UK Consumers Reporting Contactless Payment Errors

leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."

Comments

Double payments

[chromas]

sometimes paying twice when they have used another payment method.

Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?

Re:Double payments

[Skapare]

You mean like that stupidity of charging twice for the same shopping cart serial number when the final button is pressed twice? You get this shit when you let morons design it.

Re:Double payments

[ericloewe]

Some POS systems are not integrated with the card payment terminal. You click "visa" for instance, and the POS system assumes a valid card payment has been made. The payment is then made in a seperate terminal which issues a receipt for the payment, which should be kept with the purchase receipt.

Tap And Go Bankrupt

[Anonymous Coward]

Quick, buy stock in companies selling RF-blocking wallets and bags

And don't forget fashion - my electric-blue aluminium wallet pairs nicely with my neon-green tinfoil hat!

Payment without user confirmation

[Hentes]

Who would've thought that it's a bad idea?

Re:Payment without user confirmation

[click2005]

Everyone saw this coming. The banks, card companies & shops just didn't care.
Unlike purchases over £100 where the CC company is liable for half of all losses, you can bet we'll end up paying for any losses
either directly or through price increases.

Why

[markdavis]

And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.

It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?

Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.

Re:Why

[willb]

Hate those stupid gas pumps. Useless if your card is from outside the US.

Actually there is a way to use this even if your card is from outside the US. For example I have cards from Canada and the convention is to use the numbers from your postal code and add 00 at the end. It works well. If yours is from another country google around, they might have a convention on how to get the "ZIP" code you're supposed to use.

Re:Why

[JustOK]

I thought in the UK chips were called crisps.

Re:Why

[kav2k]

And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.

Contactless payments differ a lot from magnetic stripe swiping, invisible barcodes etc.

They are not static information but an active challenge-response authentication system. You cannot clone the chip; it has an internal cryptographic secret it does not allow you to access, only challenge responses. You can trick it into authorizing a purchase you don't want if you're in physical proximity, which is happening here, but you cannot save that authorization for later use, since the bank is issuing the challenge here, just like with a chip-and-pin purchase. The whole point is to ensure that this is really the actual card.

So the main problem is the lack of user interaction to go ahead with the purchase. A touch button on the card itself would help, but would destroy part of the convenience.

Security Concern

[Capt.Albatross]

While these incidents do not involve a security breach, they do indicate a sloppiness in the implementation, and so raise the concern that the system has been developed without the attention to detail that is a necessary (but not sufficient) prerequisite for security.

in Soviet Russia

[FudRucker]

retail stores shoplift YOU!

Not a security breach?

[Okian Warrior]

While these incidents do not involve a security breach...

A vendor's machine can take money from me without my consent or knowledge.

Apropos of nothing, what would constitute a security breach in your model?

Re:Not a security breach?

[julesh]

When they say it does not involve a security breach, what they mean is "it doesn't breach *our* security." Why do you think they give a shit about *your* security, exactly?