Browse by author
Lookup NU author(s): Dr Martin Emms,
Dr Leonardus Arief,
Professor Aad van Moorsel
Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.
Author(s): Arief B; van Moorsel A; Emms M; Little N
Editor(s): Ahmad-Reza Sadeghi
Publication type: Book Chapter
Publication status: Published
Book Title: Financial Cryptography and Data Security
Volume: LNCS 7859
Series Title: Lecture Notes in Computer Science: Security and Cryptology
Publisher: Springer Berlin Heidelberg
Place Published: Berlin
Notes: Presented at: 17th International Conference, FC 2013, Okinawa, Japan, April 1-5, 2013, Revised Selected Papers.
Library holdings: Search Newcastle University Library for this item