Contactless card flaw could cost victims dear

A flaw in the security provisions for contactless payment cards could allow thieves to steal large amounts of foreign currency just by touching a smartphone against a victim’s wallet, scientists have said.

The glitch could allow thieves to withdraw sums of up to 999,999.99 in foreign currency denominations, The Independent reports. If done in Euros this could come to more than £780,000.

Contactless payment cards are meant to have a spending cap of £20, but security experts from Newcastle University found that those limits are not imposed when payments are made in foreign currency.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Researchers said that thieves could potentially exploit the flaw by rigging smartphones to act as card scanners, allowing them to steal huge sums of money from unwitting victims.

Lead researcher Martin Emms said: "With just a mobile phone we created a point-of-sale terminal that could read a card through a wallet. By pre-setting the amount you want to transfer, you can bump your mobile against someone’s pocket or swipe your phone over a wallet left on a table and approve a transaction. It took less than a second for the transaction to be approved."

After reviewing Newcastle University’s findings, Visa Europe responded that the study failed to take into account the "multiple safeguards throughout the Visa system", adding: "It would be very difficult to complete a fraudulent payment of this kind outside a laboratory environment."

The UK Cards Association trade body told the Daily Mail: "While this complex fraud may be theoretically feasible in a laboratory, it hasn’t been attempted in the real world and absolutely no money has ever been lost as a result. There are robust security checks in place at every single stage of a payment – by the retailer’s bank, the card scheme and the customer’s bank – which monitor, and stop, suspicious transactions. Consumers can be assured they are legally protected from any fraud losses and will never be out of pocket."

It added: "Contactless cards are extremely safe – borne out by the negligible fraud losses of less than 1p for every £100 spent over the first half of 2014."