Contactless cards

[zag]

Does anyone else think these things are amazing?

 

I love a technology that makes my life easier and they seem to really be getting popular now accepted in all kinds of places.

 

 

I just noticed that Transport for London are launching their contactless card system this week on the tubes. No more carrying a separate Oyster card!!

 

Is this the future for all payments?

[sted]

if i was you i would carry an oyster card its cheaper by a long way i believe. Im not sure its a good idea it means if someone nicks your card they can spend up to whatever the limit is without even needing your pincode so handy yes but im not sure its not a triumph of technology over common sense

[dhicks]

if i was you i would carry an oyster card its cheaper by a long way i believe. Im not sure its a good idea it means if someone nicks your card they can spend up to whatever the limit is without even needing your pincode so handy yes but im not sure its not a triumph of technology over common sense

 

London Undeground are advertising contactless payments as being the same price as Oyster cards, although I think that's for single trips rather than a monthly or yearly travelcard. Handily, you can now (or soon, anyway) use your iPhone as a contactless payment device - I assume it should work on the Tube, and seemingly for that you need yourfingerprint on the sensor for it to authorise the payment.

[LosOjos]

Genuine question: what's to stop criminals walking around town with a contactless card reader, tapping people's back pockets to nick £1 at a time? Could be a nice little earner for them...

[itgeek1989]

Genuine question: what's to stop criminals walking around town with a contactless card reader, tapping people's back pockets to nick £1 at a time? Could be a nice little earner for them...

 

A Faraday cage wallet?

[ChrisH]

A Faraday cage wallet?

 

I've had one of these for a while now.

[seustice]

Genuine question: what's to stop criminals walking around town with a contactless card reader, tapping people's back pockets to nick £1 at a time? Could be a nice little earner for them...

 

Nothing, but banks have promised that they will underwrite any consumer loss caused by the contactless system, and I'd imagine this fraud would be fairly easy to spot by merchant services.

[CAM]

My Lumia can do this but I am not sure how to set it up. I don't really want to be fiddling with my phone at the till. :/

[zag]

Genuine question: what's to stop criminals walking around town with a contactless card reader, tapping people's back pockets to nick £1 at a time? Could be a nice little earner for them...

 

I've actually given it a go and it doesn't work through my very thin wallet.

 

I need to actually hover over the payment machine about 1cm for it to register.

 

I doubt this will be a problem to be honest.

[zag]

if i was you i would carry an oyster card its cheaper by a long way i believe. Im not sure its a good idea it means if someone nicks your card they can spend up to whatever the limit is without even needing your pincode so handy yes but im not sure its not a triumph of technology over common sense

 

Contactless - Transport for London

 

Its the same price as oyster, even for weekly travel cards.

 

Pretty cool system if you ask me. I've just registered my debit card on their site and you can even do things like track your usage and obtain refunds for incomplete trips, just like oyster.

 

[FN-GM]

They have been doing it for years in Australia. I used to use contactless cards all the time. Really quick and easy.

 

I have never used one in the UK.

[zag]

They have been doing it for years in Australia. I used to use contactless cards all the time. Really quick and easy.

 

I have never used one in the UK.

 

I was speaking to my US friend last week and they haven't even started rolling it out yet. 2015 apparently.

 

Nice to see we are ahead of the game for a change

 

Did Australia have any problems with them?

[Sdrawkcab]

Genuine question: what's to stop criminals walking around town with a contactless card reader, tapping people's back pockets to nick £1 at a time? Could be a nice little earner for them...

 

The same thing that stops them from forcing people to carry out fraudulent payments in the street using a chip+pin reader? Surely their reader wouldn't be able to actually authorize payments unless they were registered as a legitimate business? In which case, once they've done that much work surely there are more lucrative crimes they could carry out than robbing £1 off all the people in the high street?

[MrMat]

I've had one of these for a while now.

 

I don't need one of those...but i sure do want one! They're cool.

[FN-GM]

I was speaking to my US friend last week and they haven't even started rolling it out yet. 2015 apparently.

 

Nice to see we are ahead of the game for a change

 

Did Australia have any problems with them?

 

The USA don't even have Chip and Pin. Loads of TV is still recorded in 4:3 over there!

 

Don't think they had any issues, it just worked! Not all places could accept them until they had the new machines fitted, that's about it.

[pantscat]

The USA don't even have Chip and Pin.

 

Yep - that's true. It felt very odd signing for stuff when I was there last Autumn!

[Trapper]

The check (cheque) is still king in the land of the free.

 

Current accounts are still called checking accounts.

[plexer]

As well as less developed countries who still have magstripe cards America is another one where your cloned card details go to.

 

In the same vein as it's not possible to just clone a normal mifare card with just a reader you can't just read a contactless bank card and do the owner out of money.

 

Ben

[Garacesh]

I was speaking to my US friend last week and they haven't even started rolling it out yet. 2015 apparently.

Yeah, but when most people still swipe and sign, I think if they do roll it out it will be NFC and sign.

 

I never really liked NFC.. There was such a huge push for Chip and Pin in the name of security, and now they're trying to push a way to blow that out of the window? Sure, if someone steals your card you can phone up and cancel it but if you don't get to it quick enough (or simply don't know it's been taken!) they can spend a decent amount of money on it. I think my housemates NFC payment limit was £25 before he phoned up and asked for a card without the feature.

[DanTheLacky]

My bank card is contact less payment, max spend is £20 per transaction, however I don't really want it, nor did I opt in and I can't opt out either. Debit cards they issue come with contact less payment and can't be inactivated, with my bank atleast -_-

We stopped accepting cards you have to sign for because they aren't secure enough but then we go and make it even easier.... People are never happy, putting in 4 digits or remembering 4 digits is so hard.

Had a small argument with the woman who worked in the post office the other day, she insisted I use my contact less card (quiet loudly so everyone around me could hear), I could feel the people around me eying me up for my wallet.

"No one would mug you for a maximum of £20".

Bull poop, if I walked down the road with a £20 note in my hand for a few weeks I guarantee someone would nab it. Plus it's £20 per transaction per shop until my bank notices or I realise it's been stolen.

 

Sorry for the essay type rant but I don't like it when we go backwards on security for the sake of some people being to lazy to push four buttons or remembering their pin.

[zag]

My bank card is contact less payment, max spend is £20 per transaction, however I don't really want it, nor did I opt in and I can't opt out either. Debit cards they issue come with contact less payment and can't be inactivated, with my bank atleast -_-

We stopped accepting cards you have to sign for because they aren't secure enough but then we go and make it even easier.... People are never happy, putting in 4 digits or remembering 4 digits is so hard.

Had a small argument with the woman who worked in the post office the other day, she insisted I use my contact less card (quiet loudly so everyone around me could hear), I could feel the people around me eying me up for my wallet.

"No one would mug you for a maximum of £20".

Bull poop, if I walked down the road with a £20 note in my hand for a few weeks I guarantee someone would nab it. Plus it's £20 per transaction per shop until my bank notices or I realise it's been stolen.

 

Sorry for the essay type rant but I don't like it when we go backwards on security for the sake of some people being to lazy to push four buttons or remembering their pin.

 

Sounds like the same arguments that were spoken about when the cheque was introduced, then debit cards were introduced, and then chip and pin came along

 

People are always resistant to change, but I can say that so far the contactless cards have been revolutionary in the way I pay for things.

 

Personally I love them.

[CAM]

There is really nothing to fear from them. The logistics of attempting to steal money from your pocket with a reader is silly and banks have already promised to cover losses from contactless theft if you get mugged anyway. You could say every time you hit save card details on a website that they could steal well above the contactless limit if your account gets compromised which is far more likely to happen!

 

Let's assume you have someone picking pockets contactlessly. If they can even read it, you are looking at:

 

1) Having a chip and pin device that is probably too large to even carry surreptitiously. You don't just make these things like tiny card skimmers in ATMs.

2) Having a secure chip and pin device registered to a person/business. It'd be like leaving a note with your name and address in the pocket of the person you have picked.

3) A constant secure connection to the Internet to process transactions.

4) Attempting to hover this large cumbersome object over a random person's posterior which will probably beep loudly assuming you don't bump it against them and end up with a punch in the face and/or sexual assault charges. The only place you could get close enough is a crowd but bear in mind this wouldn't be anywhere near as stealthy as picking a wallet.

5) You could hide the reader under a coat/bag but we go back to the problem of the card being more difficult to pick up the more layers there are between them.

[Garacesh]

Whilst I completely agree that random-scanning is infeasible due to the technological limitations, and also about each time you give a site your details etc. But I still don't like it.

 

Would you only set up your NTFS permissions on most of your network, leaving the last little bit unprotected because "It's only a small amount" (£20) and "I have a backup of it anyway" (promise to refund)

[LosOjos]

I hadn't considered the registered reader, so OK that puts random stealing of small amounts out of reach.

 

Another question then; card cloning. I don't think it's unreasonable to imagine a thief walking around a crowded area with a concealed NFC reader (if you've ever been somewhere like Brick Lane in London on a Saturday afternoon, you'll know that you soon stop worry about being bumped in to!). If the NFC chip in the card transmits everything necessary to facilitate a transaction, which it must do as there's no secondary authentication involved, why couldn't you capture those details and program them on to a new card? As we're not talking authorised, registered devices now, we have anonymity as much as we do with any cloned card and the signal in the reader could be boosted to a point it can penetrate a couple of layers of clothing.

 

I know banks say they'll refund any illegitimate transactions, but I don't fancy trying to convince them that I wasn't the one who made those transactions.

 

One hacker in the US has already demonstrated the possibility of doing this: Hacker's Demo Shows How Easily Credit Cards Can Be Read Through Clothes And Wallets - Forbes

[CAM]

Paget's demonstration is a lab test and the article says why your theory of tap-to-clone cards won't work:

 

In fact, contactless cards do offer one security feature traditional cards don’t: Along with the card’s 16-digit number and expiration date, the cards are set to offer up a one-time CVV code with every scan. Those codes can only be used for one transaction, and have to used in the order they’re generated. If a payment processor detects multiple transactions with the same code or even codes being used to make transactions in the wrong order, it will disable the card. So a contactless card scammer can only use each stolen number once, and if the victim of a the scam uses the card again before the thief has time to make a fraudulent payment, all transactions on the card will be blocked.

 

You can steal the card details at the train station or a shop queue, but as soon as they tap the card on the barriers or point-of-sale the information gleaned from the card becomes useless.

Edited September 12, 2014 by CAM