Are contactless payment cards/phones insecure?

Question

I've heard claims that contactless cards and NFC is no less secure than chip and PIN as indicated below.

According to Barclays:

All our new Contactless debit cards include the latest advanced security features required by the payment card industry. Payments are processed through the same secure Visa technology as your Chip and PIN transactions.

If they are just as secure as chip and PIN, what's to stop someone creating a portable card reader that charges the max amount allowed (£15 in the UK) then just walking around with it, perhaps in a packed out train?

Answer 1

As you point out, Contactless Payment cards have a relatively low maximum transaction limit. [US$25 in the US and under £15 in the UK]

While they are known to be breakable [Ref] that puts an upper limit on a single case of fraud.

Where there are multiple, systemic frauds (as described in your example), the pattern is detectable, [Further reading], in which case the bank can reverse all transactions performed by that merchant (and perhaps start criminal proceedings).

Banks are in a position can require high-levels of authentication for their merchants, require a merchant to leave a deposit or delay the outgoing payments to ensure that they can take remedial action.

It is important to remember that payment systems do not need to be perfect to be profitable; they need only be better than the existing alternatives - neither cheques nor cash, for example, are risk-free.

In summary: These systems are known to be insecure, but the banks can use measures to protect against rampant fraud.

Answer 2

what's to stop someone creating a portable card reader that charges the max amount allowed (£15 in the UK) then just walking around with it, perhaps in a packed out train?

Charging a contactless card is a lot more than just walk around with a card reader. It's not like you put the card reader close to someone's pocket and £15 are transferred into your own pocket and no one notices it. It's not even like using stolen card data for payments.

Having a card reader is not enough (and there's no need to create it by oneself, card readers can be easily and legally bought or rented).

To charge a card one have to be a client of a payment service provider, a company which transfers money from a buyer's bank account to the seller's bank account. The card reader is registered in PSP system with a unique ID and every transaction can be easily traced back to the owner. So even if someone would manage to charge a couple of cards huddling around, they'll be found very quickly.

And some more considerations:

• it is not so easy to charge a card in the crowd - the maximal distance betweeen a contacltess card and the reader should be not greater than ca. 5 centimeters and
• the charging won't work att all if there are more than one contacltess card in the pocket.