It worked! Mostly... Here's where it didn't work, and what I learned from it.

Foreign Cash

Went to Hong Kong and withdrew £100 in local currency. Was completely unnecessary. Everywhere took card / contactless. We didn't stray away from the tourist trail, which may have helped. Carrying cash had a mixed effect on my anxiety. I was slightly nervous about getting mugged, but that was offset by knowing we could jump into a cab if we encountered any local difficulties.

Similarly, we went to Australia and took out the same amount of cash. We were driving in some fairly rural locations - although not the outback! - and wanted a small safety net. Again, completely unnecessary. Everything from parking meters to tiny ice-cream stands took contactless.

Spoke at a conference in Denmark. Was only a quick visit, so didn't take cash. Tried to buy a chocolate bar and drink in the train station, but was told my card wouldn't be accepted. I wasn't sure if it was the small sum, a foreign card, or something else. Bit weird, but the rest of the trip was fine.

Countless trips to the EU. I already had some € coins and notes. The first few times I took them - but they were never needed. Even in small bakeries my card or phone were accepted.

Emergency Cash

This was a horrific situation. I was due in hospital to undergo a surgical procedure and the minicab driver was screaming at me to pay him in cash. We'd booked the night before and paid in the cab firm's app. What we hadn't realised is that they'd outsourced the job to a different firm, who'd outsourced it to yet another firm. Somewhere along the way, the driver wasn't told it was a pre-paid fare.

We couldn't get hold of any of the firms so, reluctantly, we had to take cash out of an ATM using our credit card. We didn't have a debit card with us - because we never use it.

The cab firm eventually gave us a refund, and the credit card company agreed not to charge us their usual extortionate interest rates for cash withdrawal.

Lesson learned - always take a taxi which is required to accept card, or confirm with the driver before travelling.

Lunch

Most of the lunch stalls near my work take card. The ones that refuse don't get my custom.

Except for this amazing salad bar round the corner. I took out a couple of fivers to pay for a massive box of salad. I did ask the owner a few times if he'd consider taking card. He said the only way he could keep the price low was with minimal overheads. Considering how long the queue was to pay - which often prevented people entering the venue - I think it'd pay back quickly. But it's not my position to tell him how to run his business.

Cheques

LOL! I haven't paid with a cheque in years. Annoyingly, a few companies decided to send me refunds via cheque. My bank account doesn't have any local branches. So I either had to post them off, or use my backup bank. I think I'll start having to charge a cheque-processing-fee for old-fashioned companies.

I suspect that companies send out refunds by cheque because they know it's a pain. I bet lots of them go uncashed.

Odds and Sods

Our local off-licence tried to charge us an illegal card-fee. So I walked out and left the bottles on the counter. Then reported them to Trading Standards.

Similarly, a few places have insisted on a minimum transaction amount - this is against the terms of most providers. I've either picked up some sticks of gum, or bought elsewhere.

I received a few paper vouchers for a department store. They all had redemption codes, so I could use them online.

All of the plumbers and electricians I dealt with either accepted card or gave me their BACS details. A couple of clicks later and they were paid.

For group events at work, no-one wanted to deal with cash. We either transferred the money directly to whoever was organising things, or each paid separately.

Things I wasn't able to do

The UK doesn't have much of a tipping culture. I used to round up the bill, or add a fiver, if I was paying cash. These days, most places have a button on the credit card terminal with a suggested gratuity amount, or a free-form entry. I resent being forced to tip, so this seems like a sensible solution. Perhaps my tips don't go directly to the staff? That's not really my problem. Does that make me an arse?

No cash-in-hand discounts. Again, there's not much of a haggling culture in the UK. Occasionally I've been able to say "What's the best price you can do" but no money off for undeclared income.

Donating to charity. I don't give to people in the street, and I don't put coins in buckets. The majority of my charitable spend goes via Payroll Giving for tax purposes. But, most charities take contactless now:

Terence Eden is on Mastodon

@edent

Nifty! Charity using NFC payments to solicit for donations. pic.x.com/4hag3gzvet

---

Privacy

Oh no! Someone can track my spending!!! I literally don't care. Middle-aged bloke spends too much on beer and electronic gadgets. Shock. I catch the same train to work each day. Scandal!

Perhaps I'm being naïve. I'm not involved in anything revolutionary or seditious. I'm not buying illicit pharmaceuticals or private entertainment services. Maybe I'm complicit in bringing forth a dystopia - but I place a high value on convenience.

Please argue in the comments about why I'm wrong.

Lessons

In the UK, if you live in a city and have a credit card, it is absolutely possible to live without cash. I'm lucky that the public transport options where I've lived are modern and accept contactless.

With the exception of an angry taxi-driver, no one has been upset that I didn't want to use cash.

The vast majority of my transactions were via Google Pay. I waved my phone near the terminal, and the rail barriers open as if by magic.

Foreign travel was painless - but we weren't exactly going off the beaten track.

Tracking my own spending using Money Dashboard became much easier. We can look at our household budget and quickly see where we're wasting money.

So, could you go cashless for 2020? If not, what's stopping you?

Google Pay now supports American Express cards in the UK. Hurrah! But if you try to ring Amex from within the app - a problem occurs. Can you spot what it is?

The country code should be +44. For some reason, it's missing the +.

It passes to the dialler correctly, but the call then fails because the number isn't recognised.

GSM requires an international call prefix when using country codes. If Amex wants customers to be able to call, it needs to change how it presents numbers to Google Pay.

Other providers get around this by using country specific dialling. The Halifax credit card uses an 0345 number which works perfectly.

Unless you're abroad. In which case, it will fail.

I know Google doesn't like testing things before they're released - but insisting that providers use properly formatted international dialling numbers seems like a sensible precaution.

I asked who was calling, and she said, "I am calling from American Express with important information about your card. Please can I take you through security?"

You know where this is going, don't you? I asked her to prove that she was from American Express.

"I assure you that I am. This is not a sales and marketing call."

Cue a fruitless half hour argument with her and her supervisor. I wouldn't give her my security details unless they could prove that they were actually calling from Amex.

I've written before about Credit Card scams. They're a prevalent and insidious form of theft. And companies like American Express are doing nothing to prevent them.

The information they demanded of me was all reasonably public - it doesn't take a genius to work out my month of birth and phone number. Of course, they cited data protection so there was nothing that they could say to confirm they were genuinely from Amex. Which, of course, didn't stop them from revealing to someone (who may or may not be me) that I have an Amex account.

As you can imagine, this lead to an impasse.

What's needed, as I patiently tried to explain to them, is a non-invasive way for them to verify their identity to me. For example, I could give them a verification passphrase. When they ring, they should answer the question "What's my passphrase" with "Ding Dong The Witch Is Dead" or some other phrase I've chosen. Or, they could ask me "What's your favourite cheese?" and only continue if I answer "Venezuelan Beaver Cheese."

Neither of those phrases reveal personally sensitive information, but they do indicate that the caller has access to Amex's systems - which is a reasonably proxy for them working for Amex.

Outbound caller-ID can be faked, the information that they ask from me is relatively trivial to discover, and credit card companies regularly warn people not to give away sensitive information. American Express don't seem to care about any of this, though. They know that there are simple steps they could take in order to reassure their customers that security is important to them.

So, why don't they?

A scammer rings the mark and asks for her credit card details. If the mark refuses, the scammer tells her to hang up the phone, then dial 999 and ask for "Sergeant Scammer of the Fraud Squad".

The mark does so, and is connected to what they assume is the emergency services. However, because the scammer hasn't hung up at their end, the call is still active. So the mark isn't speaking to 999, but to the scammer.

Pretty devious. Luckily, it can't work on mobile. But it got me thinking - how could you get someone to give you credit card details over the phone? I'm inspired by both Bruce Schneier's "Movie Plot Threat" competitions and Kevin Mitnick's work on Social Engineering.

Trying to think like "the enemy" is a crucial part of understanding how nefarious people can exploit a situation. I think it should be considered the seventh "thinking hat".

The Goal

I want the victim to willingly give me her credit card details. I do not want her to be suspicious or report my activity to the police.

The Strategy

• The victim receives a text on her phone.

• "Your Barclay's credit card (starting 4304) was recently used to buy £2,103.54 worth of goods in China. If you wish to dispute this transaction, please call 0113 496 0123."

• The victim checks her BarclayCard - it does start 4304. Damn! She rings the number.
• "Welcome to the BarclayCard fraud line," says the voice at the other end.
• "To protect your security, please type in your sixteen digit card number," says the automated voice. So that's what the victim does.
• ... after typing in several more details, the victim finally gets through to the scammer.
• At this point, the scammer can attempt to get more information - such as home address - or simply assure the victim that the fraud has been reported.
• "Unfortunately," the fraudster says, "the £2,103.54 will show up on your July statement. But you will see the refund on the August statement."

How It Works

There are a number of factors which go into making this a potentially successful scam.

1. People are quite used to receiving texts from their card issuer.
2. It's quite common to be asked to confirm a suspicious transaction.
3. Credit cards number have a predictable start sequence. That's why credit card receipts often show you only the last few digits. This tricks the victim into thinking that the scammer knowa two crucial pieces of information; the credit card issuer and the credit card number.
4. We're trained not to give details to strangers who ring us up. By contrast, we're expected to give details to people when we ring them!
5. You can't argue or otherwise interrogate an IVR. You either have to give that disembodied voice your details or hang up.
6. Again, we're quite used to typing in our credit card details and then pressing the hash key!
7. If we do get through to a real person, the standard Social Engineering tricks all apply. Only, in this case, not only is the victim worried about the potential fraud, she has also primed herself into thinking she's speaking with her credit card provider.
8. At this point, the scammer knows that they can use the card for a fraudulent purchase and the victim won't report it! It will only be after two statements have been received that the victim will notice that she hasn't been refunded.

Problems

Now, this fraud isn't without issue. The most notable being that you do not know who has a credit card issued by a specific provider. The scammer would either need some third party intelligence that their victims all use HSBC, or they could just go on a phishing expedition. Spam a few thousand numbers and there will bound to be a few which have the card which is being targeted.

How To Do It

Using services like Twilio and Tropo, it's quite easy to create a telephone menu. It can play back a recorded voice, save all the user's keypresses, then pass the call on to the scammer.

They can even handle the automated sending of the text messages, playing back different messages depending on the caller - "Welcome to HSBC", "Welcome to American Express", etc.

Defending Against This Scam

There are three main strategies for defending against this scam - and they all boil down to trust

Don't Trust An Unknown Phone Number

Save your credit card provider's phone number in your address book. That is the only number you should ring. If someone rings you - tell them that you will take their name and call them back on the official number. If you receive a text - call the official number to check it is legitimate.

Don't Trust Partial Information

The first few numbers of your credit card are fairly generic. Trusting someone who guesses your Visa Electron starts with "4197" is like trusting a psychic who says "You were a bit of a handful growing up, especially in your teens." It's such general information as to be worthless.

Don't Trust The Other Person

I sometimes act deviously. When asked to give my address, I'll give an incorrect house number or post code. If the person at the other end doesn't pick up on the mistake, I assume I'm talking to a scammer. Similarly, you don't have to trust interactive menus. You can input incorrect information, and see if it is accepted without complaint - a sure sign of a scam. Or see if it gets you through to a human.

Is This Scam Possible?

One hurdle is targeting enough people who have the "correct" credit card. The scam would work without the credit card info, but may be less effective.

The cost of sending out the texts is also a constraint. Although text bundles are relatively cheap now.

Shutting down the numbers - or tracing them - is perhaps the biggest issue. Buying a disposable pre-pay SIM is virtually anonymous. A landline number is probably fairly easy to trace - assuming the police have the time and staffing levels to investigate such a scam.

And that may be the deciding issue. If someone reports a suspicious text to the police or their credit card provider, how quickly can the number be shut down? If the scammer is sending out hundreds of fraudulent SMS an hour, it would only take a few responses to make the scheme worthwhile.

Disclaimer

Naturally, you should not attempt this. The penalties for credit card fraud a very serious. This is intended as a thought experiment.

If you want people to willingly give up their credit card information - take a look at the morons on Twitter posting photos of their cards!