1

With the advent of contactless payments there are people who are afraid that this could be used to steal their money remotely without them even noticing. I used to be in that camp too until the pandemic started and I found out a few things that reassured me. Recently I've been debating about this in some comment section on the Internet and I started to wonder - is this even feasible?

Let's assume that it's technically realistic, in the sense that you can rig up the necessary hardware and it will actually work. But what about all the other hurdles that a fraudster would need to go through?

The things I can think of:

  • They would need a card terminal which is connected to a bank account, and only banks/intermediaries issue those. And they demand all kinds of personally identifying information in return.
  • So they'd need to find someone gullible enough to be a scapegoat (which might be doable, but still)
  • They'd need to meet the scapegoat to receive the terminal itself
  • The complaints about fraudulent transactions would start to come in almost immediately as they started using their modified setup. Thus they have only a few days at best, a few hours at worst before the terminal is deactivated, the account is locked and the scapegoat is visited by the police.
  • Within this short timeframe, only a small portion of the money would have cleared to make it to the account associated with the terminal. (I'll assume that they transfer any incoming money immediately via untraceable channels) Or maybe even new clients have a longer hold on their money, precisely because they are a larger fraud risk.
  • Then they still have the problem that they might have been seen with a camera or the scapegoat remembers them well enough (or there's a camera nearby the scapegoat).

All in all this seems like a lot of trouble for very little gain.

So my questions are: Is this kind of attack actually feasible? Has it ever been done? Should people worry about it and take precautions (foil-lined wallets etc.)?

Of additional note: I'm talking here about contactless bank cards, not contactless payments via a smartphone.

Improve this question
1
  • Side note: As you seem to be in the EU, note that the current EU Payment Services Directive (PSD 2) caps your total liability for unauthorized payments at €50. Anything above that limit is purely for the bank to worry about. And for most people in the EU, €50 is an amount they can live without for a week or two until the fraudulent transaction gets reversed by the bank.
    – TooTea
    Mar 15 at 15:39

2 Answers 2

Reset to default
3

Is this kind of attack actually feasible?

Technically - of course. Practically - as discussed in the comments, not very likely. You'd have to be fairly close to the card, or have a pretty sophisticated and standing out piece of equipment.

Has it ever been done?

Ever? Who knows. Maybe? Nothing that I've seen ever reported, but maybe someone was able to pull something like that off.

Should people worry about it and take precautions (foil-lined wallets etc.)?

No.

In most countries (you haven't specified a jurisdiction, but it's fairly universal) anti-fraud protections for credit cards are strong enough for you to not needing to care, it's banks' problem.

Improve this answer
5
  • Were comments deleted? You write as discussed in the comments. but there's only one comment to the question.
    – Bernhard Döbler
    Mar 15 at 22:22
  • 1
    Regarding not needing to care - when money was stolen one has to go to the police and all that. If theft can be avoided by a special purse it might be worth saving the effort to get your money back. Most card readers only work, when exactly one card is present. If you have two cards in your purse, you should be safe, too.
    – Bernhard Döbler
    Mar 15 at 22:27
  • @BernhardDöbler when money was stolen one has to go to the police and all that - for credit cards? Never done that. File a dispute with the credit card company and that's it, they take care of everything else. Comments - under the answer by jwh20.
    – littleadv
    Mar 15 at 23:13
  • @BernhardDöbler In practice, once the card issuer learns of the fraud (either one of the affected people complains or an automated system flags the transactions as suspicious), they're likely to just revert all of the transactions by the compromised terminal in one go. Most of the affected people will thus never notice at all (unless they check their transactions daily). And if nobody else notices, disputing a card transaction (at least in the EU) is a matter of filling in a one-page form and e-mailing that to the bank.
    – TooTea
    Mar 16 at 7:36
  • One nitpick, but otherwise perfect. Really it's the merchants problem. The banks take back the money from the merchant and the merchant is out the goods and probably some fees from the bank.
    – Pete B.
    Mar 17 at 14:03
2

I couldn't find any documented cases of where it's been done and discovered but I did find this article about its possibility:

Contactless Hack

This diagram from the article shows the setup:

Contactless Hack Setup

I would imagine that the card's data could be read by a system that can read the contactless data while the card is still in your wallet.

Improve this answer
5
  • OK, this is interesting. After some more snooping around I found this paper which seems to claim the same thing and also that this is compliant to the EMV standard. It does however mention 10cm range, which I've seen in other places too. I wonder how the physics of that work out. Is reading an card like that from several meters away really impossible or just difficult?
    – Vilx-
    Mar 15 at 14:17
  • My guess is that with proper equipment, like a higher power transmitter and a directional antenna, more than 10 cm can be achieved. But even at 10 cm, cards could be "skimmed" just by walking around and getting reasonably close to people.
    – jwh20
    Mar 15 at 14:21
  • I'd say that 10cm is quite unreasonably close to people. 😆 But it could be doable in extremely crowded places. However in those places you probably couldn't get access to many people because, well, it would be crowded and hard to move about.
    – Vilx-
    Mar 15 at 14:35
  • 1
    My wife has a friend who swears by her tin wallet. She is a bit of a loony.
    – Michael Harvey
    Mar 16 at 7:42
  • "She is a bit of a loony." - she believes everything she reads in the Daily Mail.
    – Michael Harvey
    Mar 16 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.