Strong Customer Authentication: Using Chip and PIN more often when making contactless payments

Oh? OK. Obviously dropped that context from my brain overnight. I was hoping for an easier design solution for the whole thing :frowning:

The whole point as far as I know is that if someone stole/copied your card they can’t go on a spending spree. The reason apple pay and such is exempt is because it requires either TouchID or FaceID to work, a “fast way of entering your pin”.

A better implementation would be to base this on how frequently I use my card. If I spend £100 in about 30 minutes then sure, pin lock it, if I spend £100 over the course of 5 weeks and then on the 6th week it asks me for my pin on a £3 meal deal, thats annoying and stupid.

You should be able to have a custom amount, why £100? if I can do £30 a pop then I’ll hit that in no time at all. Why can’t I set it to £500?

The rollout of this is just really bad because all banks are doing it at their own leisurely speed, I went to Fuel up and it got declined because of this and the guy behind counter giving me grief about it, about 5 people stood behind me, the whole point of contactless was to speed things up, now its RNG slowness and embarrassment.

The notification also doesn’t always show up, you also might not have your phone with you, so all you get is “declined”, the machines themselves should be able to show why (but i know this isn’t specific to Monzo, just our terrible card systems)

2 Likes

That sounds good, I spend like £10 if that via contactless a week so a custom limit would be nice.
Would also be nice if you could change the contactless limit in the app. (£30 is too much to loose when your like me)

Legislation say ~£130 max. Can’t really quibble with that. Also all banks should have been compliant by 14th September, if they’re not, they’re in breach of the law.

If this happened to you, and you told us, we are required under the Payment Services Regulation to refund you by the end of the next business day (this applies to pretty much any claim of a fraudulent transaction on your card). This rule of course applies to every UK bank.

6 Likes

I had read somewhere that there’s wiggle room in the timescale like a couple of years?

So we might not see the main legacies implement this until 2022 at which point it will be delayed again for another few years and then biometric cards come in which make the whole thing redundant.

My frustrations are mostly with the legislation, not with Monzo specifically (except the app not updating but that for me has been happening since the new app design!)

£130 is too low in my opinion, they should have had a higher limit and let the vendors choose their own (or allow you as a online specialist make a slider)

My Santander has not asked me for my pin in years, maybe I’m 1 or 2 touches away since I mostly used my Monzo :smiley: but I have definitely done more than 5 or £130 since September.

1 Like

The guidelines are a mess. It’s also written ambiguously and in Euros and left up to the banks to work out their own interpretation of the rules.

My Starling card is £135 limit, they haven’t bothered with keeping a reserve for offline, but they have also implemented the tap limit in addition to the limit which should have been an either or not both.

You’ve then got “banks” like Revolut who decide the SCA is silly and build a way to reset the limit in the app which is obviously not in the spirit but they know full well that nobody’s going to do diddly squat about it.

This is the problem in fintechs too eager to adopt the new rules and go above and beyond before they have had a chance to realise they were a mistake.

The same thing happened with cookie notices on websites and now we have a mess of a web with everyone’s own interpretation and endless ok buttons which aren’t actually following the rules and still no one reads the actual cookie notices before proceeding.

I don’t actually use my card unless I’m using an atm and it still annoys me! We have contactless for about 10 years now, I’m sure they’ll find that it hasn’t done anything to combat fraud and haven’t really acknowledged the inconvenience this new idea has caused. It’s like they were needing something to implement to look busy and some idiot raised this in a meeting without thinking it through.

As I mentioned above I can see biometric cards coming into play before the main banks implement this. It also helps raise the £30 limit using your thumb on the card to £100. I’m surprised NatWest didn’t use their new Bó bank to push this forward.

4 Likes

There is wiggle room for e-commerce transactions. No wiggle room for physical payments.

The goal is to reduce total fraud across EU payment systems (there’s a separate discussion about if this is a good approach). If banks or vendors could pick a limit, they would pick no limit or the highest limit. Additionally vendors aren’t liable for contactless fraud, banks are, so they have no incentive to set any limit.

I’m sure you’re not suggesting we flagrantly disregard the law. But if you are, I would point out that we have to obey stricter regulations than Revolut, including telling our regulators if we think we not following regulation properly. I can guaranty that if we took Revolut’s approach, we would get a strongly worded letter and ignoring that letter would end very badly for us.

It’s the law. I’m sure you want your bank to operate legally. The law had an implementation deadline (14th September), we implemented the most customer friendly version of the law we could. Not sure what more you can expect of us.

13 Likes

Revolut still need to follow the same FCA rules that banks follow. True they can adopt a “what yah going to do about it FCA” and don’t need to worry about losing a banking license if they don’t have one to start with.

Are HSBC, Lloyds Group, RBS, Barclays going to lose sleep about the FCA and not implementing back in September, I think they will do it when they are ready. They don’t work to deadlines and know the FCA won’t try anything on.

It’s going to be interesting what the largest banks do whether they pick £135 and disregard offline like Starling or push for app to reset as that seems like a sensible solutions to a problem that shouldn’t exist.

I don’t understand why you think these banks aren’t compliant. They are.

1 Like

Compliant with SCA?

Yes.

Not with my NatWest Reward I had in October 2019 or Lloyds Club Ive just switched to for my legacy.

What’s their chosen limits?

https://personal.natwest.com/personal/fraud-and-security/sca.html

https://www.lloydsbankcardnet.com/insight-series/regulatory-updates/251/are-you-ready-for-strong-customer-authentication/

1 Like

Oh every bank has put up information pages about it. It’s all written as coming :soon: They haven’t actually implemented anything or yet chosen any specific limits to my knowledge. Just a case of acknowledging the guidelines exist to tick a box.

I think it’s clear that no level of proof or evidence is going to change your mind. So there’s no point in me trying any further.

10 Likes

I’m not trying to dismiss it. What I’m looking for to change my mind is confirmation that those biggest legacies in the UK actually have implemented SCA. As I’ve mentioned it didn’t apply to my NatWest Reward card last month, Ill see if I can put more than £135 through on my Lloyds Club card via contactless to confirm that they haven’t implemented anything either. I can’t find anything to suggest that HSBC or Barclays are imposing a limit before chip and pin required either. Sure they have information pages on their websites but that doesn’t mean anything is in place.

You have not provided any proof. You are just repeating what is MEANT to be happening and shown lip service webpages. Real world doesn’t always equal theory.

1 Like

I could put up a page on my own personal website regurgitating my understanding of the rules, doesn’t mean my bank “philzo” has implemented it.

:man_shrugging:

https://www.which.co.uk/news/2019/09/new-online-security-checks-kick-in-today-what-will-your-bank-require/

Santander will introduce SCA checks for login in the first quarter of 2020, although it will be introducing full entry of a security number soon (phased).

Not everyone has done it yet, and who knows if it will get delayed.

You keep saying “its the law”, doesn’t make it not totally stupid, you also seem to be getting really offended when most of our complaints are against the SCA legislation and not Monzo specifically… Don’t take it personally.

The law on this is stupid and is a bandaid to a wider problem, will websites start asking for card details as well? If anyone got into my Amazon then rip all my money, it’s gone, they don’t ask for anything, can spend thousands in no time, but sure ask me for my pin for a £3 meal deal, that’ll stop the fraudsters.

1 Like