3

This news story from "13 Investigates" shows Walt Augustinowicz (an RFID expert, and seller of RFID proof pouches) who has a portable reader than picks up credit card details while they are still in people's wallets and purses.

He also demonstrates copying the cloned information onto a magnetic credit-card, and using it to purchase goods without needing to sign or enter a PIN.

Is it that easy to clone an RFID-based credit card?

Note: Adam Savage reports that when Mythbuster's considered investigating RFID's security, they were warned off by legal counsel for several major credit card organisations.

  • @Cullen: Would you like to turn that into an answer, so we can get this question off the unanswered lists? – Oddthinking May 27 '15 at 20:18
8

Without getting too deep into the technology behind credit cards with RFID (which you can find here if you're interested), yes, it is possible to copy the data that credit cards broadcast, but it is unlikely that that information will be useful to a criminal if the card issuer was using modern security methods that are now common practice.

Snopes posted a response to this video in 2012 that contained a pretty good summary by security analysts:

The data streams emitted by contactless cards don't include such information as PINs and CVV (Card Verification Value) security codes — or, in newer cards, customer names — and without those pieces of information a card skimmer should not be able to utilize the stolen card numbers to print up counterfeit cards or engage in Card Not Present (CNP) transactions:

None of the cards transmits the additional number on the front or back, known as the card validation code, that some businesses require for online purchases.

[C]ompany representatives argued [that] the process of making purchases with the cards involves verification procedures based on powerful encryption that make each transaction unique. Most cards, they said, actually transmit a dummy number that does not match the number embossed on the card, and that number can be used only in connection with the verification "token," or a small bit of code, that is encrypted before being sent.

"It's basically useless information," said David Bonalle, vice president and general manager for advanced payments at American Express. "You can't steal that data and just play it back and expect that transaction to work."

(Emphasis mine.)

So the information sent (at least with newer cards) is a signature on the specific transaction, not information on how to sign any future transactions, making it essentially useless to a thief.

Now, of course there is some doubt as to whether this is the method employed by older cards, but it's more likely that these older cards are not being used anymore.

I'm not sure what to think about the Adam Savage video, but given the information above, I don't think you have to worry about it. :)

  • 1
    I have an anecdote to go with this. I have two credit cards with NFC (RFID), and at least for one of them I can read at least the card number with an NFC phone. Cards are from UK banks, and I got them in 2014. Note that many merchants don't need much more than the card number (no CVV), one big example of them is Amazon. – domen May 28 '15 at 11:56
  • 1
    Ross Anderson from Cambridge University is researching (and finding) vulnerabilities in contact-less credit cards implementations, see for example: cl.cam.ac.uk/~rja14/Papers/rfid-fc07.pdf – domen May 28 '15 at 11:59
  • So I assume it's something like, reader generates random token, sends it to card, card encrypts the token with its private key and responds with encrypted message including token, reader verifies it against its public key. Is that sort of correct? – 11101111 Jun 1 '15 at 4:41
  • @tomr, Yes; from what I understand, that is correct. Check out this link for a more technical explanation: security.stackexchange.com/a/71370/44582 – CullenJ Jun 1 '15 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .