8 ms·

The utter lack of control on the part of the customer, having neither an approval step nor the ability to switch the card off seems to me to be a fundamental fl

The utter lack of control on the part of the customer, having neither an approval step nor the ability to switch the card off seems to me to be a fundamental flaw in this payment method. This system was pretty much designed to be abused.

Osmium 13y ago
Time for RF-blocking wallets to become more mainstream perhaps? That gives control back to the customer.
- anxx 13y ago
  I have a credit card that had the contactless payment feature. It is more convenient, but the lack of 2 FA (have card, know PIN) made it really weird to use. Eventually I turned off the contactless feature (via the internet banking branch).
- kaolinite 13y ago
  Are there any nice, good quality RF-blocking wallets? I've only found poor quality fake-leather / synthetic fabric wallets when I've looked.
  - kalleboo 13y ago
    I got an RF-blocking card that you can put in your current wallet.
- e40 13y ago
  Just went on a search, since I needed a new wallet, and bought this: http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-Fold-10-Slots/productinfo/IDSH7005/ http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-F... I have no affiliation with this company. The linked story and my need for a new wallet and google did the trick.
JulianMorrison 13y ago
The approval step is "you hold your card within inches of the pickup". What these people were probably doing (their protestations to the contrary) was holding up a wallet. Which does work, if only one card in the wallet is contactless.
- Leynos 13y ago
  The story on the BBC site concerns people who attempted to pay with their chip card by placing it in the reader but had their contactless card charged instead, which was still in their purse/wallet. In some instances, the transaction was processed twice using both forms of payment. The first customer was able to obtain a refund after demonstrating the problem to the store manager.
Groxx 13y ago
Barring wallets that block radio signals, yes - there are tons of them. Outside those, I agree, there's quite a large possibility for issues, though this seems weird that it seems to be happening from significantly larger distances than it's designed to work under. To such an extent that I suspect some / all of these people are simply not remembering correctly - they swung their purse between hands, bringing it near the reader, or something. People are forgetful, and this is way way outside what anyone else can replicate that I've seen.
- mpclark 13y ago
  FWIW this will no longer be an issue when everything moves to the user's phone. You'll choose a default 'card' but will be able to change it to a preferred card before any transaction.
  - Groxx 13y ago
    yeah, and then you can have real encryption too. I'm hugely in favor of phone-NFC eclipsing cards.
logicallee 13y ago
isn't it a keyfob that you press and hold up - if you don't have to press it, what's to stop a thief from simply walking through a crowd charging anyone unfortunate enough to have one of these? isn't it then just cash that you can take without touching?
- hafabnew 13y ago
  It's not a keyfob, it's built into the card itself. The security measures are pretty good actually: - Can't pay for things costing more than £20 via contactless (have to use chip and pin, the 'normal'/old method) - After a certain number of continuous contactless payments, it will ask you for your PIN to verify the cardholder is still in possession of the card. This 'counter' is reset to 0 every time you pay for using Chip and PIN. E.g. if you alternate between contactless and Chip and PIN, you'll never have to enter your PIN for the contactless payment. - If your card does get skimmed, your bank will cover you for any losses. Skimming is possible yes, but you really have to be pretty close (the article is the exception here, not the norm). Within a few cm of the card, which it's certainly possible to skim someone's card - the person would almost certainly notice.
  - gambiting 13y ago
    Actually, it's impossible to skim anyone with a regular reader. Because NFC cards are active, they need to receive a decryption key from the terminal first, before they broadcast their own data. Commercial readers are not able to read bank cards, they mostly show the card's type,and that's it, every memory bank is marked as private and cannot be read without the authorization key. So a skimmer would need to use an actual payment terminal obtained from a bank, and only such terminal would be able to read and charge money from contactless cards. But to get such a terminal,you would need to register with a bank and would be super easy to trace down.
    - TeMPOraL 13y ago
      So how shops do it? What is the thing that makes it possible for a shop to charge you for grocery while making it impossible for someone to skim you on the bus with a shop terminal? (serious question)
Jabbles 13y ago
No, the system was designed to be convenient. I don't know how serious this problem is, but since this is the first we're hearing about it it must be pretty rare, as contactless cards are much more widely used in, say, Hong Kong. We're designing an easy method of paying for small items, not arming nuclear weapons. We'll accept 1 in 1e6 errors.
- thejosh 13y ago
  Here in Australia we have PayPass which is Mastercard. Most places have eftpos terminals (handheld pin entry things) where they just tap the card and it charges your card. It scares me that they could charge any amount and you wouldn't know.
  - shawnz 13y ago
    They can't charge any amount -- pinless transactions are capped to around $20 (depending on the vendor).
    - mcpherrinm 13y ago
      Generally $50 here in Canada.
  - isaacwaller 13y ago
    Contactless transactions are limited to a small amount without entering a PIN.
    - taneliv 13y ago
      But a fraudulent "merchant" could still install a custom machine at a busy spot, and charge a good percentage of all passing NFC payment cards. Do this in a tourist area or near airport / other terminal, targetting foreign cards, and there's a good chance the fraud detection does not kick in before the weekend is over, and you have $20 x 50,000 "customers" x 2 days = 2 million in bank, converted immediately to bitcoin or similar and laundered before banks open on Monday. Why, yes, I've been the receiving end of a similar scam. It was Visa Electron and PIN-less purchases, then a new opt-out feature. The math was more like 5 customers, but 10,000 euro limit. (No, I did not lose that, or even close, by being lucky.)
dalore 13y ago
It's limited to only work for amounts below a certain threshold and also will randomly ask for the PIN sometimes. It's meant to be this easy.
hkyeti 13y ago
Millions of people use this exact system here in Hong Kong each day. It's amazingly convenient to be able to pay for train, bus, groceries, food in seconds without having to even take the card out of your wallet. People love it here.
- chrischen 13y ago
  But what happens when you have two contactless cards? The system in the article says it won't work if multiple cards are detected... but this would mean you'd have to take the card out of your wallet.
  - hkyeti 13y ago
    In Hong Kong you verbally ask to pay by for example Octopus (the most popular card) and it activates that option only. So I don't think double charging is possible here.

Osmium 13y ago

Time for RF-blocking wallets to become more mainstream perhaps? That gives control back to the customer.

anxx 13y ago
I have a credit card that had the contactless payment feature. It is more convenient, but the lack of 2 FA (have card, know PIN) made it really weird to use. Eventually I turned off the contactless feature (via the internet banking branch).
kaolinite 13y ago
Are there any nice, good quality RF-blocking wallets? I've only found poor quality fake-leather / synthetic fabric wallets when I've looked.
- kalleboo 13y ago
  I got an RF-blocking card that you can put in your current wallet.
e40 13y ago
Just went on a search, since I needed a new wallet, and bought this: http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-Fold-10-Slots/productinfo/IDSH7005/ http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-F... I have no affiliation with this company. The linked story and my need for a new wallet and google did the trick.

JulianMorrison 13y ago

The approval step is "you hold your card within inches of the pickup". What these people were probably doing (their protestations to the contrary) was holding up a wallet. Which does work, if only one card in the wallet is contactless.

Leynos 13y ago
The story on the BBC site concerns people who attempted to pay with their chip card by placing it in the reader but had their contactless card charged instead, which was still in their purse/wallet. In some instances, the transaction was processed twice using both forms of payment. The first customer was able to obtain a refund after demonstrating the problem to the store manager.

Groxx 13y ago

Barring wallets that block radio signals, yes - there are tons of them. Outside those, I agree, there's quite a large possibility for issues, though this seems weird that it seems to be happening from significantly larger distances than it's designed to work under. To such an extent that I suspect some / all of these people are simply not remembering correctly - they swung their purse between hands, bringing it near the reader, or something. People are forgetful, and this is way way outside what anyone else can replicate that I've seen.

mpclark 13y ago
FWIW this will no longer be an issue when everything moves to the user's phone. You'll choose a default 'card' but will be able to change it to a preferred card before any transaction.
- Groxx 13y ago
  yeah, and then you can have real encryption too. I'm hugely in favor of phone-NFC eclipsing cards.

logicallee 13y ago

isn't it a keyfob that you press and hold up - if you don't have to press it, what's to stop a thief from simply walking through a crowd charging anyone unfortunate enough to have one of these? isn't it then just cash that you can take without touching?

hafabnew 13y ago
It's not a keyfob, it's built into the card itself. The security measures are pretty good actually: - Can't pay for things costing more than £20 via contactless (have to use chip and pin, the 'normal'/old method) - After a certain number of continuous contactless payments, it will ask you for your PIN to verify the cardholder is still in possession of the card. This 'counter' is reset to 0 every time you pay for using Chip and PIN. E.g. if you alternate between contactless and Chip and PIN, you'll never have to enter your PIN for the contactless payment. - If your card does get skimmed, your bank will cover you for any losses. Skimming is possible yes, but you really have to be pretty close (the article is the exception here, not the norm). Within a few cm of the card, which it's certainly possible to skim someone's card - the person would almost certainly notice.
- gambiting 13y ago
  Actually, it's impossible to skim anyone with a regular reader. Because NFC cards are active, they need to receive a decryption key from the terminal first, before they broadcast their own data. Commercial readers are not able to read bank cards, they mostly show the card's type,and that's it, every memory bank is marked as private and cannot be read without the authorization key. So a skimmer would need to use an actual payment terminal obtained from a bank, and only such terminal would be able to read and charge money from contactless cards. But to get such a terminal,you would need to register with a bank and would be super easy to trace down.
  - TeMPOraL 13y ago
    So how shops do it? What is the thing that makes it possible for a shop to charge you for grocery while making it impossible for someone to skim you on the bus with a shop terminal? (serious question)

Jabbles 13y ago

No, the system was designed to be convenient. I don't know how serious this problem is, but since this is the first we're hearing about it it must be pretty rare, as contactless cards are much more widely used in, say, Hong Kong. We're designing an easy method of paying for small items, not arming nuclear weapons. We'll accept 1 in 1e6 errors.

thejosh 13y ago
Here in Australia we have PayPass which is Mastercard. Most places have eftpos terminals (handheld pin entry things) where they just tap the card and it charges your card. It scares me that they could charge any amount and you wouldn't know.
- shawnz 13y ago
  They can't charge any amount -- pinless transactions are capped to around $20 (depending on the vendor).
  - mcpherrinm 13y ago
    Generally $50 here in Canada.
- isaacwaller 13y ago
  Contactless transactions are limited to a small amount without entering a PIN.
  - taneliv 13y ago
    But a fraudulent "merchant" could still install a custom machine at a busy spot, and charge a good percentage of all passing NFC payment cards. Do this in a tourist area or near airport / other terminal, targetting foreign cards, and there's a good chance the fraud detection does not kick in before the weekend is over, and you have $20 x 50,000 "customers" x 2 days = 2 million in bank, converted immediately to bitcoin or similar and laundered before banks open on Monday. Why, yes, I've been the receiving end of a similar scam. It was Visa Electron and PIN-less purchases, then a new opt-out feature. The math was more like 5 customers, but 10,000 euro limit. (No, I did not lose that, or even close, by being lucky.)

dalore 13y ago

It's limited to only work for amounts below a certain threshold and also will randomly ask for the PIN sometimes. It's meant to be this easy.

hkyeti 13y ago

Millions of people use this exact system here in Hong Kong each day. It's amazingly convenient to be able to pay for train, bus, groceries, food in seconds without having to even take the card out of your wallet. People love it here.

chrischen 13y ago
But what happens when you have two contactless cards? The system in the article says it won't work if multiple cards are detected... but this would mean you'd have to take the card out of your wallet.
- hkyeti 13y ago
  In Hong Kong you verbally ask to pay by for example Octopus (the most popular card) and it activates that option only. So I don't think double charging is possible here.