Contactless cards spark security fears

Author

Victoria Ward

December 21, 2015

Cancelled cards can still be used by thieves for several days, it is claimed

Contactless payment cards that have been cancelled by consumers can still be exploited by thieves for several days, it has emerged.

The “tap and go” cards, which can be used for purchases under £30 without the need to enter a four-digit PIN or signature, do not require automatic authorisation from banks.

Purchases therefore may not appear on a customer’s account for some time after a card has been reported lost or stolen, leaving thieves free to keep using them at will.

The onus is then on the customer to check their statements and report any subsequent fraudulent activity to their bank in order to apply for a refund.

Emma Hartley, 45, from east London, said that when her handbag was stolen earlier this year, a thief used her cards for several days after she cancelled them.

Your contactless card could be hacked by mobile phone

“It’s horrible to have your handbag stolen and when you cancel your cards you think that is it,” she told The Guardian.

“To realise over the next couple of days that that is not the case… was really annoying. The experience actually went on for about a week.

“I had to keep checking my bank account to see what was being stolen. I didn’t even ask for a contactless card. I absolutely don’t want another contactless card. I think fraud on contactless cards must be massively under-reported because people don’t realise that you can’t cancel the cards immediately.”

She said her bank, First Direct, told her to “keep an eye” on her account and claim back any money lost through fraud.

Contactless cards: how to avoid paying twice

There are now 74.5 million contactless cards in circulation in the UK. The method of payment has proved increasingly popular since the spending limit was raised to £30.

In a major push to create a cashless society, all shops will by 2020 have to install so-called “contactless” terminals to continue taking card payments.

 Gillian Fleming, a spokeswoman for First Direct and HSBC, said the contactless system was designed to approve transactions “offline” without referring to the account provider for authorisation, for speed and convenience.

RBS and NatWest, admitted that “in theory a small number of contactless transactions could be made before the card is blocked.”

Barclaycard said: “When a customer reports a card lost or stolen, a block is applied to the card preventing all further activity. However, some contactless transactions are processed offline so may not appear on a customer’s account until after the block has been applied.”

RBS, Lloyds and Santander all said their systems could pick up contactless spending after a card was reported stolen.

A spokesman for The UK Cards Association said: “Incidents of fraud are identified in a number of ways, not just by a customer, and all banks have advanced security systems in place to detect fraudulent transactions.

“As always it’s important to check bank or card statements regularly for any unusual transactions, especially if a card has been lost or stolen. When a customer reports a lost or stolen card they will be advised to report any transactions they do not recognise to their bank. Anyone who is a victim of card fraud will get their money back and will not be left out of pocket.”

This article was written by Victoria Ward from The Daily Telegraph and was legally licensed through the NewsCred publisher network.

Comment this article

Great ! Thanks for your subscription !

You will soon receive the first Content Loop Newsletter