Contactless Cards

reclusive46

Jack_Griffin wrote: »

Yeah, a previous poster naivly said the laws of physics prevent fraud, but in fact all you need is a more powerful reader to induce a current in the card & make the chip work.

From my reading the card comms. standard (ISO/IEC 14443) says reads can be done at 10cm range, and there is another standard (ISO/IEC 14443) that allows reads up to 50cm.

I doubt those are the extreme limits of the interface, more than likely they are ranges at which you never get read errors.

So prepare to be remotely swiped, it will happen sometime, somewhere, once the cards are everywhere & criminals have a big incentive to expend effort on breaking into the system.

Manufactures are already making shielded wallets, though I'd anticipate fraud to take place near reading equipment, e.g. at the tail end of supermarket queues or near ATM machines.

The banks really need to shield these places, like US smart passport reader stations have been, but I suspect they'll wait till the situation dictates.

Basically I'm keeping out of it till I've no choice.. (I'm sure that'll happen).

But once again. Why is it your problem? In the extremely unlikely case of this happening. The bank will refund any fraudalent charges anyway.

Hominu

You don't need to buy a shielded wallet, just two contactless cards together will be enough.

I don't see what the 'big incentive' will be. Even if someone swipes your card from a distance, it can only be used once and only for upto £20. So they are going to invest in expensive equipment to get a free burger or coffee? Unlikely.

For better to carry on as they currently are. A stolen card allows such much more, as does a card reader on an ATM or similar.

FireWyrm

Hominu wrote: »

I don't see what the 'big incentive' will be. Even if someone swipes your card from a distance, it can only be used once and only for upto £20. So they are going to invest in expensive equipment to get a free burger or coffee? Unlikely.

As I said and no one seems to understand...

Individually, each person loses £20 or £80 depending on your individual card limits. Collectively, a scanner mingles in a busy high street on a Saturday morning and swipes HUNDREDS of £20's....do you get it yet? For a few hours work one morning, a scanner could score thousands of pounds of free, non-traceable money and there isnt a thing the victim can do to prove it wasnt them who spent the money because by the time they figure it out, that transaction is lost among the many others they legitimately did that morning. How do you prove that this single transaction isnt one you made when it is bracketted either side by transactions you DID make. If the previous unfortunate story is even remotely true and a man couldnt prove that 14 high price transactions (totalling £900) in under an HOUR were fraud, then what chance do you believe you have against a bank with the view that not only is Chip&Pin secure, but that 'contactless' is impossible or so bleeding unlikely, you're obviously lying if you report it?

dalesrider

gusgorman wrote: »

the onus is on them to check for fraudulent transactions on their account.

Well as you spend your money, then you are best placed to spot fraud..
As well as ALL banks have security systems in place.

gusgorman wrote: »

It is pretty stupid to add a feature with extra security vulnerabilities if the person has no intention of using that feature.

Public opinion is people want contactless cards.

Gusgorman.
Are you aware that the biggest weakness in ALL card payments is the retailers that take the payments.
They take anyone off the street and allow them access to card details. With NO security checks.
To work in a bank, you have to be fully security screened.
Yet anyone can be pulled off the streets and have access to card details in a retailer....
Perhaps you need to turn your attention. To the real problem area :mad:

dalesrider

FireWyrm wrote: »

As I said and no one seems to understand...

Individually, each person loses £20 or £80 depending on your individual card limits. Collectively, a scanner mingles in a busy high street on a Saturday morning and swipes HUNDREDS of £20's....do you get it yet? For a few hours work one morning, a scanner could score thousands of pounds of free, non-traceable money and there isnt a thing the victim can do to prove it wasnt them who spent the money because by the time they figure it out, that transaction is lost among the many others they legitimately did that morning.

I we understand that some people only look at the negitives and can not see passed half the rubbish posted on the internet. On how insecure things are.
Prove in a lab is one thing. To actually do it in the real world is another.

So these people are going to spend thousands on the scanner, then spend money and time creating the cards from the details obtained..... Do not forget they cannot simply use blank cards. They will need to at least look the same colour as the real thing.
Odds on finding a few card details that are usable is pretty slim. Given most people will have more than one card in their wallet.
So your rich pickings are getting slimmer by the second.

Far better to buy a Leb loop and a paper and stand around a ATM waing for someone to fall for it.
Net gain for a few mins work upto £500.
Funny but even these crooks do not then go and get a big mac or a coffee on the card....

FireWyrm wrote: »

If the previous unfortunate story is even remotely true and a man couldnt prove that 14 high price transactions (totalling £900) in under an HOUR were fraud, then what chance do you believe you have against a bank with the view that not only is Chip&Pin secure

Chip& pin is as secure as the PIN on the card.
Sorry but that thread just does not stack up that the card owner either was involved or knows who has done it.
I would imagine that brummie petrol stations are like the rest of the country and it is very easy to travel form one to another buying drink and cigs as well as your weekly shopping.
Maybe it was a student scam for a party....

Jack_Griffin

FireWyrm wrote: »

As I said and no one seems to understand...

They do mate, but the recent posters work for the banks and their mission is to counter arguments made against these cards.

I got considerable pressure from the person I saw at the bank today trying to disuade me from opting out of the contactless card they tried to foist upon me. They failed. & I've now microwaved the contactless card they issued to me and I'm waiting for a non-contactless replacement

I know they'll win in the end, but I think it is important to resist & make them think harder about security.

Let other people be the guinea pigs.

stclair

Just opt out and be done with it.

The only issue with that maybe is you may only potentially get issued with an online debit card.

Just pop in and ask the question.

simax

Contactless credit cards - I can live with, as it's the banks money they are stealing.

Contactless debit cards, yes I know they re-imburse etc etc but what if there is a delay and your money is gone?? It's your money gone, until it's reimbursed.

Hominu

FireWyrm wrote: »

As I said and no one seems to understand...

Individually, each person loses £20 or £80 depending on your individual card limits. Collectively, a scanner mingles in a busy high street on a Saturday morning and swipes HUNDREDS of £20's....do you get it yet?

Lets say that happens. What are they going to do with those virtual £20s ? Its useless in raw form, they need to somehow get them on another card, and one that looks genuine enough, and then they can go buy a coffee or a big mac.

Then of course if the person the fraudster just 'scanned' uses there card before the fraudster managed to copy the information to another card and use it, the information the fraudster now has is useless, and when the fraudster tries to use the information they got, the vicims card gets blocked by the bank.

dalesrider

Jack_Griffin wrote: »

They do mate, but the recent posters work for the banks and their mission is to counter arguments made against these cards.

& make them think harder about security.

Let other people be the guinea pigs.

Yes. I work for a bank. But will not support them 100% if I think they are wrong.
We first question why we were releasing these and came up with all the arguements as to why we should not.
Well 18 months on we have been proved wrong.
As I said 1 fraud case of contactless in 18 months.....

As for the time arguement.
These cards have been avaiable since 2008.