Slashdot Mirror
UK Consumers Reporting Contactless Payment Errors
leathered writes "The BBC reports that some customers of UK retailer Marks and Spencer have reported that the store's contactless payment terminals have debited their cards despite being in their bags or pockets, sometimes paying twice when they have used another payment method. The cards are supposed to work only when the card comes within 4cm of the terminal. Customers of fast-food chain Pret a Manger have been reporting similar problems, and in both cases cited the customers weren't even aware they had been issued with NFC-enabled cards by their bank."
sometimes paying twice when they have used another payment method.
Why is the software even accepting a new payment? Shouldn't the balance already be 0 by then?
Suddenly they are becoming popular - Icelandair are selling one on the inflight goodies list, as are various designer shops in Reykjavik.
Korma: Good
Someone must have gotten their units mixed up and used 4 inches.
now we need to go OSS in diesel cars
Quick, buy stock in companies selling RF-blocking wallets and bags
And don't forget fashion - my electric-blue aluminium wallet pairs nicely with my neon-green tinfoil hat!
Who would've thought that it's a bad idea?
Tinfoil is your friend. Always has been, always will be.
And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.
It reminds me of the phone pay-with-phone thing. I have to carry a wallet anyway for ID and other important documents (and yes, cash, which is the ultimate fall-back and non-tracking/anonymous payment method). Yes, I will also carry my phone. So it is somehow faster and more convenient to take my phone out of my holster, turn it "on", unlock it, launch a payment app, enter some stuff, position it correctly on a terminal, press some confirmation keys, turn it back off, and put it back into its holster. That is faster?
Yet we still don't address the MAIN problem with [credit] cards [at least in the USA]- the lack of confidential PIN codes to secure them from unauthorized use- and all us consumers are paying for that. At least I have noticed gas pumps and some other devices asking me for my zip code.... better than nothing I suppose.
Like at an auction, when you scratch an itch on your nose, you find that you just bid 2 mil for a painting of Bea Arthur
“He’s not deformed, he’s just drunk!”
While these incidents do not involve a security breach, they do indicate a sloppiness in the implementation, and so raise the concern that the system has been developed without the attention to detail that is a necessary (but not sufficient) prerequisite for security.
retail stores shoplift YOU!
Politics is Treachery, Religion is Brainwashing
The hardware having the wrong range is probably pretty hard to avoid due to variance between terminals and problems keeping them all tuned over their lifetime.
However, the NFC reader shouldn't be active until the customer told the cashier he/she will be using a contactless card for payment and the cashier enabling the reader.
It wouldn't prevent reading the wrong card if the customer has several NFC cards, but it would at least prevent the kind of surprises shown in the article.
I'd be willing to bet that 90% of the time this happens it's because a woman's put her handbag on the counter to get the wallet out, it's brushed up close against the sensor and activated it. Contactless is designed to be able to be used in a wallet, guessing distance is the big limiting factor, not having a couple of layers of cloth between them.
While these incidents do not involve a security breach...
A vendor's machine can take money from me without my consent or knowledge.
Apropos of nothing, what would constitute a security breach in your model?
Wouldn't just having a button/contact pad on the card be much much simpler? You must press the button to connect the antenna/battery/collector? Press button on card, swipe. On your way?
But the Brookstone one costs 4X as much, true to form...
My first Amex Blue for Business had a chip on it. It wasn't compatible with chip and pin, it was a separate system. Now it has an RFID chip, ExpressPay. And Visa has payWave. And MasterCard as PayPass. They're all separate systems. If a merchant terminal supports contactless, they tend to support all three systems. Google Wallet on Android phones mostly use PayPass. A few earlier ones used payWave. As for online banking, HSBC business requires a fob. I've asked for them to support Google Authenticator instead so I don't have to keep that fob around with me all the time. None of my other banks do this. UBS now emails or robo calls you with a one time passcode used for MFA in addition to the password. For CitiBank it's username/password only.
It is possible to successfully read the data exchanged with a NFC card up to 2 meters away. Just have a decent snooping device in your backpack or handbag and you can sniff the transactions of other people.
You can have a transmitter with decent power at 13.56MHz that you turn on when you get in an area with NFC readers and see how many checkouts that fails to work.
There are a few other listed security issues too with NFC cards here: MMN-o | Blog, for those that aren't able to read Swedish - use the online translator.
Yet more reading:
Study on Public Transport Smartcards – Final Report
Do contactless cards expose you to fraud?
Anyway - when it comes to NFC there are different types of cards, some are simple and doesn't have any encryption at all (E.g. Mifare Ultralight), some have an encryption which is very weak and is cracked within minutes (Mifare Classic) and some are running DES, but I expect that it has a few weaknesses too since the exchange between the card and reader is easy to snoop.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The cards with a visible chip aren't the problem, it's the cards with hidden chips that communicates with radio that are.
The contact-chips have a different set of problems and attack vectors but they are safer than the magnetic strip. Recently some skimming equipment has been found for the chip cards. As for NFC cards you can be further away to skim them.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The confirmation method has to be attached to the card otherwise it leaves open the option for rogue devices to drain your money.
If I find out that I've been issed with an NFC Card
Are you sure you haven't? I have a few cards that contain rfid chips and I was never notified. The only way to know was the logo on the card (and I guess the absence of that is not a guarantee)
there are two ways. my favourite is the first.
1) put passport / credit card on a plate
2) put small amount of water on top of NFC chip
3) put plate into microwave oven
4) set for 3 seconds on HIGH
5) press button and watch pretty sparks
6) open door VERY QUICKLY and put out anything that's smoking or on fire
7) smile and relax, knowing that you are secure from being phished.
the other way is perhaps less risky:
1) obtain a 50,000 volt electrocution device aka "stun gun"....
My Norwegian bank issued me a chip and pin card. I like it. The waitress or the teller never touches my card. I put it in the terminal when I see the total I am being charged. I punch in the PIN and the card verifies with the bank and the term. prints a receipt. In a restaurant the server brings a wireless terminal to the table and I do the same thing. The protocol allows for a gratuity to be added. As long as no thug or dip looks over my shoulder and sees my PIN I fell pretty safe from fraud. I use this card all over the continent. My US cards work, but they are less secure and I get a nasty foreign transaction fee and a disadvantageous exchange rate. Chip and PIN rocks. Hard to believe consumers wearied of punching in a little PIN. Besides, for small purchases cash works. Near Field Communication payment is an idea whose time is yet to come. I do not want an experimental-stage NFC. It will be cool when all my products are fitted with rfid tags and my NFC payment fob is in my pocket. I walk out of the store with my basket, pause at a terminal to visually scan the inventory for which I am being charged (or not), confirm, then get the receipt beamed to my fob or smart phone. Until then the chip and pin is fine. I was wondering at the profusion of stainless steel wallets on Travel Smith. They were not all passport sized. Now I understand. It makes me wonder if my current chip and pin is NFC too. Feh! Makes me want to return to the good old days of cowrie shells.
"No fear. No envy. No meanness." Liam Clancy
*Somebody* had to say it.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
You forgot:
8) Throw card away since it is useless now.
No idea how it is in the USA, but in Europe the magnet strip is hardly used anymore. Too insecure. Some people even destroy it on purpose. Instead a chip in the card used. Not a NFC chip. So, how do you destroy one chip in a microwave oven, but leave another chip on the same card intact?
Someone else in this discussion suggested cutting a notch in the edge of the card to destroy the antenna.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Use cash in stores and leave the card at home. The only place you need to take it is the ATM.
Since RFIDs landed in passports it's been a fairly badly held secret that the only thing that limits the range of such devices is the quality of the antenna and the transceiver.
The only reason those terminals work on proximity is because they use crap aerials. All it takes is a larger aerial and you can get up to max 10 meter range (beyond that the S/N ratio becomes an issue).
The only real question is why card companies are pretending they don't know this.
When have you ever known a card company to limit its opportunity to get you into interest paying debt? Why else do you think they put a payment limit on NFC transactions?
Insert
crickets
Korma: Good
mod parent +1, Sneaky Bastard.
********* sig: If you don't like the law, get filthy stinking rich, and buy a better one.
am I not surprised? *Sigh*
"No fear. No envy. No meanness." Liam Clancy
Some UK cards require Chip (on card) PIN entry on card machine and signature as well into machine. It detects after the fact false records, originally for use inside banks so elderly (memory loss etc for PIN numbers) can get teller to enter PIN from a record in bank, the signature verified the request to enter PIN.
Regards Eion MacDonald
How about those of the person in line in-front-of/behind me?
If I have a receipt showing I paid for something via debit and Visa also charged me, I'm probably good. How do I show that I didn't pay for what was actually Bob's groceries?