UK Consumers Reporting Contactless Payment Errors 193
leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."
tinfoil wallets (Score:4, Interesting)
Re:Why (Score:4, Interesting)
A lot of credit cards in the UK have the Chip'n'Pin system [pcmag.com], which requires a physical connection to be made to the payment terminal. Simply "swiping" becomes less and less common, so people have to type their PIN every 5 minutes to pay for a few quid worth of $product. I used to work in the industry, and there was a certain amount of pressure from consumers to be able to do something as quickly and effortlessly as possible, but the magstrip simply isn't deemed secure enough.
The idea was to use NFC, so people could just wave their card for any purchase under 10 or 20 quid, and be on their merry way.
Re:Double payments (Score:4, Interesting)
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Because the software is shit.
Having dealt with a few Point Of Sale systems I can say that the acronym POS is no accident.
A lot of systems are just Windows systems with a program like Pronto Xi running on top. It's not unusual for these terminals to be running Windows XP. The back end is usually pretty good but the software really suffers on the front end and the front end is where we tend to get most of the errors.
Re:Why (Score:5, Interesting)
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
Contactless payments differ a lot from magnetic stripe swiping, invisible barcodes etc.
They are not static information but an active challenge-response authentication system. You cannot clone the chip; it has an internal cryptographic secret it does not allow you to access, only challenge responses. You can trick it into authorizing a purchase you don't want if you're in physical proximity, which is happening here, but you cannot save that authorization for later use, since the bank is issuing the challenge here, just like with a chip-and-pin purchase. The whole point is to ensure that this is really the actual card.
So the main problem is the lack of user interaction to go ahead with the purchase. A touch button on the card itself would help, but would destroy part of the convenience.
Re:tinfoil wallets (Score:4, Interesting)
My bank rolled out contactless cards... by mailing one to me. No notification to me, preactivated, no PIN needed for purchases under $200.
I went there and bitched them out about it and they really could not understand why I was mad.