Contactless Credit Cards

An anonymous reader writes "According to his article in EETimes, Visa and Philips are teaming up to introduce a so-called "contactless credit card". Basically it'll work like the proximity cards many of us use for access to our places of work or apartments. You won't need to physically swipe it, simply waving it over a reader is good enough."

Comments

Good and badGood and badGood and Bad

[krray]

I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

Where?s the security? I often wonder why the heck credit card purchases don?t require a PIN at the very least. Yeah, we?re all high tech and thumb prints and/or eye scans would be cool, but I?m all for having to know and enter a PIN on each and every purchase.

I tend to go for EFT payment whenever possible as I do have to enter a PIN. Shoulder surfing or a corrupt security camera guy is always a problem. I?m smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN too. I suppose insurance costs and ?shrink? just isn?t too expensive yet?

I?d be impressed if there was a thumb reader built into each plastic card I waived around buying all my shit.

Mobile gas anyone?

Re:Good and badGood and badGood and Bad

[the_bahua]

I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.

At the very least, the signature process should be retained.

Re:Good and badGood and badGood and Bad

[FatRatBastard]

Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

Re:Good and badGood and badGood and Bad

[teknokracy]

And then it comes down to the point where you have the fact that the card could just as easily be stolen. No amount of encryption would protect a card from that.

Re:Good and badGood and badGood and Bad

[RajivSLK]

to charge them, it's very much a physical action.

Physical, hardly.
Have you ever purchased anything online?

All I need is your number, name and expiry and I can charge your account all I want.

Credit card accounts are inherently very insecure. Prosecution is the only thing stopping (even more) massive fraud.

Re:Good and badGood and badGood and Bad

[b0r1s]

I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.


Not entirely true. One of the more common credit card scams here in Los Angeles is portable card scanners being carried by waiters in restaurants. As they take the card you've handed them back to scan it for the bill, they scan it in their personal scanner, which records the information for later use.

There is no meaningful physical location tied to this because you've given your card (intentionally) to someone you have to trust. If you eat at multiple restaurants over the course of a week, there's no easy way to trace the theft back to an individual location.

Re:Good and badGood and badGood and Bad

[Jetson]

The magnetic strip in my credit cards are usually destroyed/useless before the card even expires.

My cards usually crack from curvature long before the stripe is demagnetized or worn away. I guess that's what comes from sitting on your wallet all the time.

FWIW, Esso Canada (gas station chain) has been using keychain-dongles for rapid payment for about a year now. You just hold your keys in front of the coloured box on the pump for a few seconds and it prepares to make the sale exactly the way it would if you stuck your card in the stripe reader. They also put the same dongle-reader at each cash register so you can buy your morning coffee a few seconds faster....

Re:Good and badGood and badGood and Bad

[jdreed1024]

All I need is your number, name and expiry and I can charge your account all I want.

Actually, that's less and less the case. With the exception of the "big" vendors who have enough fraud insurance (amazon, etc), more and more vendors are instituting stiff requirements on your card purchases such as: a) shipping only to the credit card billing address (or another address listed on your credit card), b) requiring that you enter the CCV (the three digit number printed on the signature stripe of the card), c) requiring that you enter your credit card's customer service number so they can contact your bank.

And almost all online vendors (except the really sketchy ones) require that you provide the credit card billing address when placing an order. If they don't match, the order won't go through. I have had several vendors call me when this happened because I typo'd the name of my street.

On a related note, I wish more and more brick and mortar stores would check your signature. To prove a point, my friend and I were making a purchase at a large national chain store, and he signed "Homer J Simpson" to the credit card receipt, and the cashier didn't care.

Re:Good and badGood and badGood and Bad

[jdreed1024]

I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

The mag stripe isn't actually necessary for making the purchase. (If a store salesdroid tells you it is, demand to see the manager or take your business elsewhere). Only the card itself is required.

Back in the day, credit cards didn't have mag stripes. They were called charger plates, and they were placed in a machine along with a carbon sales slip, and when a roller was moved back and forth across the paper, an imprint of the card was made on the sales slip. And you signed it to charge something to your MasterCharge or BankAmericard.

The security was in actually having the card present at the checkout. That is still the case - you swipe it to prove that its there, or if the stripe doesn't work, they take an imprint of it (all places that take cards are supposed to have an imprint machine). That, combined with the signature, is in theory enough security. I'd wager a large portion of credit card fraud could be stopped if places would stop hiring illiterate 12 year olds at registers who can't even read, let alone compare signatures.

Re:Good and badGood and badGood and Bad

[thelexx]

Card in pocket, it is far from "just as easy" to take it from me as it would be to pass a wand over my butt without me noticing.

Re:Good and badGood and badGood and Bad

[Zirnike]

"I wish more and more brick and mortar stores would check your signature"

I used to work for Sears. I did this. One guy comes up, tried to buy something, I think a faucet, and gave me an unsigned credit card. I asked him for ID, he gave it to me, complaining, and I handed back the ID and the card, and asked him to sign it. He refused, started yelling, and walked out.

Mind you, the card quite clearly states 'not valid until signed'. And this wasn't an isolated incident, either.

That is why stores don't check signatures very well. Customers don't want the security it provides.

Contactless? Great!

[Anonymous Coward]

They won't know where to send the bill!

Pickpocket from a distance...

[bgog]

Let's see. A crowded line at an amusement park... I'm sure I could pick up 100 credit card numbers an hour with my wiz-bang pocket card reader. "Excuse me sir... I didn't mean to bump into you..."

Go for it

[TopShelf]

The nice thing from a security standpoint is that the credit card companies have it in their own best interest to make sure people feel confident using these new technologies. While a single cardholder could be at risk to lose a few thousand dollars, these companies have billions riding on these transactions. When it comes to secure computing, this is one industry that actually keeps it on the front burner...

Re:Go for it

[berzerke]

...When it comes to secure computing, this is one industry that actually keeps it on the front burner...

I beg to differ. Credit card fraud runs in the billions of $ every year. One article claims the losses will be about (2002 figures) "$285 million over the holiday season in the United States." And that's just about 1 month's worth. Credit cards are anything but secure. Since consumers don't see the cost of the fraud directly, most are barely aware it exists. Of course, the cost is passed on in the form of higher fees and interest.

Merchants (and their employees) don't help matters any either. On all my cards, in the signature block, I put "Please ask for ID". (I've checked with Discover and they have no problems with that, BTW). Rarely do I get asked for ID.

Then there are merchants, such as the USPS, which won't accept the card without an actual signature. Don't need to show ID (I tested this), but it must have a signature or they won't accept it. It's an actual federal rule (I checked), so the clerk isn't doing anything wrong. Maybe it's just me, but I would trust a driver's license MORE than a signature with nothing to compare it too.

Perfect business opportunity

[Anonymous Coward]

Shielded wallets/credit card holders. Someone call ThinkGeek.

Re:Perfect business opportunity

[GimmeFuel]

You're behing the times, man. Us early adopters have had tinfoil-shielded wallets for years. Don't you know the government has spy satellites that can read the magnetic stripe on your credit card and track you whereever you go?

/me climbs into tinfoil bodysuit and runs for protection in underground tinfoil bomb shelter

Re:Perfect business opportunity

[GnarlyNome]

How about the RFID tag in the tinfoil?

Sounds an awful lot like SpeedPass

[Otterley]

This sounds an awful lot like SpeedPass, which is at least 5 years old. Any idea what the difference is?

Yanno what I'm thinking...

[Julian Morrison]

so THAT's why the Jedi Hand Wave works.

"These are not the droids you're looking for"
(handwave, subtle ka-ching! sound)
"These are not the droids I'm looking for.. move along..."

Re:Yanno what I'm thinking...

[space_biker]

Didn't work for Qui-Gon in episode 1...Must have been in beta then?

Mobil Speedpass

[tbdean]

That's how I pay for gas at Mobil, with their Speedpass. It's a small keychain thing that looks like a black magot:

Well, that was how I paid for gas at Mobil. I cut my Speedpass open, took out the glass cylinder, and put it inside my Nextel i90 cell phone, it fit next to the battery. The Speedpass only lasted a few months before dieing. I haven't tried it again yet...

It was cool when it worked though, I just held my cell phone up to the pump to pay for gas.

Contactless credit cards?

[cperciva]

I've been using a contactless credit card for years. I type the number into an HTML form, and my card never comes within the same city as the merchant I'm purchasing something from. For that matter, it sometimes isn't in the same city as I am when I'm making the purchase -- for a couple months last year it was on a different continent.

In fact... let me see here... no, I still haven't gotten around to signing the back.

Absolute Fascist Control

[HotNeedleOfInquiry]

Read the article. Plenty of subtle reference to rights management and content control. Buy a DVD with this viper and have to wave it next to your DVD player to get it to play.

Let me get this straight...

[djupedal]

You say you are smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN, yet you also claim to be buying shit?

Most, if not all, of the smart people I know never, ever 'buy' shit....they seem to find a way where people continously give them shit, sometimes for no apparent reason. Now I know some would argue that this may well be a gift, but I've watched this happen, over and over, and I'm here to tell you, it seems like it doesn't matter what they do or what they say, someone will eventually give them shit. Really! I am not kidding! It's true!!

If you are having to pay for shit, may I suggest a crash course in shit 'taking'...you can sign up for one online I believe..perhaps right here, if you ask nice.

Re:Anyone taking bets...

[cruppel]

...I would like to see, say, a button on the card you have to press at the same time.

I had the pleasure of seeing a prototype credit card that had that feature. It was geared toward online purchases and basically worked like this:

1. You had to have a small signal receptor at the time...this was over three years ago and they were trying to get rid of that piece of equipment.
2. When you enter your card info on a website, instead of typing it, you press an area on the card, and it emits a sonic signal that tells the receptor that
3. 1. You've actually got the card and
   2. It's you using it. The info (name, billing address, etc) is all in the card.
4. To prevent someone from stealing your card and using it at their convenience you needed to enter a PIN once you pressed the button to make it work. In the end it auto-filled your forms for you, and I thought as a concept it looked promising.

The button is an excellent idea because you save transmitter life, although I'm sure there's a power supply that can live the life of a credit card. It also controls when the info is sent out. I wouldn't mind throwing a PIN on there either. Hell, I don't even have a credit card, just a check card, so I'm fine with PINs

Damn I like ordered lists!

Comments by proxy

[NeoPotato]

It's not a new concept. We already practice it here at Slashdot - we don't even have to read the article, we just get near the story and start spouting off comments.

How you gonna....

[djupedal]

You know, back when you could still afford to go out for dinner (DQ doesn't count), how the waitperson would bring the bill on a little plastic tray and lay it on the table....and you'd simply drop your c'card onto the bill...and then someone would take the tray and bill and c'card and....oh, wait, I get it...

Hello, I'm Dwayne, I'll be your card waver this evening.

These better have a small range

[ebuck]

These cards better have a small range (two feet max) or I don't see how you will manage to perserve the time-honored tradition of the grocery store line.

"Did you swipe your card?"

"Not yet."

"That's funny, because your total has already been paid!"

Pick-pocketing

[dachshund]

My work ID badge can operate through my wallet. In fact, I can often just touch my hip or coat pocket to the reader and the door will open, depending on how lazy I'm feeling.

My concern would be that unscrupulous individuals would use portable readers to get your card number. It would be a form of pick-pocketing that wouldn't actually require any contact or much risk of getting caught.

Hopefully, the cards would use some sort of challenge/response system, rather than a fixed number that could be replayed to a terminal. Still, there are bound to be vulnerabilities, and we'll probably be reading about them in a couple of years.

Hong Kong has had this for a while

[kramer2718]

When I visited Hong Kong in 2001, I bought a subway pass with this technology.

If you buy more than about $10 US of subway services, you have the option to get a smart card. My whole stay that card left my wallet only once (to return it for a refund). Othere than that when I used the subway, I would just set my wallet on top of the read. It was so conveneient.

Even better, lots of vendors (such as convenience stores) let you pay using your subway credit.

I guess there are more security concerns when using this with a real credit card, but it seems like it should have happened in this country sooner.

I can see a new Amazon patent

[DannyiMac]

I can see Amazon patenting 0-click technology with this...

Re:Why

[thirdrock]

Other than the magnetic strip not wearing out, what's the advantage?

When I lived in Hong Kong there was a smart card (not Credit Card) called Octopus. Basically, you buy the smart-card, you add cash funds to it, and then you can use it to ride the train system.

It was incredibly convenient, not to have to buy tickets, and much greater throughput than ticket machines. You just walked through the gate and swiped your wallet over the reader.

Anyways, it wasn't long before they figured out the advantage of converting the vending machines in the station over to Octopus. No cash to collect, just fill it up with product and collect the money from the Octopus administrators, less administrative fee.

I can tell you from experience, it beats the hell out of coins, changing money, messing about with cash, fumbling about with change. Just swipe your card and get your product. Faster, easier and much more effecient.

Best of all, the cards were anonymous, which means the govt couldn't track you via the card. Disadvantage of course is that if the card was lost or stolen, there was no recovery. I guess for that reason the maximum you could put on the card was HK$500.

To me this was the first step towards an anonymous cashless society, which despite the Orwellian protests of the tin-foilers, is IMO, A Good Thing(tm). Money spreads disease, has an administrative cost, is vunerable to forgery. If we can have all the advantages of cash, including anonymity, then I say, let's get rid of cash.

Re:Anyone taking bets...

[ColaMan]

Most of the proximity cards are powered by the RF field that is used to interrogate it.

Still , a button would be nice. Even just a 'squeeze point' (eg squeeze the card whilst waving over reader) would be handy.

Then we could also have the obligatory "Squeeze the last cent out of my card jokes"

Stopping fraud?

[chrome]

Reading some of the comments here about the security of these cards, and it makes me worry somewhat.

I used to sysadmin for a shell account company, and we saw huge amounts of credit card fraud, mostly from kids looking to run bots on IRC, or just because they collected shell accounts.

One thing I came away with from that experience was the definite feeling that Credit card companies don't seem to think it is in their interest to stop credit card fraud.

After all, if the owner of a card is frauded, the bill goes on their card, and interest is accrued. If the owner of the card isn't diligent, its possible they might just automatically pay the card off, without even realise they have been a victim of card fraud.

Certainly, the credit card companies don't seem to go after the fraudsters as much as they should. One of my friends on Dalnet used to regularly give the full details of people that she had discovered doing carding. One kid was so blatant, he put up a web page, with pictures of him holding up all the crap he had bought with stolen card numbers.

He was 12, and his mother didn't care in the slightest he was stealing. And neither did the credit card companies. The police were interested though, but he didn't have much repercussions - just a couple of weeks in a counselling center for kids.

Anyway, I digress.

Proximity cards are a great ieda. It means I can just wave my wallet near the scanner to pay for an item.

But, if this is not couple with some new form of identification currently not in use with credit cards (a pin number would suffice, or something biometric such as a thumb-print), then I fear that fraud will just increase.

People will get a hold of the scanners, and set up their iPod to capture the card numbers of anyone in proximit to it, and just walk up behind people, snapping up numbers.

Maybe I'm just getting paranoid.

Octopus

[ZarathustraThePolarB]

In Hong Kong we've had a similar technology for several years now. It's called the Octopus card and virtually everyone in the city has one. It can be used for payment on nearly all public transport and in stores where people make small purchases.

The EE Times article focuses on the technology is a bit light on details of what the card actually does, so I'm not sure if it is a stored-value card (like Octopus) or actually operates like a credit card. I would be surprised if it's the latter because of concerns about theft etc.

For the naysayers...

[SamMichaels]

The place where I used to work had these key fobs which worked like that. I thought it'd be cool that we just had to walk next to the door and it'd open it.

Not.

Even when directly contacting the sensor with the key fob in my pocket it didn't activate it. It had to be held infront of the device, almost touching it.

Whatever the range they say, I'm sure you're not going to be able to sniff out the RF signal by just sitting next to someone unless you have some expensive equipment.

One use that springs immediately to mind....

[grahamlee]

Waves AmEx These aren't the droids you're looking for...

Obiwan was a bribe merchant!

Re:How easy would it be to steal info from these?

[pirodude]

They do make contactless micro-processor smart cards. Schlumberger makes one, two, three, different versions.

From their site:

High-speed contactless operations are completed in less than 100 milliseconds and at distances of up to 10 cm from the reader. Security between different applications is ensured by two 48-bit diversified keys and specific access conditions per sector. Security is further reinforced by replay attack protection and a three-pass handshake, which manages the mutual authentication between the card and the reader. In addition, the Easyflex FastOS 2.0 fast anticollision algorithm allows more than one card to be processed by the reader at the same time.

Easyflex FastOS 2.0 communicates on the 13.56 MHz carrier frequency in compliance with the current ISO 14443-Type A standard and implements the standard Mifare protocol, allowing it to be used with the vast majority of contactless card systems.