With the advent of contactless payments there are people who are afraid that this could be used to steal their money remotely without them even noticing. I used to be in that camp too until the pandemic started and I found out a few things that reassured me. Recently I've been debating about this in some comment section on the Internet and I started to wonder - is this even feasible?
Let's assume that it's technically realistic, in the sense that you can rig up the necessary hardware and it will actually work. But what about all the other hurdles that a fraudster would need to go through?
The things I can think of:
- They would need a card terminal which is connected to a bank account, and only banks/intermediaries issue those. And they demand all kinds of personally identifying information in return.
- So they'd need to find someone gullible enough to be a scapegoat (which might be doable, but still)
- They'd need to meet the scapegoat to receive the terminal itself
- The complaints about fraudulent transactions would start to come in almost immediately as they started using their modified setup. Thus they have only a few days at best, a few hours at worst before the terminal is deactivated, the account is locked and the scapegoat is visited by the police.
- Within this short timeframe, only a small portion of the money would have cleared to make it to the account associated with the terminal. (I'll assume that they transfer any incoming money immediately via untraceable channels) Or maybe even new clients have a longer hold on their money, precisely because they are a larger fraud risk.
- Then they still have the problem that they might have been seen with a camera or the scapegoat remembers them well enough (or there's a camera nearby the scapegoat).
All in all this seems like a lot of trouble for very little gain.
So my questions are: Is this kind of attack actually feasible? Has it ever been done? Should people worry about it and take precautions (foil-lined wallets etc.)?
Of additional note: I'm talking here about contactless bank cards, not contactless payments via a smartphone.