Using equipment available online, thieves could exploit a security flaw to steal all information from contactless credit cards, a study done by consumer group Which? shows. Researchers tested these tools using six credit and debit cards, and were able to successfully retrieve the 12-digit card numbers and expiration dates from six of the debit cards and four credit cards. The data stolen was said to be recovered “easily and cheaply.”
A spokesperson from Which? states: “Contactless cards are coded to ‘mask’ personal data, but using an easily obtainable reader and free software to decode data, we were able to read the card number and expiry date from all 10 cards.”
The positive side to this is they were unable to access the CVC number found on the back of cards.
The group went as far as to test out a contactless card embedded with a magnetic strip containing the retrieved data and a fraudulent name, and was able to purchase a $4,000 TV. How scary? Thieves could empty your savings.
“We doubted we’d be able to make purchases without the cardholder’s name or CVV code – but we were wrong,” explained one of the researchers.
Fast growth with contactless payment cards has been seen in the recent year. Last year alone, £2 ($3.1) billion was spent using them, according to the UK Cards Association. The current minimum limit for these cards per transaction is £20 ($31), but beginning in September, the limit will be raised to £30 ($46.5).
All this news comes at a particularly ironic time, as Apple just released Apple Pay in the UK, which incorporates some similar technologies as those used by contactless cards; but one need not worry, IPhones transfer a generated code, rather than the actual card number, making it much more difficult for theft. Touché Apple, touché.
Source: Gizmodo
Advertisement
Learn more about Electronic Products Magazine
