Fraud fears grow over contactless bank card technology

Tezcatlipoca · 29-03-2012, 22:03

I'm surprised there's been no thread about this.

Fraud fears grow over contactless bank card technology

Quote:

Originally Posted by Channel 4 News

Millions more British bank customers have been exposed to fraud through the latest credit and debit card technology, writes Channel 4 News technology producer Geoff White.

Millions more British bank customers have been exposed to fraud through the latest credit and debit card technology.

On Friday Channel 4 News reported that Barclays Visa contactless cards (ones which bear the symbol pictured) can be read using an off-the-shelf mobile phone running a special app.

ViaForensics, the company which carried out the research for Channel 4 News, has now shown the same technique works on a Visa debit card issued by Lloyds. And banking industry insiders have told us that all Visa contactless cards can potentially be read in this way.

The app reads the full name, number and expiry date from the card. Channel 4 News was able to use just these three details to order goods through Amazon; setting up an account under a dummy email address and having the goods shipped to an address which does not match that of the cardholder.

There are around 19 million contactless cards in circulation in the UK - Barclays accounts for around 13 million of those.

Visa, which provides credit facilities for Barclays, Lloyds and other banks, said it takes cardholder security very seriously. It acknowledges that the details are transmitted by the cards without encryption, but said these details can be gained "by a number of methods" and should not be usable without the three-digit CVV number on the back of the card.

(snip)

... unfortunately Amazon and some other online retailers don't use the three-digit CVV number...

This reminds me of all the talk a while back about being able to remotely read someone's RFID-chipped passport using a laptop and special scanner.

Original C4 News story on this from last week: http://www.channel4.com/news/million...posed-to-fraud

Sirius · 29-03-2012, 22:11

Quote:

Originally Posted by Matt D

I'm surprised there's been no thread about this.

Fraud fears grow over contactless bank card technology

... unfortunately Amazon and some other online retailers don't use the three-digit CVV number...

This reminds me of all the talk a while back about being able to remotely read someone's RFID-chipped passport using a laptop and special scanner.

i have no intention of using it unless i have NO other choice.

Tezcatlipoca · 29-03-2012, 22:15

It is rather dodgy that someone with an NFC-enabled phone could essentially pickpocket you without ever actually touching your wallet.

Sure, once you report a card as lost or stolen or fraudulently used, it gets blocked... but if the card is still in your wallet, how long would it take for you to realise someone has read the info and gone off to spend your money?

Cobbydaler · 29-03-2012, 22:20

All online retailers should be forced to use the CVV number.

Hom3r · 29-03-2012, 22:27

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

Cobbydaler · 29-03-2012, 22:32

Quote:

Originally Posted by Hom3r

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

Â£15 or less and no PIN required:

http://www.barclays.co.uk/Helpsuppor...P1242561764200

29-03-2012, 22:37

There's a lot to be said for technology but you cannot beat cold hard cash

Tezcatlipoca · 29-03-2012, 22:41

Quote:

Originally Posted by Hom3r

Correct me if im wrong, but this contactless method (I have a Barclaycard with this) is limited to small amounts of around Â£10/20, and still require a pin ?

The issue with this is that the cards transmit the cardholder's name, the card number, and the expiry date... all unencrypted.

If someone obtains that information, they can then use the card details to make purchases online (at sites like Amazon, which don't use the CVV number), without any of the "small transaction restrictions" that are in place when physically using the contactless card in a shop.

EDIT:

The original C4 News story - http://www.channel4.com/news/million...posed-to-fraud

**Paul** · 29-03-2012, 22:46

It was demonstrated on Watchdog tonight.

gazzae · 29-03-2012, 22:48

Quote:

Originally Posted by Matt D

The issue with this is that the cards transmit the cardholder's name, the card number, and the expiry date... all unencrypted.

If someone obtains that information, they can then use the card details to make purchases online (at sites like Amazon, which don't use the CVV number), without any of the "small transaction restrictions" that are in place when physically using the contactless card in a shop.

EDIT:

The original C4 News story - http://www.channel4.com/news/million...posed-to-fraud

Would they not also require your address? Is there not a check to make sure the Invoce address matches?

**Maggy** · 29-03-2012, 22:48

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40

Quote:

Meanwhile, contactless cardholders who are concerned about data leakage can buy a shielded wallet, which surrounds the cards with a thin sheet of metal.

I wish I still had my metal business card wallet, it would have been perfect.However I see there are some as low as a tenner.

Peter_ · 29-03-2012, 22:52

Quote:

Originally Posted by Maggy J

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40

I wish I still had my metal business card wallet, it would have been perfect.However I see there are some as low as a tenner.

You can buy them for for a lot less on Ebay CLICK ME.

I actually bought this one and it arrived it about 10 days and it is quite good quality for less than Â£2.

Tezcatlipoca · 29-03-2012, 23:00

Quote:

Originally Posted by gazzae

Would they not also require your address? Is there not a check to make sure the Invoce address matches?

Well, you'd think so, but according to C4's investigation they were able to purchase items from Amazon using different billing and delivery addresses to those of the cardholder.

danielf · 29-03-2012, 23:15

Quote:

Originally Posted by Maggy J

The answer is simple, keep youur card inside a shielded wallet .What's on offer seems expensive though.Cheapest seems to be about Â£40

Erm, and what if you actually want to use the card for its intended purpose?

**Maggy** · 30-03-2012, 08:27

Quote:

Originally Posted by danielf

Erm, and what if you actually want to use the card for its intended purpose?

Err you take it out..but that advice is only for the paranoid anyway and to make everyone spend more money if they are so worried about it.

Personally I'm not going to worry about it all.I have enough trouble with the fact that Barclays are introducing Pin Sentry devices for customers to use for online banking.