Debit Cards and Contactless Payments

[najaB]

Though we don't know whether the authorisation code was generated by the card scheme, the issuer or the terminal?

Seeing as the amount is 'pending' in my account I'm pretty sure it's the bank.

 

[GaryMcEwan]

If I recall correctly when I questioned Barclays about my contactless debit card as it would always seek online authorisation rather than offline authorisation and they told me that it was something to do with the AID (Application Identifier)

The AID on my old card was 32010 which turned out to nothing more than a Visa Electron card dressed up as a Visa Debit. And an AID of 31010 is a full blown Visa Debit card.

 

[island]

Though we don't know whether the authorisation code was generated by the card scheme, the issuer or the terminal?

I have a receipt here for a contactless payment I made yesterday. It shows 'No Cardholder Verification' and a 5 digit 'Auth'.

As I already said above, these two are separate things. Cardholder verification is a question of whether the terminal had evidence that the cardholder was present to authorise the transaction – which is typically PIN verification but may also be signature, fingerprint, device, or a few other miscellaneous things. Authorisation relates to whether the transaction was approved by the issuer, which is typically generated by the terminal contacting the issuer for approval but the card and/or the terminal can also be set to generate authorisation codes themselves for transactions meeting certain parameters. You will note that Avantix Mobile card receipts include an authorisation code, despite that no contact with the issuer was possible.

AIUI even if a card calls for authorisation the retailer can decline to carry it out (for example, TfL does not authorise any ticket barrier or bus contactless transaction). The effect of that, though, is that if the payment is not processed for any reason (e.g. no funds available) the retailer loses, as it was their choice.

Pretty much (technically, the merchant can present any transaction it likes and the issuer will pay it, but if there were insufficient funds or if one of a number of other reasons applies which includes if someone in the issuer's cards team is having a bad day, the bank can raise a chargeback because the transaction was not authorised). TfL is a special case because of the contactless transit payment system which it helped the card schemes to design. The key point on contactless outside the TfL context is that assuming the card did not flag a need to do a chip & PIN transaction, liability for fraudulent transactions rests with the issuer.

In my experience whether authorisation is carried out or not (it's easy to tell, because the terminal normally displays something about it) is completely separate from whether you use contactless, Chip and PIN or even stripe and signature to actually process it.

Indeed. It is a risk assessment.

 

[Davidtaylor]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards. You can call people irresponsible who loose things but how many people here have ever lost at least one bank or debit card mmmmm. Well the scam at the min is like this so take good care of your cards, If you drop it and somebody picks it up they go and pick a packet of chewing gum up go to a self scan machine pay for the gum and then withdraw £50 pound cash back. Move to the next machine and do the same and so on and so on, before you know it that poor persons bank as been near enough cleaned out. And for us security guards watching there's nothing we can do as there's no proof that the person doing the transaction isn't the rightful owner of that card and there's no law in getting cash back in that manner, strange yes but not illegal. Please be on your guard my friends

 

[AlterEgo]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards. You can call people irresponsible who loose things but how many people here have ever lost at least one bank or debit card mmmmm. Well the scam at the min is like this so take good care of your cards, If you drop it and somebody picks it up they go and pick a packet of chewing gum up go to a self scan machine pay for the gum and then withdraw £50 pound cash back. Move to the next machine and do the same and so on and so on, before you know it that poor persons bank as been near enough cleaned out. And for us security guards watching there's nothing we can do as there's no proof that the person doing the transaction isn't the rightful owner of that card and there's no law in getting cash back in that manner, strange yes but not illegal. Please be on your guard my friends

Doesn't sound right.

I've got three current accounts with different banks and none of them allow cash back via contactless.

Which banks allow it?

 

[najaB]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards.

As I understand it you can't get cash back on a contactless transaction. Certainly, I've always been asked to enter my PIN whenever I've wanted cash back.

 

[me123]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards. You can call people irresponsible who loose things but how many people here have ever lost at least one bank or debit card mmmmm. Well the scam at the min is like this so take good care of your cards, If you drop it and somebody picks it up they go and pick a packet of chewing gum up go to a self scan machine pay for the gum and then withdraw £50 pound cash back. Move to the next machine and do the same and so on and so on, before you know it that poor persons bank as been near enough cleaned out. And for us security guards watching there's nothing we can do as there's no proof that the person doing the transaction isn't the rightful owner of that card and there's no law in getting cash back in that manner, strange yes but not illegal. Please be on your guard my friends

That isn't a scam that would work with contactless cards, as contactless cards cannot be used to withdraw cash via CashBack [1]. They need to have the PIN, which they may well do. (The UK Card Association[2] disagree with this, but I've not found a single bank who allow this with their cards, and even then the maximum limit would be £30 for the whole transaction before a PIN is requested - and I'm sure the terminals can be set to disallow cashback with contactless regardless of what the bank says).

I find it highly irregular that the banks wouldn't class this as suspicious activity and freeze the card very quickly. My own card has been frozen for a lot less than this (all legitimate and reasonable activities by me that were just a bit out of the ordinary, such as when I first got an iPhone and bought quite a few apps).

And, yes, you can call the police in this instance as it is highly suspicious - any reasonable person would go to an ATM. You can also refuse sale for any reason whatsoever, and suspected fraud is a perfectly good reason to refuse sale - I did it myself quite a few times when I worked in retail (the number of people using what they claim to be their spouse's card is remarkably high). If the theft happened in your store I would expect you'd have CCTV footage of the incident.

 

[tsr]

None of my local supermarkets have the facility to opt for cashback at the self-service checkouts, and neither would the manned ones allow it to be done with contactless. As for £50, I think that to be most unlikely.

 

[me123]

None of my local supermarkets have the facility to opt for cashback at the self-service checkouts...

Morrisons and Asda both certainly offer cash back at the self service checkouts, although not with contactless.

 

[najaB]

Morrisons and Asda both certainly offer cash back at the self service checkouts, although not with contactless.

I think that is a store-by-store thing as I've been in branches of both where no cash back was offered.

 

[Panda]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards. You can call people irresponsible who loose things but how many people here have ever lost at least one bank or debit card mmmmm. Well the scam at the min is like this so take good care of your cards, If you drop it and somebody picks it up they go and pick a packet of chewing gum up go to a self scan machine pay for the gum and then withdraw £50 pound cash back. Move to the next machine and do the same and so on and so on, before you know it that poor persons bank as been near enough cleaned out. And for us security guards watching there's nothing we can do as there's no proof that the person doing the transaction isn't the rightful owner of that card and there's no law in getting cash back in that manner, strange yes but not illegal. Please be on your guard my friends

No UK card issuers currently allow cashback on their contactless issued cards, it isn't allowed on foreign cards and £50 breaks the contactless limit. I suspect this is just a wind up as this scenario is currently not possible.

 

[jon0844]

No UK card issuers currently allow cashback on their contactless issued cards, it isn't allowed on foreign cards and £50 breaks the contactless limit. I suspect this is just a wind up as this scenario is currently not possible.

It's the sort of nonsense I expect to read on Facebook with a 'share this with everyone so they know' comment added, followed by the inevitable comments from people about how unsafe contactless payments are.

I am somewhat surprised to see someone here actually writing as if they've personally seen this happen many times, when it's clearly not possible.

 

[Davidtaylor]

We have it on CCTV of course but we don't have grounds to challenge anybody unless we saw them pick the bank card up or if say somebody left cash back at the till and we saw another person dishonestly pick it and put it in their pocket we can challenge that but if somebody walks in and goes to the new scan and go machines. Not self scan machines. The machines was fitted last week where now you pick a tom tom type machine up when you walk in store and scan your own shopping as you go around. When you are done you plug the tom tom into a special new machine where it totals it all up and you pay only by card. Debit or contactless either one but not cash but like I said a security guard can not challenge anybody unless we seen them take the card from someone

 

[Davidtaylor]

O and believe me it is possible so for the person who thinks he knows everything and everything about everything Is very much misinformed

 

[AlterEgo]

As has been stated by several posters now, it's not possible to get cashback with contactless, so this isn't fooling anyone.

You can of course pay for purchases with them, but not get cashback.

It's just nonsense.

 

[GaryMcEwan]

Absolute twaddle. I use contactless every day on multiple occasions and not once have I been offered cashback.

That would mean you are in effect getting money back without any sort of authorisation whatsoever and because also as well contactless usually is offline, if you have no funds in the account, you would be getting money that you don't actually have, which be tantamount to fraud.

 

[me123]

We have it on CCTV of course but we don't have grounds to challenge anybody unless we saw them pick the bank card up or if say somebody left cash back at the till and we saw another person dishonestly pick it and put it in their pocket we can challenge that but if somebody walks in and goes to the new scan and go machines. Not self scan machines. The machines was fitted last week where now you pick a tom tom type machine up when you walk in store and scan your own shopping as you go around. When you are done you plug the tom tom into a special new machine where it totals it all up and you pay only by card. Debit or contactless either one but not cash but like I said a security guard can not challenge anybody unless we seen them take the card from someone

The cashier (and there always is one for the self-scan machines, as well as the scan-as-you-shop ones; perhaps the same person) can refuse any sale if they are suspicious about fraud. Multiple attempts to buy a single low value item with £50 cash back each time is highly suspicious and I would have refused to comply in that situation. And, yes, you can call the police if you're suspecting fraud. You can't rugby tackle the person to the ground and dial 999, but you can call up and report suspicious activity to the police. Unless it was just one instance in your store, in which case you don't have any reason to believe that anything untoward is happening and this whole rant is a waste of time.

As I've said already, I would be surprised if the card was not stopped by the bank very quickly, which would limit losses. Even if it wasn't, as long as the card holder reports the card as lost or stolen to their provider as soon as they realise, they are not liable for losses.

The fact that you're calling a scan-as-you-shop scanner a "tom tom type machine" really just demonstrates to us how little you know about technology.

 

[najaB]

O and believe me it is possible so for the person who thinks he knows everything and everything about everything Is very much misinformed

Perhaps you would be kind enough to let us know which banks allow cashback on a contactless transaction as I don't know of any who do?

 

[GaryMcEwan]

Davidtaylor I too, am dying to know which banks offer contactless cashback.

I have accounts with Halifax, B and Bank of Cyprus UK and not one of them offer contactless cashback.

Go on, enlighten us please...

 

[Jordeh]

As a security guard in a supermarket I have seen so many people fall victim to these contactless cards. You can call people irresponsible who loose things but how many people here have ever lost at least one bank or debit card mmmmm. Well the scam at the min is like this so take good care of your cards, If you drop it and somebody picks it up they go and pick a packet of chewing gum up go to a self scan machine pay for the gum and then withdraw £50 pound cash back. Move to the next machine and do the same and so on and so on, before you know it that poor persons bank as been near enough cleaned out. And for us security guards watching there's nothing we can do as there's no proof that the person doing the transaction isn't the rightful owner of that card and there's no law in getting cash back in that manner, strange yes but not illegal. Please be on your guard my friends

We have it on CCTV of course but we don't have grounds to challenge anybody unless we saw them pick the bank card up or if say somebody left cash back at the till and we saw another person dishonestly pick it and put it in their pocket we can challenge that but if somebody walks in and goes to the new scan and go machines. Not self scan machines. The machines was fitted last week where now you pick a tom tom type machine up when you walk in store and scan your own shopping as you go around. When you are done you plug the tom tom into a special new machine where it totals it all up and you pay only by card. Debit or contactless either one but not cash but like I said a security guard can not challenge anybody unless we seen them take the card from someone

This is also rubbish because if your contactless card is lost or stolen, your bank will refund any fraudulent transactions.

 

[jon0844]

And how many cards are dropped to facilitate this scam anyway? Seems like criminals would need to somewhat lucky to find one by being in the right place at the right time.

Sent from my VTR-L29 using Tapatalk

 

[me123]

Reviving this thread due to a recent BBC news story.

Contactless payment fraud soars to £7m

Almost £7m was taken in 2016, compared to £2.8m in 2015, according to Financial Fraud Action UK.
In the same period, contactless spending rose from £7.75bn to £25.2bn.

Hmm... let's do some maths, shall we?

In 2015, £2.8M of contactless payments were fraudulent, out of a total of £7.75B. This works out as a fraud:turnover ratio of 0.036%. For all card transactions in 2015, the fraud:turnover ratio is 0.083%. [1]

In 2016, £7M of contactless payments were fraudulent, out of a total of £25.2B. This works out as a fraud:turnover ratio of just 0.028%. I can't find the equivalent figure for all card transactions in 2016 yet.

However, the rise in contactless card fraud is much lower than the rise in legitimate usage, meaning you're far less likely to lose money to contactless fraud than other methods. So it actually seems relatively very safe to me.

And, interestingly, the BBC spoke to two victims.

She (Victim 1) said money was refunded straight away...
She (Victim 2) reported the crime to the police, and was fully refunded within two weeks.

So they couldn't even find anyone who'd actually lost money out of this.

Despite the fear mongering headline from the BBC, it seems that contactless transactions are actually very safe.

[1]Fraud: The Facts 2016

 

[najaB]

Despite the fear mongering headline from the BBC...

Though technically accurate. Quite impressive actually.

 

[Peter Mugridge]

How many on here keep their contactless cards in one of those purpose-made aluminium card holders?

 

[Howardh]

How many on here keep their contactless cards in one of those purpose-made aluminium card holders?

Not me. I check every day and *only* £30 can be taken out contactless; but if there were such things happening then I'd consider it.

So convenient these cards, I'd hate to go back to the other method.

 

[me123]

Remember - as soon as your card is lost or stolen report it to the bank and deactivate it. Any fraudulent activity that occurs will be refunded - in other words you won't be out of pocket.

Besides, my CPC doesn't work anyway so I use my iPhone which has the added security of requiring fingerprint identification. "Skimming" would only be possible when my phone is armed to make a payment, which only happens when I make a payment.

 

[jon0844]

I've just started using an Android Wear watch to make payments and I have to unlock the watch first, which makes it pretty secure. Likewise, I need to unlock my phone to make a CPC transaction.

Unfortunately I don't seem able to spend more than £30 even at places that accept Android/Apple Pay (as against normal CPCs) so I still have to carry my physical card, which seems the unsafest thing to be carrying (yet not something I am particularly worried about).

 

[island]

Merchants need a specific system upgrade for over-£30 contactless payments with on-device verification to work. I have used Apple Pay for over £30 successfully at a number of merchants but it's still bedding in.

 

[me123]

Merchants need a specific system upgrade for over-£30 contactless payments with on-device verification to work. I have used Apple Pay for over £30 successfully at a number of merchants but it's still bedding in.

Where can you do that? At the moment, the only place I've heard of is Pret a Manger, which is a shame because 1) they're too posh to come to North Wales, and 2) I can't imagine spending over £30 on sandwiches (even at their prices).

 

[chris89]

Merchants need a specific system upgrade for over-£30 contactless payments with on-device verification to work. I have used Apple Pay for over £30 successfully at a number of merchants but it's still bedding in.

Didn't know that. For the COOP (At least Mid Counties) where i work at, as soon as it goes over £30 touch is no longer a option for anyone.

Got no issues with Contactless myself, more so for people who strangely think they can get cashback with them and act disgusted when you say they can't or don't listen to you, for putting the card in the machine.

Either way, if any cards get found in the shop i work in, they are instantly put into the office/ lost property and if anyone gets them need a ID etc, to make sure goes to right person.