Security researchers have discovered flaws that could allow hackers to bypass the UK contactless verification limit of £30 on Visa contactless cards. The researchers, from Positive Technologies, tested the attack with five major UK banks, successfully bypassing the UK’s £30 limit (which is used to safeguard against fraudulent losses) on all tested Visa cards, irrespective of the card terminal. They also found that this attack is possible with cards and terminals outside of the UK.
In response to the report, below is a comment from Frederik Mennes, director of product security at OneSpan :
This attack requires the adversary to manipulate the data flow between the payment terminal and the payment card, which requires the them to be in very close proximity to both the terminal and payment card, which limits the scalability of the attack. The most practical way to implement the attack probably consists of adding an extension to the terminal that acts as a man-in-the-middle between the terminal and card. The extension should look as if it is a genuine part of the terminal, and this is similar to skimming attacks against magstripe-based payment cards, whereby a fake terminal is used to read the content of a card’s magstripe.
Banks, merchants and consumers should do the following to prevent this type of attack:
- Banks should analyse financial transactions for all payments that they process, and try to identify fraudulent transactions as much as possible
- Merchants should inspect their payment terminals regularly and make sure there are no extensions to it. Consumers should also look for strange additions to payment terminals.
- Consumers should keep their payment card in a screening wallet, so that it cannot be read inadvertently. They should also enable SMS notifications for new payments and contact their bank immediately if they notice a suspicious payment.