Disabling contactless payment on credit/debit cards

reclusive46

Anthorn wrote: »

I stand corrected. But I still don't see the advantage.

From experience in Australia, its a much quicker process. Less data is transferred so on slower dial up terminals it processes much quicker.

barbarawright

"Consumers who use contactless debit and credit cards to buy goods or services could be unwittingly opening their bank account up to fraudsters, according to an investigation by Which?

Researchers bought cheap, widely available card scanners from a mainstream website to see if they could “steal” key details from a contactless card.

They tested 10 different credit and debit cards, that were meant to be coded to “mask” personal data, and were able to read crucial data that was meant to be hidden.

It then went shopping with the information it had obtained and was able to successfully place orders for items including a £3,000 television set. "


http://www.theguardian.com/money/2015/jul/23/contactless-card-is-too-easy-says-which

thetriggerhappypwner

I have heard that wrapping the card in tin foil effectively prevents it being read. But the sure fire way is to not have a contactless card period. I don't have one, and never will have one.

SnowTiger

barbarawright wrote: »

"Consumers who use contactless debit and credit cards to buy goods or services could be unwittingly opening their bank account up to fraudsters, according to an investigation by Which?

Researchers bought cheap, widely available card scanners from a mainstream website to see if they could “steal” key details from a contactless card.

They tested 10 different credit and debit cards, that were meant to be coded to “mask” personal data, and were able to read crucial data that was meant to be hidden.

It then went shopping with the information it had obtained and was able to successfully place orders for items including a £3,000 television set. "


http://www.theguardian.com/money/2015/jul/23/contactless-card-is-too-easy-says-which

Yep, you can read the card number and expiry date from a contactless card using an Android table, or mobile phone, with an NFC reader and free software from the Play Store such as this: Banking Card Reader.

Retailers who allow a £3,000 TV to be ordered and, presumably, delivered to a 3rd party address are foolish. Amazon?

It should be easy to action a Chargeback. The retailer would lose out.

Edit: unauthorised transaction instead of chargeback.

Anthorn

barbarawright wrote: »

"Consumers who use contactless debit and credit cards to buy goods or services could be unwittingly opening their bank account up to fraudsters, according to an investigation by Which?

Researchers bought cheap, widely available card scanners from a mainstream website to see if they could “steal” key details from a contactless card.

They tested 10 different credit and debit cards, that were meant to be coded to “mask” personal data, and were able to read crucial data that was meant to be hidden.

It then went shopping with the information it had obtained and was able to successfully place orders for items including a £3,000 television set. "


http://www.theguardian.com/money/2015/jul/23/contactless-card-is-too-easy-says-which

What the report misses out is that the thieves will have to get hold of the card in order to scan it. Either that or place their scanner so it is touching the card in one's pocket or wallet due to the extreme short range of the RFID chip. There is nothing new in scanning cards of any description whether it be contactless, chip and pin or magnetic strip. All of them have the information on them which can be exploited by thieves.


But hats off to Which? and The Guardian for resurrecting something that was disproved years ago. It will probably get them a few extra subscribers and good luck to them.

reclusive46

There is another very simply fix. If you have more than one contactless card in your wallet, it won't work either as you end up with card clash.

hasdogs

Anthorn wrote: »

What the report misses out is that the thieves will have to get hold of the card in order to scan it.

http://www.bbc.co.uk/news/technology-24743920

Read from 0.5m for starters. Thieves don't even need to get close to read your card.

A reader set up in a doorway could record the credit card information of every person entering the premises. It is early days for contactless cards - IMO it will happen.

In response to the dumb "do you carry a mobile" reply to my previous post in iOS 8 apple now use MAC address randomisation which prevents phones being uniquely identified by their connection to a WiFi node. http://arstechnica.com/apple/2014/06/ios8-to-stymie-trackers-and-marketers-with-mac-address-randomization/

This was done because people don't want to be electronically identified and tracked and I won't be carrying a device which enables that without good reason.

[Deleted User]

hasdogs wrote: »

apple now use MAC address randomisation which prevents phones being uniquely identified by their connection to a WiFi node.

It's not the WiFi you need to worry about.

It's the standard mobile handshake.

hasdogs

Bedsit_Bob wrote: »

It's not the WiFi you need to worry about.

It's the standard mobile handshake.

Mobile phones simply can not function without your mobile carrier knowing approximately where the phone is. If you don't trust your mobile carrier with that information don't use one or turn it off.

A contactless card provides personal identification information to anyone who cares to read it. You have no control over or idea who read it never mind if you trust them or not.

Cookies let companies track you across the internet, a contactless card is like a cookie that will allow companies to track you in the real world. It isn't happening *yet*. I'm sure the inventor of the cookie had no idea how badly they would be abused in the future either.

[Deleted User]

hasdogs wrote: »

Mobile phones simply can not function without your mobile carrier knowing approximately where the phone is.

Exactly my point.

If you carry a mobile phone, you are carrying a tracking device.