Slashdot Mirror
Visa To Push Swipeless Credit Cards
BobPaul wrote in to mention an initiative by Visa to allow for swipeless credit card transactions. From the article: "...consumers need only wave credit and debit cards within a few inches of a reader to complete a purchase. And for purchases of less than $25, no signature is required...Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted". Update: 02/25 16:06 GMT by Z : References to RFID technology removed.
Especially since it would be easy enough to wave an RFID reader at people's purses, back pockets, etc. At, say, $24 each, in a large crowd, you could amass quite a bit of money, and many people would never know it happened.
How am I supposed to fit a pithy, relevant quote into 120 characters?
And now a thief doesn't have to guess PINs. It will be enough just to steal a card!
From TFA:
Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted, a key security feature, he said.
What protects consumers from fraudulent merchants waving some kind of electronic cash-sucking wand by your back pocket which contains your wallet which contains your RFID Visa card? There's no mention of this in the article at all!
It's a standard scam now for an unscrupulous merchant to charge millions of people a small amount of money fraudulently with the hopes that the vast majority won't even notice. Imagine what they will do when all they have to do is walk around a mall waving something at people purse's and backpockets!
I'm a big tall mofo.
This is an old /. tactic, don't get so excited: /. editor's attention.
1) Use misleading buzzword to capture
2) Front page story.
3) ???
4) Profit!
- "Nobody came out that night, not one was ever seen. But Old Man Stauf is waiting there, crazy sick and mean!"
Seriously. IT DOES NOT MENTION RFID ANYWHERE IN THE ARTICLE. Just so y'all realize. Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode? It's just a longer range barcode. And the chipmaker can set the length. It's just a way to get small amounts of information in to a computer. Relax.
And, I'm inclined to listen to visa a little bit when they say their card is secure. I mean, they are not exactly a company that can win by skimping on security. If the system is hacked, they pay, not you.
Recursive (adj.): see 'Recursive'
So, when Wal-Mart incorporates this technology, can I just have the bag containing the stolen card near the reader to purchase my illicit goods? And *IF* I am questioned about it, I can say that I didn't know it was in there, and I thought it was going to read my REAL card.
Also, does this mean that around the holidays in the mall, I wont have to hand the card over along with my driver's liscence?
"No, you don't need my ID, maam. Don't you know those cards can't be faked? It's completely secure. Yeah, I heard about it on the news, too. Never need to see my ID again. Compleltly safe. Don't forget to put that $1,235.65 on "credit". okay?"
And while the article says there is a code that can't be re-used for other readers, wont a signal jumper (the ones used to grab car alarm frequencies) still be able to get the 16 digit card number, plus exp. date?
Yeah, sending important financial data through the air sounds like a great idea. To the tech savvy, this is the same as screaming the numbers to the woman behind the register. Would you do that?
There are no gods but ourselves.
Tired of having to swipe and sign every time you use a credit card?
I haven't signed for a purchase in a long time, except once in a restaurant. Everything is chip and pin now. You can just stick your card in the reader, enter your pin, and be done. Something you have and something you know, at least it is two items of security.
Surely this contactless card will simply turn it to something you have being a requirement, making trivial theft very profitable.
Are Americans so lazy that they can't hand over the card to the cashier to swipe/insert into the chip reader?
All this looks like to me is credit card companies trying to generate a new revenue stream by getting existing merchants to pony up for the new technology required to use this system.
Is it really so hard to swipe your card through a reader as you checkout? Does Visa really think people are so lazy that swiping a card is too much work?
This is an example of technology being used simply because it exists. This adds ZERO value for the consumer and opens up huge security holes. Who believes for one second that this technology is actually 100% secure?
I guess we're supposed to be reassured by the quote from the Visa rep in the article reminding us that there is no consumer liability for fraud.
I can only imagine what is going to happen if they roll out debit/checkcards linked to actual bank accounts with this technology!
once someone figures out how to bypass the code, all they need to do is walk by you to steal your card. and besides, how lazy do you have to be not to take out your card and swipe it? seriously: 1) take card out 2) swipe. wow, that was so hard, i need to create an elaborate method so that i dont even need to move my fat ass anymore.
So now instead of someone having to take my wallet to steal my credit card they can just walk by me with a contactless reader?
hack a day
Hopefully not as easy as stopping payment on questionable charges to the account. The advantage of online progressively-updated statements becomes infinitely greater here; you'll have to check your statements every WEEK if it gets bad. Genuine cowhide is out, 100 mil thick aluminum is in!
"Ancillary does not mean you get to rule the world." --U.S. Circuit Judge Harry Edwards, speaking to the FCC's lawyer
Why do I need a contactless transaction? What is so hard about running my card through the slot in the terminal?
The information is transferred via radio signal. Given only this information I also would have inferred that RFID chips are used. The devil may be in the details but saying that it is misleading, dishonest and unproffesional is a little overboard. The main concern of security is still the same.
Aaaaand... the merchant gets screwed.
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
Please excuse me while I get this personal pet peeve off my chest.
WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?
I Don't sign my cards. I write in bold letters on the back MUST SEE ID. Still only about 1 in 20 times am I asked for an ID, even when makeing a $50+ purchase.
And the debit cards. The advertising on them is insane. They have some celebrity come out and get asked for ID then say - "With our Check Card, you Never need ID" And how is this supposed to be a good thing? I'm supposed to be happy that it is even easier for someone who has stolen a card to go and clear out my checking account? Who the heck goes out with their credit cards, but skips their ID? Who the heck runs around without an ID in the first place? What, your going to go into your wallet or purse, take out the debit card, and leave your licence/ID in there?
With all the credit card fraud and identity theft gong on, why would anyone make it even easier to ruin your credit rating and entangle you in hours upon hours of sometimes futile effort to get it set straight?
Mind you I will screem like hell if somebody REQUIRES me to carry an ID all the time - but cash spends fine without any verification.
Thanks.
You're right, it may only be misleading and unprofessional.
I could just see me pull out my wallet and have it just be in range of the reader. I intend it to charge to one card and...whoops, it charges to the card I'm almost over limit on.
But the slow part involves getting out the card, answering the debit/credit question, printing the receipt, and signing it. If the goal is speed up the process the debit/credit question could be removed and the signature. I'm assuming people still want receipts, although I could be wrong there.
I too sign my cards CHECK I.D. This is accepted practice. Some credit card companies have even recommended it. Stores are SUPPOSED to ask for ID in that case, the point being to see that the photo ID matches my face, and the names match.
I'd like to see some store manager so ignorant as to try to confiscate my credit card because it tells him to to ask for I.D.
Infuriate left and right
The merchant does not add a $20 item and transfer money instantly. It has to go thru the issuing bank, and not instantly, and not without the possibility of chargebacks, and then that merchant will lose his VISA account and be out of business. If you dispute the matter, and they see a pattern of some merchant going bananas with $20 chargebacks, he will be in banana-skin city. The merchant will lose. This is credit cards.
Infuriate left and right
WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?
Generally as a customer I don't. Not that I think showing ID is bad idea but I generally find the signature and to a lesser extend ID security measures to be as pointless as most of the airline "security". They're half heartedly implemented, irritating, and as implemented don't really do much to stop crime. It's appearance of security without substance. I wouldn't mind people asking for ID except that almost no one does, so what's the point? And the signature matching is a stupid since any thief with half a brain (admitedly some lack even half) will just look at the card and make at least a half-hearted effort to copy it. It's not like he has to look hard for it...
Let me be clear. I have the mistfortune of being a man with a name that is very rarely associated with the masculine gender. As irritating as that is to me, I should get asked for my ID all the time. But I don't which tells me that the the store management and credit card companies don't really percieve it as a problem. And they have the data to know whether it is or isn't. It's not like they're guessing. Furthermore, when I do get asked for ID, it's almost always at places like an airport (where I've been asked for my ID 20 times) when buying a $4 magazine, never for the $1000 printer. As a customer, I'll admit that being asked for ID is irritating and I don't like being regarded as a potential criminal but if it were a widely implemented security measure, I could deal. But since the credit card companies and most retailers don't regard it as enough of a problem (actions speak louder than words) to ask for ID consistently, I'd rather they save me the irritation and not bother at all.
It gets repeated here ad-nauseum that authentication consists of some combination of what you have, what you are and what you know. The signature is worthless as a security measure because it is simply two instances of something you have in the same item. Someone who takes my credit card also has my signature. Asking for photo ID sort of gets at what you are, though it can be forged by an ambitious criminal. But it could slow down the smaller thefts were it actually used. A pin code is actually useful IMO because it is something you know but is not used (for cost reasons mostly) for credit cards here in the US. And unlike biometric ID, it can be changed if there is a mixup.
While I'm venting, what really irritates me is when they have those swipe-it-yourself pads but still ask to see the signature! I've already mentioned that I think signature comparison is worthless as a security measure, but this practice just wastes both my time and the clerk's time. Furthermore they don't physically have the card at the right time if the credit card company tells them to hold the card. If they want to see my signature, the clerk should swipe the card him/herself and check. By having me do it, they don't save any time and they don't improve security. If they are going to ask for something they should ask for ID at that point, not a signature.
Is that PIN pad on the card itself?
Nope, it'll work the same way PIN pads at Wal-mart (and wherever else) work right now.
Can that be made durable enough to live in my wallet?
Durability isn't the problem with putting a PIN pad on the card. The problems are power (where do you get it?) and cost -- mostly for the increased manufacturing complexity.
It sounds like these cards are going to be pricey (several dollars each to manufacture).
About $3 each. Current cards cost about $0.25 each. Cards with a PIN pad would be closer to $10 each.
Is there a way to extend that unique RFID chip to online transactions? Maybe a reader hooked to your computer?
Sure. Contactless readers are still fairly expensive, though, the cheapest one I know of costs about $70. However, most of these cards will probably also have a contact plate, so you can use them with a contact reader attached to your PC. Those readers can be bought for along with the sooper-seekrit protection code on the back
Yeah, CVV and CVV2 are a joke.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Think about how many times you go to a store but don't buy anything and you walk out passing nearby the registers...
I agree completely that this technology is useful and should be more secure than what we have today if it is used right. But it is surely a problem if someone can swipe your card without your knowledge while it is still sitting on your keychain. A small amount among a whole bunch of other small amounts in a month has a good chance to go unnoticed.