2

If someone has access to the physical Visa card (and with that comes the number on the front, the expiry date, and three digits on the back) would it be possible for them to program a NFC-enabled device to emulate the physical card?

In reading "What prevents people getting charged over NFC in crowded places?" it seems that the reader authenticates the card, but does that make a difference?

It seems that both Google Wallet and SimplyTapp can do this, correct?

3

I talk about this in the answer to another question:

Modern credit cards generally can't be copied, however this can depend on the country. In the USA I believe it's easier to clone cards as the banks there haven't all implemented what the UK calls Chip & PIN but is more generally known as EMV. EMV helps protects against cloning as each card has a cryptographic key that it uses to sign and then return some data that the ATM sends it. This key can't be (easily) extracted from the card meaning that you can't set up a fake card with the key.

As I mention the situation is a bit different in the USA which can use a slightly different system that doesn't require the card to sign any data sent to it by the reader, this makes them easier to clone. The banks are trying to push the USA towards using Chip & PIN and I believe some are going to make it mandatory for shops to have soon so hopefully this won't be an issue for too much longer.

In relation to some other points in your question:

  • As I comment on the top answer of the "What prevents people getting charged over NFC in crowded places?" the card doesn't authenticate the reader at all, the answer is incorrect. I'm not sure why it got so many up votes and no one got back to me on my comment.

  • SimplyTapp as far as I know doesn't try to emulate your credit card, you buy prepaid gift cards which can only be used at certain merchants. When I tried it they didn't even have any gift cards left so I couldn't use the app at all, from a couple of comments on news articles about it, it seems that other people have the same problem.

  • I think for Google Wallet they basically issue you their own card and they pay the merchant, then bill your bank. This is from the Wiki page you linked to although there's no source for the statement. "The latest security measurement implemented (July 2012) is based upon Google financially completing the transaction and subsequently billing the respective card issuer."

0

I'm not sure about NFC specifically, but generally speaking all EMV cards have a private key that is 'signed' by the issuer.

More specifically, networks like VISA & Mastercard have root certificates, that they use to sign intermediate certificates to the issuing banks (e.g. Citibank), the issuing banks in turn use these certificates to sign card certificates that are unique for each card. Those certificates are in turn, tied to specific private keys embedded on the card.

When you insert your EMV (again not sure about NFC), the terminals validate these certificates against the root certificates they have pre-installed (not unlike how browsers validate TLS certs).

The 'trick' with EMV cards is that they never reveal their private key -- or at least they're designed to never reveal their private key. Only the certs are revealed.

Hence, when a terminal 'challenges' the card, only a valid card, signed by a valid issuer recognized by the network is allowed. You'll be unable to clone a card, because in order to do, you'll need the specific private key of the card, which the card is designed to never reveal.

Here's a great resource: https://www.cryptomathic.com/hubfs/docs/cryptomathic_white_paper-emv_key_management.pdf

  • Same thing happens in NFC card also. The only difference is communication between the card and the terminal is wireless. Also, NFC doesn't mandate PIN in order to reduce transaction time. – defalt Aug 26 at 17:03

protected by Community Aug 26 at 6:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.