Android App Lets You Steal Contactless Credit Card Data 221
mask.of.sanity writes "An Android application capable of siphoning credit card data from contactless bank cards has appeared on the Google Play store.
The app was developed by a security penetration tester for research purposes and will steal card numbers and expiry dates, along with transactions and merchant IDs.
It requires a near field device capable phone, or accessory."
Anyone surprised? (Score:5, Interesting)
Re: (Score:2)
Except if they use secure encryption, it's not magic.
Re: (Score:3)
Re:Anyone surprised? (Score:4, Insightful)
Yes. Pleasantly surprised.
It proves that the Android app store is not strongly censored.
Re:Anyone surprised? (Score:4, Interesting)
Re: (Score:3)
I don't know about elsewhere but in the UK credit cards can't be used until they have been activated either online or over the phone. Not sure if you could skim the card and then wait until the card was activated to use the details but I am fairly sure that NFC connections are a one off deal, you can't store the information and use it over and over again.
Re: (Score:2)
Right, so you scan the mailbag, wait a month or two and then abuse the information.
Re: (Score:2)
Re:Anyone surprised? (Score:5, Insightful)
Step 1: Steal contactless CC data.
Step 2: Burn semi-realistic magnetic card with CC data. Emboss the number on the front. 99% of all retail employees will not look twice at the card.
Step 3: Profit.
You don't need the security code for purchases made in person, and if you're doing this in person, you can probably speculate what the zip code is for the few places that even ask for that. Granted, this requires making purchases in person, so you're subject to video surveilance for anyone who REALLY wants to come after you, but since you can repeat this process, it's essentially a use one, throwaway kind of thing.
Re: (Score:3, Informative)
Okay, you couldn't use it for online purchases, but at a brief glance, you can get magnetic card encoders for 150+ USD. Not sure about whatever tech they use for the contactless style ones, but here's what I'm thinking:
Step 1: Steal contactless CC data.
Step 2: Burn semi-realistic magnetic card with CC data. Emboss the number on the front. 99% of all retail employees will not look twice at the card.
Step 3: Profit.
You don't need the security code for purchases made in person, and if you're doing this in person, you can probably speculate what the zip code is for the few places that even ask for that. Granted, this requires making purchases in person, so you're subject to video surveilance for anyone who REALLY wants to come after you, but since you can repeat this process, it's essentially a use one, throwaway kind of thing.
Or,
2a: Burn numbers into some other magnetic card (even a customer loyalty card will work, so I'm told). Use cloned card at self-checkout, gas pump, or other unattended POS system. No need to emboss or even disguise the card.
3: Profit!
I know this works, because my CC info has been stolen twice in the last year and used to make cloned cards (the cloned cards were used at a brick-and-mortar store which is how I know the card was physically cloned). The first time was February, the second time was yesterday. S
Re: (Score:3, Informative)
Do you check all atms, gas pumps, etc that you use for card skimmers? http://krebsonsecurity.com/all-about-skimmers/ [krebsonsecurity.com] , http://www.thelocal.de/national/20110818-37041.html [thelocal.de] and http://boston.cbslocal.com/2011/11/17/atm-skimming-device-found-at-eastern-bank-in-taunton/ [cbslocal.com]
They are getting pretty good at making realistic ones. And in some cases have gotten them inside gas pumps.
Re:Anyone surprised? (Score:5, Informative)
Here in Spain (and rest of Europe?) all physical stores require a PIN when you pay with plastic. Most online stores send a six digit code to my mobile phone which I have to enter on the web site to authorize the transaction.
Even if you find my card in the street it won't help you much. You need my PIN and/or cellphone too.
Re: (Score:2)
Re: (Score:2)
Why can't you have an app / device into which you put your card number (or the card itself), the amount, and the merchant ID and have it output a code to give to the merchant? Date / time can be set by GSM signal, or by serial number and timing like RSA tokens. Hell, secure it with a PIN number as well if you must.
This idea seems so easy to implement, would work online and offline, and would make card fraud next to impossible witho
Re: (Score:2)
obligatory http://xkcd.com/538/ [xkcd.com]
Re: (Score:2)
if you're gonna hit him on the head with a wrench until he tells you his pin. and bring him along with you and hit him until he tells you the six digit code everytime you shop online, then you're probably better off taking his card in the same manner than using a phone to read his card without him knowing :p
Re: (Score:3)
I'm not at all surprised it's been cracked, the obvious application is to set up a merchant account w
Re:Anyone surprised? (Score:4, Insightful)
This is clearly not really the case, although you might think it is.
One obvious fallacy is if I (from the US) come in with my PIN-less credit card and want to make a purchase. No PIN exists, so what are they going to do? Telling me to go away is not a winning strategy. So someone comes in with a re-striped card without a PIN and they are going to be able to pay just like I can.
I suspect the store isn't sending the code but the card issuer. Great for validation but it sucks for the folks trying to use stolen credit card information.
You see, in the US the card holder, the card issuer and the card organization (VISA or MasterCard) don't care about fraud. For everyone but the merchant it is meaningless and the merchant just has insurance to cover their losses due to fraud. So it is important for things to be as easy as possible for people getting stuff with stolen credit card information. Well, I guess you would need to call it "borrowed" because they really haven't stolen anything - just made a copy.
And nobody is ever prosecuted for this sort of stuff, unless you do something wild and crazy with a million credit card numbers.
I do not see this situation changing, ever. Why would it? It doesn't really affect anyone except the cardholder who has to get a new card with a different number. Yes, some people get away with buying stuff that nobody ever pays for, but the merchant is covered by insurance so they lose nothing. Certainly the insurance companies don't want it to change because then nobody would buy the insurance.
Re: (Score:2)
Well, the insurance costs money, and the merchants would surely rather not be paying it. Insurance smooths out the costs, so that every merchant pays a little rather than being able to directly tot up the costs of the fraud. The total paid in insurance premiums = the total cost of fraud (plus a fee).
The merchants haven't demanded an end to it yet, so apparently the cost of fraud must be down in the cost-of-doing-business range for most merchants. There are other sources of loss (shrinkage, breakage, supply
Re: (Score:2)
In the UK when trying to use a non-chip and pin card the normal reaction is pay by cash or credit card, which is insured against fraud if they ring to confirm funds/not stolen first (which they will do), cheques are not accepted by most retailers now (being phased out and only used by a very few mostly fraudulently ...)
With chip and pin the transaction takes 30s, without it can take a lot longer ... but the retailer is not willing to pay, so will do more through checks, since most have chip and pin now mos
Re: (Score:2)
The banks don't care because they set rules to make sure that the resulting higher retail prices affect even cash customers. They WOULD care if the extra costs of doing business by credit card were internalized by passing them only to credit card users since that would dent their bottom line by encouraging cash transactions.
So, in fact, everyone but the banks loses.
Re: (Score:2)
As I understand it, in the UK you can pay up to 15 UKP by only holding the contactless card near the reader. Yes, in some cases they will ask for your PIN but below 15 they don't always.
The £15 value is chosen by the banks, it was 10 when the tech was introduced in this country and I think it is going up again soon.
Re: (Score:2)
Heh, in the US, there are penalties for using a PIN!
For example: If I scan my bank card the terminal asks if I want to use credit or debit. Pressing credit means it won't ask for a PIN, and I am subject to the US laws on credit cards. The credit card processor is liable for fraud, I get special credit protections, and I get a guaranteed dispute resolution process and the ability to issue a chargeback. If I click debit, I must enter a 4-digit PIN (yeah, that's secure!) and none of the aforementioned prote
Re: (Score:3, Informative)
In the US credit card fraud is essentially not prosecuted. Which means you can be in line next to a uniformed police officer and hand the clerk a card that the clerk is told (phone, terminal, cash register system, whatever) to confiscate the card. Nothing happens.
I suppose you could hand the clerk an obviously hand-forged credit card and again, nothing would happen. Video surveilance is meaningless for this because it is a non-prosecuted crime. Which is why there is so much of it.
But the important aspec
Re:Anyone surprised? (Score:5, Informative)
There is so much wrong with that comment that I don't even know where to start...
First of all, most retailers do not have "insurance" that covers fraud. Yes accidental liability insurance for legit (or less than legit) accidents. As far as merchandise goes they simply "write off" any loss of products in whatever form (shoplifting, credit card fraud, bad checks, damaged, etc.) in the retail industry we call this "shrink." In that aspect you are correct. Insurance is a gambling game, the insurance company is betting they'll pay out less than the insured has in claims. Something like shrink, which is all but guaranteed to happen, is not something an insurance company is going to be offering. They may have some policies on individual high-ticket items in some cases, but I don't know of any "umbrella" shrink insurance available.
Where you really go astray is in saying this "write off" is a "victimless" crime. Let's take your example of walking into a store and buying a $1000 TV with a stolen card. Right off the bat, the merchant will pay somewhere in the 1-3% range to take that card, depending on its card processing volume, card brand and type and other factors. Let's just say 2% to make it easy and call it $20. Anywhere from 1-90 days later (more in some cases) the merchant receives a chargeback request from the card processor, saying the cardholder is disputing the charge. Merchant sends all required information, but since the cardholder wasn't actually the one using the card, the dispute is successful. Merchant now has $1000 removed from their account, along with a $25 chargeback fee. They've now spent $45 out of pocket, plus they're out the merchandise which probably cost them closer to $800 (electronics themselves don't have that high of a markup rate, unlike accessories like cables.) All said and done the merchant lost $845 tangible costs, plus intangible costs like the employee time required to stock that item on the shelves, the cashier's time to run that transaction, etc. Where the retailer would have made $200 on the item, they now have to sell 5 of them to make up for the one lost item and have a little profit.
Now do you think the merchant is just going to accept that loss and move on? Of course not, they have sales numbers and profit margins they expect to maintain. If they have no control over whether that item left, which at the time of the sale they had a card approval and no reason to suspect otherwise, what can they control? They can control the price they charge for all of their items. Retailers expect to have a certain percentage of shrink, so that percentage of profit is added back into every item they sell in the form of higher prices. When shrink goes up over time, retail prices go up accordingly. If the retail market won't support higher prices, then costs must be cut by means of reduced personnel and other means, or they close their doors completely.
What this means in the end is that you and I, along with every other honest customer, are the victims. Because of this credit card fraud, we pay higher prices and deal with reduced service levels at the stores. Even if there is a shrink insurance that some retailers may have, the money to pay for the premiums and deductibles would be passed down to us in the same way.
Enforcement for any retail fraud, including shoplifting, seems to take a back burner for police. Unless the retailer has the person detained (which can be a whole new can of worms) police are very unlikely to pursue the case, even if the retailer has positive identification and video of the person leaving the establishment with the merchandise. Even if they do, prosecution is likely to plea it down to a lesser charge so the person gets a slap on the wrist and is free to go do it again, learning from the mistake of getting caught. Credit card fraud is even worse because it involves coordinating with out-of-state organizations such as the card processor, the actual cardholder if it wasn't a local theft of the card itself, etc.
Re: (Score:3)
That insurance is not free. Businesses pay for it and pass the costs on to the consumer. Because of the way merchant agreements are done, the costs are even passed on to cash only customers so that you get dinged for the bank's laxity even if you do not have and do not want a relationship with the bank.
Re: (Score:3)
Also, as far as I know nobody ever in the US has been charged with any crime using a credit card or credit card number in a fraudulent manner.
I might be missing the point here, but doing a quick google search on "us credit card fraud convictions" would suggest otherwise.
Re: (Score:2)
Re: (Score:3)
I received a new credit card about two year ago, my old one expired. 3 months ago, a website denied my card. After a few double checks, I found out the problem. The new card had the same number, but a different code. The code I had entered was th one from the old card, 2 years old. Every single place until then I had tried it at had accepted the old code, for two years.
Oh, and many places, including most pay by phones and about 1/3-1/2 of websites I go to don't ask for it. So not only do you not need
I confirm this in another response (Score:5, Informative)
I can vow that this is true, have had to implement it like this myself. It is often marked as required but never actually checked.
Three reasons, the web master is afraid of putting up any hurdles to a purchase.
During testing, the CVC check is often disabled, so its proper functioning can only be tested on a live account.
And lastly not every card has it and so the idea exists with web shop owners that if they enforce it, they might loose X% of customers.
IF you happily filled in your number correctly for years, that is no proof it was ever checked. Welcome to the online purchasing!
Re: (Score:2)
Most contactless (hah - you usually end up touching the reader with your card) transactions are a free-for-all for stuff under $25. No PIN, no swipe, no signature. Just tap and go (debit AND credit).
Just make a semi-realistic looking card (the cashier doesn't handle it - you just have to flash it and tap the reader) and you're done.
And $25 is small, but it
Re: (Score:2)
Depends on the site. The vast majority of sites do require it.
Test this (Score:5, Interesting)
Because I have had to implement credit card payments where the field was marked as required but never checked or stored anywhere. So, if you didn't fill it in or put in a random value, it worked perfectly fine and this was on sites doing millions in transactions per year.
There is also nothing in the contracts with processors that this is required, it is recommended but not required.
A lot of web companies are terribly afraid to turn away any customer because they might have to think for a second while making a purchase.
Re: (Score:2)
It isn't required but you get dinged for a higher discount rate if you do not have it. So there is an incentive to process cards with this number.
Required? Heck no.
Re: (Score:3)
I've had a few cases where a card went through even though I thought I made have typoed it, but wasn't sure. However, I have had more than a few cases where it was rected because I put in the wrong code.
Re: (Score:2)
Keep in mind Visa and MC are going to start riding your ass for that. They will still authorize, but do it enough and they will start to bitch. (recent mandate)
Re: (Score:2)
Re: (Score:2)
Granted: the front-end software can reject it, but if it's allowed, the merchant will be downgraded (pay a higher fee for the transaction).
Not that a card thief would care...
Re: (Score:2)
it's incredibly relevant, as for the card to be of any use to you, you would have to find a place that will accept number + exp that is willing to sell you something that you have some reason to get.
Re: (Score:3)
Without the Card Security Code (CSC) on the back, all that information would be useless. The CSC is not stored digitally on the card.
Cloning wouldn't work either. My Chip 'n PIN would stop that.
Tard.
Re:Anyone surprised? (Score:5, Informative)
Not entirely true.
Not all merchants in the world have Chip+Pin (which is terribly broken anyhow) and CSC is not taken by all merchants in the world either.
Card numbers and expiry dates are all you need.
Yes, outside Australia, the UK and (I think) the EU the uptake of CSC and Chip and Pin is rather low.
Re:Anyone surprised? (Score:4, Insightful)
Yes, outside Australia, the UK and (I think) the EU the uptake of CSC and Chip and Pin is rather low.
As are nfc capable phones.
Re:Anyone surprised? (Score:5, Insightful)
The criminals don't have to use the stolen details in the country they stole them from.
Re: (Score:2)
I don't even accept credit cards with RFID chips in them. Bank tried to send me some...I called and asked to have them replaced with 'dumb' ones, and they were (fortunately) happy to comply.
I just see this as a huge security/privacy breech waiting to happen.
I certainly don't want to use my phone as my wallet. I prefer to make most purchases in meat space with g
Re:Anyone surprised? (Score:4, Informative)
RFID cards are pretty insecure, since there's no requirement that the user do anything before you can steal the data. I don't even know why they bothered with them. Once you have multiple cards with identical NFC systems in a physical wallet, you can't even use the excuse that it lets you tap your wallet without taking out the card. Most people have more than one credit card.
NFC in phones is neat. You don't have to use it for wallet-like stuff, you can use it for things that previously people would use IrDA (infrared) for: moving contacts, etc. It's only on when your screen is on, their antennas are pretty awful so they really only work rather close, and every thing I've seen that reads from the phone has an action the user of the phone has to take (i.e. google wallet: you have to enter a pin, android beam you have to 'tap to beam' from the source phone, etc.) NFC in phones isn't scary, but yes it can be disabled easily if you'd rather not have the rather minimal battery drain.
Electronic wallets will be nice, because it will hopefully let you get rid of all of those 'loyalty' cards: http://tomfishburne.com/2012/01/loyalty.html [tomfishburne.com]
Using credit cards, *if you have the money to do so and pay it off every month* is a no-brainer. Get a rewards card and an interest-bearing checking account, and you get some more interest collected in the checking account until the credit card bill is paid, and the rewards from the credit card, even at 2%, are rather nice. Plus usually credit cards have other perks (if someone steals my wallet, I'm not responsible for the charges. I am out all of the cash they just stole though), often there's complimentary travel insurance, etc.
Now, credit cards charge fees to the merchants, so using them at stores you really like, or smaller chains might not be a 'nice' thing to do. But at large chains which have likely 1: negotiated lower fees and 2: have such a high percentage of people paying with cards that they already have adjusted their pricing of goods to accommodate for the likelihood of someone paying with a card, I don't feel guilty at all.
So in conclusion:
RFID (NFC) physical credit cards (without any second factor): dumb
Credit cards vs. cash: credit cards all the way.
Actually carrying a balance on credit cards: exceedingly dumb
Different mentality for cash vs. credit card: well, just know that it exists and intentionally go against that behavior, if you like. I'm very lucky to have a job and to not live paycheck to paycheck, so I can afford to have the 'credit card mentality' of comparing benefits before comparing price.
Re: (Score:2)
Re: (Score:3)
Re:Anyone surprised? (Score:4, Informative)
I don't know where you are posting from but certainly in the UK most retailers will refuse a card if the chip doesn't work. If they choose to accept a signature then according to the terms of their contract with Visa/Mastercard they take full liability for the transaction. Meaning that if it is deemed to be fraudulent the money comes out of the retailers pocket rather than from the credit card company. The vast majority of retailers don't want to assume that risk, so they don't accept signature authorised payments.
Re: (Score:2)
Re: (Score:2)
Australian retailers are more than happy to fall back to signature.
It happens all the time. Usually because chip and pin isn't working on their terminal.
They are very very quick to blame the machine which helps even more with 'fry the chip' fraud.
Re: (Score:2)
And there needs to be more uproar about this. Chip and pin is ridiculously easy to defeat. They used to steal data from the mag strips and get your pin before the banks made ATMs that were resistant to the type of tampering required to get an additional mag stripe reader into them.
Now all they need is an RFID reader and a camera set an an ATM anywhere and they can pick up every fucking card in your wallet from 6-10 feet away plus have your pin with a camera that could be set up with a good zoom up to 100ft
Re: (Score:3)
Chip and pin has nothing to do with near field devices or RFID. The chip and pin system uses an exposed chip on the surface of the card. This chip is read by a chip and pin reader when the card is inserted. The user must then input their pin. You can't read them at a distance, the exposed chip needs to be in contact with the reader circuitry. This article isn't about chip and pin it is about near field devices used for contact-l
Re: (Score:3)
And there needs to be more uproar about this. Chip and pin is ridiculously easy to defeat. They used to steal data from the mag strips and get your pin before the banks made ATMs that were resistant to the type of tampering required to get an additional mag stripe reader into them.
Now all they need is an RFID reader and a camera set an an ATM anywhere and they can pick up every fucking card in your wallet from 6-10 feet away plus have your pin with a camera that could be set up with a good zoom up to 100ft away. You can literally throw an RFID reader into the plastic trash can with a wireless transmitter on it and get every single card that passes the atm that day, then have the evidence (the RFID reader) destroyed for you because the banks incinerate their garbage.
Pretty much everything in your post is wrong.
PIN plus RFID interception = SFA. With an EMV-compliant transaction the message is encrypted and the key can't be pulled off the card. EMV encryption has not been broken, and that's not for lack of effort. You could take the entire EMV message and post it on the Internet with your PIN, and nobody would be able to do anything with it.
Plus, very few fraudsters use pinhole cameras any more - it's generally done with tampered PIN pads.
Older contactless cards emulate
Re: (Score:2)
What is "Chip'n Pin"? New term for me....is this something in EU?
Re:Anyone surprised? (Score:4, Funny)
Re: (Score:3)
So I can buy an NFC reader for $60ish and connect it to my computer and read the cards that way instead?
The problem is with the protocol, not the hardware.
Re: (Score:2)
I suppose the fact that this article is not related to anything you mentioned matters at all to you. It does show everyone who reads your comment that you are an idiot, though.
Re: (Score:2)
Check this [wikipedia.org]
Re: (Score:2)
Remember the security researcher who read passport RFIDs in people's pockets 30 feet away, from inside his car, in San Francisco? All it takes is a well-designed and large enough antenna. It could also be 30 feet away, and even behind a wall.
Nobody paid any attention to me. Well... guess what? Not only are they being intercepted -- and it doesn't even take specia
Re: (Score:2)
So you are arguing for security through obscurity; that the only way these cards will ever be secure is if Apple/Google/Microsoft all strictly monitor what gets posted to their devices?
Sounds like a losing proposition. Just because you stick your fingers in your ears and say, "Only the elite hackers will be able to do this" will not make your data more secure.
It was only a matter of time (Score:4, Interesting)
I mean really, how idiotic do these companies need to be to make a system where the full Credit Card information is TRANSMITTED over the air with no authentication. Even a token would be more acceptable.
The Credit Card system is quite happy to take a loss on all the money they have to pay back with protection guarantees when consumers get scammed, instead of actually tackling the problem by inventing a SECURE SYSTEM that is impervious to skimming methods.
This app does not add any additional functionality that scammers don't already have, but a good highlight of how damn simple it is to do, while Mastercard/Visa and the financial institutions who use them do nothing.
Re: (Score:3)
There is authentication, it's just not done by a computer. Do you hand your credit cards out to people at random? Pass them around in a club for everyone to play with, regardless of whether you know them or not? Of course not...and why not? Because the simple act of doing so authorizes them to access the information on the card. Looking at it will give them your name on the card, the number, expiry date and CVV number on the back. With a $40 device, they can get the read direct off the magnetic strip [givemebackmycredit.com]
Re:It was only a matter of time (Score:4, Insightful)
It's the ease with which it's done, and the fact that physical security is no longer enough. If the card isn't NFC capable, you have to physically hand the card to someone. With an NFC reader, bumping up against them in a crowded club/street may be enough. I can protect against handing my card to people who don't have a legit reason for it, and I can prevent it leaving my sight when not at home. I'm not capable of preventing anyone who wants to from brushing against me. So yes, this is a big deal.
Re:It was only a matter of time (Score:5, Insightful)
You contradict yourself.
It's skimming while the card is still in your pocket. It's exactly the same as handing your card to random people for them to play with.
Re: (Score:3)
Re: (Score:2)
This may be true where ever you are posting from but in the UK as long as a payment is made using the Chip and Pin system then the credit card company takes liability. If a payment is made online then again as long as the 3D Secure system is used then the credit card company take liability.
The only time a retailer is liable is if they essentially waive that protection by accepting a signature authorised payment in person, or allo
Re: (Score:2)
I give occasional help to a retailer (in Europe, if it matters). The hoops the credit-card companies make them jump through are pretty amazing. Example: they have a simple web-shop with a web-form that allows the customer to enter credit-card info. This info stays online in the MySQL database for a short period of time, until their little ERP system sees it, downloads it and deletes it. In more than 10 years using this system, they have never had a problem.
Nonetheless, the credit-card companies want them to
Re: (Score:3)
It is called PCI-DSS Compliance and it has been standard practice for years. If you don't store any credit c
Re: (Score:2)
It's not that bad, some type of cards are more protected:
http://en.wikipedia.org/wiki/Contactless_smart_card#Contactless_bank_cards [wikipedia.org]
Re: (Score:2)
You don't need a secure system at all. Credit card numbers should be near worthless. They should require something held and something known.
Even that can be skipped if all purchases must be authorized by the purchaser via a website or text message. You give your CC number, you get txt or website login, that then gives you a chance to approve or deny.
Re: (Score:2)
The credit card issuer (bank?) doesn't take a loss - they charge it back to the merchant. The card holder doesn't take a loss - the fraudulent charges are removed from the bill. The merchant doesn't take a loss - they have insurance for this.
So nobody loses at all. So why make it secure? It is like having a combination lock on the bathroom door so nobody else can pee in your toilet.
Re: (Score:2)
So nobody loses at all.
au contraire ...
The insurance company charges the merchant a premium to cover this. The merchant is not a charity and often works on small margins so, guess what, the premium is passed off in higher prices to the customer - so because of the fraudsters everybody loses a little (it's just spread out thinly).
Re: (Score:3)
It is a token of sorts, the CVV code is one-time use
Is that why they print it permanently on the card?
Re: (Score:2)
There are different types of CVV/CCVs [wikipedia.org]. RFID cards transmit a one time only CVV, so intercepted data is only valid for one transaction and the transaction will only be approved if used before the card is used again because the CVVs have to be used in order.
Wow, there is an app for that (Score:2)
I wonder what the range is, which I realize it is a function of the phone, but a ball park. Are we talking 10 cm, 50 cm, 1 m?
Re: (Score:2)
It could be so much better. (Score:2)
Hate broadcasting CC (Score:4, Interesting)
Or perhaps can anyone name a national bank who has allowed them to get a debit card that doesn't do this?
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Or perhaps can anyone name a national bank who has allowed them to get a debit card that doesn't do this?
You must be in Europe. In the US, most cards still don't have this functionality. Right now, this vulnerability seems to be limited to MasterCard nfc cards, not Visa nfc cards (and yes, the Mastercard nfc specs are supposed to be different from the Visa nfc ones, not that I've even seen the Visa ones, so I can't confirm that for a fact).
Your other option could be to use an NFC-phone to pay for things. Contrary to the popular opinion on slashdot, I believe that most nfc phones are actually much more secure t
Re: (Score:2)
That's Unpossible (Score:2, Insightful)
The NFC card proponents and credit card companies said that this could not happen.
They said that the data was encrypted and virtually impervious to interception.
They said we could trust them.
They said that the people saying otherwise were clueless Chicken Littles.
Obviously this app is the product of highly sophisticated terrorists, or possibly an enemy state. /s
So... (Score:2)
Does anyone know of a good credit card... "sleeve" that shields EM radiation? Ideally something you can put the card into that can fit in your usual wallet and which is still fairly easy to remove for when you do need to use it.
Re: (Score:2)
This is (partly) BS! (Score:2, Informative)
I have an NFC-enabled Android smartphone and tried out this app (and several others with similar claims).
They simply do not work as advertised. Most cards I tried use encryption and the app wasn't able to break it (as a matter of fact it didn't even try...).
All that these apps can do consistently is detect if there is some kind of RFID chip nearby (as in "less than 10 cm away from the phone").
Some can read part of the information stored. But none of them could read the hidden data on any of the cards I trie
Hmmmm (Score:2)
Re: (Score:2)
Re: (Score:2)
That's right, you didn't.
Re: (Score:2)
Nope. Contact-less is a US thing. Europe uses chip and PIN.
Re: (Score:2)
We have it here in Australia, not happy about it, the new cards have it included for our convenience! lol
Re: (Score:2)
Hi I'm in the UK we have contactless cards here.
Last time I checked the UK was a founder of the EU and in Europe ;-)
Re: (Score:2)
Last time I checked the UK was a founder of the EU and in Europe ;-)
I see the smiley but am intrigued by your claim the UK was a founder of the EU...
http://en.wikipedia.org/wiki/History_of_the_European_Union [wikipedia.org]
As a matter of fact the UK has so many exemptions to the otherwise general rules of the EU that it's even a bit of a stretch to call them a full member right now.
Re: (Score:2)
Exactly! :)
Re: (Score:2)
Barclays made a big thing about introducing this in the UK with the advert with a guy sliding down a near endless water slide buying things as he went.
I was livid as soon as I saw it, I had less than zero faith in it's security, I did NOT want it on my cards.
Even back then I realised it meant a stolen card was instantly usable even if only for the small daily limit before it was reported, I still did not want it. But over the air cloning was what I was expecting.
Re: (Score:2)
Where does all of this FUD come from here on /.? I just received a new card from my bank a month ago, and it has the contactless PayPass chip. This is from one of the big conglomerate banks.
Cripes, /. used to be a place to go for articles with somewhat intelligent comments. Now it is more and more like The Onion every day.
Re: (Score:2)
Most of these contact less cards, etc. are found in Europe, where the majority of credit cards are stolen.
Good ol' US still uses the crappy magnetic strips. Sure they are just as easy to clone, but only through contact with a skimmer.
Are you sure they're not exclusively used in america?
Re: (Score:2)
Re: (Score:2)