Flaw in New ‘Secure’ Credit Cards Would Let Hackers Steal $1M Per Card

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
If you think it is a pain in the butt dealing with your credit card company now, imagine having to dispute a one million dollar fraudulent charge on your account. :eek:

According to researchers at Newcastle University in the UK, the card system developed by VISA for use in the United Kingdom fails to recognize transactions made in non-UK foreign currencies and can therefore be tricked into approving any transaction up to 999,999.99. What’s more, because the cards allow for contactless transactions, a thief carrying a card reader designed to read a card that’s stored in a wallet or purse could conduct fraudulent transactions without the victim ever removing their card.
Click to expand...
 
I don't know how they do things in the UK, but with my card services, such an entry would freeze the associated account and I would be contacted immediately.
 
So here's the million dollar question of the day...

Who the hell thought that making credit card payments wireless was a good idea?

I'm sorry, I usually embrace technology in most forms but a credit card is a device that should only be used if the human who owns said credit card is actively holding the card and making it physically connect to a credit card processing station. There are too many opportunities for fraud otherwise.
 
That article is misleading. It's written like it's a flaw in the EMV chip design. It's actually a flaw in Visa's contactless payment system.

So the new chip that needs to be included by the deadline in 2015 will be fine as long as Visa doesn't also include their bugged contactless system on the credit cards. easy fix.
 
But I thought these cards with chips are so much more secure than the magnetic stripes on the cards in the US?

Seems there is always a week link somewhere.

As for disputing a million dollar charge, I assume most people would also have to dispute the "over the limit" charges too :)
 
Yeah sorry, the flaw in the EMV chip itself is depredate from the flaw described by VISA.

Let's not confuse the flaws.
 
nutzo said:
But I thought these cards with chips are so much more secure than the magnetic stripes on the cards in the US?

Seems there is always a week link somewhere.

As for disputing a million dollar charge, I assume most people would also have to dispute the "over the limit" charges too :)
Click to expand...

This isn't describing a flaw with chip&pin, this is describing a flaw with a specific contactless payment.
TWO very different things.
 
dgingeri said:
Suddenly, I think the Faraday cage wallet industry will see a surge in sales. I've been using one for years now.

http://www.thinkgeek.com/product/8cdd/
Click to expand...



What's funny is that the Myth busters were going to test these devices and RFID cards in general. Before it could air, VISA/etc. called discovery and forced them to bin it. They also can't talk about it.

Gotta love large corporations, always looking out for what's right.
 
Most people don't have a million of anything (except maybe cells or bacteria or something) so disputing that much moolah would be super easy just based on the average person's total lack of money.
 
Spidey329 said:
What's funny is that the Myth busters were going to test these devices and RFID cards in general. Before it could air, VISA/etc. called discovery and forced them to bin it. They also can't talk about it.

Gotta love large corporations, always looking out for what's right.
Click to expand...

Chip cards have been proven hackable on a show similar to myth busters in Canada, I'll try to find a link.
 
Oh man, I maintain 2-step authentication is the best way to go. My Credit union doesn't quite have it yet, but if you have to approve every charge via your phone (Goggle Wallet), it won't do shit if they stole my CC number.
 
AaronGant said:
That article is misleading. It's written like it's a flaw in the EMV chip design. It's actually a flaw in Visa's contactless payment system.

So the new chip that needs to be included by the deadline in 2015 will be fine as long as Visa doesn't also include their bugged contactless system on the credit cards. easy fix.
Click to expand...

QFT.

There is NO RFID in the EVM chip. Visa has paywave and mastercard has easypass these 2 systems are RFID systems that are damn horrible. I use to use a hole punch on my cards to get rid of the RFID chip.
 
mullet said:
QFT.
I use to use a hole punch on my cards to get rid of the RFID chip.
Click to expand...

Allegedly simply pounding on a card with an RFID chip in it a few times with the sole of a shoe used to work as well. But that hack was from years ago. Hammers worked too, especially ball peen's, so you didnt damage the card itself and have to deal with possible unacceptence from retailers.
 
Solution.. don't get a card with a chip period.
I'm perfectly fine with my mag strip card.
 
The Neo Zero said:
Solution.. don't get a card with a chip period.
I'm perfectly fine with my mag strip card.
Click to expand...

Again chip&pin != contactless

Mag strip & sig is flawed and cc fraud is rampant in the usa.
Chip&pin overcomes alot of this and in the course of a year cc fraud dropped significantly.

Contactless is something different and has issues.

Stop showing your ignorance
 
You must log in or register to reply here.
Back
Top