The security of contactless debit cards

skybluesaver

I also don't trust or want the contactless function on my new Barclaycard. They have confirmed they cannot offer me an alternative so regrettably the account will be closed once my old card expires the end of this month.

foram708

Every RFID chip (as used in these cards) has a unique serial number that is broadcast to the reader before the encrypted session starts.
"In August 2005, Los Angeles-based Flexilis set a world record by reading an RFID tag from 69 feet away". The distance depends on the reader, which could be in a doorway, in someone's briefcase etc. So your movements can be tracked or money taken without your knowledge.
If you want to prevent this, radio-opaque wallets are available - or wrap the card in foil. Or you can cut the antenna with a scalpel - see
woodall[dot]me[dot]uk/barclays/
which will leave the Chip&PIN intact.
One bank has this in the small-print that comes with the card:

If the type of account you hold with us is changed or Control is added to your account, we may replace your card with a card that does not have contactless technology.

So if it suits them you can have a card that doesn't violate your privacy, but not apparently if it suits the customer. Stick to your guns: perhaps challenging every contactless transaction will have the desired effect.

System

I love contactless payment systems. I can't wait for the day when cash is replaced by this, or a similar, system. IMO it is no less secure than having a couple of £10 notes in your back pocket or wallet. More than once I have lost notes by pulling my phone out of the same pocket as the notes and not noticing them fall to the ground.

I am excited by the possibility of using my iPhone to pay for small items in a similar way too.

pmduk

scgf wrote: »

More than once I have lost notes by pulling my phone out of the same pocket as the notes and not noticing them fall to the ground.

I've had that happen too, I've solved it by using a wallet to keep cash secure, it still doesn't make contactless cards secure in my mind. To be fair, I've never had a problem with my oyster card on the rare occasions I venture to London. I suspect we're all just worrying about a new type of technology, only time will tell, most of us are unable to use these new terminals as they're not in widespread use. Unless the card companies can convince condumers of their security there will be no reason for retailers to consider installing them.

pqrdef

Olipro wrote: »

additionally, it's very unlikely the bank will challenge you for such a low value purchase.

The difficulty will be for the customer to be certain which transactions he didn't make. If I don't use a card very often, it may be a while before I miss it, and I won't be checking my account daily.

If I discover that a card is missing, and I don't know how long it's been missing, and there are low-value transactions on my account from say 2 or 3 weeks earlier, and the merchant is indecipherable, how will I be certain which transactions aren't mine?


Incidentally anybody who uses a contactless card a lot is going to get a statement full of small transactions that he doesn't remember and can't place, because so many merchants have account names that have no resemblance to their trading names. I don't suppose there's any chance of getting that fixed.

pqrdef

foram708 wrote: »

"In August 2005, Los Angeles-based Flexilis set a world record by reading an RFID tag from 69 feet away".

Undoubtedly the next step will be scanners that will pick up any RFID tags being carried by anybody who walks past, in the name of anti-terrorist precautions etc.

Bob++

I just heard that someone came up with another crazy idea:

Apparently the plan is to print pieces of paper (called notes) with different numbers of pounds on them; £5 £10, £20 etc. They will then issue these to the public so that they can exchange them for goods. There is no apparent maximum to a transaction either.

I would feel really really scared carrying these around. If I drop one then anyone could use it. If someone stole my wallet then they would be able to use all the 'notes' in there without even having to identify themselves.

Madness.....

ChiefGrasscutter

pqrdef wrote: »

Undoubtedly the next step will be scanners that will pick up any RFID tags being carried by anybody who walks past, in the name of anti-terrorist precautions etc.

Such a system has been operational in the Austrian ski resorts for years. Everyone is told to put the Ski lift pass card (with RFID chip embedded in it) in your top left jacket pocket, you walk past the detector as you approach the ski lift entrance gates, ski pass is automatically interrogated to check its valid.... and gate opens for you. Ski pass never leaves your pocket; human log jams at lift entrance gates much reduced. Card is returned at end of holiday and you get your deposit back on it and its reprogrammed for someone else the next week.