Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 13 down vote favorite
1

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just bumping into me on the street? Do all NFC devices require user interaction to confirm payment?

I can see how a mobile phone might ask me to confirm the payment, but an NFC-enabled credit card is unlikely to have the input or output devices to prompt me for such a confirmation.

share|improve this question
Additional information from 2006. events.iaik.tugraz.at/RFIDSec06/Program/papers/… – Bernie White Jul 3 '12 at 19:46

3 Answers

up vote 8 down vote accepted

The card is supposed to authenticate the reader, so that only legitimate (bank-issued) readers can access the card. This does not preclude a legitimate reader making fake payments, either because the merchant is dishonest or because the reader was stolen. The payment should be traceable though, and the bank should be responsible for any charge resulting of their lack of security.

Banks and other providers of financial services are waffling between always requiring a PIN (which is disruptive, and is vulnerable to terminal spoofing anyway) and not requiring a PIN for small transactions (which is risky, but practically required for use cases such as paying for a subway ticket when passing a fare gate).

Note the “supposed to”, “should”, etc. This is a new ecosystem, and the security expectations haven't crystallized yet. The security achieved by NFC cards and devices tends to be less than chip-and-PIN contact cards, but more than filling out the card number and expiration date on a web page.

share|improve this answer
up vote 6 down vote

There is nothing to stop the NFC being read from a card in the UK according to this study conducted recently by a security firm called ViaForensics.

On a NFC enabled phone the article states that the NFC hardware is switched off when the screen is not lit.

share|improve this answer
On an NFC-enabled phone, whether NFC is disabled when the screen is off is determined by power saving considerations, not by security considerations. One NFC use case requires NFC always-on (transportation), but this is a battery drain so vendors are divided as to what to do. – Gilles Jun 28 '12 at 18:15
up vote 2 down vote

you have to enter a pin to complete the transaction. source: http://www.google.com/wallet/how-it-works-security.html

share|improve this answer
3  
How do you enter a PIN on a card? – curiousguy Jun 28 '12 at 12:41
@curiousguy google.com/wallet/what-is-google-wallet.html – Thawab Jun 28 '12 at 12:51
2  
Not 100% correct @curiousguy the British bank Barclay's will ask for your pin to be typed into the NFC reader "occasionally". barclaycard.co.uk/personal/getting-more/contactless But that will be just to authorise a payment. I'm sure the information held on the NFC is probably still readable. – SomethingSmithe Jun 28 '12 at 14:05
3  
@curiousguy - You need to stop being literal about everything. I don't even see the word "card" used in his answer. If a pin is required you would input it into the reader not the card. – Ramhound Jun 28 '12 at 14:24
1  
@Ramhound "I don't even see the word "card" used in his answer." No, but I see it in the question. – curiousguy Jun 28 '12 at 15:34
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.