Lloyds and Halifax contactless fraud procedures 'under review' after MSE reveals security flaw

In a statement today, the three banks' parent company Lloyds Banking Group told MoneySavingExpert.com: "Our approach and procedures to tackle contactless post-cancellation fraud are under review as part of our constant work to review and improve our safety measures.

"We remain committed to our multi-layered fraud defence strategy, seeking to minimise the occurrence of fraud and to maximise the protection of our customers, their money, their personal information and their privacy."

Earlier this month we revealed that stolen contactless cards had been used by crooks some eight months after they were cancelled, with issuing bank Halifax failing to spot the fraud.

What banks are doing

Shops don't always immediately check with your bank when a payment is made on your card, so cancelled cards may not receive the instruction by the bank to stop working. Contactless cards are particularly at risk of being used after cancellation because you don't need to enter a PIN each time you use them.

While all contactless cards can be used to make fraudulent transactions because of the way the system's set up, banks' processes vary. Some prevent accounts being raided by this type of fraud, while others leave it to unsuspecting customers to spot dodgy payments, even though they can start happening months down the line.

Lloyds, Halifax, Bank of Scotland, Post Office Money, Co-op Bank and Nationwide told us they generally rely on customers to spot fraud on lost and stolen cards after they're cancelled, and admitted they allow such transactions to debit the victim's account without checking first. See the full table of banks' policies.

While procedures at the Lloyds Group banks are now being reviewed, Co-op Bank and Post Office Money told us there had been no change to their processes, and Nationwide wouldn't confirm any changes to its approach.

The chair of the House of Commons' influential Treasury Select Committee Andrew Tyrie MP has called on banks to do more to protect customers from this type of fraud, saying: "Either banks have been careless, or they need to sort out their IT systems."

Have your say