Is transaction history stored on credit card a security risk?

Question

I installed an NFC reader on my android and scanned each of my bank cards to see what they would reveal through their contactless feature (NFC).

Unsurprisingly they reveal the card number and the expiry date, these are required for the transaction and they did not reveal the cv2 which is comforting.

I was surprised to find though my Mastercard credit card revealed a transaction history with the charged amount and the date and time of the transaction, I tried this out with another card and found the same.

Does this present a security risk to the owner of the card if a malicious actor read their card with an app like this or if the card is lost. It does not reveal who the payment was made to, but this could be enough information to socially engineer the card holder. What is the benefit of storing this transaction history on the card itself? Only the Mastercard credit card seemed to do this, so it does not appear to be an industry standard practice.

Answer 1

There is some risk. Whilst the merchant isn't listed the amount, time & currency does leak information. Combined with other easily obtained data it can give more.

Considering some card issuers use transaction history as part of their security verification process leaking the info isn't ideal. With regards to social engineering it doesn't really give you much more than just following someone.

Transaction history is I believe part of the EMV standard. Visa disable it by default whilst Mastercard don't. Issuers can override this. If you are concerned then complain to your card issuer.

What is the benefit of storing this transaction history on the card itself?

One possibility would be with something like TFL in london. You can tap into and out of the transport network with a contactless bank card. TFL have inspectors on random trains/buses that ask you to present your payment method - for contactless cards they scan them with a reader. For cards offering transaction history they could verify immediately whether the card was tapped in. Without this they have to compare inspected card logs against transaction logs when they are processed at end of day - meanwhile if the card was fake/stolen the holder is long gone.