Contactless journey history and refunds restored

Customers using pay as you go with a contactless card or a mobile device can now see their full journey history online, after it was temporarily restricted following a recent highly sophisticated cyber security incident.

The reopening of contactless.tfl.gov.uk follows TfL reopening systems for Zip photocards, 60+ London Oyster photocards, 18+ Student Oyster photocards and other concessions in recent weeks, and means that all TfL fares services impacted by the recent cyber incident are now reinstated. Already, more than 33,000 Zip photocards, around 40,000 18+ Student photocards and more than 13,000 60+ London Oyster photocards have been processed and dispatched since applications reopened.

TfL prioritises the security of its network and customer data, continually monitoring its systems to ensure only those authorised can gain access.  On 1 September, TfL identified suspicious activity and took immediate action to secure its network, ensuring all safety critical systems and processes were maintained.  TfL has worked closely with the National Crime Agency and the National Cyber Security Centre throughout this process and notified the Information Commissioner's Office.

As part of the measures implemented to deal with the incident, TfL took the difficult decision to temporarily restrict access to customers’ contactless journey history while it undertook important security checks. With this reinstated, customers and TfL’s customer services teams can now access both Oyster and contactless journey history, correct incomplete journeys and process service delay refunds if required.

Customers are warned that due to the expected backlog, there will be some delays in contacting TfL’s customer services and/or receiving a final response. Customers are therefore advised to log into their online account to review their account first to see whether they can correct incomplete journeys and request refunds that way.

As previously announced, TfL intends to refund customers who have paid more for their travel than they should have due to TfL not being able to accept new photocard applications. TfL will be refunding all pay as you go journeys made by students who were unable to submit an application for a 16+ or an 18+ Student photocard due to them not being accepted and have now applied for a photocard. These will apply from when their term started to when their photocard was dispatched.

TfL will also refund all journeys for anyone who has applied for a 60+ London Oyster photocard between the date they turned 60, and when their card was dispatched. TfL is in the process of writing to customers who have successfully applied for a new photocard to explain the criteria for refunds and how to apply for these.

Shashi Verma, Chief Technology Officer at TfL, said: "We're pleased that customers can now access their contactless journey history again, meaning that all TfL fares services impacted by the recent cyber incident are now reinstated. We apologise for any inconvenience that this incident has caused our customers.

“We are now able to process contactless and Oyster refunds for those requiring them, though customers should anticipate there may be some delays due to the expected backlog. We have also contacted all new photocard customers who were impacted by not being able to apply for their new photocard. I want to also personally thank our engineers and customer services teams who have worked hard during this incident to support customers and restore services."

As previously announced, TfL and train operating companies across London continue to accept expired 5-10 and 11-15 Zip Oyster photocards, where they are normally valid, in light of the cyber security incident until 31 December 2024. This gives expired Zip photocard holders plenty of time to apply for their new concession photocard. Parents and guardians of those with expired Zip photocards are encouraged to apply as soon as possible for a new photocard for their children or dependent to help ensure that they are ready to use in the New Year. Expired photocards will not be accepted for travel on TfL or train operating company services from 1 January 2025.

To view a TfL online account for Oyster or contactless – please visit tfl.gov.uk/account

For the latest information on TfL's recovery from the cyber security incident can found here - http://www.tfl.gov.uk/campaign/cyber-security-recovery