Feeds

Bank turns London man into RFID-enabled guinea pig

Halifax customer bites back

The Essential Guide to IT Transformation

The Halifax bank is enrolling unsuspecting customers in trials of a new generation of RFID-enabled bank cards, and trying to keep them in the program even if they have mis-givings about the wave and pay technology.

PayWave allows punters to debit their account without having to enter a PIN or sign for goods valued at less than £10.

The RFID-based technology, backed by Visa, is being rolled out by UK banks Barclays and Halifax, as well as others on the continent. Mastercard is backing a similar technology called PayPass.

Halifax is introducing the technology in London to a number of punters, including Reg reader Pete.

Pete, a current account holder at Halifax, was among those issued with a new card. He didn't want to use the unsolicited technology and his attempts to receive an alternative card, though ultimately successful, proved frustrating.

"I have to input my PIN the very first time I use this 'Paywave' card, but after that it is automatically authorised to work for all transactions under £10," Pete explained. "I put the new card straight in the bin - in fact, I shredded it and put it in several different bins. I don't want this highly insecure-sounding facility, and I never use a debit card for retail transactions anyway."

Pete thought no more of the card assuming his old plastic, which had months left to run, would continue to be useable. But when he went to his local bank in early December to get some cash the ATM refused the transaction and retained his card.

Bank staff, having verified Pete's identity, were not immediately able to work out why the card had been retained. They gave him back his card but, after other attempts to use his card failed, he was faced with the chore of getting his card replaced. After calling Halifax's helpline, Pete was told that the (unsolicited) issue of the contactless card had automatically cancelled his original card, something not mentioned in the paperwork that came with the old card, according to Pete.

"Halifax are cancelling peoples' bank cards without permission and without even telling them, and forcing them to use these new cards, which as far as I know nobody has asked for," Pete told El Reg

"Who wants these things? Not me. And is there no limit to the level of insecurity they want to introduce to their cards? I guess not, so long as the cardholder can be stuck with the liability," he added.

A replacement card also came with the unwanted contactless card technology. Curiously, Pete's wife didn't get a contactless card even though she is joint holder of the same Halifax account.

Ultimately, after complaining long and loud, Pete has now received a non-Paywave bank card from Halifax. The incident has left him far from satisfied. Halifax turned down Pete's request for compensation.

Halifax declined to speak about individual cases, but confirmed it was conducting a trial of the technology across London, prior to a nationwide rollout.

A spokesman for banking association APACS said whether customers had the ability to refuse new technologies was "card issuer dependent".

Barclays is also introducing the technology in the UK. A developer familiar with Barclays plans said it, like Halifax, is rolling out the technology in London in advance of the rest of the country, both as a test-bed for the technology and because Londoners are more used to using RFID-enabled technology in the form of Oyster travel cards.

Barclays has created a triple-function card (called OnePulse) that combines a traditional credit card with PayWave and also with Oyster on-board as a separate application.

"Barclays and a couple of other banks were bidding to effectively take over Oyster and subsume it into a larger payment scheme using the less-proprietary Visa and Mastercard technology, but these negotiations fell apart," he added.

Our source noted that the maximum transaction value for contactless purchases is typically £10, which mitigates the increased risk of using the cards.

"Major customer education issues still need to be overcome before everyone is happy to use this as a cash-replacement technology, which is what the banks and retailers want," he said. "It's certainly a very interesting privacy issue if banks are including the contactless chips in 'standard' credit cards without asking, especially since the transactions are effectively unsecured because no PIN is needed.

"On the privacy issue, there is likely to be a growing number of stories and attempts at hacking and skimming contactless cards, once they are out in the wild, and whether or not the risks to consumers are real, they need to understand the issues and risks."

Our source added that the situation created a market for niche security firms to develop products that protect contactless-enabled cards from "uninvited attempts to communicate with them", in response to security concerns about the possible misuse of the technology to perpetrate fraud.

Whether the likes of Pete will be reassured by extra security controls on a type of card they have had forced on them in the fist place remains to be seen. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.