8 ms·
You can stratch it off, or use a very powerful magnet to erase the strip. When scratching be careful not to damage the NFC antenna which loops around in the car
by LeonM 8y ago
You can stratch it off, or use a very powerful magnet to erase the strip. When scratching be careful not to damage the NFC antenna which loops around in the card.
- Tor3 8y agoIt doesn't need a 'very powerful magnet'. In fact I'm surprised how easy it is to make the magnetic strip unreadable. The way I (unintentionally) do it is simply to keep the cards together in the wallet. Their individual magnetic stripes destroy each other. All the cards are unreadable now, except for the newest card. And no, there aren't any other magnetic or electro-whatever device nearby.
- tjoff 8y agoActually, the prudent thing is to actively damage the NFC antenna. There is not much point in damaging the magnetic stripe but leaving wireless functionality... they are exactly the same thing only wireless works from a greater distance.
- gambiting 8y agoThat's absolutely not true. Magnetic stripe is just a dumb carrier of information - you can buy a $5 reader off eBay and read every card in the world, it's not protected in any way. Modern NFC cards do not surrender their information to some random reader - they need to receive a valid cryptographic key first to reply with the data - and such key can only be produced by an authorized terminal. A normal NFC reader will not read any data off a contactless card, it's just not possible(yes I am aware that there have been attacks demonstrated, but they were all timing based, with extremely limited use in real world).
- tjoff 8y agoDepends on the card. All NFC cards in Sweden are just as dumb as a magnetic stripe cards. I actually believe all cards in Europe are but I could be wrong. It's there, in plain text, any normal NFC-reader will get you everything (there even are android-apps that does it in the play-store).
- gruez 8y agoThose apps don't get you an authorization token, which is needed for a transaction.
- deleted 8y ago[deleted]
- tjoff 8y agoWhat authorization token? If you mean the CVV it isn't required to make a transaction.
- gruez 8y ago>If you mean the CVV it isn't required to make a transaction. that's incorrect. there's a cvv1 on the magstripe that's needed for magstripe transactions, and there's cvv2 that's on the back of the card that's mostly required (depends on merchant policy) for card not present transactions. for EMV transactions, you need a payment terminal because the card will refuse to communicate unless the other side has a valid certificate. even then, the card only returns a signed response, which you can't use elsewhere.
- tjoff 8y ago> that's incorrect. No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? Why would an attacker opt for a magstripe transaction or a contactless transaction?
- gruez 8y ago>No? You just said so yourself? "depends on merchant policy" Why would an attacker choose a merchant whose policy denies their use case? it's not as easy as you think. nearly all merchants require some sort of additional information (cvv, billing address, cardholder name) in addition to card number + expiration date. reason being, for card not present transactions (eg. online), the merchant is liable for fraud (the purchase amount + ~$25 chargeback fee), so they have a strong financial incentive to collect/verify as many pieces of information to reduce their losses. it would be insane to not collect any of those (only requiring card number + expiry date), because the chargebacks will bankrupt you. the reason i said "depends on merchant policy" is because some merchants (iirc amazon) don't collect cvv2 (but they do collect billing address + cardholder name), which I presume is for convenience/conversion rate reasons. I don't actually know of any merchants that only collects card number + expiry date.
- therealmarv 8y agoNFC payment cards are cryptographic protected. It's not just read it and you have a 1:1 copy. Attacks are possible but only online attacks (this is no offline payment system) and with the right critical timing.