Contactless card fraud cases continue to surface following MSE investigation

Since MoneySavingExpert.com first exposed the issue in September, we've been contacted by a number of fraud victims who were stunned to find their lost or stolen cards were still vulnerable months after cancellation.

The cases we've seen demonstrate the scale of this little-known type of fraud. There are 92 million contactless cards in the UK, many of which could be vulnerable if lost or stolen – and MSE has repeatedly warned that thousands whose contactless cards have been lost or stolen should check statements for fraudulent transactions that may not have been flagged.

We have also raised the issue with the Financial Conduct Authority (FCA), though it has declined to comment on whether it's looking into the issue or plans to take any action.

'Everyone was really shocked this could happen'

Communications manager Maeve Atkins contacted MSE to tell us about her ordeal after her handbag containing three contactless cards was stolen from a north London pub on Halloween this year.

The theft was reported to police and the cards were all cancelled about an hour after the theft. However Maeve noticed the next day that all three cards - a credit and debit card from Lloyds Bank and an MBNA credit card - were still being used to make contactless purchases.

The fraudster who had Maeve's cards was using them to make purchases at London branches of high-street chains including Tesco, Sainsbury's, McDonalds and Costa Coffee, and to travel on the London Underground. The dodgy payments - totalling £206 - only stopped around a week after the original theft.

Maeve made repeated calls to both card issuers to report suspicious transactions as she spotted them, and they refunded the money she'd lost.

She said when she first started reporting the fraud she found "everyone was really shocked that this could happen", and she described an "awful two weeks" as she tracked the thief's actions on her statement and made an estimated 10-15 calls in total to Lloyds and MBNA.

Lloyds admits that when she first phoned up to cancel her debit and credit card, it failed to warn her there could be "ongoing activity" even after the card was cancelled. This warning was only made during a later call, after she'd spotted and reported the fraud herself.

Contactless cards are particularly at risk of post-cancellation fraud because they don't always require a PIN

In addition to refunding Maeve, Lloyds made a distress and inconvenience payment of £50 and refunded the £75 cost of her calls to the fraud team. In a statement the bank said: “We were sorry to hear of what happened to Ms Atkins and we have taken measures since to ensure that the financial impacts to her are minimised wherever possible.

"Whilst we acknowledge that we could have provided Ms Atkins with more clarity from the outset with regards the activity that she may see posted to her accounts after her cards were cancelled, immediate action was taken to refund all fraudulent transactions as they were posted and we have compensated Ms Atkins for any inconvenience or distress caused."

It added that its procedures to tackle contactless post-cancellation fraud "remain under review as part of our constant work to improve safety measures" - a fact we have previously reported.

An MBNA spokesperson said: "We always fight fraudsters and ensure no customers is left out of pocket if fraud occurs. Ms Atkins first alerted us soon after her handbag had been stolen. Over a four-day period, a total of £44.27 was taken by the fraudster before the MBNA card was stopped altogether.

"The ability of a fraudster to transact on a card is strictly limited due to tight controls in place across the industry. We ensured that £44.27 was returned to the customer’s account within a few days, so that she was never out of pocket. We also made her a goodwill payment to cover the cost of her calls."

'It's worrying this can happen'

Maeve's story is just one of several we've received since first exposing this issue and calling for victims to share their experiences.

Gemma Jackson tweeted us about a fraudster's five-month spending spree with her card:

In a separate email Gemma elaborated: "The transactions began on 19 May 2015 and the last one was 29 September 2015. There were 11 transactions in total. - in total it was just under £50-worth.

"Every time I noticed one I telephoned the bank, had to go through a load of fraud questions and the money was always refunded. The whole thing left us feeling frustrated, annoyed and confused as no-one at the bank was able to explain how they had continued to use the card once it was cancelled."

Another MoneySaver emailed us: "My wallet was pick-pocketed from me on August bank holiday weekend. I realised quite quickly so cancelled my cards within a hour of them being stolen

"In September I got a call from the fraud department of my bank saying there had been some transactions after I had reported it. I didn't recognise any of them so my bank put into a 'fraud account' and they weren't applied to my account."

"I wasn't aware that contactless could still work if your card had been cancelled and it's quite worrying as I use it for lots of small purchases and tube travel and trust that what has always been on my bank statement is correct."

And it's not just stolen cards which can be used in this way. We heard from one London-based MoneySaver who accidentally left his contactless debit card behind in a branch of Co-op.

When he went back to the store it was gone, so he called and cancelled it immediately. Despite this, the card was used for small contactless payments at local retailers for several weeks.

How is this possible?

For a full explanation of how lost or stolen cards can be used by fraudsters after cancellation, read our full investigation.

But in brief, the issue arises because shops don't always immediately check with your bank when a payment is made on your card, so cancelled cards may not receive the instruction by the bank to stop working. Contactless cards are particularly at risk of being used after cancellation because you don't need to enter a PIN each time you use them.

The cards do stop working eventually, due to a number of industry-wide security measures built into the technology. However it's possible for cards to work months or even years after they're cancelled.

Our original investigation also uncovered significant variation in how banks, building societies and credit card companies deal with post-cancellation fraud. While some take proactive steps to warn customers or block payments from debiting their accounts, others make it the customer's responsibility to spot the fraud.