Slashdot Mirror
UK Consumers Reporting Contactless Payment Errors
leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Suddenly they are becoming popular - Icelandair are selling one on the inflight goodies list, as are various designer shops in Reykjavik.
Korma: Good
Someone must have gotten their units mixed up and used 4 inches.
now we need to go OSS in diesel cars
Quick, buy stock in companies selling RF-blocking wallets and bags
And don't forget fashion - my electric-blue aluminium wallet pairs nicely with my neon-green tinfoil hat!
Who would've thought that it's a bad idea?
Tinfoil is your friend. Always has been, always will be.
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
Like at an auction, when you scratch an itch on your nose, you find that you just bid 2 mil for a painting of Bea Arthur
“He’s not deformed, he’s just drunk!”
While these incidents do not involve a security breach, they do indicate a sloppiness in the implementation, and so raise the concern that the system has been developed without the attention to detail that is a necessary (but not sufficient) prerequisite for security.
retail stores shoplift YOU!
Politics is Treachery, Religion is Brainwashing
The hardware having the wrong range is probably pretty hard to avoid due to variance between terminals and problems keeping them all tuned over their lifetime.
However, the NFC reader shouldn't be active until the customer told the cashier he/she will be using a contactless card for payment and the cashier enabling the reader.
It wouldn't prevent reading the wrong card if the customer has several NFC cards, but it would at least prevent the kind of surprises shown in the article.
QUESTIONMARK
I will never use this tech. If I find out that I've been issed with an NFC Card I'll return it to the issuer with a few choice words.
Frankly, I see this as just the tip of the proverbial IceBerg.
Why am I so anti this tech?
Well, I am one of those who has had their identity stolen. IT took me a really long time to get rid of the damage it did to my credit and other ratings. I see this tech as a really good way to start that whole process off.
Many customers have also reported paying me, even though they've never met me! Because see, I have this device that can read their contactless cards at at least a metre away. I also use it to steal their passport details.
Criminals are awesome. But I only say that 'cause I'm a criminal.
These contactless payment things are idiotic. Proximity to a reader is not the same as accepting to pay. Pressing a few buttons is not a problem, unless you have no fingers, in which case you should have a pointer device attached to your hand anyway.
Contactless payment is yet another stupid "innovation" that makes life worse. Who comes up with this crap?
Companies are always looking for a way to make paying for stuff 'smoother' or quicker, when the payment methods we already have (cash for one, swiping a credit card for another) work just fine. Of course, there's an ulterior motive IMHO. The faster you can pay for something, the faster you can impulsively buy things without, you know, actually THINKING about out it.
stick it in the microwave for 1 sec on the lowest setting
I'd be willing to bet that 90% of the time this happens it's because a woman's put her handbag on the counter to get the wallet out, it's brushed up close against the sensor and activated it. Contactless is designed to be able to be used in a wallet, guessing distance is the big limiting factor, not having a couple of layers of cloth between them.
Imagine if I'm buying something and the person behind me gets charged. Wouldn't that be awesome? /me wraps wallet in tinfoil to avoid being the berson behind
While these incidents do not involve a security breach...
A vendor's machine can take money from me without my consent or knowledge.
Apropos of nothing, what would constitute a security breach in your model?
The "N" in NFC is for "Near." I have never trusted it, knowing that someone in line behind me could easily read the card without having to do anything I would be able to notice.
For this reason, I had my bank send me replacement credit cards without NFC chips in them.
I don't go to those silly places that require it, so I will continue to function in a world where only the merchant and the entire network behind him are putting me at risk, instead of also inviting everyone who passes within a few feet of me to participate.
I requested that my bank issue me a card with out a chip. And they did.
Wouldn't just having a button/contact pad on the card be much much simpler? You must press the button to connect the antenna/battery/collector? Press button on card, swipe. On your way?
And the card is in a wallet, pressed up against other cards? This is still not the way...
I finally have a use for my tinfoil wallet!
But the Brookstone one costs 4X as much, true to form...
My first Amex Blue for Business had a chip on it. It wasn't compatible with chip and pin, it was a separate system. Now it has an RFID chip, ExpressPay. And Visa has payWave. And MasterCard as PayPass. They're all separate systems. If a merchant terminal supports contactless, they tend to support all three systems. Google Wallet on Android phones mostly use PayPass. A few earlier ones used payWave. As for online banking, HSBC business requires a fob. I've asked for them to support Google Authenticator instead so I don't have to keep that fob around with me all the time. None of my other banks do this. UBS now emails or robo calls you with a one time passcode used for MFA in addition to the password. For CitiBank it's username/password only.
The confirmation method has to be attached to the card otherwise it leaves open the option for rogue devices to drain your money.
there are two ways. my favourite is the first.
1) put passport / credit card on a plate
2) put small amount of water on top of NFC chip
3) put plate into microwave oven
4) set for 3 seconds on HIGH
5) press button and watch pretty sparks
6) open door VERY QUICKLY and put out anything that's smoking or on fire
7) smile and relax, knowing that you are secure from being phished.
the other way is perhaps less risky:
1) obtain a 50,000 volt electrocution device aka "stun gun"....
My Norwegian bank issued me a chip and pin card. I like it. The waitress or the teller never touches my card. I put it in the terminal when I see the total I am being charged. I punch in the PIN and the card verifies with the bank and the term. prints a receipt. In a restaurant the server brings a wireless terminal to the table and I do the same thing. The protocol allows for a gratuity to be added. As long as no thug or dip looks over my shoulder and sees my PIN I fell pretty safe from fraud. I use this card all over the continent. My US cards work, but they are less secure and I get a nasty foreign transaction fee and a disadvantageous exchange rate. Chip and PIN rocks. Hard to believe consumers wearied of punching in a little PIN. Besides, for small purchases cash works. Near Field Communication payment is an idea whose time is yet to come. I do not want an experimental-stage NFC. It will be cool when all my products are fitted with rfid tags and my NFC payment fob is in my pocket. I walk out of the store with my basket, pause at a terminal to visually scan the inventory for which I am being charged (or not), confirm, then get the receipt beamed to my fob or smart phone. Until then the chip and pin is fine. I was wondering at the profusion of stainless steel wallets on Travel Smith. They were not all passport sized. Now I understand. It makes me wonder if my current chip and pin is NFC too. Feh! Makes me want to return to the good old days of cowrie shells.
"No fear. No envy. No meanness." Liam Clancy
*Somebody* had to say it.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
As for online banking, HSBC business requires a fob. I've asked for them to support Google Authenticator instead so I don't have to keep that fob around with me all the time.
That HSBC fob is from Verisign. Download the Verisign "VIP Access" to your smartphone then call HSBC and tell them you've replaced your current fob and need to enroll the replacement to your account. The app will give you the data they need, will seem just like the physical fob to their systems, but won't require you to carry anything extra anymore.
Now that I've been helpful I'm going to rant: I wish tech geeks would stop fucking pushing Google offerings as the only solution to any problem. Google Wallet, Google Authenticator, ... there are plenty of other vendors offering solutions and many of them have been offering good solutions since long before Google realized there was another way to aggregate away our privacy.
You forgot:
8) Throw card away since it is useless now.
No idea how it is in the USA, but in Europe the magnet strip is hardly used anymore. Too insecure. Some people even destroy it on purpose. Instead a chip in the card used. Not a NFC chip. So, how do you destroy one chip in a microwave oven, but leave another chip on the same card intact?
I'm in New Zealand and they've just started doing advertising for these kinds of card.
The first ad was a bunch of people in a hurry on their way to a wedding. Fair enough.
The second ad has people in a coffee shop, paying by contactless card. When one guy gets out cash, the entire shop stops and stares at him, with everything going quiet, until he is finished. This has literally turned up in the last maybe 2 months and their advertising has immediately gone to "what a fucking weirdo you are if you want to pay with cash. Everyone stop and look at this fucking weirdo"
You were told it is a CONSPIRACY theory that NFC would allow a credit/debit card to be used without the owners permission. You were told it is a CONSPIRACY theory that smart meters would allow the government to monitor each appliance in your home, and shut down the power if the government disapproved of your energy consumption. You were told it is a CONSPIRACY theory that the government wishes to switch entirely to digital currency, so that the government can deny the use of currency to individual targets.
You are sheep. You are betas. You are conditioned, lied to and controlled for the benefit of those who consider themselves better than you. You are cattle to be farmed, exploited, and sent to the rendering factories when no longer of use.
In the UK (home of '1984' and 'Animal Farm'), technology is exploited to abuse the population just as soon as it reaches that level of possibility. Only a week or so back, the British government actually BOASTED about how smart meters would allow 'bad' households to have their power removed, and by 'bad' they explicitly stated they meant people who, for instance, had too big a fridge for their family unit (or too big a TV, or too many computers).
It comes as no surprise that the first widespread abuse of the NFC system should happen in the UK as well. Britain's major stores and supermarkets are owned by people who can be considered the second tier of Britain's political power structure. They directly fund and control the public facing parts of the three major political parties- Conservatives, Liberals, and Labour. As a consequence, price fixing is a universal policy in Britain's major food stores, giving Britons the highest food prices and lowest food quality amongst the major nations of the Western World (see the 'horse meat' scandal as a tiny example). British supermarket chains have the highest level of profits on the planet.
With the advent of computer tills, the crooks that run Britain's supermarkets could NOT resist the temptation to run massive numbers of scams against shoppers already paying sky high prices for terrible products. Any major shopper who inspects their till receipt will always find at least one error (in favour of the supermarket, of course). The "whoops, we accidentally charged your debit card via NFC" is simply an extension of this process. Once upon a time, UK supermarkets were subject to massive fines for mistakes in pricing, or issues with food quality. Now, there are ZERO penalties even when a supermarket company is found engaging in the worst criminal practises. British 'trading standards' were rendered fully toothless by Blair in this regard, told to focus on the 'scourge' of counterfeit goods/software instead (you know, the small time crooks under-cutting the prices of the big-time crooks that pay off the politicians).
The excuse is that Britons have much STRONGER consumer rights protection than, for instance, you Yanks (this is true)- but this requires the individual consumer to notice they have been ripped off, and to actually make an effort to confront the shop itself. A bold, mouthy Brit will always get satisfaction. However, schools increasingly teach the pupils to be timid and subservient to all authority, reducing the likelihood that as adults, they would seek redress. Rights are no use if they vast majority of people are too frightened or uninformed to use them.
PS- the overcharging at the till trick is brilliant, because to get your money back (usually a few quid), you have to wait maybe 30 mins at a special counter, while all your frozen goods defrost in your trolley/bags. Thus, even those that notice the mistake consider it more trouble than it is worth to seek redress. None of this is by accident.
Someone else in this discussion suggested cutting a notch in the edge of the card to destroy the antenna.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Use cash in stores and leave the card at home. The only place you need to take it is the ATM.
I have been thinking the easiest way to cheat the system is a repeater. Just use the card in the wallet of the guy next to you to pay the bill. Since you are not decoding the info there is no security requirement. The plus is it just looks like the shops system malfunctioned.
Since RFIDs landed in passports it's been a fairly badly held secret that the only thing that limits the range of such devices is the quality of the antenna and the transceiver.
The only reason those terminals work on proximity is because they use crap aerials. All it takes is a larger aerial and you can get up to max 10 meter range (beyond that the S/N ratio becomes an issue).
The only real question is why card companies are pretending they don't know this.
When have you ever known a card company to limit its opportunity to get you into interest paying debt? Why else do you think they put a payment limit on NFC transactions?
Insert
NFC has been massively rolled out throughout the first world for years.
Your whiny crusade was baseless. Everything went fine. A few tiny, hardly substantiated blips do not justify your years of rage and apocalyptic predictions at RFID cards. You lost, and you were wrong. Get-over-it.
crickets
Korma: Good
am I not surprised? *Sigh*
"No fear. No envy. No meanness." Liam Clancy
Some UK cards require Chip (on card) PIN entry on card machine and signature as well into machine. It detects after the fact false records, originally for use inside banks so elderly (memory loss etc for PIN numbers) can get teller to enter PIN from a record in bank, the signature verified the request to enter PIN.
Regards Eion MacDonald
How about those of the person in line in-front-of/behind me?
If I have a receipt showing I paid for something via debit and Visa also charged me, I'm probably good. How do I show that I didn't pay for what was actually Bob's groceries?