Contactless Visa Debit

Popoutman

So it seems that there are no effective security measures in place for protecting the information that is held on the RFID / contactless payment cards. The information can be read, including the card number, the expiry date, and the cardholder's name. Pretty much all the information needed for a lot of fraudulent transaction types. This is based on an Android application getting relevant information from an RFID card without the card owner being aware.
Link: http://www.newscientist.com/blogs/onepercent/2012/06/android-app-lets-you-swipe-con.html
Link: http://www.channel4.com/news/millions-of-barclays-card-users-exposed-to-fraud

Just because the false transactions may be refunded after the fact by the card provider is not enough as the cost will still be handed down to the customers eventually.

I've seen the apparent requirement for close contact advertised as a security measure. However, it's possible to read RFID information from tens of metres under ideal conditions and well into the single-digit metres range under normal conditions with off-the-shelf equipment. It would be easy to install an RFID reader in e.g. a shop doorway or other choke point, and read a huge number of cards as people stroll past, each person being completely oblivious to the fact that their new credit card details have just been read without their knowledge.

Here is a link to a demo given where a card was cloned live in front of the owner and then used to conduct a transaction through normal payment channels. As the demonstrator "paid" themselves $15 but then gave the card owner $20 the transaction was not fraudulent therefore would not have been picked up by the card provider as a fraudulent transaction..

It appears that if a group of people wished to, they could easily gain the numbers of a lot of people's contactless credit cards. This is an issue, as most people are not aware of this possibility though they may be protecting physical access to their wallets.

As it is at the moment, it appears that there is no effective defence built in to the systems in use other than a cut-off of the contactless transactions if the card fails a pin check. This is not confidence inspiring. It is also not confidence inspiring that any details of security measures, stated to be in place, are available at all. Is there any proof of any security measures at all?

I'd like to see all of the banks provide free-of-charge RFID screening sleeves to prevent unwanted and unknown reading of the cards in possession, given that the cards are easily scanned while in a wallet or pocket. When will these be made available to customers? If not, why not? It would be an extra layer of security for information that can be gleaned without the owner's knowledge and if the card is in a screening sleeve then at least the card holder would have to actively take the card out to use it, thus ensuring that the card holder is aware of the security implications of contactless payments.

I'm willing to have a chat via PM if required where I can discuss my issues as a BOI customer, if that is preferred by the BOI reps here.

PaulDalyRoI

card number , expiry date and name is not enough to make a transaction.

you can't create a valid mag stripe from that.. nor a contact/contactless chip (no where near it!). All you may be able to do is use it for online purchase and even then you should at least need the code on the back of the card to get approval. Not to mention verified by Visa or 3d secure (mastercard) should also be needed.

But still I gotta agree that I don't like the thought of any of the card data being easily accessible.

I wonder has anyone actually got these details from contactless cards outside of a lab environment? ie in a real life situation...

A friend has a phone with a contactless reader and the tags that come with it pretty much need to touch the phone to be read.... you'd never manage to get peoples card details without being very obvious.....

Bank of Ireland: Pat

Hi Popoutman,

Thanks for your post. I appreciate your concerns in relation to the security of the NFC capabilities that are included in some customers' Visa Debit cards. Unfortunately, as previously mentioned, we cannot go into any more detail about the security features of our contactless cards.

I've passed on your feedback and concerns to our Visa Debit team for consideration. If there is anything else you would like to add to your post above, feel free to PM me and I will pass it on as well.

Thanks
Pat

1865

Hi Pat,

Like a few of the others on this thread, I have been working in IT for some time, and, am worried about the security of NFC cards.

I rang BoI to ask to have this capability turned off on my card but was told that this is not possible. However the person in the call centre was not at all familiar with the cards and was only able to read me the guff from your website. Can you confirm if this is possible or at least to have it set to always ask for a PIN.

Bank of Ireland: Graham

Hi 1865,

It isn't possible to disable the contactless technology on the card, or to set it up so that you're always asked to enter your PIN.

Bank of Ireland: Pat wrote: »

You can request a Visa Debit card without the contactless technology by contacting your branch or by ringing Banking365 on 0818 365 365.

Thanks for your query,
Graham

cpio

It seems you can disable the contactless technology in the cards by slightly mutilating them. This will leave original chip and pin functionality intact - http://linuxcentre.net/disabling-contactless-cards

I've been using other BOI cards for ages with similar cracks in them caused by wear and tear so I can't see it causing too many problems.

Sounds like a reasonable solution until BOI begin to issue the new Visa debit cards with the contactless technology disabled.

Bank of Ireland: Pat

Hi all,

We would strongly advise against disabling the contactless functionality of your card by following the steps outlined in the link above.

As the method outlined involves cutting your card, this will weaken the card and will greatly heighten the chances of your card splitting. Also there is no guarantee that this will turn off the contactless functionality as not all cards are designed the same.

In the picture at the bottom of the article the author has already damaged the strip on the back of his/her card. This can lead to issues using your Visa Debit card in some ATMs. This can also raise the chances of your card being stuck in an ATM machine or being retained by the machine.

If you wish to opt out of the contactless functionality on your new Visa Debit, please contact your branch and request a card that does not include the contactless functionality.

Thanks
Pat

cpio

Hi Pat,

Thanks for your quick follow up.

Can you confirm a couple of points:

1) The replacement card without contactless technology is still a full Visa debit card and not just an ATM card.

2) If you have not yet upgraded to the Visa debit card and are still on Laser, will you or will you not be charged the €5.90 for the issue of a non-contactless visa debit card?

Cheers!

Bank of Ireland: Laura

Hi cpio.

A Visa Debit card that does not feature the contactless technology is still a debit card, the only difference is that you will be required to enter your pin number each time you make a point of sale transaction.

There is no charge if you decide to change from a contactless to a contact Visa Debit card. Please contact your account holding branch directly who will arrange this for you.

Hope this helps.
Laura

1865

Bank of Ireland: Graham wrote: »

Hi 1865,

It isn't possible to disable the contactless technology on the card, or to set it up so that you're always asked to enter your PIN.

Originally Posted by Bank of Ireland: Pat View Post
You can request a Visa Debit card without the contactless technology by contacting your branch or by ringing Banking365 on 0818 365 365.

Thanks for your query,
Graham

Thanks For the response Graham. I did ask for this when I rang Banking 365 and was told that it is all or nothing but I will try again.

Bank of Ireland: Tara

Hi 1865,

If you contact your branch directly, a representative will be happy to order a contact only Visa Debit card for you. You can find contact details for your branch here.

Thanks,
Tara

Explosive_Cornflake

I'm not sure if anyone else has seen this, but I have passed the €15 limit without using a pin.
31/07/2012 C2907GB 18.30@.782051 23.40
That was in an M&S in London. I was curious to know if it would work, I had in my the limit was 20.

Bank of Ireland: Billy

Hi Explosive Cornflake,

Different countries have different Contactless limits.
The UK limit is £20.

We do not have access to account information but the 23.40 you mentioned should be the Euro amount which would be less than £20.

Thanks for your question.

Billy

Explosive_Cornflake

I do realise how currency excahnge works. The point I was raising is that the limit is not €15 euro, but as you said, depends on the country where it is used. I hadn't seen that mentioned anywhwerre, but again I have not read the whole thread.
I have no dispute.
Do we know what countries have a high limits?
If the UK is £20, is Ireland ever likely to go above €15?

yer man!

I just got my visa debit this morning except it's a non contactless one, I wanted a contactless one. How do I arrange this?

youngblood

Will Bank Of Ireland be extending their no charge fee on contactless transactions since the general take up of NFC in this country has been so poor, that those with the cards, rarely if ever get to avail of it?

Bank of Ireland: Laura

Hi all.

Explosive_Cornflake wrote: »

Do we know what countries have a high limits?
If the UK is £20, is Ireland ever likely to go above €15?

There is a Visa Europe default limit of €20 for contactless payments, however, it is possible for countries to set their own limits. For example, the limit for the Republic of Ireland is €15, and is unlikely to change in the near future.

yer man! wrote: »

I just got my visa debit this morning except it's a non contactless one, I wanted a contactless one. How do I arrange this?

We have had this query on a previous thread. The information below should help you.

Bank of Ireland: Graham wrote: »

The type of Visa Debit card you receive is account specific. If you wish to discuss your card type you can contact your branch and a staff member will be happy to help you.

youngblood wrote: »

Will Bank Of Ireland be extending their no charge fee on contactless transactions since the general take up of NFC in this country has been so poor, that those with the cards, rarely if ever get to avail of it?

Our fees and charges are reviewed periodically. Your feedback is appreciated and we have forwarded it on to the relevant department.

Thanks for your queries.
Laura

1865

Just quick note to say thanks to the Bank of Ireland staff. I contacted my branch and they supplied me with an NFC free card.

Thanks guys

Bank of Ireland: Tara

Hi 1865,

You're welcome, thanks for letting us know how you got on.

Cheers,
Tara

Bank of Ireland: Linda

Hi everyone,

Bank of Ireland: Linda wrote: »

We are happy to announce that 1 million Visa Debit cards have now issued.

We would like to remind all customers who have received their Visa Debit cards to activate their card as soon as possible. Your current Laser/ATM card will be deactivated after 2 months of the Visa Debit card being issued.

Thank you for all the customers that have given us feedback on this forum.

Again just to remind all customers to activate their Visa Debit card to avoid any issues./QUOTE]

Thanks
Linda

daheff

Bank of Ireland: Linda wrote: »

Hi everyone,

Bank of Ireland: Linda wrote: »

We are happy to announce that 1 million Visa Debit cards have now issued.

We would like to remind all customers who have received their Visa Debit cards to activate their card as soon as possible. Your current Laser/ATM card will be deactivated after 2 months of the Visa Debit card being issued.

Thank you for all the customers that have given us feedback on this forum.

Again just to remind all customers to activate their Visa Debit card to avoid any issues./QUOTE]

Thanks
Linda

Hi Linda -how many of the 1m have been activated?

Bank of Ireland: Tara

Hi daheff,

To date we have had a satisfactory activation rate, however, we cannot give specific figures at this time.

Thanks
Tara

Bank of Ireland: Tara

Hi All,

It is now possible to pay for purchases up to the value of €15, using your Contactless Visa Debit card in all Boots Retailers in Ireland. For more information, here is a link to an article on the Silicon Republic website.

If you have any questions, please feel free to ask.

Thanks
Tara

Nate--IRL--

1865 wrote: »

Just quick note to say thanks to the Bank of Ireland staff. I contacted my branch and they supplied me with an NFC free card.

Thanks guys

Just did this myself - they waived the €5.90 fee to replace the card. However I'll have to ring again to deactivate my old ATM card or I'll get done for stamp duty on both cards.

Nate

Tow

Nate--IRL-- wrote: »

Just did this myself - they waived the €5.90 fee to replace the card. However I'll have to ring again to deactivate my old ATM card or I'll get done for stamp duty on both cards.

Nate

There appears to be a lack of training with the call centre staff. I am also getting a free replacement NFC 'Free' card, while a couple of others who rang them the same day have been told they will be charged.

Nate--IRL--

Tow wrote: »

There appears to be a lack of training with the call centre staff. I am also getting a free replacement NFC 'Free' card, while a couple of others who rang them the same day have been told they will be charged.

Hmm odd - I did ring my branch, perhaps that is the better option than the call centre.

Nate

Bank of Ireland: Linda

Hi all,

Apologies for the confusion regarding this. Banking 365 agents do not have authorisation to refund fees, this would normally be done by your branch.

Thanks
Linda

AtomMcC

Anybody know if the option is there to get back my old non-Visa, non-Debit, non-Contactless card. Just want to use cash. Anything wrong with that?
Anybody ever ask the customer?

Bank of Ireland: Linda

Hi AtomMcC,

If you do not want a Visa Debit card you can request a atm only card from the branch. An atm only card can only be used in the republic of Ireland.

Thanks
Linda

AtomMcC

Bank of Ireland: Linda wrote: »

Hi AtomMcC,

If you do not want a Visa Debit card you can request a atm only card from the branch. An atm only card can only be used in the republic of Ireland.

Thanks
Linda

Hi Linda. Thanks very much. ATM use only in Ireland has served me pretty well so far (& I travel quite a bit!)