Forum Topic

New Contactless Payment system - Oyster Card Readers - a warning for the unwary

I am of an age where I carry a Freedom Pass. Yesterday evening I used it as usual to validate a bus journey. This afternoon, when checking my bank account online I found that I had been charged £1.40 for the privilege.On going to the TfL website I found that the new Contactless Payment system had been introduced - there was nothing on the bus to indicate this. The website says that if one presents an Oyster card (the Freedom Pass is a type of Oyster card) and there is a credit or debit card in the vicinity of the reader at the time, then the reader will reject both cards. This did not happen last night. Even though the Debit card was nowhere near the reader and the Freedom Pass was pressed up against the reader, it still took the debit card in preference to the Pass.I have complained to TfL via the website, asking for a refund, but though I would flag up the problem on here to avoid anyone else falling into the same trap.

Russell Maiden ● 4750d11 Comments

A contactless transaction is initiated by the chip on the card. Cloning a chip is extremely difficult. Cloning a card's magnetic stripe date, on the other hand, is ludicrously easy. They can create cards, yes, but unless the fraudster is *extremely* sophisticated he/she will not be able to create a copy of your chip. And even if they are able to do this, a chip card will not allow more than a pre-defined amount (usually £50) to be spent via contactless. Once that amount is exhausted, the chip will tell the terminal that the cardholder needs to be authenticated via PIN. Once a valid PIN has been entered, contactless will be re-enabled for another $50.

Alex Weel ● 4746d

Surely they could also clone the contactless information and perhaps create cards for others to use? The criminal and hacking fraternity are always on the spot when it comes to these things.

Peter Chadburn ● 4747d

The real danger lies not in them taking money off your card. To do that, a fraudster would have to have a merchant processing agreement in place with a bank connected to the payment network in order to get the transactions cleared and settled - far too much hassle. No, these guys are after your card details, which are contained in an image of the card's magnetic stripe located on the chip. These can can then be transposed to a magnetic stripe and used in countries without a chip infrastructure or used for online payments at merchants (Amazon, for example) which do not require you to provide the 3-digit security code.

Alex Weel ● 4749d

This is one card that i think anyone would be insane to have. Having had my debit card cloned at Shell Garages in Hanwell, South Ealing and Hanworth. I heave learned my lesson. But it does not seem to be beyond the possibilities of science that people could would round with a device that just takes money off you without you knowing. Oh yes that have an Oyster machine!!! But someone more sinister could easily do it.

Peter Chadburn ● 4749d

Your bank would not be able to remove the contactless functionality. You would need to do this yourself by disabling the antenna.Some issuers apparently are willing to re-issue cards without contactless capability but most aren't to the best of my knowledge.

Alex Weel ● 4749d

That is one reason why I have also asked my Bank to disable the contactless ability on my card, or exchange it for a non-contactless version as soon as possible. One does not want to take unnecessary risks with one's security!

Russell Maiden ● 4750d

I also have a Freedom Pass, but I do not trust the UK contactless card system because it was tested in Europe before being introduced here. It was discovered that the card could be read from nine feet away, so there is a real chance of fraud.

Chris Bell ● 4750d

According to the website you have to show the authorised official whichever card you used to "pay" for the journey. Presumably they place it in a machine to see whether the fare has been debited - I've never seen a ticket examiner on a bus journey yet - do they exist?!Seriously, I would hope that whatever method(s) they use to check the card would be something akin to the machine one uses to pay by card at any retail outlet, and that confidential bank details are not "poached" by the act of inspection.

Russell Maiden ● 4750d

If you pay for travel using an Oyster card and then later an inspector needs to check whether you have paid I assume the inspector could check from the card details.If you had used a standard bank card would you need to supply your bank details to the inspector?

Chris Bell ● 4750d

Thanks for that, Nigel, I have sent an email accordingly.

Russell Maiden ● 4750d

Thank you for pointing this out.Perhaps worthy of a line or two on the front page if you contact the site Editor.

Nigel Brooks ● 4750d