Contactless Cards - good / bad?

[naw]

I've had a contactless debit card for several months (didn't even realise what the "<small><small>)</small>)</small>)" logo meant) and used it a couple of days ago to buy a couple of beers - the bartender just took my card and waved it in front of the reader and that was that - transaction done - very convenient, but then I got to thinking how easy it would be to scam. So I made a 'faraday wallet' out of some tin foil and duct tape - I since found out you can buy them online, anyway, mine works (went to the same bar to test it last night - any excuse ), it only took 5 mins to make and cost virtually nothing.

Anyhow, I contacted my bank (First Direct) and insisted that they send me and my wife new cards without this Contactless facility and after some argument, they capitulated and sent me new cards without the NFC facility. I also read that snipping a corner off an NFC card breaks the aerial so my old 'NFC' card will get tested again tonight

But in reality - how difficult would it be to scam, I read a few articles online that say in theory its easily done, some counters by the banks saying there have been no incidents and in practice its just not practicable since the card has to be within 5-7cm of the reader and max 5 transactions @ £10 /day is allowed. But then they would say that.

I figure that if (for instance) I had a reader in my pocket and was jostling at a bar or packed into the tube, I could be skimming dozens of cards - 5 cards, 5 transactions @ £10ea = £250 - kerching!

I suspect the banks will just *accept* any complaints that any £10 transactions I claim are fraudulent and refund the money since it would be more expensive time-wise to actually chase the money down. So apparently a *ahem* 'victimless crime' (though of course the bank will recover their losses through charges - so everyone is a victim really).

So my question is: does anyone out there have 'actual' first-hand personal experience of getting scammed in this way? Is it a real threat? I have to say, I don't like it.

[PB]

We have them here in Australia, and I use mine every day.
The cards are safe as long as they're not stolen, because
then anyone can just go to the shop and wave the card
at the machine to buy small items.

It kind of makes a mockery of all these years of being told
never to let anyone know your PIN, so they can't use your
stolen card, but then this comes along with no PIN needed.

Ah, humans.

[PB]

> I had a reader in my pocket and was jostling at a bar or
> packed into the tube, I could be skimming dozens of cards

You can buy metal cases to keep them in, to avoid that risk.

[naw]

@PB yep I made a sleeve out of duct tape and foil that stays in my wallet and *shields* my card - seems to work perfectly

[netmaestro]

Well, I'll never use one. Shield or not, it could be slipped out and scanned in your gym locker by an employee or at home by your kid's friend over visiting or any number of ways. With no pin required it's still a lot weaker.

[blueznl]

Isn't there a limit on them?

[netmaestro]

For now there's a limit.

[naw]

I believe the limit is £20 /transaction, maximum 5 transactions /day. But that will only ever increase. So the limit is £100 /day /card. I guess the banks assume you can afford to lose £100 /day or £3,000 per month.

[PB]

> it could be slipped out and scanned in your gym locker by an employee
> or at home by your kid's friend over visiting or any number of ways

Perhaps, but you just dispute the transaction with your bank and they
have to give you the money back, no questions asked. No big deal.

[naw]

Ok - so in the event of a dispute, the bank takes the hit - <£20 is too little for them to bother investigating. But now the limit is £20 /transaction, so they put up their fees by 0.0001% to recover the loss - in the end the bank loses nothing, we pay.

[PB]

> they put up their fees by 0.0001% to recover the loss

You still use a bank that has fees? Try ING.

[naw]

> they put up their fees by 0.0001% to recover the loss

You still use a bank that has fees? Try ING.

Sure I do, everybody does. All banks have fee's - they're crappy interest rates / arrangement fee's / payment protection fee's / charge for cash withdrawal / overdraft fee's / in this case, a charge (to the merchant) for using a Credit Card (which they inevitably pass on to you) which includes a small amount to cover refunded fraudulent transactions.
The banks want contactless to stop us using cash because there are so few opportunities to charge a fee for a cash transaction (only at the point of withdrawal from the bank/ATM). The merchants/retailers want it because they can employ fewer shop assistants and process sales quicker - people are less *aware* of card transactions, so there's opportunities to increase prices.
Any fraudulent transactions will be charged indirectly back to the customers - absolutely no doubt about that.

[blueznl]

IIRC my bank allows you to disable the option. Problem solved. Actually, I think it should be an opt-in choice, but that's a different story.