Another Money Alert

Yet another thing to be aware of:

Contactless card fraud warning: Crooks can use them MONTHS after cancellation


By Faye Lipson, News Reporter
8 Sep 2016

Bank customers whose lost or stolen contactless cards have been cancelled may need to comb through months or even years of statements to check for fraudulent transactions, an MSE investigation has found.

The shocking security flaw emerged after MoneySaver Justin Robson discovered his Halifax cards – cancelled by his bank when stolen last November – were used to make a series of fraudulent contactless purchases eight months later.

The problem is that shops don't always immediately check with your bank when a payment is made on your card, so cancelled cards may not receive the instruction by the bank to stop working. Contactless cards are particularly at risk of being used after cancellation because you don't need to enter a PIN each time you use them.

Our investigation highlights a chaotic system in which banks are powerless to prevent cancelled cards being used by fraudsters, and don't even know when the fraud will end. And while some banks prevent accounts being raided by this type of fraud, others leave it to unsuspecting customers to spot dodgy payments – even though they can start happening months down the line.

Re: Another Money Alert

Another good reason for not having/using one, Mups. Thank you for the warning!

Re: Another Money Alert

This story makes no sense.

If the cards were cancelled by the bank, then surely the bank account, which must have details of all active and non-active cards is flagged. The card in question, being cancelled, is no longer a valid card for that account.

How you VERIFY your ownership of that card is surely immaterial. Whether you stick the card in and enter the PIN, or swipe it down the side of the reader and physically sign a piece of paper or just use a contactless swipe, doesn't make a difference. The card's actual identity, embedded into the magnetic strip and chip, is the key element and that never changes. And that identity has already been cancelled against the bank account when the bank cancelled the card.

So this isn't making much sense to me at present and starts to look more like an anti-contactless card bit of a scare story.

The entire purpose and job of a shop card reader is surely to obtain the card identity (from the chip or strip), perform a lookup to the banking system and obtain an authorisation code for the transaction. That's pretty much it.

IF the cards had been truly cancelled by the banks, then the card reader would NOT obtain the authorisation code for the transaction plain and simple. Same would be true if you had a genuine active bank card but you had exceeded your overdraft limit. The transaction would be rejected.

So, logically speaking, this begins to actually look more like the banks have failed to cancel the cards.

Provided that the customer HAS dutifully informed the bank of the loss of card, then at that point they have no further liability. It is now the bank's liability if they have failed to take action and disable the link between the card and the account.

This does still mean that subsequent transactions would appear on your statement and that typically the customer would have to spot them and report them to the bank who must of course reimburse the funds.

In the end then, is this really an issue about the contactless card system, or is it actually an issue about banks failing to cancel cards once customers have reported them stolen?

Re: Another Money Alert

Ok I just read through the MoneySavingExpert website where the article was published and I am correct.

It's a poor article. The issue is NOT about contactless cards per say. It is about "Offline Transactions" concerning cancelled cards which the BANKS are allowing to go through.

In layman's terms, some shops don't use online hookup to the bank systems. They take transactions throughout the day, store them up and then process them all, typically the next day, i.e. they go online at that point and post all the transactions.

There are clearly risks already associated with this practice. Imagine if you had already exceeded your overdraft limit, walked into such a store, and bought something, using conventional chip and PIN. The retailer would have no clue at that point. Only when they came to process the transactions the next day, would the computer system (hopefully !) beep and say, this transaction is not authorised as account has been suspended due to overdraft etc.

In the cases specific to this article, it is the bank cards themselves that have been cancelled against the account. Thus when the retailer goes online to process the day's transactions the bank system SHOULD clearly at that point REJECT the transaction because it was made using a cancelled card.

Very clearly that is not happening and the banks ARE allowing offline transactions to go through for cards that have been cancelled.

THAT, is where the problem is.

The contactless card element is a red herring.

This is negligence by the banks to either :

a) cancel the card in the first place or
b) allow transactions to be processed to your bank account from cards that have been cancelled.

The article is trying to sensationalise the contactless card system when in truth the issue concerns offline transactions which the banks are not dealing with properly.

On the MoneySavingExpert Forum where members have highlighted the dubious article the MSE admin have admitted:

"we know (and the article states) that offline payment isn't exclusive to contactless cards."

and

"We agree it's shocking that many banks and providers debit payments made on cancelled cards without checking, and our hope is that highlighting the issue will lead to improved policies from banks."

Re: Another Money Alert

I noticed that when I use my Debit Card to 'pay at the pump' for diesel it immediately deducts one pound from my account. I can check my account online for as much as three days before the balance is taken. I would imagine that if one pound can be taken it proves that the card is valid.

On one such occasion (after six weeks) Tesco failed to take the balance of £59 I notified the manager of the mistake and he said it would be impossible to take it now......Well I tried.

Re: Another Money Alert

OGF, I have heard this before. Someone I know queried the extra money taken, and was told it was for charity donations! The cashier said if you didn't want to donate, you had to 'opt out.'
Bloody cheek!

You shouldn't have to 'Opt out,' you should be asked if you want to make a donation, not just have it taken.
Trouble is, they don't tell customers, and not many people even check their receipt, and just bin it.

Re: Another Money Alert

That does not make sense with a Debit Card but makes more sense with a Credit card were you are charged by some firms for using one.