Monzo Labs: Improved Card Security

This would be nice, regardless of SCA, to know how the transaction was made.

1 Like

Unfortunately not once it goes live for all customers. It’s goong to be the same at other banks too

2 Likes

I think it worked as intended for me today:

The notification brought up these screens;


followed by:

For reference, I was at a self checkout and the till prompted me to insert the card once the contactless failed.

Great work guys :+1:

8 Likes

@milo some feedback for you :slight_smile:
So this happened to me this evening at a Shell garage, went to use contactless, the card machine then said insert card, the notifications came up on my phone about it declining so that worked fine. Then I then put my card in the machine, typed in my PIN, then the machine decided to perform a reversal. No payment came out at this stage, but it performed a reversal. We had to start the transaction from scratch, put the card in the machine and then the payment went through fine, but not quite sure this is the behaviour you would be expecting? I am assuming it would be the card machine’s fault and not Monzo’s?

Also, if you perform chip and pin after the contactless declines, do you have to go in the app, select the notification to unlock contactless, or does performing chip and PIN unlock contactless for the next transaction? That doesn’t seem too clear to me at the minute.

Lastly, when you go through the notification for we declined a contactless payment, you can go through this more than once if you click on it again, should this come up with something like “you have already unlocked contactless”?
EDIT: Looks like the feed item has now gone now for we have declined a contactless payment, but took a while for it to disappear, so not sure if it needs to disappear straight after you enter your PIN and click Close?

3 Likes

Could you possibly authenticate the penultimate payment before locking (4th payment say), just after it had gone through - so it’d be approved anyway, but if you used that one and popped up saying ‘was this you?’ on the phone, which the user could answer whenever, it would stop this authorisation flow from getting in the way when you actually need to pay in a shop, it’d just be an occasional question from the app basically saying ‘do you still have your card and did you create this transaction’ without blocking them from paying and resulting in declines just for using contactless a lot.

The word initiation in your answer makes me think that’s probably not possible though or you’d be trying something similar…

5 Likes

This is exactly the kind of feedback we’re looking for. The card machine shouldn’t have done that. Could you DM your Monzo email so we can take a closer look at what happened?

You can reset your limits either in the app, or by simply performing a Chip & PIN transaction at the terminal.

It’s good to know you found this confusing. We’ll work on making this whole process a bit clearer.

This is a side effect of how we’ve implemented the feed item. We’ll work on making that better.

This is an interesting idea. I’ll have a chat with our compliance people and see what they make of it.

11 Likes

I just had a thought:

If you do a contactless transaction and it declines because of the new measures, a feed item is added explaining it and asks you to reverify with PIN.

If you, at the time of the same purchase, do a Chip & PIN (not app & pin) transaction as contactless didn’t work - is the feed item then removed or changed or will it still present the same thing and ask for a PIN even though it’s unnecessary at that point? If not, this may be worth implementing.

You can vote for that feature here:

@Rika has even confirmed that it’s possible.

4 Likes

If Monzo knows that the next transaction will definitely require chip and pin, could an alert show in the app feed so I can skip trying to use contactless and go straight for chip and pin?

9 Likes

This. If it is every five transactions as opposed to a monetary value, just add a notification and feed item after the fourth transaction that you need to use Chip and PIN next time.

5 Likes

Even if it is based on £100 limit, maybe the app could ask you to authenticate after a transaction takes you over, say, £80, as per @kennygrant’s suggestion.

2 Likes

I had my first decline last night at a Lidl self service checkout.

The payment declined, the self service checkout them required an assistant to authorise the fact that I could try again with chip and pin - at which point the assistant announced rather loudly “your card declined” thanks for that haha!

I agree with some of the other feedback, maybe there needs to be a method of showing when you’ll next need to do chip and pin authentication.

Lidl need to think about their terminals too as of declines are going to become move frequent for everyone, then they’ll end up running around a lot

1 Like

Had my first decline yesterday

I walked away thinking all had gone through then the cashier told me it didn’t go through so bad to start from scratch again

I had no signal so only received the enter pin on device after it went through

Inserted card , entered pin - went through OK

I had a decline yesterday, the terminal asked me to insert card.

I thought the in app message (which I read after) was confusing as it was suggesting I used chip and pin to unblock future contactless payments but at the same time was mentioning I enter my pin in app?
I did both as wasn’t sure based off the wording/flow which one was actually the solution or if both methods independently unblock it.

3 Likes

No problem at all, I have messaged you my email address!

I imagine larger companies like supermarkets probably have their finger on the pulse and will issue guidance eventually, but it does make me wonder whether smaller, independent businesses are going to be aware of the wider SCA changes and the impact it may have to their expected payment flows. It seems that SCA has come about at a point where contactless payments are now ubiquitous.

I only know about SCA because of the eCommerce changes I was expected to make, but we’ve had nothing from our payment processor (yet) with regard to physical payments, even if to just keep us in the loop.

1 Like

Hopefully this new regulation will make more online stores accept Apple Pay, in-store I’m almost 100% Apple Pay anyway.

Just used this in Aldi. The till/card machine didn’t say declined instead the card machine simply asked me to insert the card and enter PIN so none of the awkwardness of being told the card declined. And I got the 2 feed notifications as expected.

The “enter my pin” button on the feed notification doesn’t feel right because I’d already done that in the store before pulling my phone out to check the notifications. The notification says card declined use chip and pin. I think most people would just do that even if glancing at the phone whilst at the till without opening the app. So that button doesn’t fit the flow.

7 Likes

It does give you that extra level of control, though. With legacy banks, you can’t completely freeze your card, because some transactions are offline. With Monzo, a card freeze is much tighter.

2 Likes

I agree that this could become quite frustrating - particularly when you’re at a busy checkout or in a pub - with a bunch of impatient people behind you.

And not being able to enter the PIN into the terminal - or authorise the transaction in the app in real-time will make the experience even more challenging.

In my mind, there’s a simple solution to this (though I’m not sure if it would satisfy the new regulations). Would it be possible to pre-authorise the transaction - essentially resetting the running total to £0, so the transaction is less likely to hit the limit.

Essentially:

  1. Customer opens the app and pre-authorises the transaction - ideally before they’ve even got to the front of the queue. A nice design for this might be that customer opens the app, authenticates, and then confirms they’re in possession of the card by tapping their card onto the NFC sensor on their iPhone or Android phone
  2. Customer taps the card on the terminal to make their payment

Separately, I could also see a Monzo Apple Watch app as a nice way to make the authentication smoother. If the customer could interact with the notification on their watch to confirm it’s them, it would save the hassle of taking their phone out of their pocket, unlocking it and opening the Monzo app. Or they could even enter their PIN into a Monzo watch app.