contactless/touchless payment. BAD IDEA

[JMOT]

Just been reading an article about this new form of payment for items under £15 etc

In the same way Oyster cards work using a short proximity radio wave typically 4cm it will only take a hacked reader to take the range up to 10-15cm then just walk thru busy underground trains silently collecting up to £15 off each card enabled with this technology.... for example.

Such a bad bad idea. Its a fraudsters dream.

Apparently having to enter your PIN is only a random requirement presently.

Why pick pockets or steal handbags when you can just scan them.

Just a sunday morning rant

 

[fish]

they are raising the limit to £20 for contactless payments so even more potential for the crim fraternity.

If your bank has issued you a card that uses this tech you should contact them to turn off the feature (if you don't want to use it). I believe it is by default switched on for all new cards issued.

 

[JMOT]

oh really.... didnt know i could opt-out. Will investigate! cheers

 

[chrisduggan]

Mobile phones are doing it too

 

[doodlebug]

You can buy a shield to put your card in so it can't be read unless you take it out, thing is banks should be giving these shields away.

I think it's a good idea having easy electronic payments, having a card in your wallet is just like having money in your wallet, don't lose it and you're fine.

Difference is lose £200 cash and it's gone, lose a card and you can have it stopped before they get to spend to much of it.

 

[cc976a]

You can buy a shield to put your card in so it can't be read unless you take it out, thing is banks should be giving these shields away.

They are foil lined card holders, which prevent your card being read -

http://www.google.co.uk/search?q=foil+lined+card+holders&ie=UTF-8&oe=UTF-8&hl=en-gb&client=safari

...and if anyone fancies diversifying I have foillinedcardholder.co.uk and foillinedcardholders.co.uk open to offers

 

[doodlebug]

3M do a paper version which as copper strips through it.

 

[mojoco]

The Sun highlighted how easy and cheap it is for electronic pickpockets to collect card data in an article in April.

http://www.thesun.co.uk/sol/homepage/features/4285837/Robbed-by-radiowave.html

 

[solaris]

I think they have a fallback security feature where if too many transactions come too fast the party receiving payment asks for a password.

What I'm not clear about is if you have password protected access to your phone, do you have to log in to swipe it to pay? If so then you have protection when the phone is not in use.

Paypal do transactions now by sending you a QR code that the merchant scans - so they have to see the code and scan it.

 

[freddy]

Doesn´t matter what kind of new payment technology is coming up, it will be less and less secure....

 

[fish]

Doesn´t matter what kind of new payment technology is coming up, it will be less and less secure....

bit of a sweeping statement that ^^

do you have knowledge / knowhow of how to breech the secure side of things?

 

[solaris]

Doesn´t matter what kind of new payment technology is coming up, it will be less and less secure....

Are credit cards more or less secure than cash? More or less secure than cheques?

When people in front of you in a queue pay fast by swiping this will start to seem like a nice idea, even if you don't risk using it yourself.

 

[freddy]

bit of a sweeping statement that ^^

do you have knowledge / knowhow of how to breech the secure side of things?

You are right, a little bit of sweeping statement, I do not want to look like a spammer....

What I meant was that all new improvements we are facing in terms of off- or online payment are opening also new security holes which can not be controlled by the Payer.

When carrying cash only in your wallet you are responsible yourself in which pocket you have your wallet.

A credit card with a wifi chip? well it sounds somehow scary to me, the thief don't need to touch me get my CC Number. Of course it is in the economies interest to make payment processing so easy as possible. But with the large variety of different payment systems I even don't know which new one is only a scam which which one is real.

I sell a lot of domains with paypal each month, but I also withdraw funds twice a month.

And of course in my early young and wild ages I was reading CC with a card reader. Well my own CC only!!! I never crossed the line...

 

[solaris]

But with the large variety of different payment systems I even don't know which new one is only a scam which which one is real.

This is true, there are a lot of schemes and in a busy place like a station a scammer or crooked employee could just put up what looks like a paypoint for tickets, a shop, a cafe or other service and grab £20 payments all day.

This site has some interesting official industry info http://www.contactless.info/

 

[Bailey]

contact less payment systems aren't going to go away, it's foreseeable that finger or thumb print recognition will be built into the security and ongoing activation of the card as usage (and payment amounts) progress

 

[JMOT]

bit of a sweeping statement that ^^

do you have knowledge / knowhow of how to breech the secure side of things?

Not really that sweeping.. I used to be a credit card fraud analyst over 10 years ago...

What was true then is true now. Whatever thats "new" is only ever 18 months tops in front of the fraudsters cracking it.

 

[fish]

Not really that sweeping

it appeared it to me, & I used to work in producing e-security events for 6 years