Can an attacker get information off the card?
Yes, at least some can, and the UK consumer group Which? mentioned in the question did it:
Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks.
Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software to decode data, we were able to read the card number and expiry date from all 10 cards.
We were also able to read limited details of the last 10 transactions, although no cards revealed the CVV security code (the number on the back).
Can the info be used to buy stuff?
While most online shops will not let you pay without the CVV, some do. So while the fraudsters might have limited shopping to choose from, they can still spend your money:
We ordered two items - one a £3,000 TV - from a mainstream online shop using 'stolen' card details, combined with a false name and address. We've alerted the store involved.
Your card could also be copied and used for other contactless transactions. Which? estimates that limits on those would limit the theft to £45 - £100.
Note how the qoute from the Visa FAQ is carefully worded not to say that this isn't possible, just that it is not what fraudsters are looking for nowadays.
How close would the attacker need to be?
Edit: See ewanm89's comment - this might not be true.
To pull this off and be able to read a card you have to get quite close. The Guardian interviews a privacy standard expert at the National Consumers Federation:
He said that while industry standards specify a maximum magnetic-field strength for card readers of 5cm, some may be able to read cards at greater distances.
“It may be possible for a small percentage of cards to be read 15 to 20cm from the reader,” he said. “Even if this was to occur in 0.1% of cases, with more than 300m transactions taking place last year, many consumers could be affected.”
Is this a problem for you?
The bank or the merchant will be liabel for most of your monetary loss, so you will not end up in the poor house just because someone steals your credit card number.
Which? reports on the rules, but they might be different outside the UK or EU:
Fraudulent transactions on contactless cards are protected by the same rules that apply to other card payments. This means that if you're a victim of fraud, your bank will refund you the money, provided it’s not a result of your own negligence. However, you will have to pay the first £50 of the total amount of fraudulent transactions made on your card.
That the banks takes most of the financial hit does not mean this is without impact on you:
- You might loose £50.
- You will have to go through the hassle or reclaiming money from your bank if your card is abused. Maybe just an annoyance, but still.
- If the attackers only steal small amounts, you might not even notice and hence not be able to report it.
- It is hard to be completely anonymous if you carry around a radio tag broadcasting your name. It is easy to think of situations where you would not want to wear a name tag...
- Some cards broadcast recent transaction history. This has obvious privacy implications.
- Credit card numbers could be used in phishing attacks. A cold caller who knows your card number is more likely to fool you.
- A card number could be used to impersonate you. It is not uncommon for a customer support to use some digits from your card as a security question to verify your identity. You can get a lot of private information, like order history, from a customer support. In some places you can even get them to do a password reset.
- Buying things in your name with your credit card can make you look pretty bad. Your significant other might not be so happy to find big payments for porn sites in your credit card history... This could be used to mess with people.
In the end, you will have to decide if it is worth the risk or not. I would not worry about the money, but if I lived in a dictortorship I would not bring my credit card when attending a protest.
What can you do to protect yourself?
I see three solutions:
- Try to convince your bank to give you a card without this capability.
- If they don't want to do that, you can try to physically destroy the antenna. A bit risky, since you could acidentally destroy the card.
- Carry the card in a faradays cage wallet. Either buy one or if you feel handy, make one yourself. (Either way, make sure to test it so you know that it actually works.)
