/security

News and resources on cyber and physical threats to banks and fintechs worldwide.

Fraud spike forces bus company to ban online banks and cut mobile contactless limits

An Essex bus company has banned customers from Monzo and Revolut from using their smartphones to pay for fares and has slashed mobile contactless limits to just £10 following a spike in debit and credit fraud across the network.

5 comments

Fraud spike forces bus company to ban online banks and cut mobile contactless limits

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

Ensignbus, which ploughs routes through Southend, Grays and Tilbury, says it suffered £10,000 worth of losses through contactless 'non-payments' over the last three months.

The reduced contactless limit affects all users trying to pay via iPhones and Android devices, while transactions from Monzo, Reveolut and ABN Amro apps have been blocked at the ticket machines.

An Ensignbus spokesman told the local paper: "As part of ongoing contactless fraud/non-payment issues, a number of banks are now blocked on our ticket machines.

"The most common which may affect you are Revolut, ABN Amro and Monzo.

"If you use any of these, please use an alternative bank card or cash."

Passengers are being advised to make more than one contactless payment transaction for tickets above the £10.00 limit. For season ticket purchases, the transit scheme has withdrawn contactless purchases completely and moved to a cash-only system.

Sponsored [New Report] The Future of UK Fintech: 2015 - 2035 - An IFGS Special Edition - UK Fintech Week 2024

Comments: (5)

Jim Bray VP of Sales at Quinteft.com

It would intresting to learn how the fraudesters are taking advantage of vulernabilites in contactless machines.

A Finextra member 

I'd like to learn more about this. If people are clever enough to run this fraud, why waste their brainpower on stealing a few free bus journeys. There are fatter targets availabe.

A Finextra member 

Probably cloned cards  sold for £100 each  - not a bad deal for copy-paste 

 

Jim Hart ciso at Pollinate International Limited

You can't easily clone contactless cards. This fraud likely does not require genius... Some bus companies are not using GSM POS so don't process payments until they're at the depot. This means they'll authorise a payment but not actually check the funds are there. As Revolut and Monzo are pre-pay, and don't offer any form of overdraft, it's quite easy to get a card then zero the acount but still hold a valid card with an approval limit only set by the POS. Hence, buying a high-value seasonal ticket on the card is authorised at point of sale, and the season-ticket issued, without there actually being any funds on the card used to pay with... As a scammer, you'll not get rich doing this but it is a fairly easy fraud. This is the same reason pre-paid cards like Revolut are not authorised on flights, or ferries etc.. It was all too easy for fraudsters to buy loads of tat from the onboard duty free without ever having to pay for it.

As a solution, the bus company needs to either upgrade their POS to GSM units (which will add 10-15 seconds in the authorisation process...) or block pre-paid cards, or even just block them only for higher-value transactions which is a middle-ground.

David Abbott Senior Sales Manager, Cards - Europe at FIS

thanks Jim - that was a very useful update - i was familiar with the Airline duty free issue - didnt realise this was the Bus issue -  seems shortsighted not to include an auth capability - but the additional 10-15 second wait could put a huge dent in timetables if bus needs to onboard 20 passengers 

[Webinar] Ensuring Interoperability in the Age of Global, Cross-Border e-InvoicingFinextra Promoted[Webinar] Ensuring Interoperability in the Age of Global, Cross-Border e-Invoicing