile number.

I can see this ending badly with the embarrassment of an important transaction being declined sooner or later.

Sandtree

iyhr said:

On a rare journey on the London Underground, £8.25 was taken from my Contactless Card as I went through the barrier even though it was in an inside pocket of my handbag. 

So what did you think you were using to open the gates? I'm assuming the payment was to TFL

As others have said whilst its a theoretical risk of people skimming cards the reality is much more difficult because near field communication is very short range. Secondly there is safety in numbers and so multiple contactless cards in a purse just wont scan from a distance as all the cards respond to the reader causing it to fail... if you leave a card loose or have disabled the rest of them then the risks are technically higher but also see the above about real world attempts to skim cards.

I've used TFL gates every day at least twice and often more and despite having half a dozen contactless cards in my wallet never once as the system accidentally taken a payment from the wrong card. Those that state they have had a problem are almost exclusively one off users which is an odd coincidence 

emmajones1976

In the year 2022, wanting your bank NOT to have your phone number is an absolutely ludicrous notion.