The utter lack of control on the part of the customer, having neither an approval step nor the ability to switch the card off seems to me to be a fundamental flaw in this payment method.
This system was pretty much designed to be abused.
This system was pretty much designed to be abused.
I don't know how serious this problem is, but since this is the first we're hearing about it it must be pretty rare, as contactless cards are much more widely used in, say, Hong Kong.
We're designing an easy method of paying for small items, not arming nuclear weapons. We'll accept 1 in 1e6 errors.
It scares me that they could charge any amount and you wouldn't know.
Why, yes, I've been the receiving end of a similar scam. It was Visa Electron and PIN-less purchases, then a new opt-out feature. The math was more like 5 customers, but 10,000 euro limit. (No, I did not lose that, or even close, by being lucky.)
http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-F...
I have no affiliation with this company. The linked story and my need for a new wallet and google did the trick.
Outside those, I agree, there's quite a large possibility for issues, though this seems weird that it seems to be happening from significantly larger distances than it's designed to work under. To such an extent that I suspect some / all of these people are simply not remembering correctly - they swung their purse between hands, bringing it near the reader, or something. People are forgetful, and this is way way outside what anyone else can replicate that I've seen.
The first customer was able to obtain a refund after demonstrating the problem to the store manager.
isn't it then just cash that you can take without touching?
The security measures are pretty good actually:
- Can't pay for things costing more than £20 via contactless (have to use chip and pin, the 'normal'/old method)
- After a certain number of continuous contactless payments, it will ask you for your PIN to verify the cardholder is still in possession of the card. This 'counter' is reset to 0 every time you pay for using Chip and PIN. E.g. if you alternate between contactless and Chip and PIN, you'll never have to enter your PIN for the contactless payment.
- If your card does get skimmed, your bank will cover you for any losses.
Skimming is possible yes, but you really have to be pretty close (the article is the exception here, not the norm). Within a few cm of the card, which it's certainly possible to skim someone's card - the person would almost certainly notice.
(serious question)
If you manage to get a proper shop terminal(which are only given to proper registered businesses) then yes, you could theoretically skim peoples' cards in a bus or any other public place. The only problem with that is, that you can only charge at most 15 quid, and you cannot get the card details back, so you can't use it for internet payments. And because the bank has your details they can very very quickly track the payments back to you and stop you from stealing money(and not even pay out any money to your account). So yes, the trouble is completely not worth it, which is why probably no one will do that.
http://www.v3.co.uk/v3-uk/news/2163404/researchers-punch-hol...