Cable Forum - Fraud fears grow over contactless bank card technology

Cable Forum (https://www.cableforum.uk/board/index.php)

- Current Affairs (https://www.cableforum.uk/board/forumdisplay.php?f=20)

- - Fraud fears grow over contactless bank card technology (https://www.cableforum.uk/board/showthread.php?t=33686656)

Tezcatlipoca

29-03-2012 22:03

Fraud fears grow over contactless bank card technology

I'm surprised there's been no thread about this.

Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Channel 4 News

Millions more British bank customers have been exposed to fraud through the latest credit and debit card technology, writes Channel 4 News technology producer Geoff White.

Millions more British bank customers have been exposed to fraud through the latest credit and debit card technology.

On Friday Channel 4 News reported that Barclays Visa contactless cards (ones which bear the symbol pictured) can be read using an off-the-shelf mobile phone running a special app.

ViaForensics, the company which carried out the research for Channel 4 News, has now shown the same technique works on a Visa debit card issued by Lloyds. And banking industry insiders have told us that all Visa contactless cards can potentially be read in this way.

The app reads the full name, number and expiry date from the card. Channel 4 News was able to use just these three details to order goods through Amazon; setting up an account under a dummy email address and having the goods shipped to an address which does not match that of the cardholder.

There are around 19 million contactless cards in circulation in the UK - Barclays accounts for around 13 million of those.

Visa, which provides credit facilities for Barclays, Lloyds and other banks, said it takes cardholder security very seriously. It acknowledges that the details are transmitted by the cards without encryption, but said these details can be gained "by a number of methods" and should not be usable without the three-digit CVV number on the back of the card.

(snip)

... unfortunately Amazon and some other online retailers don't use the three-digit CVV number... :rolleyes:

This reminds me of all the talk a while back about being able to remotely read someone's RFID-chipped passport using a laptop and special scanner.

Original C4 News story on this from last week: http://www.channel4.com/news/million...posed-to-fraud

Sirius

29-03-2012 22:11

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406913)

I'm surprised there's been no thread about this.

Fraud fears grow over contactless bank card technology

... unfortunately Amazon and some other online retailers don't use the three-digit CVV number... :rolleyes:

This reminds me of all the talk a while back about being able to remotely read someone's RFID-chipped passport using a laptop and special scanner.

i have no intention of using it unless i have NO other choice.

Tezcatlipoca

29-03-2012 22:15

Re: Fraud fears grow over contactless bank card technology

It is rather dodgy that someone with an NFC-enabled phone could essentially pickpocket you without ever actually touching your wallet.

Sure, once you report a card as lost or stolen or fraudulently used, it gets blocked... but if the card is still in your wallet, how long would it take for you to realise someone has read the info and gone off to spend your money?

Cobbydaler

29-03-2012 22:20

Re: Fraud fears grow over contactless bank card technology

All online retailers should be forced to use the CVV number.

Hom3r

29-03-2012 22:27

Re: Fraud fears grow over contactless bank card technology

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

Cobbydaler

29-03-2012 22:32

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Hom3r (Post 35406931)

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

Â£15 or less and no PIN required:

http://www.barclays.co.uk/Helpsuppor...P1242561764200

martyh

29-03-2012 22:37

Re: Fraud fears grow over contactless bank card technology

There's a lot to be said for technology but you cannot beat cold hard cash

Tezcatlipoca

29-03-2012 22:41

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Hom3r (Post 35406931)

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

The issue with this is that the cards transmit the cardholder's name, the card number, and the expiry date... all unencrypted.

If someone obtains that information, they can then use the card details to make purchases online (at sites like Amazon, which don't use the CVV number), without any of the "small transaction restrictions" that are in place when physically using the contactless card in a shop.

EDIT:

The original C4 News story - http://www.channel4.com/news/million...posed-to-fraud

Paul	29-03-2012 22:46

Re: Fraud fears grow over contactless bank card technology

It was demonstrated on Watchdog tonight.

gazzae

29-03-2012 22:48

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406938)

Would they not also require your address? Is there not a check to make sure the Invoce address matches?

Maggy

29-03-2012 22:48

Re: Fraud fears grow over contactless bank card technology

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40:(

Quote:

Meanwhile, contactless cardholders who are concerned about data leakage can buy a shielded wallet, which surrounds the cards with a thin sheet of metal.

I wish I still had my metal business card wallet, it would have been perfect.However I see there are some as low as a tenner.:)

Peter_

29-03-2012 22:52

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Maggy J (Post 35406943)

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40:(

I wish I still had my metal business card wallet, it would have been perfect.However I see there are some as low as a tenner.:)

You can buy them for for a lot less on Ebay CLICK ME.

I actually bought this one and it arrived it about 10 days and it is quite good quality for less than Â£2.

Tezcatlipoca

29-03-2012 23:00

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by gazzae (Post 35406942)

Would they not also require your address? Is there not a check to make sure the Invoce address matches?

Well, you'd think so, but according to C4's investigation they were able to purchase items from Amazon using different billing and delivery addresses to those of the cardholder.

danielf

29-03-2012 23:15

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Maggy J (Post 35406943)

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40:(

Erm, and what if you actually want to use the card for its intended purpose?

Maggy

30-03-2012 08:27

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by danielf (Post 35406958)

Erm, and what if you actually want to use the card for its intended purpose?

Err you take it out..but that advice is only for the paranoid anyway and to make everyone spend more money if they are so worried about it.

Personally I'm not going to worry about it all.I have enough trouble with the fact that Barclays are introducing Pin Sentry devices for customers to use for online banking.:erm:

Chris

30-03-2012 08:33

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406952)

Well, you'd think so, but according to C4's investigation they were able to purchase items from Amazon using different billing and delivery addresses to those of the cardholder.

In which case, the critical weakness is with Amazon, not with the Visa card. They should be verifying that the purchaser is in possession of the card by collecting the CVV at point of sale, but they're not (presumably because they think it interferes with their one-click impulse buying engine). They should also be cross-checking addresses but again, they want to operate a gift delivery service so their product offering is taking precedence over card security measures.

Stuart

30-03-2012 09:45

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Hom3r (Post 35406931)

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

If you somehow got hold of a portable reader (like those Waiters often have access to) and reprogrammed it, you could still defraud an awful lot of people just walking down a busy street.

mertle

30-03-2012 09:54

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406918)

read one way to stop it but special sleeves blocks out scammers getting the signals until removed to be used then can still pick up.

The other not brilliant solution rap it in aluminium.

Was potentially always going to happen stupid stupid idea.

There only one way biometrics or eye scan expensive but only way.

Chris

30-03-2012 09:58

Re: Fraud fears grow over contactless bank card technology

A tinfoil hat for your credit card? :D

Tim Deegan

30-03-2012 10:05

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406918)

It is rather dodgy that someone with an NFC-enabled phone could essentially pickpocket you without ever actually touching your wallet.

Sure, once you report a card as lost or stolen or fraudulently used, it gets blocked... but if the card is still in your wallet, how long would it take for you to realise someone has read the info and gone off to spend your money?

This is what most credit card fraudsters rely on.

I had one fraudulent transaction against my company, which wasn't noticed until the genuine card holder received their statement. By which time the goods had been delivered:mad:

But because the first tranasaction was successful they tried again. But by this time, after a big argument with the secure gateway for giving me the wrong advice on security settings, I had increased the security.

They then made 19 attempts using 19 different American cards.

I can't go into details, but after talking to the fraud squad, it seems that no credit or debit card are as secure as we thing they are. In fact for the buyer, the safest way to purchase is on line through a secure gateway. And make sure the seller is PCI compliant.

---------- Post added at 10:05 ---------- Previous post was at 10:00 ----------

Quote:

Originally Posted by Chris (Post 35407026)

The CVV check is down to their level of security.

As for the address checks, depending on the gateway this should be done anyway (including the status of the alternative delivery address). However, there are things that the banks don't check, but easily could do. It's the banks that really need to tighten their security up.

Before anyone asks me to go into details. I'm not going to for security reasons.

mertle

30-03-2012 12:00

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Chris (Post 35407076)

A tinfoil hat for your credit card? :D

indeed inconvenient but actually works been advice in yankie land which this stupid techno been out for abit.

http://pamela99.hubpages.com/hub/Ide...als-New-Access

http://www.ehow.com/how_4744558_keep...ards-safe.html

love the first one LEAVE IT AT HOME.

Tim Deegan

30-03-2012 12:04

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by mertle (Post 35407137)

indeed inconvenient but actually works been advice in yankie land which this stupid techno been out for abit.

http://pamela99.hubpages.com/hub/Ide...als-New-Access

Yeah, very inconvenient. It would be far better if the banks increased their terrible security, especially AMEX who believe it or not, are the worst.

mertle

30-03-2012 12:11

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Tim Deegan (Post 35407142)

Yeah, very inconvenient. It would be far better if the banks increased their terrible security, especially AMEX who believe it or not, are the worst.

Indeed it seems they want make life easier for crims. You know what I would not be shocked they wont refund fraud at some point.

Tim Deegan

30-03-2012 12:16

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by mertle (Post 35407144)

Indeed it seems they want make life easier for crims. You know what I would not be shocked they wont refund fraud at some point.

Well they certainly aren't making any more difficult for them. The potential is there for very strict security, but they don't seem to want to use what is available to them.

mertle

30-03-2012 12:42

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Tim Deegan (Post 35407147)

Well they certainly aren't making any more difficult for them. The potential is there for very strict security, but they don't seem to want to use what is available to them.

true they blame costs for not implenting the tech but for what fraud costs surley it would balance. Now would love to see the figures of implenting to fraud costs. Not forgeting it would be bank v bank totals.

I glad mine at moment not one these but believe others barcleys got plans it stupid.

You can stand near them get apps on devices which will scim them just by standing next to someone as long the persons wallet near the it will read it.

Tim Deegan

30-03-2012 12:58

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by mertle (Post 35407159)

It shouldn't really be a big cost issue. Many of the merchant services and gateways already request far more information than the banks actually check. The banks have the details to cross check, so it would just be a case of the banks catching up with the gateways and merchants service suppliers.

mertle

30-03-2012 13:36

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Tim Deegan (Post 35407170)

thanks my bank given us software online but secerity already high it interfered:shocked:.

We have password thing too if buy anything online they now second layer you go through.

Now the only thing about shops is if your asked password or question it could be recorded.

In privacy in bank little easier to have that extra barrier.

The other is identity that again could be faked.

The problem also is people themselves they dont want jump through hoops to shop. This why this stupid idea came from ease shopping. People hate queuing longer necessary hate pin, everything in speed.

When the first barcley advert came up with him sliding down slide we said it would open fraud easier our family.

Anonymouse

30-03-2012 14:40

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Matt D (Post 35406938)

The issue with this is that the cards transmit the cardholder's name, the card number, and the expiry date... all unencrypted.

This sounds like a silly, obvious question, I know, but...why is this information transmitted unencrypted?!

And don't say it's because of cost - how much more does it cost the banks etc. in fraud claims? If they'd just ensure it's encrypted, end of problem...well, at least until some genius proves the Riemann Hypothesis, that is. :p:

mertle

30-03-2012 15:18

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Anonymouse (Post 35407227)

Its valid point however encryptions only go so far once system cracked you then have to change it suppose thats the expense.

Tetra was deemed uncrackable its now been cracked by maths lecturer at uni. Geniuses cant stop giving themselves the challenge of breaking the unbreakable. Not problem but usually that information finds it way in the wrong hands.

What man can do man can unlock.

Tim Deegan

30-03-2012 20:19

Re: Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by mertle (Post 35407189)

thanks my bank given us software online but secerity already high it interfered:shocked:.

We have password thing too if buy anything online they now second layer you go through.

The 3D secure part when you buy on line is what makes buying on line the most secure way to buy.

Quote:

Originally Posted by mertle (Post 35407189)

Now the only thing about shops is if your asked password or question it could be recorded.

You should never give out any passwords or security questions in a shop. The only place you should do this is by entering your pin number into a chip and pin machine. Or at the 3D secure stage of an on line transaction.

In a shop they should pass you the chip and pin terminal, and they should never handle the card.

With an on line secure gateway, the retailer won't even see the whole card number, and therefore can't record it.

Even if you pay over the phone the retailer should NEVER make a note of the security code.

Quote:

Originally Posted by mertle (Post 35407189)

In privacy in bank little easier to have that extra barrier.

The 3D secure window on line comes direct from the card issuer.

Quote:

Originally Posted by mertle (Post 35407189)

The other is identity that again could be faked.

Most secure gateways ask for far more information than the banks request. The banks could easily cross match all of the information, which would lower the chance of identities being faked.

Quote:

Originally Posted by mertle (Post 35407189)

The problem also is people themselves they dont want jump through hoops to shop. This why this stupid idea came from ease shopping. People hate queuing longer necessary hate pin, everything in speed.

If all the information that is currently required by the secure server gateways was cross matched by the banks, then there would be no need for any extra levels of security.

All times are GMT +1. The time now is 05:14.