This is something that has bothered me a little over the last few months but this morning, it has made me think it needs to be changed due to account security.
I tend to pay my credit card off via a bank transfer, so I can pay extra off, as well as by direct debit. The banks I use need to use the credit card number as the reference to locate the account.
I had noticed that Monzo keeps the whole full credit card number as a reference in the appropriate fields in app, as well as flashing it as a notification on the iPhone home screen.
Monzo Payment Screen
Monzo Payment Reference
Aside from not really wanting my credit card number flashed on notifications, this has come to ahead for me because I was looking at Emma and noticed my full credit card number has been passed onto them which wasn’t my intention with open banking.
Other banks asterisk out credit card reference numbers when attached to sort codes of well known credit cards even when used for faster payments. Here is the RBS apps asterisking of the same number on their system.
RBS Select Payee
RBS Payment Screen
RBS Transaction feed
Please can this be looked into
Please look at this Monzo - it’s been annoying me for payments to my MBNA card (which uses the card number as the reference number as well). It wouldn’t take much to run a basic check over reference entries and if finds a 16 digit string starting 4 or 5, classify that string as ‘hidden’, star it out apart from last four digits and only allow it be shown on a prompt.
Would it be more useful to have an “obscure reference” toggle when you create the payment perhaps?
Possibly - but would need to be able to set this on direct debits in the future (if/when their reference numbers are exposed on notifications/to third parties - again, MBNA use the same reference number as my card number on DDs and faster payments).
We actually wrote this change (mask PANs we identify in Direct Debit references) a few days ago, it’ll probably get deployed early next week
Always ahead of the game haha
It would help, but really it should be automatic for references for known credit card sort codes and account number like other banks. Monzo already stop payments to these banks without a reference automatically.
Will it apply to Faster Payments/Bank transfers, as I posted above, as you were very specific the fix was for Direct Debits.
We don’t actually Some banks reject the payment if it doesn’t contain a valid reference
Yeah they don’t reject these payments. I completely forgot to add my credit card number (other banks retain this as a continuing reference rather than having to add each time)
Anyway Monzo didn’t reject and TSB didn’t seem to know the their own system (prior to their migration issues) and the payment was returned after a day
Interesting, if I attempt to pay without a reference to my Smile Credit Card account number and sort code, the payment is instantly declined. I don’t need to wait at all for it to be refunded, Monzo lists it as a declined payment.
Going off @HughWells’s comment, if it isn’t Monzo, Co-op (Smile) must just reject any incoming payments out of hand without the reference field filled in.
Yup, we only submit Single Immediate Payments to FPS which means that the recipient bank has to acknowledge the payment with what’s known as a Qualification Code. Different codes mean different things, and payments can either be accepted or rejected with an appropriate status code. Because this is all essentially syncronous (it’s not in actual fact, but there are timeouts etc.) it means we only actual create the feed item and, if appropriate, move the money once we know whether the recipient bank intends to accept or reject the payment. In certain failure modes (most notably that we don’t get a response from the scheme) we will queue payments to be retried a certain number of times before we give up.
Great answer as usual @HughWells thanks a lot
Interesting I never thought of it in the past, but I have more than once looked up a credit card number from my bank statements with other banks (usually to make a payment when I didn’t have the card on me).
Monzo has the ability to be better in this case, given that they’re not going to persuade credit card companies to stop wanting full credit card numbers as payment references.
@nickrw I just noticed that in upcoming direct debits the credit card number is clearly visible. Are there any plans to carry this obfuscation functionality over to upcoming payments?
+1 to this… Any update from Monzo? I guess at least it only appears in the app, rather than notifications.
Hi @nickrw, I paid my Amex via DD for the first time today and it looks like the card number isn’t masked (but my other Visa/Mastercards are masked just fine). Were Amex card numbers included in your change?