Money Talks: contactless card fraud, most convicted landlords and savings warning

Consumers who use contactless debit and credit cards to buy goods or services could be unwittingly opening their bank account up to fraudsters, according to an investigation by Which?

Researchers bought cheap, widely available card scanners from a mainstream website to see if they could “steal” key details from a contactless card.

They tested 10 different credit and debit cards, that were meant to be coded to “mask” personal data, and were able to read crucial data that was meant to be hidden.

It then went shopping with the information it had obtained and was able to successfully place orders for items including a £3,000 television set.

“By touching volunteers’ cards to our card reader, we got enough details to allow us to go on an internet shopping spree,” a Which? spokesman said. “With these card details, the contactless transaction limit is irrelevant, because online transactions aren’t contactless.”

The limit for a contactless transaction increased from £15 to £20 in June 2012 and will rise to £30 in September.

Contactless payments are booming. There are now 58m contactless cards in circulation and UK householders spent £2.32bn on them last year.

Industry body, the UK Cards Association, dismissed the findings saying Which’s report was “not a new story”.

“The method shown by Which? is not a new discovery,” said Richard Koch, head of policy at the UK Cards Association. “Instances of fraud on contactless cards are in fact extremely rare, with losses of less than a penny for every £100 spent on contactless – far lower even than overall card fraud.”

He added that most retailers need additional data such as the card security code, along with the cardholder’s address, before they allow a purchase to go through. However, Which? found it easy to spend on the cards in a large online shop.

“We doubted we’d be able to make purchases without the cardholder’s name or CVV code – but we were wrong,” Which? said. “We ordered two items – one a £3,000 TV – from a mainstream online shop using ‘stolen’ card details, combined with a false name and address.”

There are no statistics to show the scale of theft attributable to contactless technology fraud and if householders are not negligent with their card they should not be liable for any losses.

However, card fraud can be upsetting for the victim and time-consuming to resolve, and some industry experts believe more could be done to tackle it.

Peter Eisenegger, privacy standard expert at the National Consumers Federation was part of an expert group that developed a range of European standards covering the use of contactless cards.

He said that while industry standards specify a maximum magnetic-field strength for card readers of 5cm, some may be able to read cards at greater distances.

“It may be possible for a small percentage of cards to be read 15 to 20cm from the reader,” he said. “Even if this was to occur in 0.1% of cases, with more than 300m transactions taking place last year, many consumers could be affected.”

He added: “I’d like to see banks and retailers stepping up to meet European standards with contactless technology.”

Which? said it also wants people to be able to opt out of having a contactless card if they want to. All leading debit and credit card providers now issue contactless cards as standard but not all of them allow customers to opt out of having one.

http://www.theguardian.com/money/2015/jul/23/contactless-card-is-too-easy-says-which