• Our new ticketing site is now live! Using either this or the original site (both powered by TrainSplit) helps support the running of the forum with every ticket purchase! Find out more and ask any questions/give us feedback in this thread!

Invalid bank cards permitting exits at TfL barriers

Status
Not open for further replies.

assimilated

Member
Joined
3 Aug 2024
Messages
12
Location
London

I was watching this show (the video should start at the relevant part at 2m 30s) and it appears to indicate that an invalid bank card will permit a passenger to exit through TfL barriers. There's another episode where this is even true of a lost or stolen bank card which has been blocked by the bank.

Can anyone explain why this would be the case? Surely a card which has been blocked or declined by the bank should be rejected by the barriers?
 
Sponsor Post - registered members do not see these adverts; click here to register, or click here to log in
R

RailUK Forums

Mike395

Forum Staff
Staff Member
Administrator
Joined
23 May 2009
Messages
3,400
Location
Bedford
Short answer - speed. Ticket gates don’t wait for an online authorisation response from the issuer as it’d mean a few-second delay in the gates releasing; not practical on a mass transit system. Relying on an internal blacklist within TfLs network is much faster but it has to know the card exists in the first place.
 

Fawkes Cat

Established Member
Joined
8 May 2017
Messages
5,324
Short answer - speed. Ticket gates don’t wait for an online authorisation response from the issuer as it’d mean a few-second delay in the gates releasing; not practical on a mass transit system. Relying on an internal blacklist within TfLs network is much faster but it has to know the card exists in the first place.
And this also means safety. If each card was checked on exit (with, as above, a few seconds delay) it's not hard to imagine the whole barrier line being blocked, with extra people coming up the escalator from behind. That's how crushes happen, and if TfL have decided safety trumps revenue protection then I agree with them.
 

Mike395

Forum Staff
Staff Member
Administrator
Joined
23 May 2009
Messages
3,400
Location
Bedford
And this also means safety. If each card was checked on exit (with, as above, a few seconds delay) it's not hard to imagine the whole barrier line being blocked, with extra people coming up the escalator from behind. That's how crushes happen, and if TfL have decided safety trumps revenue protection then I agree with them.
Indeed - it's also the reason why even if a card is declined when TfL runs the background preauthorisation (usually within a few minutes of the first touch-in on any given day) you will be allowed (once) out of the system with the same card.
 

3rd rail land

Member
Joined
30 Jan 2019
Messages
752
Location
Where the 3rd rail powers the trains
Short answer - speed. Ticket gates don’t wait for an online authorisation response from the issuer as it’d mean a few-second delay in the gates releasing; not practical on a mass transit system. Relying on an internal blacklist within TfLs network is much faster but it has to know the card exists in the first place.
Does a declined card go on to TFL's internal blacklist after a few uses? Does the gateline check the internal blacklist each time a contactless card is tapped? I assume the answer to at least one of those is no for such prolonged use of a declined card to happen.

I was surprised that this was broadcast
Perhaps the thinking was it will deter others from doing this if they know TFL will eventually catch up with them.
 

assimilated

Member
Joined
3 Aug 2024
Messages
12
Location
London
The other aspect that was unclear to me is why they have to use an exit gate to enter. If the system isn't doing a real-time check, then surely they could use a normal entry gate?
 

Haywain

Veteran Member
Joined
3 Feb 2013
Messages
24,816
The other aspect that was unclear to me is why they have to use an exit gate to enter. If the system isn't doing a real-time check, then surely they could use a normal entry gate?
Once the card is blocked it won’t open an entry gate, but it will always open an exit gate.
 

assimilated

Member
Joined
3 Aug 2024
Messages
12
Location
London
Once the card is blocked it won’t open an entry gate, but it will always open an exit gate.
Ah, so it's not doing a real-time authorisation, but it is doing a real-time check of a database of blocked cards? And that check would take too long at the exit barriers?
 

Haywain

Veteran Member
Joined
3 Feb 2013
Messages
24,816
Ah, so it's not doing a real-time authorisation, but it is doing a real-time check of a database of blocked cards? And that check would take too long at the exit barriers?
No, the system is designed not to prevent exit. Similarly, with an Oyster card if you have been allowed to enter the system you will never be prevented from leaving.
 

assimilated

Member
Joined
3 Aug 2024
Messages
12
Location
London
If I understand correctly, National Rail barriers do block exit, so this difference simply reflects the greater crowding in tube stations?
 

blimmo

Member
Joined
30 Jul 2025
Messages
667
Location
West Mids
If I understand correctly, National Rail barriers do block exit, so this difference simply reflects the greater crowding in tube stations?
I believe TfL changed the behaviour of blocked cards on exit to reduce the confrontation that gate line staff had to deal with.

== Doublepost prevention - post automatically merged: ==

I suspect national rail barriers are operating on the assumption that the entry station is likely to be unbarriered whereas TfL are operating on the assumption that both entry and exit are barriers.
 

Trainman40083

Established Member
Joined
29 Jan 2024
Messages
4,664
Location
Derby
Well, thanks for giving a thorough answer. It certainly had me wondering, after watching that programme.
 

mmh

Established Member
Joined
13 Aug 2016
Messages
4,289
I believe TfL changed the behaviour of blocked cards on exit to reduce the confrontation that gate line staff had to deal with.
I think that's unlikely. Pay as you go Oyster has always allowed cards to always exit (a negative balance can exit) and I imagine when it was expanded to contactless it similarly allowed all cards to exit.
 

davews

Member
Joined
24 Apr 2021
Messages
1,016
Location
Bracknell
I was puzzled when I watched that programme. I take it he was entering the station through the exit barriers which would have been displaying a big red cross. So he has to stretch over to tap his card at the other side or is the reader on the outer side still active? Presumably if he tried to put a paper ticket in the slot at that side it would be blocked? Or maybe we shouldn't be probing too much the details...
 

assimilated

Member
Joined
3 Aug 2024
Messages
12
Location
London
If my understanding of all of this is correct, I can see a major flaw in the system. I probably shouldn't post the details here, but I think I see a way the flaw could be exploited to allow a fare evader to tap in as well as tap out, and which would be completely undetectable by the data trawl system. If anyone here works for TfL's fraud team, please PM me.
 

Haywain

Veteran Member
Joined
3 Feb 2013
Messages
24,816
I was puzzled when I watched that programme. I take it he was entering the station through the exit barriers which would have been displaying a big red cross. So he has to stretch over to tap his card at the other side
Some time ago we had a case on the forum of someone who had done exactly that, and then got caught.

== Doublepost prevention - post automatically merged: ==

and which would be completely undetectable by the data trawl system.
TfL clearly register the details of cards being used to "escape" the system in that way, and set up operations to catch prolific offenders. It may not be a perfect process but it is certainly detectable.
 

Mattplans

Member
Joined
27 Sep 2024
Messages
716
Location
London, UK
If we can think back to when Revolut and Monzo banks became popular, it was apparently easy to open accounts with them, there was a ‘hack’ floating around on Tiktok etc that even with £0 on your account, you can always touch out.

This is when it went 'viral' that you can reach over to allow entry and just do the same at your destination. I recall watching tiktoks labelling this as a "TFL hack" or "free travel hack" etc a couple years back.

I have no personal knowledge of how difficult it is to open an account with any of these banks, but I imagine the sudden attraction is that it was easier to do so under pseudonyms or false details so you can be anonymous? Since they have no IRL branches and all verification takes place online.

I believe some retailers/merchants now have a blanket ban on these banks because of these “vulnerabilities”. I have heard enough stories of individuals having difficulties with these 'branchless' banks to put me off ever wanting to open an account with any of them!
 
Last edited:

swt_passenger

Veteran Member
Joined
7 Apr 2010
Messages
34,307
Some time ago we had a case on the forum of someone who had done exactly that, and then got caught.
It’s the Nov 23 thread linked in post #19 by @dosxuk - I’ve just had a read because I was pretty sure this has been a well known ‘feature’ since a particular software upgrade, and in fact it’s all quoted in that thread.
 

Adam Williams

Established Member
Joined
2 Jan 2018
Messages
3,608
Location
Warks
I imagine the sudden attraction is that it was easier to do so under pseudonyms or false details so you can be anonymous? Since they have no IRL branches and all verification takes place online.
I don't think this is accurate; Monzo for example still do KYC checks as you'd expect any regulated bank to do. You need to provide ID and record a video selfie. They have done this since day 1. Digital verification doesn't mean worse verification, and arguably there's far more data they can use to help make a decision than if you did it at a legacy bank by filling in paper forms.
 

bubieyehyeh

Member
Joined
25 Feb 2016
Messages
380
I've noticed where the person in front of me enters using a mobile phone on yellow pad, the gate opens but then the led on the yellow pad flashes red. Not sure if its another hack, it was very common to see this, less so in last few months.
 

Haywain

Veteran Member
Joined
3 Feb 2013
Messages
24,816
I've noticed where the person in front of me enters using a mobile phone on yellow pad, the gate opens but then the led on the yellow pad flashes red. Not sure if its another hack, it was very common to see this, less so in last few months.
I have noticed something like that happening when scanning eTickets.
 

Railguy1

Member
Joined
6 Apr 2016
Messages
254
If we can think back to when Revolut and Monzo banks became popular, it was apparently easy to open accounts with them, there was a ‘hack’ floating around on Tiktok etc that even with £0 on your account, you can always touch out.

This is when it went 'viral' that you can reach over to allow entry and just do the same at your destination. I recall watching tiktoks labelling this as a "TFL hack" or "free travel hack" etc a couple years back.

I have no personal knowledge of how difficult it is to open an account with any of these banks, but I imagine the sudden attraction is that it was easier to do so under pseudonyms or false details so you can be anonymous? Since they have no IRL branches and all verification takes place online.

I believe some retailers/merchants now have a blanket ban on these banks because of these “vulnerabilities”. I have heard enough stories of individuals having difficulties with these 'branchless' banks to put me off ever wanting to open an account with any of them!


See above for example. Negative credit can open thr barriers and that has always been the case.

I really don’t understand your comment on vulnerabilities either. Do you have any evidence for this?
 

Starmill

Veteran Member
Joined
18 May 2012
Messages
27,311
Location
Bolton
I suspect national rail barriers are operating on the assumption that the entry station is likely to be unbarriered whereas TfL are operating on the assumption that both entry and exit are barriers.
This isn't what's happening. You can't be blocked into the system because TfL made a deliberate choice that this was the best option.

The system may not even have received the entry tap when you exit. This is the same for Underground and other stations. The same hardware and database are used at all of them.
I was puzzled when I watched that programme. I take it he was entering the station through the exit barriers which would have been displaying a big red cross. So he has to stretch over to tap his card at the other side or is the reader on the outer side still active? Presumably if he tried to put a paper ticket in the slot at that side it would be blocked? Or maybe we shouldn't be probing too much the details...
There are rather a large number of ways to get inside the ticket gates without having touched in. Get on any train at Hanwell or Mill Hill East, nearly any DLR station and a large number of national rail stations and you can immediately access the paid side areas. There are also lots of agency staff who will just open the gate rather than arguing if they're shown an expired ticket or one that has been picked up off the floor, or stations where not every entrance has the gates closed at the same time. People also jump remotely-monitored gates all the time and nobody sees them do it. It's really not unusual unfortunately.
 
Last edited:

island

Veteran Member
Joined
30 Dec 2010
Messages
17,913
Location
0036
No, the system is designed not to prevent exit. Similarly, with an Oyster card if you have been allowed to enter the system you will never be prevented from leaving.
This isn't correct. Oyster cards can be invalid for exit even if cleared to enter, for example if they were hotlisted but had dropped off the locally stored list because of non-use. In the past, exit was also denied for lack of OEP when needed.
If we can think back to when Revolut and Monzo banks became popular, it was apparently easy to open accounts with them, there was a ‘hack’ floating around on Tiktok etc that even with £0 on your account, you can always touch out.
Other options I'm aware of being used are "visa gift cards" purchased at retail, multi-store prepaid cards issued from Westfield and the like, as well as French luncheon voucher cards.
I believe some retailers/merchants now have a blanket ban on these banks because of these “vulnerabilities”. I have heard enough stories of individuals having difficulties with these 'branchless' banks to put me off ever wanting to open an account with any of them!
I know from a very good source that one newer bank came very close to having all their cards banned from TfL because of the level of problems with their customers.
 
Status
Not open for further replies.

Top