On 04/12/2015 14:51, Roland Perry wrote:
2015, Clive Page remarked:
I thought that when contactless bank cards were introduced for small
transactions in shops one of the safeguards was that the first time
you used one you would be required to enter your pin on the associated
pin pad, just so that if someone stole your card and you had not
enabled it in this way it could not be used to empty your account.

I dimly recall that too, but have never encountered it myself in the
field (I have several cards on the go).

I've just got more information on this, by chance. Halifax says of a
conctact-less card that "the first time you use it for any transaction
you will need to enter your PIN. Once you've done that your card is
ready for contact-less payments."

And I just checked the website of Nationwide Building Society which has
different and rather ambiguous wording but to much the same effect -
except that they say the initial transaction can be a chip and signature
one. So it doesn't appear that there is any flag on the card that has
to be updated by using it with a PIN the first time, the flag (if any)
must be on the bank's own servers. Nor does it appear that you need to
use it with a potentially contact-less terminal but with a PIN first
time, provided you have used that card somewhere with a PIN beforehand,
even an ATM.

This makes me more worried than I was - it means that any of my
contact-less cards could be stolen and used for a whole string of
transactions under £30 by anyone else with no PIN. I wonder how I would
establish that I didn't make these purchases myself.

Rather bizarrely, the Nationwide site says
"For extra security, you might occasionally be asked to enter your
4-digit PIN, or sign."

This is just after pointing out that you can use them for travel on
London Transport in place of an Oyster card. I'll bet a bus or tube
gate-line never asks for your PIN.


--
Clive Page