Contactless card security flaw largely fixed, in win for MSE’s two-year campaign

What’s been done to fix the problem?

Last February, we reported that the the three main card providers – Visa, Mastercard and American Express – had agreed to bring the majority of contactless transactions online. And the financial regulator’s now confirmed that this has happened, and that it took action to help fix the problem.

FCA director of strategy and competition Chris Woolard writes: “The good news is that, after we engaged with the major card schemes such as Visa and Mastercard, they have made changes so that almost all transactions are now processed ‘online’.

“This means that if you’ve lost your card or had it stolen and reported it, it is much harder for someone to use it to make contactless payments. As firms have put these changes in place, the proportion of transactions automatically checked online has significantly increased.”

“There are some exceptions where transactions still aren’t processed online. This is where the slight delay of having the payment checked online might interfere with the customer experience – for example, it could mean significant delays or queues for people paying for a train or bus journey with a contactless card. But these exceptions are few and we expect the number of online transaction processes to continue to rise.”

We’ve checked with the major card schemes and this is what they told us:

• Visa says most contactless transactions have been online since October 2017. It says there are some exceptions relating to transportation payments, but “even these are increasingly being processed online as well”.
• Mastercard says most contactless transactions have been online since March 2018. Again, there are a few exceptions such as Transport for London payments. 
• American Express says it plans to have most contactless transactions online by August. This is in line with the timescale it outlined last February. It says “progress has been good”, though again, even after August there will be some transactions which continue to be made offline such as “unattended terminal transactions” for transport and parking.