Security alert over thieves’ sprees on contactless cards
THE new wave of contactless payment cards is being exploited by thieves who can use them for days even after they have been reported stolen, it emerged last night.
The ‘tap-and-go’ cards are proving hugely popular on the High Street this Christmas and consumers are expected to rack up £1billion on them in December alone.
But – unlike conventional plastic cards – purchases are approved automatically without online authorisation by banks. It means payments may not appear on customer accounts until some time after a card has been reported stolen.
In the meantime a thief could get away with using it for several days to make a series of small-value purchases that could soon mount up.
Banks are trying to encourage Britons to use the new payment technology instead of cash. Single payments can be made up to a value of £30 by simply swiping or tapping the cards on a reader at checkouts, buses or tube stations. Payment information is sent by radio wave from a chip in the card to a receiver in a till.
In the past, a criminal using a stolen debit or credit card would need to have the owner’s four- digit PIN or fake a signature. But there is no such safeguard with the millions of contactless cards now being issued automatically to customers, whether they want them or not.
Although it might be assumed that cards are immediately blocked when an owner reports a theft, it is not always the case. In some instances the onus is on customers to keep a check on their bank account to spot any fraudulent activity and claim the money back.
The potential for fraud has been highlighted by an East London-based internet blogger Emma Hartley, 45. She said a thief used her contactless cards over several days in January to make a series of purchases worth £135, including at McDonald’s and a petrol station. ‘It’s horrible to have your handbag stolen and when you cancel your cards you think that is it. To realise over the next couple of days that that is not the case... was really annoying. The experience actually went on for about a week.
‘I had to keep checking my bank account to see what was being stolen. I didn’t even ask for a contactless card. I absolutely don’t want another contactless card. I think fraud on contactless cards must be massively under-reported because people don’t realise that you can’t cancel the cards immediately.’
She called her bank, First Direct, to complain her card been used three times in a McDonald’s and twice on a garage forecourt. But she told The Guardian she was instructed to ‘keep an eye’ on her account and claim back any money lost through fraud.
The first contactless cards were introduced by Barclaycard in 2008 and there are now 76million in circulation. The total amount spent on them in October stood at £930million – up by 213 per cent on the same month last year. Consumer group Which? has also suggested that criminals can steal the details on contactless cards with scanners bought on the internet. A spokesman for First Direct and HSBC said contactless facilities are designed to offer ‘speed and convenience’ for shoppers. RBS and NatWest admitted that ‘a small number’ of transactions could be made before the card is blocked.
Barclaycard said blocks are applied to stolen cards. But some payments are processed ‘offline’ – without referring to the account provider for authorisation – and ‘may not appear on a customer’s account until after the block has been applied’. It said payments that had been made offline on the day of cancellation may be applied to accounts and would be refunded when the customer identified them.
RBS, Lloyds and Santander claimed their systems can pick up contactless spending after a card is reported stolen. The UK Cards Association, which speaks for the banks, said: ‘There is absolutely no evidence to suggest fraud on contactless cards is under-reported.’
‘Theft continued for a week’