Contactless card security flaw largely fixed, in win for MSE's two-year campaign - MSE News

This really isn't news. The people that come up with these new POS card-acceptance processes have a rosy view of the world and just failed to consult properly with the right people in their organisations. This used to happen when I worked in cards and we had to shout very loudly at people to make them understand the fraud risks involved and to show them how to take appropriate preventative measures.

With contactless payments the banks had obviously decided that the fraud risk with off-line processing was acceptable and that they could stomach any losses given the predicted overall increase in genuine sales volume and a faster/better customer experience at the POS.

If it took some kind of campaign to 'fix' the problem then that must have been contrary to what the card industry wanted. Most card issuers, if they experience too many fraud losses, will get changes made without any outside intervention.

Fraud is like a balloon. If you squeeze it in one area, it pops out in another. Sometimes it is better not to squeeze too hard in one area lest it pops out in another area where it is harder to contain. That could have been the thinking behind allowing a certain level of fraud to continue in the contactless arena.

As for cards being used months after being cancelled, that is not new either. Criminals have long known that a card issuer will block a stolen/lost card for a number of months following its loss and then allow the block to lapse on the basis that the fraud risk will have passed by then. The more patient crooks simply waited until the block had lapsed and spent willy-nilly. CHIP and PIN and lesser reliance on something known as 'Stand-in Processing' (STIP) for authorisations helped reduce the potential for losses in this area - and then along came 'contactless' to open it all up again.

I can, of course, understand that card issuers need to be more mindful of the customer experience and, whilst customers will not be liable for losses following loss/theft, they may still have a problematic time if the card involved is suddenly used again after months.

If you report your card lost or stolen and transactions are made afterwards the bank will refund you anyway.

As others have said this really is a non-issue.

People are so concerned about contactless for some reason when at most someone could maybe get away with three transactions amounting to £90 before they're asked for the pin and the bank will refund it anyway.

Terry_Towelling wrote: »

With contactless payments the banks had obviously decided that the fraud risk with off-line processing was acceptable and that they could stomach any losses given the predicted overall increase in genuine sales volume and a faster/better customer experience at the POS.

The banks were never free to make this choice. Unlike "normal" businesses (eg a shop deciding it's cheaper to allow petty theft rather than have security staff/CCTV systems/products locked up), financial institutions are under a statutory obligation to reduce financial crime. This has been the case since the passing of the Financial Services Markets Act 2001 and was in section 6 (since reorganised).

They engaged with all the AML stuff - probably because of compliance risk rather than commercial risk. Seems they are now doing the same in respect of contactless cards, albeit late in the day.