Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just bumping into me on the street? Do all NFC devices require user interaction to confirm payment?

I can see how a mobile phone might ask me to confirm the payment, but an NFC-enabled credit card is unlikely to have the input or output devices to prompt me for such a confirmation.

share|improve this question
    
Additional information from 2006. events.iaik.tugraz.at/RFIDSec06/Program/papers/… –  Bernie White Jul 3 '12 at 19:46
add comment

3 Answers

up vote 7 down vote accepted

The card is supposed to authenticate the reader, so that only legitimate (bank-issued) readers can access the card. This does not preclude a legitimate reader making fake payments, either because the merchant is dishonest or because the reader was stolen. The payment should be traceable though, and the bank should be responsible for any charge resulting of their lack of security.

Banks and other providers of financial services are waffling between always requiring a PIN (which is disruptive, and is vulnerable to terminal spoofing anyway) and not requiring a PIN for small transactions (which is risky, but practically required for use cases such as paying for a subway ticket when passing a fare gate).

Note the “supposed to”, “should”, etc. This is a new ecosystem, and the security expectations haven't crystallized yet. The security achieved by NFC cards and devices tends to be less than chip-and-PIN contact cards, but more than filling out the card number and expiration date on a web page.

share|improve this answer
    
This seems to be incorrect in that the card doesn't authenticate the reader at all. The reader does authenticate the card however. You can read the details off a card and get get a transaction approved by a card just using a PC or a phone, the card doesn't care where the commands are coming from. –  Peanut Aug 5 '13 at 17:32
add comment

There is nothing to stop the NFC being read from a card in the UK according to this study conducted recently by a security firm called ViaForensics.

On a NFC enabled phone the article states that the NFC hardware is switched off when the screen is not lit.

share|improve this answer
    
On an NFC-enabled phone, whether NFC is disabled when the screen is off is determined by power saving considerations, not by security considerations. One NFC use case requires NFC always-on (transportation), but this is a battery drain so vendors are divided as to what to do. –  Gilles Jun 28 '12 at 18:15
add comment

you have to enter a pin to complete the transaction. source: http://www.google.com/wallet/how-it-works-security.html

share|improve this answer
3  
How do you enter a PIN on a card? –  curiousguy Jun 28 '12 at 12:41
    
@curiousguy google.com/wallet/what-is-google-wallet.html –  Thawab Jun 28 '12 at 12:51
2  
Not 100% correct @curiousguy the British bank Barclay's will ask for your pin to be typed into the NFC reader "occasionally". barclaycard.co.uk/personal/getting-more/contactless But that will be just to authorise a payment. I'm sure the information held on the NFC is probably still readable. –  SomethingSmithe Jun 28 '12 at 14:05
3  
@curiousguy - You need to stop being literal about everything. I don't even see the word "card" used in his answer. If a pin is required you would input it into the reader not the card. –  Ramhound Jun 28 '12 at 14:24
1  
@Ramhound "I don't even see the word "card" used in his answer." No, but I see it in the question. –  curiousguy Jun 28 '12 at 15:34
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.