Contactless cards again! [OT in uk.d-i-y]

[Roger Mills]

This article

appears to vindicate what I have always said about contactless cards.

Not only are they vulnerable to fraud by villains with scanners who don't need to get close enough to arouse suspicion, but it now seems that they're also vulnerable to *accidental* use!

I'm very glad that I ditched my CapitalOne card when they insisted [1] on replacing it with a contactless card.

More and more financial institutions are now using these things, making it very difficult to avoid unless you do away with credit and debit cards altogether. I've unfortunately still ended up with one or two, but they never leave the house and are used only for on-line transactions.

The sooner the whole idea is re-thought, the better!

[1] Using the very dubious tactic of pretending that my previous card had been "compromised" (which I'm damn sure it hadn't!) in order to provide a pretext for needing to issue a new card long before the old one had expired.

[Lee]

Can always re-purpose the tin foil from the hat to screen the card ;)

[therustyone]

You would need a ferrite-based card holder to deny magnetic field access. Could be a business opportunity.

rusty

[Andy Cap]

There's several Youtube videos on disabling them but I suspect they're using US cards pre-Chip and Pin and it looks like you'd damage that area as well. Andy C

[Tim Streater]

I don't believe I've seen one of these. Is it obvious what they are? Or might I find that the CC company sent me one when the current card expired and I didn't know it?

[Andy Cap]

Put "contactless card symbol" into Google.

[Frank Erskine]

Mu-metal.

[Tim Streater]

I see, thanks. Hmmm, looks like it's too late.

[Bernie Hunt]

Here's one company that has been offering products for several years. I expect there are others.

Bernie

[Roger Mills]

If you carry it around, keep it in a lead sheath!

[polygonum]

But if the same issue applies to NFC mobiles, the ferrite will play merry hell with recpetion...

[David Woolley]

Silver is best, then copper, but aluminium foil seems quite good, as tested with Oyster cards, which use the same near field communication standards. Lead is likely to be relative non-conductive. Sandwiching them between two Oyster cards may also trigger a multiple card error.

You can get foil lined card sheaths, and even foil lined card wallets (e.g. google "rfid blocking wallet").

The foil probably detunes the circuit, as well as screening it.

[Tim Watts]

On Monday 20 May 2013 14:38 therustyone wrote in uk.d-i-y:

Or you could just tell your bank to replace them...

[John Rumm]

I seem to recall that my bank wrote to me saying they were going to issue these things, and to object if you did not want one. I did, and later they sent one anyway. I wrote and pointed out I had requested not to have one, and they said basically "tough, its policy now!"

[Martin Brown]

Probably needs to be a sandwich of mu-metal inside copper inside silver to get maximum screening in minimum thickness.

According to that R4 consumer programme some M&S terminals were particularly aggressive about using contactless cards at a distance.

It is clear folly to have contactless unvalidated transactions. No-one needs to be able to buy things whilst wizzing past on a water slide!

[Martin Brown]

Advantage is they can probably only grab £20 at a time.

Depends how good you are at playing "guess the icon".

Contactless cards icon is "))))" with each one getting bigger.

If you have a Barclaycard chances are it as this functionality now.

[Theo Markettos]

A carefully placed drill hole should do the trick.

If anyone asks, you drilled it to keep cards on your keychain like those Tesco Clubcard thingies.

Theo

[Andy Wade]

Looking at BS ISO/IEC 14443-2 reveals that the operating frequency for these cards is 13.56 MHz - one of the ISM 'free-radiation' freqs.

Hence low-frequency screening techniques such as mu-metal aren't particularly relevant. Wrapping the card in aluminium foil ought to work fine. Ideally all the seams should make good contact, but you're not looking for a particularly high screening factor and more or less any sort of overall wrap ought to do the trick.

[Roger Mills]

But they can probably do it multiple times before being asked for a PIN

- and rack up quite a bill in the process.

[Harry Bloomfield]

Roger Mills explained on 20/05/2013 :

A sheet of cooking foil, in with the notes of your wallet, would probably be enough to defeat it.