Monzo Labs: Improved Card Security

I think that’s for online transactions.

2 Likes

If law requires it under so small limit, maybe Second Factor could be not pin on terminal, but for example opening transaction from monzo notyfication and pressing “it is OK” button?. Let’s say every time when you will dissmis transaction notyfication with “ok” button you also reset the “counter” for pin in terminal?
This way you will never hit limit, as long you look at every transaction notification.

This was also covered before, in that Monzo only have ~1 second to reply to any transaction (which isn’t long enough for you to get your phone out).

I didn’t mean confirming every transaction in order to proceed with payment. I meant that you have let’s say 5 transactions untill next “pin transaction” will be requiried. Let’s say you paid for two things - so you have 3 left. But after second transaction you clicked on your monzo app notification about that transactions from before, and by clicking that “it was OK transaction” you reset counter. So the only way to be forced to pay with pin, will be if you will ignore notyfications from monzo about transactions and they will stock unreaded to over 5.

1 Like

This was also covered in the thread.

Just tried at a Sainsbury’s Self Service, lousy experience.

  1. Transaction declined, insert card message on card machine as expected.
  2. Wrong PIN error (granted I brain farted and it was the wrong one)
  3. Wrong PIN error (I got the right one this time)
  4. Try different card - wrong PIN error, again it was correct
  5. Payment failed message on till, select to pay cash then select to pay card
  6. Finally chip and PIN worked.

If I understand the info made available so far correctly;

  • Tapping a card for a contactless transaction increases the ‘tappped’ number by one.
  • Once it hits the number ‘5’, a limit imposed by Monzo is met and the transaction must be competed using chip&pin. This resets the ‘tapped’ number to zero and the cycle continues
  • This limit will be raised by Monzo to the SCA maximum of 100 ‘taps’ at some stage

Apple/Google Pay transactions are seen the same as chip&pin transactions - not contactless - so because they are virtually ‘entering a PIN for you’, the ‘tapped’ number never really increases and the limit is never reached. It only increases when you use your physical card to make a contactless transaction.

This makes total sense to me. If someone found my lost card and went on a contactless spending spree, they’d only manage to rip me off by £150 or less (depending on the ‘tap count’ of the card) before they were presented with the extra barrier of “enter your PIN” - which they wouldn’t know.

1 Like

It’s £100 (however many ‘taps’ it takes) limit. Or 5 taps of £30 or less.

I believe Monzo are planning on the monetary limit of £100 (it’s currently £30 for testing). Monzo could possibly do a combination of the 5 taps or £100 limit in the future, however.

Transport transactions do not count towards the limits. Apple/Google etc device payments are not affected either.

3 Likes

In a feat of remarkable timing, a Monzo email on the subject was received which is slightly vague but explains the overall experience;

2 Likes

As stated many times, No. If the card isn’t involved in the transaction, the count can’t be reset by it.

The number 5 is imposed by law.

No, it’s still 5.

It sounds like they’ll use the £100 limit instead which could prolong the time between PIN entries unless you always tap for >£20.

1 Like

That makes it clearer. I got the number of taps and maximum spend confused.

1 Like

No, as I understand it, @michalrydlikowski is suggesting something different, which seems to meet the criteria (and if possible would be a slick way to reset the SCA counter). He’s suggesting that you can tap on a previous transaction in your feed that was made with your card (e.g. an hour ago you spent £21 at Sainsbury’s via contactless) and confirm it, thereby resetting the counter. This is the same as confirming a failed contactless transaction after the fact - it is tied to your possession of the card, and you are verifying it as a valid transaction.

3 Likes

I believe @thomas is going to speak to the compliance team about a similar proposal.

3 Likes

So glad Google Pay doesn’t count for this. Haven’t taken my card out with me in a year! I’d be forked if the cashier suddenly says “sorry you need to enter your card”! :sweat_smile:

1 Like

Just as a heads up to everyone here: We’ve raised the limit to £100

16 Likes

Just got the e-mail and updated to the latest version. Is there somewhere in the app that tells you what version you are on? I appreciate that if you are up to date you will not be offered an update [probably]. R-

If you are on iOS new nav it’s

Profile>cog>settings and scroll down to the very last option

1 Like

Thank you - I shall do my very best to remember that :laughing: R-

1 Like

I’ve read quite a bit of this but not all. Being somewhat old fashioned and apprehensive of technical issues (eg contactless card often not read well enough, mobile signal too weak or non-existent, and so on), is there anything to stop me just paying using chip and pin every time?

The extra 5 seconds or whatever saved using contactless isn’t really that helpful for me.

I do not wish to have alerts on my phone (if it is working) when trying to pay for things in a queue. That would really irritate me and others, delaying payment (while I faff about finding my phone, using my own phone’s security measures to start the app, and so on) which contactless is designed to prevent. Chip & pin seems a good compromise provided it works every time.

Cash is also quite handy.

I spent nearly 40 years in the payments IT business…