If someone has access to the physical Visa card (and with that comes the number on the front, the expiry date, and three digits on the back) would it be possible for them to program a NFC-enabled device to emulate the physical card?

In reading "What prevents people getting charged over NFC in crowded places?" it seems that the reader authenticates the card, but does that make a difference?

It seems that both Google Wallet and SimplyTapp can do this, correct?


I talk about this in the answer to another question:

Modern credit cards generally can't be copied, however this can depend on the country. In the USA I believe it's easier to clone cards as the banks there haven't all implemented what the UK calls Chip & PIN but is more generally known as EMV. EMV helps protects against cloning as each card has a cryptographic key that it uses to sign and then return some data that the ATM sends it. This key can't be (easily) extracted from the card meaning that you can't set up a fake card with the key.

As I mention the situation is a bit different in the USA which can use a slightly different system that doesn't require the card to sign any data sent to it by the reader, this makes them easier to clone. The banks are trying to push the USA towards using Chip & PIN and I believe some are going to make it mandatory for shops to have soon so hopefully this won't be an issue for too much longer.

In relation to some other points in your question:

  • As I comment on the top answer of the "What prevents people getting charged over NFC in crowded places?" the card doesn't authenticate the reader at all, the answer is incorrect. I'm not sure why it got so many up votes and no one got back to me on my comment.

  • SimplyTapp as far as I know doesn't try to emulate your credit card, you buy prepaid gift cards which can only be used at certain merchants. When I tried it they didn't even have any gift cards left so I couldn't use the app at all, from a couple of comments on news articles about it, it seems that other people have the same problem.

  • I think for Google Wallet they basically issue you their own card and they pay the merchant, then bill your bank. This is from the Wiki page you linked to although there's no source for the statement. "The latest security measurement implemented (July 2012) is based upon Google financially completing the transaction and subsequently billing the respective card issuer."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.