Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device.

It apparently works by scanning the credit card data into a mobile application that syncs with the Coin device itself over Bluetooth. The scanner works like a credit card skimmer from my understanding of it.

What are the security and regulatory implications of a device like this? Does it violate PCI-DSS in anyway? Without actually having the device to test against, what plausible security threats might exist?

share|improve this question
2  
1) How would it clone the chip? AFAIK magnet strips are only used on legacy devices. 2) What's the point of it? Do people seriously carry around multiple credit cards? –  CodesInChaos Nov 18 '13 at 8:33
    
@CodesInChaos 1) Apparently, this device targets the US market, where magnetic strips are still the standard for credit/debit cards. 2) I have no idea. I've never carried more than two cards. But if TV shows are right, then carrying multiple card seems to be quite normal in the US. –  Adnan Nov 18 '13 at 8:54
add comment

3 Answers

up vote 5 down vote accepted

Coin relies on the loophole that they're not a merchant or a middle-man handling payment data; they're just an electronic form of a physical wallet and the data is always with the customer (on the Coin itself). This is apparent in their FAQ:

Q. Does Coin have a PCI PA-DSS validation?

A. The PCI Security Standards Council PA-DSS program addresses payment applications used to accept and process payment for goods and services. A device such as a Coin is seen as similar to a payment card in a consumer’s wallet and the standard does not apply.

Coin loses one aspect of handling a payment card - physical identification characteristics; the name isn't physically present on the card, so is the expiration date and the customer's signature. This will be met with disagreement from merchants as this will make fraud much more difficult to detect by the human cashier employee. (Note: This is one aspect of fraud detection. I'm aware that this can be easily circumvented. The fact is, merchants still train their employees on these practices).

Clearly, this device is targeting the US market where magnetic stripe cards are still the standard.Personally, I see this device massively failing (and I certainly hope so) because most US card issuers have announced that in 2017 they will be implementing a liability shift in cases of fraudulent transactions. This means that any merchant or ATM operator that doesn't use EMV (~Chip&Pin) will be liable for this transaction. Which means EMV-compliant cards will be used more and more.

Since EMV-compliant cards can't be cloned*, this Coin device will eventually die, just like its inventors hipster style.

* Well, they can be, with the help of electron microscopes and fancy laser technology, but let's not get into details on this one.

share|improve this answer
    
Even if it eventually dies, the next 4 years (or call it two) could still be fairly profitable for the manufacturers. How many people replace their cell-phones every two years (the common length of a contract/purchase plan). –  Clockwork-Muse Nov 18 '13 at 13:59
add comment

PCI-DSS is only required for merchants, but not for clients. The risk of getting access to the device would be the same as loosing your wallet with the 8 cards in it. The one thing which is important to note is that this is not going to work in countries where only Chip&PIN is accepted and swiping is not a possibility anymore. (most European countries these days)

Furthermore, in some countries the shops are required to verify your identity, with these cards this is going to be quite hard because you can't physically check anymore which name is written on the card.

share|improve this answer
add comment

There are positive and negative aspects to security with a system like his:

Positive:

  • The device has to have cards loaded on demand, so it can only be once card at a time. If it is stolen you've only lost one card. EDIT: This isn't actually true I found out, this single card has ALL the cards on it.
  • The card apparently doesn't have the physical details on it, like the 3 or 4 digit code on the back. If it is stolen it's much less useful to the thief
  • The card can tell when it's out of range from its parent phone and shut itself down, so if it is stolen it will stop working when out of range. That feature can be disabled by touching a button on the card, so if the thief knows they can pop the card out and hit the button before it's out of range. Still, that would defeat quite a few pickpockets

Negatives:

  • Bluetooth isn't known for its security, in fact it is relatively easy to sniff and interfere with. If this company is using bluetooth they'd better have cast-iron protections to counter bluetooth's known vulnerabilities
  • If the device is stolen the owner is relying on the app to tell them which card has been lost, the owner wouldn't be able to make that determination without technology
  • Thieves wanting your card device will need to steal your phone as well, this might mean that owners are at additional physical risks
  • The ad says that you can only add your own cards, however it's basically a skimmer for a mobile phone. There's no reason that someone couldn't buy one of these and add your cards to their device
  • This one card has all the cards programmed into it, all selectable with the touch of a button on the card, without any sort of authentication

Personally I think it's potentially useful, and if I lived in the states I might look into it as the potential usefulness of the device may outweigh the security issues. It's completely useless for most of the rest of the world though, so unless they can get it working with chip and pin it's not going to go far.

share|improve this answer
    
Negative #1: Coin FAQ page says that they use encryption for the Bluetooth communication. Negative #2: Makes no sense whatsoever. How is that diffident from a normal payment card? This is not a negative point in the device itself. This is how our modern society is, with our key chains, wallets, mobile devices, etc. You have no way of knowing when you lose them unless you really check all of your pockets. Negative #4: Coin claim that they have certain security checks to make sure you're the card owner (they OCR the photo and verify the name with your bank-verified Coin account). –  Adnan Nov 18 '13 at 9:20
    
Negative #1: having encryption doesn't mean it is good. As has been seen encryption to very small, low power devices isn't always good. Also, does it protect against MiTM attacks? I'd want more details before buying. Negative #2: I never said it was, only if you have a wallet that gets stolen you know what cards are there, and with a device you don't. Negative #4: the question was not about coin specifically, but the technology itself. –  GdD Nov 18 '13 at 9:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.