UK Consumers Reporting Contactless Payment Errors 193
leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."
Double payments (Score:5, Insightful)
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Re:Double payments (Score:5, Insightful)
You mean like that stupidity of charging twice for the same shopping cart serial number when the final button is pressed twice? You get this shit when you let morons design it.
Re: (Score:2)
You mean the brilliance of being able to ding a customer for twice their shopping cart value? Extra profit from stupid and/or impatient people.
And when they chargeback, you can provide proof and cancel their order and still keep the other payment. And tie it up with confusion because you can easily switch which payment you're talking
Re: (Score:2)
I always thought that, even if there is server-side protection for it already, the final "click this button to pay" button should get disabled when you click it the first time, preferably with a processing icon or the like. That way you provide a visual clue that something is happening if they are on a slow connection.
Nope,
The server is handling 100 transactions a second or more. All through SSH sessions, or worse yet a proprietary protocol. Front end terminals are usually connected to a server in another location over VPN (or worse yet, a WAN link with an open port at the server side) and this server may be across the country. In almost all of the Point Of Sale software I've seen error checking is done locally and there is next to fuck all of that happening anyway as the goal of POS systems is to move as fast as poss
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It's not a good point, if the packets were lost the first time round then they should simply be resent.
Re:Double payments (Score:4, Insightful)
For example, at my company we do most of our business with tech-unsavvy businesses. The people who make the buying decisions are usually impatient and capricious and very averse to entering their data more than once. Also, any problem is attributed to us, even if it's a network outage on their end. If their connection to us goes down they expect to continue the ordering process exactly where they left off or they will reconsider the entire deal. Some will take weeks to make room in their apparently ultra-busy schedules to go through our (phone-assisted) ordering process once. If there is a problem that they can't trivially recover from that means waiting for a few weeks more. "Just have them redo the last few steps" comes with an unspoken "and lose a few sales".
The problem is that you're facing (potential) customers. Just like in every customer-facing situation that means that you end up dealing with a number of people who don't want to bother actually having realistic expectations. Depending on your business, these potential customers may be expendable or they may be critical to your success. If the latter applies then you have to bend over backwards to allow behavior that we consider wrong but they consider logical.
Re:Double payments (Score:4, Interesting)
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Because the software is shit.
Having dealt with a few Point Of Sale systems I can say that the acronym POS is no accident.
A lot of systems are just Windows systems with a program like Pronto Xi running on top. It's not unusual for these terminals to be running Windows XP. The back end is usually pretty good but the software really suffers on the front end and the front end is where we tend to get most of the errors.
Re:Double payments (Score:5, Informative)
Some POS systems are not integrated with the card payment terminal. You click "visa" for instance, and the POS system assumes a valid card payment has been made. The payment is then made in a seperate terminal which issues a receipt for the payment, which should be kept with the purchase receipt.
Re: (Score:2)
I'm not sure about those two stores, but in a lot of stores, especially ones owned by smaller companies, the credit card terminal is not linked to point of sale system. The checkout operator presses the button on the till for card or cash, nobody takes cheques any more, then if it is card, they enter the total amount into the card terminal, process the payment, and usually put the store copy of the card receipt in the till. It may well be that they thought the card terminal wasn't working, and put the pay
It's not a bug, it's a feature! (Score:2)
*Somebody* had to say it.
Re: (Score:3)
It's operator error. The person on the till is confused by the customer trying to insert their card into the read even though it already appears to have made the transaction. They put it through again and the customer gets charged twice.
It sounds too stupid to be true, but that is apparently what is happening.
Re: (Score:2, Informative)
tinfoil wallets (Score:4, Interesting)
Coleman and Brookstone sell RFID-blocking wallets (Score:2)
But the Brookstone one costs 4X as much, true to form...
Re: (Score:2)
I just bought one of these a couple of weeks back:
http://www.thinkgeek.com/product/8cdd/ [thinkgeek.com]
It's surprisingly good quality for $20, too.
I decided to buy it after reading this:
http://www.cbc.ca/news/canada/manitoba/story/2013/04/23/mb-smartphones-skimmer-credit-card-winnipeg.html [www.cbc.ca]
Re:tinfoil wallets (Score:4, Interesting)
My bank rolled out contactless cards... by mailing one to me. No notification to me, preactivated, no PIN needed for purchases under $200.
I went there and bitched them out about it and they really could not understand why I was mad.
Re: (Score:2)
Mental note: if / when I go totally insane, and need some quick cash to jump start my career in super villainy, purchase near-field scanner & Raspberry PI model B unit with battery, as well as directional antenna and signal booster. Then hide it in the bushes across the way from where the postal workers unload the trucks, and stop by daily to pick up the 'leads.'
Actually, disperse several units at foreign postal offices, and employ WAP signals to push data to the internet. Use PGP to encrypt packages, a
Re: (Score:3)
My card issuer decided to push me a personal NFC card, without asking.
They would not disable it (claimed they could not) or issue me a card without it one activated (again, claimed that they could not).
So it sits unused in my desk drawer as I told them it would, and another less high-handed card issuer gets my transactions.
(They did the same with my business VISA, but when I phoned to complain and asked them to disable NFC they said "yes" which means they were probably lying either then, or when they told m
Re: (Score:3)
I actually quite like contactless payment when I have had the chance to use it ...
I quote like it too, when I only had one card - I could just wave my wallet over the machine and it'd work. Now every bank card I own has been upgraded without me having any say in the matter, they interfere with each other when they're all in my wallet and now I have to take the card out to use it. Once I've done that, I might as well also enter the PIN and prove it's me.
I too really hate the fact that these cards were sent to me in the post, pre-activated, without even informing me they were coming and in
Re: (Score:3)
The antenna goes around the outside of the card. Cut a notch with scissors about 5mm into the card (opposite side of the magnetic stripe) and you've disabled the contactless portion.
Re: (Score:2)
Good to know.
I haven't yet been burdened by one of these cards, but I do appreciate comments about how to disable the wireless withdrawals.
Within 4 cm? (Score:2)
Someone must have gotten their units mixed up and used 4 inches.
Re: (Score:2)
Someone must have gotten their units mixed up and used 4 inches.
So it turns out that like RFID tags, the assurances of limited range are absolute bullshit. A more powerful transmitter coupled with a more sensitive antenna than used in the reference design allow them to work from farther away. Who'd have thought it?
Re: (Score:2)
The guaranteed distance for a successful reading is 4cm, but that doesn't mean that it has to be that close for a successful reading.
I'm toying around with NFC right now and the distance is 4cm+ for a reading. Our local public transportation company (Västtrafik [vasttrafik.se]) uses NFC for the ticket system and there have been numerous accounts of accidental reading of the cards as well as missing to read. They have a system where you have to check in when boarding and check out when leaving - and if you don't check
Tap And Go Bankrupt (Score:4, Funny)
Quick, buy stock in companies selling RF-blocking wallets and bags
And don't forget fashion - my electric-blue aluminium wallet pairs nicely with my neon-green tinfoil hat!
Payment without user confirmation (Score:5, Insightful)
Who would've thought that it's a bad idea?
Re:Payment without user confirmation (Score:4, Informative)
If I had mod points, you would get them... I really genuinely don't get why no one saw this coming.
Re: (Score:2)
I saw it coming... Before one of my banks put them on ALL their cards I got a survey about how much I would like them. All my asnwers were the most negative on their scale and multiple write-ins (in the write in space) to the effect of OMFG NO, worst idea ever!
Sadly I was apparently the only one who thought so because now they do not have any credit cards that do not have NFC.
Re:Payment without user confirmation (Score:5, Insightful)
Everyone saw this coming. The banks, card companies & shops just didn't care.
Unlike purchases over £100 where the CC company is liable for half of all losses, you can bet we'll end up paying for any losses
either directly or through price increases.
Re: (Score:3)
In the UK the card issuer is liable for all the losses due to fraud or clerical errors.
The £100 rule is that any item worth over £100 and paid for in whole or in part on credit card makes the card issuer liable as the vendor. In the event of a problem they have the same responsibility to sort it out as the seller does.
The card issuers certainly do care because they want contactless payment to become popular. If it is abused or doesn't work people will carry on paying for small items
Re: (Score:2)
Re: (Score:2)
Bad idea for whom?
For the merchants accepting the payments, because they'll have to bear the cost of chargebacks on transactions that were otherwise perfectly valid but cannot be proven to have been authorised by the cardholder.
Re: (Score:2)
Bad idea for whom?
For the merchants accepting the payments, because they'll have to bear the cost of chargebacks on transactions that were otherwise perfectly valid but cannot be proven to have been authorised by the cardholder.
In addition to the fees for accepting the transaction.
Yes, a merchant pays a fee for accepting payment via card. Fees for accepting a credit card range from 1-5% of the transaction amount. Paying with debit (your own money) is usually under 1% of the transaction.
Wisdom of the paranoid ages (Score:3)
Tinfoil is your friend. Always has been, always will be.
Re:Wisdom of the paranoid ages (Score:4, Informative)
howdy y'all,
is tin foil available any more? i looked the other day and only found aluminum foil. i have an old roll of tin foil stashed in the back of one of my closets that i got from my mom when i 1st went to college. i aint seen any _tin_ foil in decades ...
take care,
lee
Re: (Score:3)
I've got some tin foil stored in a steel tin.
Re: (Score:2)
You fail, both for being retarded, and for signing your post.
Re: (Score:3)
You can get adhesive copper foil. That's the better tool for this.
Why (Score:5, Insightful)
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
Re: (Score:3)
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
Hate those stupid gas pumps. Useless if your card is from outside the US.
Re:Why (Score:4, Informative)
Hate those stupid gas pumps. Useless if your card is from outside the US.
Actually there is a way to use this even if your card is from outside the US. For example I have cards from Canada and the convention is to use the numbers from your postal code and add 00 at the end. It works well. If yours is from another country google around, they might have a convention on how to get the "ZIP" code you're supposed to use.
Re: (Score:2)
Hate those stupid gas pumps. Useless if your card is from outside the US.
Actually there is a way to use this even if your card is from outside the US. For example I have cards from Canada and the convention is to use the numbers from your postal code and add 00 at the end. It works well. If yours is from another country google around, they might have a convention on how to get the "ZIP" code you're supposed to use.
Yep; in the end, they're just checking AVS which just checks the numbers in your postal code. Same should work for at least UK-issued cards, and probably all major European issuers as well.
Re: (Score:2)
UK postal codes include letters and numbers.
Re: (Score:2)
I could give it a go but the exchange charges aren't too good.
Re: (Score:2)
Re: (Score:2)
Hate those stupid gas pumps. Useless if your card is from outside the US.
Then go inside and pay like you would everywhere else you make purchases. It's not hard, and you rarely have to queue. I guess, being a 'murican, you're either too fat or too lazy to waddle over to the door.
would make more sense for the gas pump to support pin on cards which have pin. I mean, asking for zip code is the stupidest verification right after touchscreen signatures. do wallet stealers have a powerful washington lobby or what the fuck?
Re: (Score:2)
They take pin if you're using the debit card portion. Not all credit cards have that though I understand. When you travel internationally, things get a little complex sometimes.
Re: (Score:3)
No credit cards have that because you are talking about a debit card. I will not own a debit card with a credit card logo- it is just ASKING for trouble.
If I want to use a credit card, I use a real credit card- which is using SOMEONE ELSE'S money until I pay for it. There is zero risk of my bank account being instantly drained for who knows how long.
Re: (Score:2)
Re: (Score:2)
Why would you assume he's American when he's talking about cards from outside the US? (Looks like he isn't if the other post above is from him).
Note that this zip code requirement has only been brought in in the last 5-7 years. Largely, I think, due to the high rise in gas prices. When you could fill a tank for 20-30 dollars, not an issue. Now even my relatively small car takes 60-70 to fill up on occasion.
Re: (Score:2)
Just tell them you didn't want to have to file with the IRS every year even though they have no jurisdiction over your earnings. That's the main reason I'm putting off becoming a citizen (should I ever change my mind about returning to the UK).
Re:Why (Score:4, Interesting)
A lot of credit cards in the UK have the Chip'n'Pin system [pcmag.com], which requires a physical connection to be made to the payment terminal. Simply "swiping" becomes less and less common, so people have to type their PIN every 5 minutes to pay for a few quid worth of $product. I used to work in the industry, and there was a certain amount of pressure from consumers to be able to do something as quickly and effortlessly as possible, but the magstrip simply isn't deemed secure enough.
The idea was to use NFC, so people could just wave their card for any purchase under 10 or 20 quid, and be on their merry way.
Re:Why (Score:5, Funny)
I thought in the UK chips were called crisps.
Re: (Score:2)
Chips are called chips, and look like this - http://www.mccain.co.uk/Global/Images/Products/Product%20Category/Healthy/oven%20chips%20sc%20large.jpg [mccain.co.uk]
Crisps are called crisps and look like this - http://images2.mysupermarket.co.uk/Products_1000/37/174137.jpg?v=2 [mysupermarket.co.uk]
Re: (Score:2)
The potato product invented in Belgium
Re: (Score:2)
Sure they were... and I suppose next you're going to blame the Belgians for Morris Dancing?
Re: (Score:2)
Re: (Score:2)
£3-4? Isn't that what cash is for?
Actually, my office has one of these NFC systems. It's acceptable givent there's never more than £10 in the account it's linked to, which is completely separate from my bank account. No way in hell would I trust my main bank account to a system like that.
I am currently living in Europe. (Score:3)
Re: (Score:2)
Not only is remembering endless new passwords and PINs very hard, but I don't want to entrust the PIN for a bank card with a direct call on my current account (for example) to retailers who are notoriously cheap when it comes to security measures.
The only thing I want to use a PIN on a bank card for is an a bank ATM to withdraw cash or as part of 2-factor authentication for on-line transactions.
Rgds
Damon
Re: (Score:2)
If the terminally is correctly designed and uncompromised. In several high-profile retail cases neither of those has been true.
Rgds
Damon
Re: (Score:2)
Which has happened.
Or someone standing behind you in a dense queue watches what you enter.
Rgds
Damon
Re: (Score:3)
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
plenty of countries have gone pretty much all chips. you stick the card in, put in the pin and the payment is done.
nothing wrong with that, except if for bus fares etc.. if you need extremely fast throughput of people then contactless is nice.
contactless without pin for your usual every day big money card though.. that's just fucking stupid. like having all your money in cash in your pocket. which geniuses came up with that?
Re: (Score:2)
If you do it your way, it's slower. Most people with a phone have it on already, with no locking. If you do it the way people who use payment apps do it, it can be a lot faster.
You could argue that this method is a lot slower: stare at the cashier, wait for the total, dig in your purse to find stray bills, decide you don't have enough cash, find a checkbook, hand the blank to the cashier so the register prints it, enter the amount and balance your checkbook.
Yes people do it that way, but most people avoid
Re: (Score:2)
If you think it is an exaggeration, then you need to watch the typical people around you. SLOW.
I am always fast, and I can almost guarantee I can use a swipe credit card just as fast as any "phone" user.... unless the cashier puts obstacles in my way...
Re: (Score:2)
So you don't have to touch the pad or the community pen?
If it cuts 1/2-1 minute off a transaction, a line of 50 people will save a half hour. That's a lot more customers for a morning coffee run.
Re: (Score:2)
It's a good idea because magstrips are easy to erase and contacts are easy to destroy. It's unfortunate that this implementation is so crap, but that doesn't invalidate the concept.
Re: (Score:2)
I'm sorry, but no. The concept of contactless payment is just inherently broken. It's really obviously, blatantly, completely invalid. Making it possible for me to pay from a distance wirelessly without having to do anything specific with the payment card/source/token, means that I can be robbed without noticing it. It just t
Re:Why (Score:5, Interesting)
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
Contactless payments differ a lot from magnetic stripe swiping, invisible barcodes etc.
They are not static information but an active challenge-response authentication system. You cannot clone the chip; it has an internal cryptographic secret it does not allow you to access, only challenge responses. You can trick it into authorizing a purchase you don't want if you're in physical proximity, which is happening here, but you cannot save that authorization for later use, since the bank is issuing the challenge here, just like with a chip-and-pin purchase. The whole point is to ensure that this is really the actual card.
So the main problem is the lack of user interaction to go ahead with the purchase. A touch button on the card itself would help, but would destroy part of the convenience.
Re: (Score:2)
I'm one of those Bitcoin-heads and have been interested in some of the discussions of hardware wallets. What all the designs I have seen in common have is some way to display the charged amount on the device and a button to be pressed for user confirmation. It is such an obvious requirement for anyone who takes a moment to think about it so I can only think that it has not been implemented in this case because it detracts from the "gee-whiz" aspect of the technology. Marketing over design.
Re: (Score:2)
You cannot clone the chip; it has an internal cryptographic secret it does not allow you to access, only challenge responses.
Yeah, you're making two claims here, neither of which I believe.
Yes, this is how the system is designed to work. But it's a very complicated system that was designed by humans. People make mistakes in implementation, and tomorrow people will know things they don't know today. I've seen too many claims similar to yours fail in the past to really believe the designers of NFC thought of everything.
Re: (Score:3)
Well, my point wasn't that the original card is impossible to clone given physical access to the card. My point is that using only radio communication with the chip, it is not possible to clone it. I imagine that NFC stuff and the crypto module are isolated, and the hardware crypto module quite literally has only one command exposed, to generate a response to a challenge. So neither passive (when you hear the challenge and the response) nor active (when you can submit challenges yourself) attacks can give y
Re: (Score:2)
+1 informative
Yours is one of the best replies yet. Yes, the idea of having a button or some other technology that confirms intent is what would be needed to "fix" the situation.
Re: (Score:3)
Re: (Score:2)
I was once standing a line in front of someone who complained quite loudly about the (marginal) extra time it took to process card transactions. That was about 20 seconds before someone turned up with a bunch of change to be sorted into the cash drawer. He was oddly quiet after that.
Card processing terminals vary but some do it right. Typically, at Walmart, I have all the card business done by the time the checker is still swiping the last items and I have the cart loaded by the time the receipt is ready.
Re: (Score:3)
Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something
Uh, so you don't already HAVE chips?! My EC card has had them for years. All ATMs use the chip, and magnetic strips only work as a fallback option (though there are safeguards against simply using a copied card without chip).
I am curious, what are the options for online banking in the US today? When I was a customer of Citibank in the US in 2001, it was just username/password (I had an HBCI encryption chip on my German card then...)
Re: (Score:2)
Username/password with my bank.
Re: (Score:3)
>"Uh, so you don't already HAVE chips?! My EC card has had them for years. All ATMs use the chip, and magnetic strips only work as a fallback option (though there are safeguards against simply using a copied card without chip)."
None of my USA credit cards have chips.
My Bank of America debit/ATM card also has no chip.
>"I am curious, what are the options for online banking in the US today? When I was a customer of Citibank in the US in 2001, it was just username/password (I had an HBCI encryption chip o
Re: (Score:2)
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Wait... You keep your phone in a holster? And off?
Your issues with the payment app system aren't really anything that affects most other people. My phone, for example, is in my pocket - and on. Getting at it isn't any more work than pulling my wallet out of a pocket, and launching an app is as fast as finding the correct card somewhere in my wallet.
Heck, my wallet isn't even in my pocket, more often than not. It's usually buried in my computer bag.
Re: (Score:2)
Being in a holster is no less accessible or slower than being in a pocket.
No, it is not "off", the SCREEN is off, you have to press the button to turn the screen on
Re: (Score:2)
I make all my phonecalls and texts with a Nokia 6015i "dumbphone" http://www.cellphones.ca/cell-phones/nokia-6015i/specs/ [cellphones.ca] Yes, I do have a "smartphone", but the greedy asshole cell carriers insist on an extra "data plan" charge for smartphones. So I don't bother getting a sim card or a plan for it. I leave it off except when I'm using it. The smartphone is a mediocre mp3-player/FM-radio/ebook-reader/web-browser/etc, but I'm *NOT* going to pay extra for connecting it versus the Nokia.
Re: (Score:3)
In Europe, and most of the rest of the world, we use smart-chips when we aren't using contactless. There is a magnetic stripe on the card, that that is only so that the card can be used in the USA and other similarly backward countries.
Security Concern (Score:5, Insightful)
While these incidents do not involve a security breach, they do indicate a sloppiness in the implementation, and so raise the concern that the system has been developed without the attention to detail that is a necessary (but not sufficient) prerequisite for security.
Not a security breach? (Score:5, Insightful)
While these incidents do not involve a security breach...
A vendor's machine can take money from me without my consent or knowledge.
Apropos of nothing, what would constitute a security breach in your model?
Re:Not a security breach? (Score:5, Insightful)
When they say it does not involve a security breach, what they mean is "it doesn't breach *our* security." Why do you think they give a shit about *your* security, exactly?
in Soviet Russia (Score:5, Funny)
The NFC terminal shouldn't be active until needed (Score:3)
The hardware having the wrong range is probably pretty hard to avoid due to variance between terminals and problems keeping them all tuned over their lifetime.
However, the NFC reader shouldn't be active until the customer told the cashier he/she will be using a contactless card for payment and the cashier enabling the reader.
It wouldn't prevent reading the wrong card if the customer has several NFC cards, but it would at least prevent the kind of surprises shown in the article.
Re: (Score:3)
The confirmation method has to be attached to the card otherwise it leaves open the option for rogue devices to drain your money.
Handbags (Score:2)
Re: (Score:2)
Right, and why is a second payment then accepted in another way?
how to get rid of NFC on a passport or credit card (Score:2)
there are two ways. my favourite is the first.
1) put passport / credit card on a plate
2) put small amount of water on top of NFC chip
3) put plate into microwave oven
4) set for 3 seconds on HIGH
5) press button and watch pretty sparks
6) open door VERY QUICKLY and put out anything that's smoking or on fire
7) smile and relax, knowing that you are secure from being phished.
the other way is perhaps less risky:
1) obtain a 50,000 volt electrocution device aka "stun gun"....
Re: (Score:2)
8) Throw card away since it is useless now.
No idea how it is in the USA, but in Europe the magnet strip is hardly used anymore. Too insecure. Some people even destroy it on purpose. Instead a chip in the card used. Not a NFC chip. So, how do you destroy one chip in a microwave oven, but leave another chip on the same card intact?
Re: (Score:2)
Someone else in this discussion suggested cutting a notch in the edge of the card to destroy the antenna.
workaround (Score:2)
Re: (Score:2)
It is possible to successfully read the data exchanged with a NFC card up to 2 meters away. Just have a decent snooping device in your backpack or handbag and you can sniff the transactions of other people.
You can have a transmitter with decent power at 13.56MHz that you turn on when you get in an area with NFC readers and see how many checkouts that fails to work.
There are a few other listed security issues too with NFC cards here: MMN-o | Blog [mmn-o.se], for those that aren't able to read Swedish - use the online t
Re: (Score:2)
The cards with a visible chip aren't the problem, it's the cards with hidden chips that communicates with radio that are.
The contact-chips have a different set of problems and attack vectors but they are safer than the magnetic strip. Recently some skimming equipment has been found for the chip cards. As for NFC cards you can be further away to skim them.
Re: (Score:2)
If I find out that I've been issed with an NFC Card
Are you sure you haven't? I have a few cards that contain rfid chips and I was never notified. The only way to know was the logo on the card (and I guess the absence of that is not a guarantee)