Slashdot Mirror
UK Consumers Reporting Contactless Payment Errors
leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Suddenly they are becoming popular - Icelandair are selling one on the inflight goodies list, as are various designer shops in Reykjavik.
Korma: Good
Quick, buy stock in companies selling RF-blocking wallets and bags
And don't forget fashion - my electric-blue aluminium wallet pairs nicely with my neon-green tinfoil hat!
Who would've thought that it's a bad idea?
Tinfoil is your friend. Always has been, always will be.
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
While these incidents do not involve a security breach, they do indicate a sloppiness in the implementation, and so raise the concern that the system has been developed without the attention to detail that is a necessary (but not sufficient) prerequisite for security.
retail stores shoplift YOU!
Politics is Treachery, Religion is Brainwashing
The hardware having the wrong range is probably pretty hard to avoid due to variance between terminals and problems keeping them all tuned over their lifetime.
However, the NFC reader shouldn't be active until the customer told the cashier he/she will be using a contactless card for payment and the cashier enabling the reader.
It wouldn't prevent reading the wrong card if the customer has several NFC cards, but it would at least prevent the kind of surprises shown in the article.
While these incidents do not involve a security breach...
A vendor's machine can take money from me without my consent or knowledge.
Apropos of nothing, what would constitute a security breach in your model?
The confirmation method has to be attached to the card otherwise it leaves open the option for rogue devices to drain your money.
My Norwegian bank issued me a chip and pin card. I like it. The waitress or the teller never touches my card. I put it in the terminal when I see the total I am being charged. I punch in the PIN and the card verifies with the bank and the term. prints a receipt. In a restaurant the server brings a wireless terminal to the table and I do the same thing. The protocol allows for a gratuity to be added. As long as no thug or dip looks over my shoulder and sees my PIN I fell pretty safe from fraud. I use this card all over the continent. My US cards work, but they are less secure and I get a nasty foreign transaction fee and a disadvantageous exchange rate. Chip and PIN rocks. Hard to believe consumers wearied of punching in a little PIN. Besides, for small purchases cash works. Near Field Communication payment is an idea whose time is yet to come. I do not want an experimental-stage NFC. It will be cool when all my products are fitted with rfid tags and my NFC payment fob is in my pocket. I walk out of the store with my basket, pause at a terminal to visually scan the inventory for which I am being charged (or not), confirm, then get the receipt beamed to my fob or smart phone. Until then the chip and pin is fine. I was wondering at the profusion of stainless steel wallets on Travel Smith. They were not all passport sized. Now I understand. It makes me wonder if my current chip and pin is NFC too. Feh! Makes me want to return to the good old days of cowrie shells.
"No fear. No envy. No meanness." Liam Clancy
You forgot:
8) Throw card away since it is useless now.
No idea how it is in the USA, but in Europe the magnet strip is hardly used anymore. Too insecure. Some people even destroy it on purpose. Instead a chip in the card used. Not a NFC chip. So, how do you destroy one chip in a microwave oven, but leave another chip on the same card intact?