Have you turned off contactless payments or set contactless limits? Why?

[GeoffF100]

Saying that, I do have a blocking card in my wallet and a pouch for my cards and phone, I leave the tin foil hat at home most days.

That appears to be unnecessary:

https://nordvpn.com/blog/does-rfid-blocking-work/

[GeoffF100]

Surely you would not lose anything since the bank/issuer has to refund you for any charges that are not yours.

You will usually get a full refund:

"Most banks will refund you in full any money that has been fraudulently taken from your card. You must report it missing immediately as this could affect your legal position if it's subsequently used fraudulently. However, if your card provider can show that you've been grossly negligent, it can refuse to refund you anything."

https://www.which.co.uk/consumer-rights ... hase-goods

Nonetheless, it makes sense to limit your risk if you can. If a mugger steals your mobile phone along with your payment cards, reporting the problem to your bank could be an issue. When my debit card went missing, I walked into the local bank branch to report it, but they would not block the card because I did not have valid ID (driving licence or a passport). It is best to avoid situations like that.

[GeoffF100]

My credit card is Contactless. I couldn't get them to give me a replacement, so I have physically disabled the card's RFID by severing the aerial from the chip. It still works perfectly as a credit card using Chip & Pin.

You can disable contactless payments by punching a hole in the card. If it is a card that you never use for in person payments, that clearly that reduces risk. If you carry a card as a reserve that you are unlikely to use for several years at a time, that should reduce the risk too. If you do use the card regularly, however, disabling contactless payment entirely can increase your risk. Suppose that you have thousands of pounds credit on a card and use it to make a £10 payment. If someone shoulder surfs your PIN (or uses a hidden camera) and snatches you card, they can drain your account. If you still had the £100 contactless limit, they would not have the PIN, and would be unlikely to be able to drain more than a few hundred pounds, before the bank required a PIN.

[mc2fool]

Saying that, I do have a blocking card in my wallet and a pouch for my cards and phone, I leave the tin foil hat at home most days.

That appears to be unnecessary:

https://nordvpn.com/blog/does-rfid-blocking-work/

"There are four key reasons why outright contactless attacks are unlikely:
:

• The scannable information on a card doesn’t include the sensitive data that thieves are actually looking for (the CVV code on the back of the card, for example)."

Does Amazon require a CVV for card transactions nowadays? 'Cos it famously didn't and still didn't last I registered a card with it.

[GeoffF100]

That appears to be unnecessary:

https://nordvpn.com/blog/does-rfid-blocking-work/

"There are four key reasons why outright contactless attacks are unlikely:
:

• The scannable information on a card doesn’t include the sensitive data that thieves are actually looking for (the CVV code on the back of the card, for example)."

Does Amazon require a CVV for card transactions nowadays? 'Cos it famously didn't and still didn't last I registered a card with it.

"Why do some websites not require CVV?":

https://www.chase.com/personal/credit-c ... equire-cvv

If a merchant does not ask for the CVV and the payment turns out to be fraudulent, the merchant has to pick up the bill.

Here is a better article on RFID blockers:

https://www.digitaltrends.com/cool-tech ... an-expert/

That is clearer. RFID scanning should not put us at risk nowadays, and there are no recorded cases of it being used in the UK.

[Lanark]

Saying that, I do have a blocking card in my wallet and a pouch for my cards and phone, I leave the tin foil hat at home most days.

That appears to be unnecessary:

https://nordvpn.com/blog/does-rfid-blocking-work/

That article just says that RFID skimming has not been detected happening in 2018.

That's no guarantee it won't become an issue in the future, I don't leave the front door unlocked just because nobody in the street has been burgled recently.

[XFool]

My credit card is Contactless. I couldn't get them to give me a replacement, so I have physically disabled the card's RFID by severing the aerial from the chip. It still works perfectly as a credit card using Chip & Pin.

You can disable contactless payments by punching a hole in the card.

Not necessary to make any holes in the card, just to carefully score around the chip with a sharp tooth pick, to sever it from the RFID aerial.

Eventually, proved entirely successful: viewtopic.php?p=568489#p568489

If it is a card that you never use for in person payments, that clearly that reduces risk. If you carry a card as a reserve that you are unlikely to use for several years at a time, that should reduce the risk too. If you do use the card regularly, however, disabling contactless payment entirely can increase your risk. Suppose that you have thousands of pounds credit on a card and use it to make a £10 payment. If someone shoulder surfs your PIN (or uses a hidden camera) and snatches you card, they can drain your account. If you still had the £100 contactless limit, they would not have the PIN, and would be unlikely to be able to drain more than a few hundred pounds, before the bank required a PIN.

In my case it was not done for security reasons, but for convenience: viewtopic.php?p=580472#p580472

[GeoffF100]

My solution is to use a prepaid card with a small amount of money on it for most of my in person payments. I cannot reduce the contactless limit from £100, but at least my liability is limited if the card is lost or stolen.

Monzo is prepaid and allows you to set the contactless limit from £0 upwards (£0 will decline all contactless).

I believe that the same is true for Starling too. However, both banks use MasterCard, and so does my current account. I am using Tesco Clubcard Pay+, which uses Visa. Nationwide also uses Visa, and also does not allow unauthorised overdrafts. Neither of these accounts allow you to reduce your contactless limit. Lloyds Banking Group is uses Visa too, and does allow you to reduce your contactless limit, but it also allows unauthorised overdrafts.

[mc2fool]

"There are four key reasons why outright contactless attacks are unlikely:
:

• The scannable information on a card doesn’t include the sensitive data that thieves are actually looking for (the CVV code on the back of the card, for example)."

Does Amazon require a CVV for card transactions nowadays? 'Cos it famously didn't and still didn't last I registered a card with it.

"Why do some websites not require CVV?":

https://www.chase.com/personal/credit-c ... equire-cvv

If a merchant does not ask for the CVV and the payment turns out to be fraudulent, the merchant has to pick up the bill.

Here is a better article on RFID blockers:

https://www.digitaltrends.com/cool-tech ... an-expert/

That is clearer. RFID scanning should not put us at risk nowadays, and there are no recorded cases of it being used in the UK.

I nobble the contactless cards I carry for convenience rather than security (viewtopic.php?p=548559#p548559) and I use https://play.google.com/store/apps/details?id=com.github.devnied.emvnfccard to check that I've done it properly.

That app used to show the full card number and expiry date, which meant that all you then needed was the owner's name to go on an Amazon buying spree, although as the comments say, it no longer does that. Apparently now only the paid version shows the card number and only when you put in the last 4 digits to validate. Other apps may not be as scrupulous. I'm not sure exactly what the free version will show as I don't have any activated cards to test it with. Maybe someone can find an older version...

Mind you, skimming someone's contactless card for details to use on Amazon (rather than stealing from the card directly) will probably be more difficult than just trying to take a photo of the back of the latest HSBC cards, which have ALL of the information -- name, card number, expiry date and CVV -- all on one side now.

[stevensfo]

First of all, you do not have to buy an expensive wallet. A piece of aluminium foil is just as good.

As we have known for over a decade, the antenna for contactless runs around the edge of the card, so you simply have to make a thin cut in the side with a scalpel or razor blade to cut the antenna. Best place is the narrow edge that sticks out when you put it into an ATM machine. You can test this using old expired cards next time you're in a supermarket. Even an expired card will still 'ping'. If it doesn't then you know how to do it.

Most smartphone bank apps will let you know when your card is being used. If they don't, then ask your bank why! It's all part of Due Diligence.

Some apps allow you to switch contactless on/off. This is now quite old tech, so there's no excuse.


Steve

[XFool]

First of all, you do not have to buy an expensive wallet. A piece of aluminium foil is just as good.

No. The real, simple answer to this whole contactless cards shitshow is so very obvious.

People are different, people have different expectations and opinions, people's affairs are not identical.

All the unnecessary troubles caused by contactless, all the inconvenience, problems, waste of effort time and money*, all can and could have been easily avoided. Card suppliers could have let people - who know their own requirements best - decide for themselves. People could have been allowed to chose: "Do you want a contactless card or a non-contactless card?"

But that's far too simple for us: IT'S NOT THE BRITISH WAY. Let's make it complicated...


* Or am I simply being naïve here? Perhaps the real 'answer' has always rhymed with "munny"?

[GeoffF100]

Mind you, skimming someone's contactless card for details to use on Amazon (rather than stealing from the card directly) will probably be more difficult than just trying to take a photo of the back of the latest HSBC cards, which have ALL of the information -- name, card number, expiry date and CVV -- all on one side now.

That is standard now that the cards are no longer embossed. My Tesco card also has the account number and sort code on the back, albeit in tiny lettering. I expect that is standard too.

[XFool]

Mind you, skimming someone's contactless card for details to use on Amazon (rather than stealing from the card directly) will probably be more difficult than just trying to take a photo of the back of the latest HSBC cards, which have ALL of the information -- name, card number, expiry date and CVV -- all on one side now.

That is standard now that the cards are no longer embossed. My Tesco card also has the account number and sort code on the back, albeit in tiny lettering. I expect that is standard too.

Well, the contactless Revolut card (along with the contactless Barclaycard) I found recently on the ground near my home had the owner's name on the front, no embossing, and the card number, expiry date and cvv2 number on the back, in large letters.

(Have reported it to them)

[GeoffF100]

Most smartphone bank apps will let you know when your card is being used. If they don't, then ask your bank why! It's all part of Due Diligence.

Some apps allow you to switch contactless on/off. This is now quite old tech, so there's no excuse.

I would not want to use a smartphone app for an account that potentially gives access to serious money. That is an unnecessary security risk.

I certainly would not use Google Pay, Apple Pay or Samsung Pay. That is inviting theft, or worse, a mugger with knife to your throat demanding access to my phone and banking app. I do not want the phone to announce its presence either, so I turn on "Do not disturb" whenever I reasonably can.

I have installed the app for my in person payment card. That does not give access to any more money than the card itself. I am only keeping small amounts of money on the card, so I need to have an easy way to monitor how much is left.

As I have said, turning contactless off completely has the downside that it increases the shoulder surfing risk.

[GeoffF100]

That is standard now that the cards are no longer embossed. My Tesco card also has the account number and sort code on the back, albeit in tiny lettering. I expect that is standard too.

Well, the contactless Revolut card (along with the contactless Barclaycard) I found recently on the ground near my home had the owner's name on the front, no embossing, and the card number, expiry date and cvv2 number on the back, in large letters.

(Have reported it to them)

My Barclaycard Rewards card has all the information on the back too.

https://www.barclaycard.co.uk/personal/ ... rd-rewards

[stevensfo]

That is standard now that the cards are no longer embossed. My Tesco card also has the account number and sort code on the back, albeit in tiny lettering. I expect that is standard too.

Well, the contactless Revolut card (along with the contactless Barclaycard) I found recently on the ground near my home had the owner's name on the front, no embossing, and the card number, expiry date and cvv2 number on the back, in large letters.

(Have reported it to them)

The Revolut owner has probably already disactivated the card in his app and reported it. My wife did the same last year when she had her purse stolen in Madrid. In any case, he would receive a loud 'ping' if the card is used either in a shop or online.

Not sure about Barclays. They seem to be paying quite a lot in fines, so maybe they can't afford to give a damn about their customers.


Steve

[stevensfo]

Most smartphone bank apps will let you know when your card is being used. If they don't, then ask your bank why! It's all part of Due Diligence.

Some apps allow you to switch contactless on/off. This is now quite old tech, so there's no excuse.

I would not want to use a smartphone app for an account that potentially gives access to serious money. That is an unnecessary security risk.

I certainly would not use Google Pay, Apple Pay or Samsung Pay. That is inviting theft, or worse, a mugger with knife to your throat demanding access to my phone and banking app. I do not want the phone to announce its presence either, so I turn on "Do not disturb" whenever I reasonably can.

I have installed the app for my in person payment card. That does not give access to any more money than the card itself. I am only keeping small amounts of money on the card, so I need to have an easy way to monitor how much is left.

As I have said, turning contactless off completely has the downside that it increases the shoulder surfing risk.

I certainly would not use Google Pay, Apple Pay or Samsung Pay. That is inviting theft, or worse, a mugger with knife to your throat demanding access to my phone and banking app.

Although I have heard of this, I would never, ever, link my finances to Google. I know that some people use these services, but it's simply sending your info to organisations outside your control. Why?

Keep using cash! As Dominic Cummings told us,take back control!!

Steve

[1nvest]

I'm in the use it or lose is brigade. Draw out £200 often, alongside a debit card - for travel and for the odd money (£24.34 purchase, £20 note, £4.34 from card). I envisage otherwise a monopoly (end of cash) resulting in unavoidable additional costs (2%/whatever of transaction value in bank fees would be little different to a 2% increase in tax on spending). I dislike the trend towards leaving a legacy of where the state sees/records all - as then your work/effort to accumulate wealth is no longer yours, is just a state loan.

Haven't set a contactless limit, could and perhaps should set it to £20 as otherwise a dropped/stolen wallet could have £500 spent within minutes and before the loss was realised. I imagine banks have issues with some spending that sort of amount and then claiming their card was lost/stolen.

Additionally have a credit card - used rarely, has a high limit and is kept more for emergencies, paying for a private ambulance/medical treatment following a accident abroad/whatever. Also carry gold coins - as a get you through the gate and onto the last plane/ship bribe.

[stevensfo]

I'm in the use it or lose is brigade. Draw out £200 often, alongside a debit card - for travel and for the odd money (£24.34 purchase, £20 note, £4.34 from card). I envisage otherwise a monopoly (end of cash) resulting in unavoidable additional costs (2%/whatever of transaction value in bank fees would be little different to a 2% increase in tax on spending). I dislike the trend towards leaving a legacy of where the state sees/records all - as then your work/effort to accumulate wealth is no longer yours, is just a state loan.

Haven't set a contactless limit, could and perhaps should set it to £20 as otherwise a dropped/stolen wallet could have £500 spent within minutes and before the loss was realised. I imagine banks have issues with some spending that sort of amount and then claiming their card was lost/stolen.

Additionally have a credit card - used rarely, has a high limit and is kept more for emergencies, paying for a private ambulance/medical treatment following a accident abroad/whatever. Also carry gold coins - as a get you through the gate and onto the last plane/ship bribe.

Haven't set a contactless limit, could and perhaps should set it to £20 as otherwise a dropped/stolen wallet could have £500 spent within minutes and before the loss was realised. I imagine banks have issues with some spending that sort of amount and then claiming their card was lost/stolen.

If you have not done your due diligence, KYB and AML research, then you have only yourself to blame. Your phone should tell you each time your cards are used. If not, why not?

Steve

Moderator Message:
Edited to remove rude epithet, even though stated in the third person. -- MDW1954

[GeoffF100]

Your phone should tell you each time your cards are used. If not, why not?

Having an app on your phone provides the bad guys with another way into your account. You should know if your cards are stolen. If they are, you inform the bank as soon as you can. Knowing that they are being used before you can do that does not help. If the worst comes to the worst, you should be compensated. It is best to avoid the worst if you can though.