The Inconvenient Truth about Contactless Payments (RFID / NFC)

• Expiry Dates – Interestingly, as mentioned in the first point ‘Magstripe’, the expiry dates of a card are stored on the card itself and can be modified by a card skimmer on the Track 2 data.
• Check Digits – Check digits, or Longitudinal redundancy check (LRC) — is one validity character calculated from other data on the track, however, most reader devices do not return this value when the card is swiped to the presentation layer, and use it only to verify the input internally to the reader. Also, because this is a form of data integrity rather than data security, it needs to follow the International standard ISO 1155, which has its algorithm for calculating the check digit publically available.
• Fallback Transactions – A fallback transaction normally occurs when a chip card, presented at a chip terminal, cannot be read due to a technical issue with the chip which results in the technology “falling back” to a magnetic stripe transaction. In some situations, a fraudster may create a counterfeit card with an intentionally damaged chip in order to invoke this scenario. Alternatively, they can purposefully damage the chip, cover it with clear tape or insert the card backwards. For this reason, fallback transactions are deemed risky by the payments industry and it is the issuer (bank) that holds liability on fallback transactions.

You can read this article from 2016 where I demonstrate the above concerns, here.

So, just before I jump back into RFID / NFC contactless payments, I think it is worth noting the following, extremely concerning, observations

• Magstripe, as a form of identifying a payment card, is known to be flawed;
• For this reason, EMV Introduced the chip & pin capability;
• In addition, the magstripe remained on the card, with the same data (albeit 1 service code digit) for backward compatibility.

–  In case the chip is damaged

–  In case the terminal does not support chip & pin.

Therefore, it would be safe-to-say that chip & pin, in its current implementation – Is fundamentally flawed. For as long as the magstripe is still on the card, encoded with payment data, card skimming and card fraud is still as possible as without the chip & pin.

So what have the issuers (banks) actually done to try and reduce the risk? The answer, as it appears to me, is to:

• Further maximize the use of limits. This would be in effort to reduce the amount (value) of the fraud before it is identified and stopped rather than remove the magstripe entirely, for the reasons stated above; and
• Introduce 2FA where possible, such as the 3D Secure functionality, Dynamic Passcode Authentication (DPA), and OTP for online, Card Not Present (CNP) transactions.

However, in credit of the issuers (banks), it would also be necessary to note that there are standards based on ISO/IEC 7816 for contact cards, and standards based on ISO/IEC 14443 for contactless cards that may possibly also act as a restraint to not “do what they like”.

EMV originally stood for “Europay, Mastercard, and Visa”, the three companies that created the standards. The standards are now managed by EMVCo, a consortium of financial companies. The most widely known chips of the EMV standard are:

• VIS – Visa
• Mastercard chip – Mastercard
• AEIPS – American Express
• UICS – China Union Pay
• J Smart – JCB
• D-PAS – Discover/Diners Club International.
• Rupay – NPCI
• Verve

So what’s wrong with RFID / NFC enabled contactless payments?

The answer is quite simple – It is fundamentally no different to the other forms of card identification – Other than its convenience. This being said, it seems to have a higher risk tolerance (for now) which I can only assume is due to its new-ish adoption.

Following the research, it appears some card issuers (banks):

• Restrict the number of contactless transactions that can be made before the PIN is requested, to minimize fraud;
• Force a cash limit for each contactless transaction which differs slightly between issuers;

At the same time issuers (banks) are supposed to limit the number of contactless payments each day to protect users if their card is stolen. If a certain number of contactless payments are exceeded, usually three, a PIN number is requested or the card may even be blocked.

However, some issuers (banks) have been known to allow as many contactless payments as the customer wishes to make.

So let’s not kid ourselves, contactless card fraud is on the rise; in the first half of 2018, thieves stole more than £8 million from contactless fraud.

In conclusion, although the risks are reportely low:

1. You card can be targeted with an NFC enabled terminal even when it’s in your wallet or purse:It is possible to be defrauded on your RFID / NFC enabled contactless card. See ‘Are Contactless Cards Cloneable‘ for more information.
2. It is possible for fraudsters to skim details off your contactless card, for instance, by standing behind you in a queue. (The distances from which you can be skimmed vary depending on the power of the reader. But some researchers say that because the NFC technology in contactless cards uses a 13.56Mhz radio frequency technology that only transmits digital data within a very short range (typically 5 cm or less). No communication should be possible beyond that range.) However, the University of Surrey Journal of Engineering said a team managed to “successfully receive contactless transmission from distances of 18 to 31 inches”.
3. Your card can be targeted with an NFC enabled terminal even when it’s in your wallet or purse: