Zip photocard applications now being accepted for customers aged 5-10, 11-15 and 16-17

More than 40,000 photocards have been dispatched since online systems reopened, following A temporary pause due to the recent cyber security incident. Expired 5-10 and 11-15 Zip Oyster photocards will continue to be accepted on TfL and train operating company services where normally valid until 31 December 2024. Parents and guardians advised to apply for cards as soon as possible. TfL will shortly write to affected photocard customers to advise how to claim for any additional travel costs incurred while the photocard website was unavailable. Applications for new 5-10, 11-15 and 16+ Zip Oyster photocards are now being accepted by Transport for London (TfL), after they were temporarily paused following a recent highly sophisticated cyber security incident.The acceptance of new applications for Zip cards follows TfL reopening systems for 60+ London Oyster photocards, 18+ Student Oyster photocards and other concessions in recent weeks, and means customers can now apply for all photocard concessions again.

TfL prioritises the security of its network and customer data, continually monitoring its systems to ensure only those authorised can gain access.  On 1 September, TfL identified suspicious activity and took immediate action to secure its network, ensuring all safety critical systems and processes were maintained.  TfL has worked closely with the National Crime Agency and the National Cyber Security Centre throughout this process and notified the Information Commissioner's Office.

As part of the measures implemented to deal with the incident, TfL took the difficult decision to temporarily pause new concession photocard applications while it undertook important security checks. With the concession photocard website now fully back online again, TfL is working to process all new photocard applications as quickly as possible. Already, more than 30,000 18+ Student photocards, more than 10,000 60+ London Oyster photocards and nearly 600 Apprentice photocards have been processed and dispatched since applications reopened. 

As previously announced, TfL and train operating companies across London continue to accept expired 5-10 and 11-15 Zip Oyster photocards, where they are normally valid, in light of the cyber security incident until 31 December 2024. This gives expired Zip photocard holders plenty of time to apply for their new concession photocard. Parents and guardians of those with expired Zip photocards are encouraged to apply as soon as possible for a new photocard for their children or dependent to help ensure that they receive one before the end of the year. Expired photocards will not be accepted for travel on TfL or train operating company services from 1 January 2025.

As well as Oyster photocard applications, TfL continues to restore services following the recent cyber security incident where customers were unable to access their contactless journey history, correct incomplete journeys or apply for service delay refunds. TfL can now however process refunds for journeys made using Oyster card, and photocards – including those due where customers received maximum fares for not touching in or out correctly - and paper tickets. TfL hopes that it will be able to start processing refunds and corrections for journeys made using a contactless card or mobile device shortly and will keep customers up to date as this work progresses.

As previously announced, TfL intends to refund customers who have paid more for their travel than they should have, due to TfL not being able to accept new photocard applications. TfL plans to write to photocard customers who were impacted by not being able to apply for a new Photocard with further details about how to apply for refunds and the criteria for processing these.

Shashi Verma, Chief Technology Officer at TfL said: “We’re pleased that we can now accept photocard applications for all concessions managed by TfL and will be working hard to process these as quickly as possible. We apologise for any inconvenience that this has caused our customers.

“Following the recent highly sophisticated cyber security incident, we have been working to restore systems which we had to take offline as part of our mitigations. We are now able to start processing refunds for those requiring refunds for journeys made using Oyster or paper tickets. We hope to shortly contact all new photocard customers who those who were impacted by not being able to apply for their new photocard, as well as continue work to allow us to begin processing refunds for contactless journeys, and for customers to be able to see their full journey history again.”

Photocard applications can be made via photocard.tfl.gov.uk. For the latest information on TfL’s recovery from the cyber security incident can found here – tfl.gov.uk/campaign/cyber-security-incident