Security in Contactless Cards: Real Danger or Myth?

A news story that made the rounds recently claimed that, alongside the spread of contactless cards, a new kind of fraud had appeared: fraudsters could pull money from cards from a suitable distance using POS devices — without ever touching the victim's wallet or bag, and for amounts below the limit that require no signature or PIN.

Comments followed in the days after — which is perfectly normal. What was surprising, though, was that some people who, given their title and workplace, ought to know the subject dismissed it as a “myth” and turned the discussion into a sitcom centred on “the POS device.”

Focusing only on the POS is a big mistake

Contactless cards are built on RFID technology. There's no need to turn this into an academic paper on contactless cards, RFID and its applications. Yes, the story quoted was specifically about “bank cards.” People who know the RFID field may see that as a gap; but both because news needs to hit hard and because the reporters didn't know the field well, it's quite natural that only bank cards were mentioned and the devices used for the theft were limited to POS terminals.

Yet public transit cards, access/door cards and — even in a different format — biometric passports that operate on the same frequency as contactless cards are all contactless applications too. Every secure document that uses RFID (credit card, transit card, hotel key, passport) faces this risk; even if it hasn't become widespread in the world or happened here yet, somewhere out there someone is trying it, if only in a lab.

Examples: Video (YouTube) · Global News · Forbes · CBC News · Daily Mail

A determined thief comes prepared

Because the story mentioned a POS device, some commenters explained things in POS-specific terms. But anyone intent on theft wouldn't attempt it with a POS device in the first place: consider how many NFC-capable Android phones and tablets there are, onto which the necessary software can be loaded with ease… (video)

What's more, credit-card fraudsters have turned into internationally connected organisations; instead of large one-off amounts, they go after many cards for small sums that won't attract attention. Card data stolen abroad is often not even used in the country where it was taken — it's traded through international networks and used in other countries. (NPR)

Denying problems is not a solution

This is a potential risk that hasn't yet turned into a problem. Whether ignoring the risk and being unable to tolerate even talking about it is a method the industry is resorting to for the first time, I couldn't say. (video)

Now let's look again at the potential danger in our wallets: our contactless credit cards, new-generation chip IDs, chip passports, transit cards and workplace access cards are the first that come to mind.

Speaking of passports

Did you know that in the US — the first country in the world to adopt chip passports — passport books are handed out wrapped in a sleeve that stops the information inside from being read by unauthorised people? In other words, I'm talking about a country that is aware of just how big a danger the thing we call a “myth” here actually is, and that leads on the issue. You can read the answer to “Is there a threat from skimming personal information or tracking American citizens?” on the official page: U.S. Department of State.

Better safe than sorry: how do we protect our data?

Of course, for secure documents the primary security element is the software and its design. But RFID-blocking products are a complementary part of it. Faraday-cage wallets are already on the shelves of many stores. Unfortunately, though, the fact that these wallets have entered the country with no consumer awareness or legal regulation about how reliable their production standards actually are doesn't quite clear the question marks from our minds.

What is this article for?

To trash contactless chip technology? Absolutely not. This technology, known for how much it makes life easier, needs to spread even further. It's just that industry risks shouldn't be ignored; even when the dangers are only potential, precautions should be considered and planned.