0

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and use it ( though my card is DDA and only one time he can use tracks data but even with card number and expiry he can pay on many websites) . I can't understand why banks are forcing these cards despite of the fact that they are less secure.

  • you know what else is unsecure? putting the number on the front for all to see... – dandavis May 15 '17 at 14:10
1

Many people use cars on a daily basis, even with the number of deaths on roads worldwide. So why would everyday people want to use them?

The reason why I ask that question at the start is because it will get you into the mindset of Information Security. Nothing is secure everywhere, all the time. The same applies to cars, they are mechanical devices that have physical flaws, and as time progresses, virtual ones as well.

"Tap" payment schemes came about because of the wear issues associated with "Chip and PIN" technology. Due to the shear number of cards being put into a card reader at a retailer, the cards and machines become worn out. This is not only because of the physical contact required, but also dust and dirt which is just an everyday thing. "Tap" or RFID payment schemes overcome this because there is a belief that if small purchases are done with RFID, the cards and machines will last much longer. You may wish to consult your credit card company for their analysis on this topic.

At least my understanding of the current system, while it is certainly correct to say the system is "broken", there are certain features that mitigate risks.

The first is a payment limit. Many cards limit how much can be purchased by RFID or contactless transfer. As I bring up the previous point of small purchases, there is huge risk involved for everyone with large transactions (thousands of dollars). I'm aware that my card with a recent contactless terminal will not allow for a transaction over $100 to be processed, it must be done with the Chip and PIN.

The second is that the "keys" associated with transactions expire. I've seen various bits of information where some state that it's possible to clone a rfid card, but you would be unable to use it for another transaction. Other sources mention the fact that the clone will work until the true user makes another payment. Regardless of what the case might be, there doesn't seem to be any clear innovation coming down the tubes for a while. The easiest way would be to still provide a PIN, but again, removes the end-user convenience, and you might as well just use the Chip and PIN technology.

To be fair, the likelihood of someone bringing a crafted device to capture RFID payments is fairly small. Because of the close proximity involved, one would either have to physically take possession of the card, or bring such a large antenna (and/or power supply) making such a thing impractical.

  • brother that's fine and ragarding other purchase brother 95% plus cards of europe are static ( not dda) . and regarding the data we get from it we get card number and expiry brother that is sufficient. And yes you are right all countries have floor limit for rfid but still huge risk brother . I m working on that only demonstrating to people how much risk it could case :/ . – Sunny Nehra May 14 '17 at 17:23
  • @SunnyNehra For the card to be useful in the grand scheme of attackers and black markets, much more information is required such as the CCV. CCV and the actual card type (Visa Gold vs Visa "standard") are not transmitted over RFID, making the sale of raw RFID captured data near useless. – dark_st3alth May 14 '17 at 17:31
  • brother there are endless websites that you can pay on without cvv that is what i am speaking about. and regarding type of cards u can get to know just with bin . go to bins.pro write bin and you get that info. I have myself paid on so many websites without using cvv (cvv2). And regarding data here is bombay so many fraudsters buy rfid data nowadays . That is my main concern brother. Track 1 and track 2 you can get now with some apps. – Sunny Nehra May 14 '17 at 17:41
  • @SunnyNehra This is very much up to the merchant. In a "card not present" transaction, many merchant agreements place the full responsibility on the the merchant. The credit card holder neither accepts or assumes any risk if the merchant decides to not verify a card (or it's CVV). If fraudulent activity is found to originate from a merchant they could face revocation of their status, fees, and possibly more. – dark_st3alth May 14 '17 at 17:54
  • that i know well brother for that i have a famous video on youtube explaining all cases of chargebacks :) . but still brother people buy that data and do lot misuse. data from france comes a lot there in bombay. i myself tried writing on jcop 21 and got success and it worked for 2k here for thrice and i really was shocked. – Sunny Nehra May 14 '17 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.