Contactless Payments & Social Engineering

I was recently in London for a series of meetings and decided to catch a cab between appointments. Nothing unusual about that you might think and neither did I until I came to pay my fare. It was the first time I had encountered a London taxi that offered a contactless payment method.

Contactless payments aren't new, but they are gathering popularity in major cities and towns in the UK. Contactless card payments are a faster option when paying with your card, as there is nothing to sign and no numbers to enter. They are used for small transactions – currently up to £15 – and are processed quickly, simply by holding your contactless card up to a card reader.

The payment is taken from your bank account in the same way as for a debit card transaction, or in the case of a credit card contactless payment, the amount is added to your credit card bill and repaid at a later date.

I got to the end of my journey and confirmed with the cabby that I could pay by card at which point he directed my attention to the contactless reader mounted neatly in the corner. I held the card up to the reader and having done contactless payments before in various coffee and sandwich shops in London, I knew that I wouldn't be asked for my PIN. After seeing the green light flash and the screen display a "Transaction Successful" message, I kindly asked the driver to provide me with a receipt.

So far this story hasn't had any unusual aspects to it, but thank you for bearing with me this far. It's about to get a whole lot more interesting...

After printing out the receipt for me, the driver pointed out some text on the receipt where it read "PIN Not Verified" and asked me to please pay cash instead. I challenged him saying that the payment was successful but that because this was a contactless payment, I was not required to enter my PIN. After asking me to pay cash instead, I continued to explain that the payment had gone through and that my fare had been paid. It was only after I asked to see the receipt and pointed out the very small fine print which read "transaction successful" that he agreed to let me go on my way.

At the time I did wonder how many other people he had tried a similar stunt on with the sceptic in me screaming "SCAM SCAM!", but I have since decided to give him the benefit of the doubt and look at the experience as an honest mistake. It does go to show however that less knowledgeable people than me may have fallen victim to such "mistakes" and now be out of pocket.

Until next time, stay safe and don't be a victim.