Why are card associations launching RFID enabled payment cards despite of their being unsecure?

Question

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and use it ( though my card is DDA and only one time he can use tracks data but even with card number and expiry he can pay on many websites) . I can't understand why banks are forcing these cards despite of the fact that they are less secure.

Answer 1

Many people use cars on a daily basis, even with the number of deaths on roads worldwide. So why would everyday people want to use them?

The reason why I ask that question at the start is because it will get you into the mindset of Information Security. Nothing is secure everywhere, all the time. The same applies to cars, they are mechanical devices that have physical flaws, and as time progresses, virtual ones as well.

"Tap" payment schemes came about because of the wear issues associated with "Chip and PIN" technology. Due to the shear number of cards being put into a card reader at a retailer, the cards and machines become worn out. This is not only because of the physical contact required, but also dust and dirt which is just an everyday thing. "Tap" or RFID payment schemes overcome this because there is a belief that if small purchases are done with RFID, the cards and machines will last much longer. You may wish to consult your credit card company for their analysis on this topic.

At least my understanding of the current system, while it is certainly correct to say the system is "broken", there are certain features that mitigate risks.

The first is a payment limit. Many cards limit how much can be purchased by RFID or contactless transfer. As I bring up the previous point of small purchases, there is huge risk involved for everyone with large transactions (thousands of dollars). I'm aware that my card with a recent contactless terminal will not allow for a transaction over $100 to be processed, it must be done with the Chip and PIN.

The second is that the "keys" associated with transactions expire. I've seen various bits of information where some state that it's possible to clone a rfid card, but you would be unable to use it for another transaction. Other sources mention the fact that the clone will work until the true user makes another payment. Regardless of what the case might be, there doesn't seem to be any clear innovation coming down the tubes for a while. The easiest way would be to still provide a PIN, but again, removes the end-user convenience, and you might as well just use the Chip and PIN technology.

To be fair, the likelihood of someone bringing a crafted device to capture RFID payments is fairly small. Because of the close proximity involved, one would either have to physically take possession of the card, or bring such a large antenna (and/or power supply) making such a thing impractical.