Evan Schuman's StorefrontBacktalk

Some Marks & Spencer customers have reported that the U.K. chain’s contactless payment terminals have taken money from contactless cards even when those cards were still in purses or wallets a foot or more away—and in at least one case, the grabby POS behavior was repeatable.

The retailer just finished rolling out contactless point-of-sale terminals to 644 U.K. stores and reportedly processes more than 230,000 contactless transactions every week. But multiple customers told the BBC that they had the experience of inserting a chip-and-PIN card in the PINpad’s slot, but being issued a receipt for a contactless card that was nowhere near the PINpad. The contactless system isn’t supposed to work at distances of more than about two inches.

One of the customers was able to repeat the card mischarge in front of a Marks & Spencer store manager.

“I put my [chip-and-PIN] card into the reader and the assistant was asking me if I wanted cash back,” the customer told the BBC radio program Moneybox. “Before I could answer, the transaction came up as complete and the till issued a receipt. I hadn’t put in a PIN at all at that stage. I queried it with the assistant and she seemed rather puzzled, and looked at the receipt and compared it to my card and realized that the numbers didn’t tally—in other words, the amount had been debited from a different card, other than the one I put into the machine.”

The customer realized the number belonged to a card in her purse that she hadn’t even realized was contactless. When she explained the situation to a Marks & Spencer manager, he asked her to try to repeat the transaction so he could see it for himself—and again the contactless card in her purse a foot away was charged. The manager reversed out the two charges, and the third try with the chip-and-PIN card worked.

None of this should be a complete surprise. After decades of complaints about how hard it is to get Wi-Fi, Bluetooth and infrared-based device-to-device technologies working reliably, POS and card manufacturers have finally managed to build a technology that consistently exceeds the nominal specifications, in the form of contactless/near field communication. Anywhere else, this would be a triumph. But with the specialized requirements for payments, it’s a problem.

The fact that the problem is occasional suggests that it only happens with certain cards interacting with certain terminals—they just happen to work too well together. The fact that the problem is repeatable is good news from an engineer’s point of view—that makes it a lot easier for the chain to troubleshoot.

It’s still a high-profile problem, though. In theory, the PINpads are supposed to be shielded on all sides except the top. That turns out not to be the case for at least some of the Marks & Spencer PINpads. (We don’t know who the vendor is, or if all the stores were outfitted by the same PINpad vendor.) Is it a quality-control problem? A case where power levels and sensitivity were set too high on some contactless readers? A glitch in a particular batch of cards? That may require a lot of experimenting to determine.

And that’s not the only problem: Those PINpads are reportedly supposed to shut down the contactless functionality as soon as a chip-and-PIN card is inserted. With a card in the slot, how did the contactless work at all? And should the transactions have gone through without the cashier doing anything?

As long as the problems are rare—and they’re investigated—nothing here should be a showstopper for Marks & Spencer’s contactless rollout. But it’s the kind of glitchy behavior that the chain really should stamp out as quickly as it appears. The last thing contactless—and Visa Europe, which is promoting it heavily in the U.K.—needs right now is an urban legend that every time a customer walks past a POS, a transaction will be rung up.