0

I have credit card with wireless payment.

For low prices it does not require to enter pin code.

An attacker with 100$ device can take these money whithout my knowledge.

Of course, I can configure day limits but as I know wireless payments can be made offline (?)

Can i completely protect card from such cases with some kind of package (made of foil or some material which block radiowaves)?

3
  • 2
    Try googling 'rfid wallet'
    – iainpb
    Commented Jun 18, 2017 at 14:14
  • 1
    Drill through the microcontroller in the NFC chip with a 0.5-1mm drill.
    – user2497
    Commented Jun 18, 2017 at 20:23
  • 1
    microwave 5 seconds on high.
    – dandavis
    Commented Jun 18, 2017 at 20:51

3 Answers 3

3

To answer the question briefly, and if we're only talking about wireless payment, yes it is possible. You can ask your bank for a non-NFC card, or simply to not allow NFC payments, which would be the first step. Or it can be physically disabled by placing it inside a NFC-blocking wallet, whose actual efficiency varies, or even sabotaged by making a cut into its antenna with a pair of scissors, and using a flashlight as displayed below is the best way to find where to cut, though I would only recommend this if you really know what you're doing:

enter image description here

Now the technology used for a specific card is dependant on the bank, and the country, not everyone uses the same technology. Some cards plainly transmit their PAN and expiry date, some keep the CVV separate, some rely on different information, some generate temporary tokens, some have a CVV that changes every hour... the technology solutions are many, you may as well check yourself using a NFC-capable device, like many smartphones today, and see which kind of information gets transmitted.

When it comes to payment security, your first resort is local law. Some countries hold banks liable for any card fraud caused by their negligence, and a card that dispenses its information too generously is in fact a negligence. Your second resort is bank policy, some banks will cover damage caused in the event of card fraud, others won't. It is up to you to figure out how much you are covered on both fronts, and decide if it's worth it. And then, you have to hope you're not liable. The general baseline is that as long as the card wasn't stolen nor lost, and is still in your possession, and you haven't publicly and consciously disclosed its information, you won't be considered liable, but things aren't as easy anymore. While higher security cards reduce the risk of fraud, it comes at the cost of making you more liable; fraud became much harder, but so does justifying it is an actual fraud, and neither bank policy nor local law may cover you. I'd go as far as claiming many of these technologies claiming to be "safer" only serve to make you more liable, because these is no greater safety than law and policy.

The best solution remains to request your bank not to use NFC, because disabling or sabotaging a NFC card will only prevent you from using it, but it won't prevent the card information from being very valid and usable. Simply ask your bank, they should have no issue disabling NFC payments, no need to even reissue a new card. Some banks even provide you the option in a smartphone app.

As for actual fraud, well it happened to me. I can easily see why, my card provides all information via NFC, but I am 100% covered, and I like how this primitive and unsafe technology relieves me of any liability, as long as I don't lose it. It's all about mitigating risk, similar to how this kind of fraud isn't very profitable, but very unlikely to get investigated.

1

Such things exist, but they're mostly pointless. Skimming a card number with a handheld device is possible, but kindof useless for committing crime.

This article points out (emphasis mine):

What’s less clear is whether RFID skimming is a threat worth worrying about in the first place. For all the hype about the theoretical danger, there have been few if any reports of actual crimes involving RFID skimming. The technique appears to be far more popular among security researchers than it is among thieves, and for good reason: There are much easier and more effective ways to steal people’s money and data.

While early versions of RFID payment systems may have transmitted sensitive data like the card number unencrypted, major credit card companies insist that’s no longer the case. Their RFID chips now send a one-time code for each transaction, so at best, a determined thief might be able to make a single purchase by recording and replicating the signal he picks up from a given card. Even if that were to happen, the cardholder would not be liable for the fraudulent purchase under most credit card companies’ policies. From the thief’s perspective, it’s a lot of work for relatively little gain.

By contrast, skimmers installed on ATM or point-of-sale machines allow thieves to pick up much more usable information from a far greater number of cards. Unlike RFID skimming, ATM skimming is a real and widespread problem both in the United States and elsewhere. But no wallet will protect you from that.

In other words, the thief would have to capture your information, replay it to an actual merchant (which involves being physically present and probably on camera), and even then you just dispute the charge with your credit card company and they'll remove it.

The thief can't just take money, because that requires having a merchant account to accept it. The thief can't use the card number online, because they don't have the printed CVV, and the one that's transmitted via RFID is different from both the one on the magstripe and the printed one. And the thief has to find someone who has a RFID/NFC card they can get close enough to read in the first place, which involves possibly being memorable.

All in all, you can buy yourself a wallet to provide piece of mind, but there's no real likelihood of this attack in the first place.

0

First some banks accept to replace the RFID enable card with a non RFID one, some others allow to configure their own system to consistently reject any RFID payment.

As explained by Bobson, the risk of capturing an RFID exchange to later use it for fraudulent payment is generally seen as low, because on a thief's point of view, the gain/cost ratio is low, and in addition the expected gain is very limited. I have not still heard of such an attack, and RFID enabled bank cards are now quite common.

But those cards can be really chatty. I have seen one that gave access to the last operations (over more than one month). So for a mere privacy reason you really should use a secure wallet to prevent others from too easily accessing this data which without being secret is still personal. Some bank accept to provide you such a wallet for free.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .