Additional security measures for Apple and Android Pay - is there any point using it now?

[Jawloms]

Related - https://www.bbc.co.uk/news/business-49556473

 

Banks and retailers had been expected to introduce the measures on 14 September, when the law will officially change, but many were not ready.

 

Instead the Financial Conduct Authority has effectively delayed it, saying it won't enforce the law until March 2021.

 

However, it still expects providers to introduce the measures in a staggered approach over the next 18 months - although when you start noticing changes will depend on who you bank with and where you shop.

[Garacesh]

I expected this would happen sooner or later, since IIRC any contactless payment basically carries with it a "Er, that weren't me, refund plox" clause. Contactless, as a technology, is inherently (and by design) insecure. You can slap bits on top of it that help mitigate the potential damage, like the £30 limit or connecting it to another device that requires authentication (e.g. a phone that uses facial recognition or biometics) but the underlying technology is still insecure by design.

 

I pretty much exclusively use my Monzo card for purchases now.. My salary goes into, and bills go out of, my Halifax account but I wire myself a per mensis to Monzo each month and my Halifax card doesn't have contactless. So by the sounds of it this won't really effect me all that much anyway. I haven't seen anything official to say so, but it comes across to me that Monzo are never going to bother using the decline+insert card response code mentioned by Rika in the earlier-posted twitter thread provided you regularly check-in with the app. But hopefully they'll have an official statement soon.

[elsiegee40]

Ooh look. They’ve backtracked!

 

On Monday 2 September we sent you an email about Strong Customer Authentication (SCA) and the importance of your card issuer having your most up-to-date contact information.

 

We incorrectly suggested that you may be asked to insert your card and key in your PIN when using Apple Pay and Samsung Pay. We are pleased to tell you that you are not required to present your card or enter your PIN when using these payment methods, and you can continue to use Apple Pay and Samsung Pay as normal.

[Arthur]

A new feature for Monzo beta testers...

 

Monzo Labs: Improved Card Security

 

Hi Everyone,

 

On 14 September 2019 new regulation for authenticating payments, called Strong Customer Authentication (SCA), will be introduced in the UK as part of the second Payment Services Directive (PSD2).

 

SCA will play a key role in reducing the level of fraud across the UK by tightening the rules around authenticating our customers when making card payments that don’t need you to enter your PIN. While this new regulation won’t actually protect you from any new types of fraud you weren’t already covered for, it will save the industry as a whole millions of pounds a year!

 

We can authenticate you by verifying at least two of the following three factors:

 

• Inherence - something you are, like a fingerprint
  
• Knowledge - something you know, like your card’s PIN
  
• Possession - something you have, like your phone
  

For card transactions that don’t need you to enter your PIN (such as contactless) the regulator has suggested two possible instances where you’d need to prove two of the above:

 

• When you make 5 payments in a row without entering your PIN
  
• When you spend £100 without entering your PIN
  

We want to implement this extra level of security while maintaining the same smooth payment experience you’re all used to, but we need your help testing it!

 

What exactly will change?

We want to minimise the number of times you need to re-authenticate yourself so we’ve decided to decline based on total spend rather than number of transactions.

 

That being said, if you think it would be better to re-authenticate based on the number of transactions you’ve made, please let us know why!

 

For the time being we have set the limit to only £30 to try and gather as much feedback as possible about the new flow. In practice, this means you can make any number of transactions, so long as they don’t sum up to more than £30.

 

Once you have spent more than £30 since your last authentication you will be required to go through the flow.

 

For the moment we are only applying the improved security to contactless payments but will soon expand the trial. In the future we’ll likely include other payment types that don’t require PIN verification such as chip and sign.

 

How would this work in practice?

If you reach your authentication limit and hence have a contactless transaction declined, you will see two feed items in the app.

 

One will be a regular decline item with information about the transaction and the fact it failed. The other feed item will prompt you to go through the authentication flow and ask you to enter your card PIN into the app. Once you’ve done this you’ll be free to use contactless again!

 

Alternatively, at any stage you can simply make a chip and PIN transaction and we’ll reset your counter.

[Arthur]

www.starlingbank.com/blog/making-contactless-more-secure

 

You’ve probably noticed that security is kind of a big deal to us at Starling. From biometric login to 3D Secure and in-app card locking, we do everything we can to make sure that your money stays safe under our watch.

 

So as of the 12th September, we’re introducing a new measure to make contactless payments even more secure. It goes by the lofty name of Strong Customer Authentication (SCA) – but really, it just means that you’ll have to enter your PIN a little more regularly than before. It’s come into play because of a new regulation called the Payment Service Directive II, a European law that’s being ushered in at all UK banks to improve the security of payments and prevent fraud (and yes, it’ll definitely still be in force after Brexit!).

 

The long and short of SCA is that it makes sure that when someone’s using contactless on your card – that someone is definitely you.

 

So what will I have to do?

Not all that much, actually. We’ll just be asking for your PIN a little more regularly when you pay with contactless. After you’ve made five contactless payments in a row (or once your payments have totalled £135) your card will now decline and you’ll be asked to enter your card in the machine and enter your PIN. It doesn’t mean there’s anything wrong with your card or account – rather it’s just another way for us to keep your money as safe and secure as possible.

 

You’ll continue to be asked to enter your PIN for card transactions of more than £30 – but you probably knew that already.

 

What’s so ’strong’ about it, then?

All the ’strong’ in ’Strong Customer Authentication’ means is that the person using the card – you, hopefully – has passed at least two of three ’proof points’ confirming they’re the owner of the account. Those three points are Knowledge (knowing your Password or PIN), Possession (having your card or phone on you) and Inherence (being able to prove you’re you through fingerprint or facial recognition). When you use your bank card and know its PIN, you’ve passed at least two of those tests – which makes your customer authentication nice and strong. That’s it!

 

A word on merchants

It’s worth bearing in mind that these are new regulations for the UK, so some merchants will still be finding their feet. Some might ask you to use a different card when your contactless declines, but all you’ll need to do is use your Starling Chip & PIN instead.

 

Speaking of merchants – there are a few exceptions to bear in mind. Some unattended payment terminals – such as parking meters and Transport for London machines – won’t ask you for your PIN after five transactions and you’ll be able to pay through contactless as many times in a row as you like. The same goes for Digital Wallets such as Apple Pay and Google Pay, so if you haven’t started using yours yet, now’s the time.

[elsiegee40]

A new feature for Monzo beta testers...

 

Monzo Labs: Improved Card Security

 

Hmm not sure about sharing my PIN with any app! That’s the one thing that’s private between me and the till points.

[Garacesh]

Hmm not sure about sharing my PIN with any app!

Yeah, but it's Monzo, everything's done via the app, so sometimes you need to provide your PIN to authenticate yourself since the app has no biometric capabilities yet.

You also need to do this with ordering a new card, or changing your address. I don't see the problem?

 

Edit: 2 important things in that article, though:

• Apple and Google Pay transactions, also won’t count. If you do end up at a terminal without PIN entry capability, such as a vending machine, you should be able to pay using your phone’s virtual wallet
  
• If for whatever reason you are unable to authenticate yourself but still have access to your app you can turn the feature off whenever you want. This will return your card to normal behaviour, even if you’ve reached the new contactless limit
  

 

So Apple/Google Pay (and other e-wallets) don't count towards your limit, and there seems to be an opt-out.

Edited September 12, 2019 by Garacesh