Where's the scam?
Discussion
Does the scam these guys are trying to save you from really exist?
'Special' wallet
Or is the real scam falling for a Daily Mail-esque scare story about protecting your wallet and buying some more crap you don't need?
'Special' wallet
Or is the real scam falling for a Daily Mail-esque scare story about protecting your wallet and buying some more crap you don't need?
Barclaycard use 'contactless technology' as seen on the advert with the man on the slide.
It's not common where I live, but I expect there will be more RFID credit cards and readers if this contactless tech catches on with retailers and card providers.
In that case I would imagine the frequency of this type of crime would increase.
It's not common where I live, but I expect there will be more RFID credit cards and readers if this contactless tech catches on with retailers and card providers.
In that case I would imagine the frequency of this type of crime would increase.
simonrockman said:
There are 6m Visa cards with contactless in the UK. You may very well have one an not know.
Simon
Really? I thought it was just those barclaycard ones for now. Is there any identifying mark on them or are they going to be activated later or what? I have a fairly new NatWest visa debit card, do you know if they are contactless?Simon
I'm not too worried about people stealing the info, but would like a go at the tech
Passive RFID works by the antenna (connected to the chip) collecting RF signal from a reader and using it to reflect its own signal back to the reader.
The size of the antenna in the card and the frequency of the signal directly affects the distance over which this reflected signal can travel. In the case of contactless cards, that distance is tiny. If you've ever used a door swipe card or an Oyster card you'll be aware that you practically have to touch the card to the read point to get a read. This distance is also "line of sight", i.e. there's nothing between the card and the read point. Signal is further degraded by environmental factors, such as other items in your wallet, the wallet itself, your trouser pocket etc. On top of that, the 2 worst things for RFID signals are metal (keys, coins) and water (70% of the human body).
In order to get a quality read from a contactless credit card that was in your wallet, in your pocket, the reader would have to be within a centimetre or two of your body at which point they may as well pick your pocket.
All this aside, all but the very earliest of these card are encrypted, so the data is fairly useless anyway.
The size of the antenna in the card and the frequency of the signal directly affects the distance over which this reflected signal can travel. In the case of contactless cards, that distance is tiny. If you've ever used a door swipe card or an Oyster card you'll be aware that you practically have to touch the card to the read point to get a read. This distance is also "line of sight", i.e. there's nothing between the card and the read point. Signal is further degraded by environmental factors, such as other items in your wallet, the wallet itself, your trouser pocket etc. On top of that, the 2 worst things for RFID signals are metal (keys, coins) and water (70% of the human body).
In order to get a quality read from a contactless credit card that was in your wallet, in your pocket, the reader would have to be within a centimetre or two of your body at which point they may as well pick your pocket.
All this aside, all but the very earliest of these card are encrypted, so the data is fairly useless anyway.
digitise said:
In order to get a quality read from a contactless credit card that was in your wallet, in your pocket, the reader would have to be within a centimetre or two of your body
Have you ever been on the Tube at rush hour? Very easy to get this close to people's wallets if you were to try.Also it's not fair to say that they 'may as well pick your pocket'. Since that is inhrently more risky as you have to remove and conceal the wallet, plus you have to use the details before the card is reported missing - which won't take long. By stealing the data via RFID you can take your time as the victim will not stop their card immediately, as it's not physically missing so they are non the wiser until you start spending on their account, by which point it's too late.
Finally, on the range: Have you ever been to a library? The books normally have a little lable in them which makes the buzzers at the exits go off if you take out a book you're not supposed to. I believe these work via passive radio and only require you to pass through the gate, rather than get super close. Don't know if this is the same tech as the credit cards though.
mrmr96 said:
Finally, on the range: Have you ever been to a library? The books normally have a little lable in them which makes the buzzers at the exits go off if you take out a book you're not supposed to. I believe these work via passive radio and only require you to pass through the gate, rather than get super close. Don't know if this is the same tech as the credit cards though.
Ditto on clothes and many other goods - used to control stock movements, 'clocking' items as they leave warehouse, enter truck, leave truck, enter store, leave store, etc.There are a couple of controls. The system requires a PIN over certain values, and occasionally needs a PIN for transactions less than that value.
I don't know if this is generated by the reader - and so hackable - or by the network.
My boss will and I'll ask him.
Simon.
I don't know if this is generated by the reader - and so hackable - or by the network.
My boss will and I'll ask him.
Simon.
Edited by simonrockman on Thursday 10th June 16:48
mrmr96 said:
digitise said:
In order to get a quality read from a contactless credit card that was in your wallet, in your pocket, the reader would have to be within a centimetre or two of your body
Have you ever been on the Tube at rush hour? Very easy to get this close to people's wallets if you were to try.Also it's not fair to say that they 'may as well pick your pocket'. Since that is inhrently more risky as you have to remove and conceal the wallet, plus you have to use the details before the card is reported missing - which won't take long. By stealing the data via RFID you can take your time as the victim will not stop their card immediately, as it's not physically missing so they are non the wiser until you start spending on their account, by which point it's too late.
Finally, on the range: Have you ever been to a library? The books normally have a little lable in them which makes the buzzers at the exits go off if you take out a book you're not supposed to. I believe these work via passive radio and only require you to pass through the gate, rather than get super close. Don't know if this is the same tech as the credit cards though.
A quick google reveals that the Mifare Classic encryption was hacked in 2008. Very quickly after, a new, stronger encryption was released to replace it. There will always be a battle between those trying to improve security methods (be it cards, car alarms, whatever) and those trying to crack those methods for jollies or financial gain, and I don't think that contactless cards are any more vulnerable than mag stripe or chip & pin cards.
As far as range is concerned, it's horses for courses. I have worked with UHF passive RFID tags that can be read 30 feet away, and LF tags that will only read on contact. If you want to stop people walking out of your store with a free jumper, you deploy HF tags with a range of 18" and place reader hoops 3 feet apart. If you want to use contactless cards, you use a very low range tag that require the user to be within a centimetre of the reader.
I live up norf, and don't have need of an Oyster card, so this is a question to those in the know. Can you pass your wallet over the read point on the gate (with the Oyster inside) and get through?
Handy.
On reading a little further into this, there is a whole range of encryption possibilities and vulnerabilities depending on the card you have. All newly issued Oyster cards now come with Mifare DESFire chips, which apparently have stronger encryption than previous "Classic" cards.
The Barclaycard contactless has a maximum transaction value of £15 (and may occasionally request a PIN, as previously mentioned). They also pledge to fully refund anyone found to have been a victim of fraud, which suggests that they're not overly confident in their security
My guess would be that as the encryption gets better, the maximum transaction values will increase, as will the attempts to clone the cards, but the liability will still remain with the card provider.
Besides, I plan to keep mine tucked away under my tinfoil hat, so it can't be read (in the supermarket or from space).
On reading a little further into this, there is a whole range of encryption possibilities and vulnerabilities depending on the card you have. All newly issued Oyster cards now come with Mifare DESFire chips, which apparently have stronger encryption than previous "Classic" cards.
The Barclaycard contactless has a maximum transaction value of £15 (and may occasionally request a PIN, as previously mentioned). They also pledge to fully refund anyone found to have been a victim of fraud, which suggests that they're not overly confident in their security
My guess would be that as the encryption gets better, the maximum transaction values will increase, as will the attempts to clone the cards, but the liability will still remain with the card provider.
Besides, I plan to keep mine tucked away under my tinfoil hat, so it can't be read (in the supermarket or from space).
Gassing Station | The Lounge | Top of Page | What's New | My Stuff