3 ms·
I'm curious about the example used. They show a fraudulent purchase of $2000. I know my MC caps the size of the purchase that can use tap for auth (somewhere
by peeters 10y ago
I'm curious about the example used. They show a fraudulent purchase of $2000. I know my MC caps the size of the purchase that can use tap for auth (somewhere under $100). Is the same challenge/response used for both tap and chip? Otherwise, wouldn't the bank catch that it got a tap response for a purchase that should've used chip and pin?
Or is this assuming the bank allows a $2000 purchase using only tap?
- dtech 10y agoThe article is a bit confusing (perhaps deliberately to scare the reader). The attack is possible on all current electronic chip payment forms (contacted/contactless, with & without PIN). For contactless without PIN, transactions are limited (in my country to €25 per transaction and €50 total before a PIN is required). Contactless without PIN is much easier to attack (for obvious reasons), but cannot break this limit. Contacted with PIN is fully vulnerable, but also a lot harder to pull off. The 600km limit is also highly deceptive, as it doesn't take into account latency introduced by electronics. E.g. a typical good wifi connection has a much higher ping than 2ms.