Topic: Issues with contact less payments. (Read 567 times)

In my country, you need to re-enter your PIN each time you've spent 100€. That's the reason I don't like to use, maybe good for the small payments. I know with a Raspberry PI you can make something to collect the card's information from people but here you could do nothing with it since you receive a SMS code from your bank for each online transaction.
People can use card protection like this one, sometimes you can get some for free

Yeah, the wavelength is not the factor here.
RFID chips used in cards are passive, they require energy from the antenna of the card reader to activate and transmit data.

You would have two choices, stopping the incoming wave (easier to spot the guy with the antenna pointing at you in my opinion), or stop the outgoing wave from your chip, which has been already taken care in newer chips or if you really want to be 299% safe, use the solution neuroticfish has pointed out.

But I really think this is blown out of proportion, with older chips, there was the possibility of let's say supercharging them with custom built antennas and increase their range to almost one meter.

But, and there are a few buts
- all test have been done in laboratories with nothing in between the two
- you need a power source, the guys in an experiment used a pick-up truck battery, not the thing you want to carry around.
- most tests have used customs antennas ranging from 30 to 50 cm in diameter, again, not the thing you want to carry in a subway and point at people
- no test as I am aware right now has tried to do this with multiple chips and this is the part where it will get totally confusing
for a reader. Again, speaking for myself, if they somehow manage to point this at my wallet and indeed get a response it will be from 3 chips. Oh...wait!  I got also a transport card with a chip, and my work security card, and my card for the apartment complex door, and my healthcare card.... Actually now I just realize how much stuff I carry around...feeling a bit weird.
- most important of all, as I was saying, newer chips have limitations in their architecture, they simply physically don't care what you point at them the wave will be the same.

Get a mobile banking solution from your bank with instant transaction alert and you're safe.
Remember that they need an official merchant account to charge your card.

The frequency of these cards is 13.56mhz

Meaning that its really low energy and has a wavelength of about 22m which I don't think is helpful to anything but... (I was trying to work out the size of something needed to stop the frequency passing through it however that seems to be 22m unless I've got something wrong - likely).

Never say never.
This term is used so many times here when banks feel there is something even remotely suspicious so they have a chance in a case in court if you are brave enough to challenge them.
And the term (translation equivalent) is clearly stipulated in my contracts, on both type of cards, visa and mastercard.


At this point, you're sounding like an infidel who enjoys the scraps the banking cartel is throwing at him.
Bring in the pitchforks!!!!!!!

Just joking, I knew well before this that BTC can't offer and won't be able to offer alone the protection customers want.
Merchants love BTC, consumers love PP.

i see what you're saying now though. i think it was unclear because in the USA, debit cards = PIN, credit cards = no PIN.
[/quote]

Well, and this is meant for this #exstasie also, should conclude the debate because I honestly admit didn't have a clue that in the US you do have PINs only on the debit cards I thought that was general, further proof  that there we're talking about different systems with different laws and different taxes without perfect knowledge of the other side.

So, bottom line since we're gone so far from the topic, more than the 4cm RFID radius, let's get back to it  

@Neurotic, yeah I got those RFID blocker for my partner, who actually does like using those contactless cards. I think the primary card anyway seems to actually come like that by default. A bit of a wallet padder, that blocker, and can't help wonder if data can still be stolen at the moment the card is taken out. Can't imagine why you'd not want to enter a password, it's a 2-second inconvenience.

fair enough but if you look at the transaction volumes done on credit cards, they are actually incredibly secure. if fraud were a bigger problem, i'm sure we'd see issuers pushing to add PIN numbers for credit transactions. as i read it, that was one of the issues raised in the discussion---this idea that credit card fraud is so unsustainably rampant is basically flat out untrue. it's making mountains out of molehills.


it's up to the issuers. they don't care because fraud just isn't that big of a problem.

i see what you're saying now though. i think it was unclear because in the USA, debit cards = PIN, credit cards = no PIN.

And as a consumer why should I care? If I stop using credit cards today, the prices I pay won't drop!

You're belaboring a point everyone in the room already understands. We all know credit card (and debit card!) processing fees and fraud increase overall prices.

What you don't seem to accept is credit card users are actually receiving value back. Debit users are not. And in the US, credit card users have superior protections. This is really not debatable.


That article wasn't even about that. It was about whether/how much banks issue refunds or credits because of customer complaints (including complaints over fees, billing disputes, interest rates, etc.)


I still don't see how it's less safe for me to never give out my banking or debit card information. Any fraudulent charge goes on a credit card balance (not my money) where my card agreement says I am not liable for unauthorized spending.


That will never happen. The banks would be laughed out of the court system if they tried to argue "losing your wallet = gross negligence." This is why cash advance limits are only a small fraction of the entire credit limit, because fraudulent cash advances are completely covered by the bank.


In most cases they won't. https://en.wikipedia.org/wiki/Gresham%27s_law

This is why consumer spending is just about the least interesting aspect of Bitcoin. It's rational to hoard BTC rather than spend it, and it pays (literally in the case of credit cards) to spend dollars.

Ok, lets take a break here because the discussion has split in two about debit/credit and the security part that triggered my post got lost, so at this point let me remind you what my initial post was:


Then @exstasie claimed that credit cards are better because the bank takes the loss.

It had nothing to do with credit or debit, I was asking why Americans are still using no chip no pin cards, not why they use credit. So my point was that cost could decrease if you (as in Americans) would take better care of your cards, be it debit or credit or them and don't simply rely on the fact that the bank will magically eat the loss just because it's a credit and not debit.

And the nice thing in that article I mentioned:

You see, the loss might be distributed to all, but in some cases, it might be distributed just to one country .
The one that relies on the banks and card processors taking the loss  

that's the whole point. other people using credit cards is already priced in. the prices have already been hiked to account for cc users. therefore it's rational for any one individual to use credit cards since they can reap rewards that compensate for those price hikes.

when i use my credit card, i get 2% cash back. you get nothing back for using a debit card, but you pay the same price as me. how are you being logical? it's much more rational to use a credit card, pay the balance in full, and pay lower prices as a result.

This is more dangerous for customers who have card payment systems with just a swipe away. With contact less credit cards it even made easier for scammers or pickpockets to steal your money away from you. The problem for banks here is they always try to ease up your cashless way of transacting but they always fail on backing it up with good security. The way I see it is they always push for convenience in the exchange if their user's security which I think they do it in purpose for them to earn more, that is why I still have a traditional debit card lying in my wallet instead of this convenient card like this one.

Oh, it makes perfect sense and is logical enough.
The cost of insurance goes up as you create more losses than you pay for the insurance company.
For car insurance, it's pretty easy to adjust these, but credit card companies can't do the same, by hijacking only your processing fee 3x times, so the global loss goes to all.

Remember this?

Visa and Mastercard decided to increase their Fees.And there is nothing y can do

This is where all this "protection money" tax goes in .


Exactly this!
What is a store owner that has lost all his profit in a month due to fraud going to do?
a) Print money?
b) Go to a temple and pray the money coems back?
c) Raise prices to recover the loss?



This only IF the bank agrees with the refund.
https://www.creditcards.com/credit-card-news/cfpb-dispute-complaint-refund-1701.php#state
If you're on the unlucky side the money that was never yours become your debt.

Second, debit cards have limits too and people don't have all their balance on a debit account.
In my case, for example, I have a bank account that is used to wire in my salary, that bank account is in my name only and can't be accessed via a debit card.

For me, it's far safer to have an account in which to keep my deposits, wire enough money from it to have enough for shopping on my debit card and use my credit only in extreme measures.

Holding a card that can be stolen or simply lost and in one minute a thief can withdraw 10 000 euros from an ATM without any problem since there is no pin barrier is far riskier.
What if the bank will tell you that they believe it was you who has done the withdrawal or simply call it gross negligence?
Then you're liable for more money than you've ever had.


As I said, there is a very big difference between a debit card and a bank account, and our version of the ACH in the EU is nothing like your ACH at all, it's more like a direct debit.

Probably the difference between US and the EU is at fault for many of our contra arguments here but there is one thing I must ask you...

So, (in the US)
You got total protection, you can reverse transactions up to 120 days, you get 5% cash back, you have a credit line with no extra charge or  0 interest rate for a period (I assume this, as that's how things work here in EU)...then....
Why would people use BTC  

if you have used cryptocurrency as a tool for your payment every day, it might not be possible for some other countries that still have no clear legality regarding the circulation and use of cryptocurrency.

This is generally how it is in Canada also. Most people only use Visa/Mastercard/American Express for purchases because they get cashback/air miles/free crap like gasoline/etc.

I didn't know what contactless payments were either but one day I got sent a credit card and it had the Wifi looking icon and tried it out one day at the store and haven't looked back.

Credit cards are very safe and its usually the merchants that are at risk of accepting them due to fraud. I know a few store owners who were victims of CC theft and they had to eat the costs or get them reimburised from their insurance company, the consumer is never at fault.

This is why some stores have a "NO TAP" message near the terminal because they disabled them to reduce any forms of theft with a found CC. Because if they accepted that payment, they would most likely have to take the loss, not the person who lost the card.

I trust in the security of the blockchain than any other system because we have seen how decentralized and anonymous the system can be, I have been a freelancer on the blockchain space for about 4 years plus and I have never collect fiat as a mode of payment, I also have a crypto atm card which I can use to make withdrawals from atm and also make payments for good and services in mall which I prefer then making use of a bank that gives me so much limit on how I spend my money.

that analogy makes no sense since consumers are all paying the same prices---they are all paying 450 euro each. they don't pay different premiums based on their payment method.

in other words the costs of credit cards are already socialized. so it's pretty pointless to tell a paypal or credit card user they are paying higher prices than everyone else. of course they aren't! they're paying the same price as everyone else---plus they get additional consumer protections, perks like frequent flyer miles and cash back and activity-based discounts etc.

it's actually more rational to use cc than cash because cash users are the ones getting screwed by higher prices. higher prices are the fault of cc users but cash users are the stupid ones for paying those higher prices and getting nothing back for it. at least cc users are getting something out of it......

Security is always an issue when you have wireless forms of transmission.

All these anti-fraud guarantees are only as good as promises, and it will sometimes be difficult to prove to a central entity that your card was hacked into and you shouldn't be held liable - and that's why you should always take security seriously despite what banks tell you.

Though, I don't think that bitcoin is in direct competition with contactless payments. Bitcoin in the future could be integrated with some form of contactless payment infrastructure which would make things a lot easier. But certainly, credit card fraud is very widespread, and as a seller, you certainly don't want to be on the receiving end of that which means that sometimes, irreversible payment methods like bitcoin work out to be much better.

Of course that increases the costs. But your logic is nonsensical.

Millions of people are using credit cards, driving up the final cost of goods and services. If I personally stop using credit cards, that won't drop the price of anything for me.

I don't save anything by using a debit card, so why would you make this argument? I can't stop the rest of the world from using credit cards and driving prices up. And if I stop using credit cards? The only thing that would accomplish is I would stop getting up to 5% cash back.


With credit cards, I have 120 days to recognize a fraudulent charge. With debit cards, there is a maximum of 60 days (my bank is actually 30 days). After that, you are 100% liable for all fraudulent charges. My girlfriend lost thousands of dollars once because she reported a theft of her debit card a few days late. We lost everything because of that.

More importantly is the function of time. If a thief empties my bank account via debit card fraud, it can take 10+ days to recover the money. For some people, this could mean missing rent payments or other obligations, etc. If a thief runs up my credit card balance, I've never lost any money at all. There was never any chance of losing actual money.

Credit cards are simply better for consumers. Rational consumers will continue to use them. I haven't seen one reason why I should use a debit card instead.


Yes, I am much safer not letting anyone access my bank account and debit my money. By using credit cards, my money is never at risk.

Why the hell would I give merchants access to my bank account, LOL? It's just stupid. I have plenty of credit lines to cover all everyday expenses and pay for them later with bank-to-bank ACH payment.

Plus, when fraud eventually does occur, it's much easier to have a new credit card number issued than to open a new bank account, order new check books, change all my bill payment accounts, etc. Why would I ever want to go through that trouble? To gain what?

No matter how sensitive it is, the card emits to only 4 cm, above that the signal is dead, in reality the range is around 2-3 cm with nothing between, much like phone or wi-fi signals work, if your phone isn't capable of sending back signal it doesn't matter if you're in the coverage area.

Also, don't forget the leather from the wallet, maybe two folds depending on how you fold it, other cards and your clothes, and the thief's device should be also covered with something, and.....he has to find out where you keep your wallet, sometimes even I have to tap my pockets to realize where it is

If that would be possible we would be seeing a flood of angry people complaining about how they were robbed...and yet, there is nothing like that.

I watched some clips regarding this one last year. It seems like contactless card payment, though even modernized, are more dangerous to use than to those cards who needs a pin before transacting. Theres this experiment which a person with a contactless card in his wallet rode a train. After this man tap this device (which we see on the cashier if we are swiping our cards) on the man's pocket, a money were stole for an instant.

I do understand both of these however, isn't the card just transmitting a frequency? So unless the frequency is terminated by skin/leather then that's fine but if it isn't then a card reader of a greater sensitivity might still be able to pick it up.

(my key card seems more secure than the debit card sometimes  with its three chips)...

---

Does anyone know of an open source version of Google pay also? I don't want them tracking me but it seems a waste of a chip on my phone...

---

@stompix our credit card and debit card rules are different. The credit union people handle the credit cards and give incentives like 180 day charge backs... Debit cards are less fruitful on offers like this but may still include them and probably do.

Wow, you seriously believe that? Do you think merchants and card companies are taking the loss and not increasing fees per transactions and final price of the product?
It's like insurance, cheap if you don't drive , once you go out in the city 3 accidents in 6 years and you're in the next class, the price goes from 210 euros to 450.



Debit cards are not different at all from credit cards here if we speak on how they work.
Both have pins, both have customer protection, with both you can seek a refund in 45 days, the only difference is that you can spend more than you have when it comes to credit.

For example, I own 1 Mastercard credit (for times I find a good deal and low on funds) and 1 Visa debit contactless at ING (day to day purchases) and another Citi Visa debit (for internet purchases), I was forced to ask for refunds on all of them, all were solved in less than 7 days and I haven't yet run into a situation where there was an unknown charge in any of my accounts.


So your far better and safer without the PIN....sorry but I can't find any logic in this.

There’s a risk on having a contact less card since many hackers are more high tech now and they can actually scammed you. There are some wallet that they can block this trasaction, the rfid blocking system of the wallet i think. You also need to make sure that you are using your card in the right way, contact less just improve the transaction but the risk is still the same.

A PIN for any purchase? Why? That seems like complete overkill.

Americans are happy with credit cards because they're incredibly convenient and as a consumer, nothing can ever go wrong. If anything goes wrong (fraud, incorrect charges) the bank or the merchants eat the losses, not us. And we get up to 5% cash back rewards for using credit cards. It's win-win-win for consumers. Why wouldn't we be happy with them, LOL?

I basically never use my debit card, ever, because if it gets fraudulently used, it's much harder to claw back the money (if possible at all) than with a credit card. Inputting my PIN number all over town, in questionable POS/ATM machines? I would never do that! Not to mention the risk of dealing with dishonorable merchants. With a credit card, I can instantly charge back. Debit cards have much less favorable policies and they don't give cash back.

I've been using credit cards every day, everywhere, for 20+ years. I've seen a fraudulent charge a grand total of one time. My bank instantly reversed the charges, reissued the card and I never heard about it ever again. The whole issue is being blown out of proportion.

Same here. I have a leather wallet and it just doesn't want to register my card through the wallet. I have to take it out each time.

Exactly. I never understood that either. Not one single person around me ever had a problem with theft or fraud with their tap2pay debit cards, while those with credit cards (yep, it's also a thing here in Europe) haven't done anything but complain about fraudulent charges. I don't even understand how the issuers of these credit cards still allow this to happen. It shouldn't be possible to settle payments without a PIN in any amount.

No, no, where have you seen that? You can withdraw money contactless with visa/master card, upi cards and etc. Yeah, the money you can withdraw is limited but it's not like put card and you'll withdraw. You don't need to enter pin but when you try to withdraw contractless, usually you receive sms in your mobile phone which you have to enter instead of pin. That's very great to be fair.
Also OP, yeah, you can get 16 number, expiry date and card name even from your smartphone if it has NFC support, even touching and one special app is enough for that but you can't get that three number that's placed on back.
Also if unexpected payment happens, banks will help you to get money back. Doesn't matter if happened to a lot of members at the same time because as we know similar thing had happened when amazon was hacked and everything was solved easily.

Yeah, it's the myth about managing to get all your data and clone your card with a simple scan.
It has been debunked hundreds of times but people still are afraid of it.

Also, about the guy embracing you in the subway and scanning your wallet with a  mysterious instrument..., I tried a year or so ago in an afternoon to pay with the cards still in my wallet. I knew well the cashier and I was the only one in the shop otherwise obviously I wouldn't have done it but I still coudn't manage to get a confirmation even with my wallet sitting on top of the PoS scanner.

Besides ING offers a mobile cost control so usually, I get the message with the spent amount faster than the recipe is coming out of the machine .

But, speaking about cards, I'm amazed how Americans are still happy with their no PIN number card.
Seriously, we're afraid of somebody trying to scan your cc with hi-tech stuff inches away from you for 50euros a day while other are giving the card to the waiter and hope they will be charged correctly...

Yup it's a lot worse here in the UK compared to a lot of. Places because 6 banks account for 90% if people's money so they'll just get bailed out again and if they don't there's always the fscs crap.


It's an overreliance on banks that's the issue too. And actually, that credit card thing seems more of an incentive to get people to use credit cards over debit cards too.
They don't need any tactics to get the moment back anyway because it doesn't exist to start with lol.

hasn't that always been an issue with credit cards? they've been offering 100% money back fraud guarantees for decades. i figure the banks cope by screwing the merchants, who have no choice but to eat the losses to keep business coming in.

or worst comes to worst, they'll probably get bailed out again.

If an unexpected card payment is made,you can always call your bank and ask for a chargeback...
If your coins are lost/stolen,they are lost forever...
This is waht stops mass crypto adoption.The lack of a chargeback system makes people scared that they will lose their coins.

Are you guys referring to the Visa Paywave or the Mastercard Paypall contactless payments? If I recall those usually have a max limit of transactions per day and a max dollar value limit per transaction.

I also don't think you can go to an ATM and actually withdraw cash, its only for payments like at a grocery store or gas station. The limit is $100 CAD here in Canada. Anything over and it requires the pin.

i hope now you realize that bitcoin is not just about security, the main characteristics of bitcoin that makes it better than all of these other options is its decentralization. otherwise all these methods of payment can technically become just as secure as bitcoin with some effort but they still will remain centralized and it is always going to be the bank that controls your money and allows you to spend it and can decide not to do it some day...

A sure thing people nowadays wants life to be easy and this piece of card is a breeze to use, by just tapping it to a sensor and you are good to go, But in the advancing world, hackers are also cooping up and the worst they are already ahead of the technology and this contactless card is pretty sure hackable, I am not used to this kind of things and prefer the use of non-digital ones to be safe from hackers just like when we stored bitcoin on cold wallets But the downside to these wallets is you can not make a direct transaction, Or I would prefer a cardless transaction instead.

Not sure what card you got, but that's certainly not possible with my debit card.

In case whatever hacker manages to clone my card, there is nothing the hacker can do other than to utilize the €50 24 hour limit, which I will be notified about anyway. In order to change the amount or unlock certain features to enjoy more freedom with my tap2pay card, you need a special code that can only be generated with my banking calculator (hardware device).

I'm pretty content with the security measures my bank offers me.

Umm.. nope.



The card in the bag takes about the same space in the wallet as the card used to take. I'm not good at explaining, just imagine in the image a bag inside each section and the cards inside the bags. I pull the cards out exactly in the same way as before and after 3-5 uses I also insert them back as I did before. And for paying I get the card out as I always did.
Imho the point with contactless payments is to not spend the time inserting/getting out the card from the POS + entering the PIN. I never put the whole wallet to the reader because I have more RFID cards (bank cards, transportation card, card for the the door at job).

The limits don't matter if you can get a name and an expiry date and the long number as they can spe d whatever they want to.

I was hoping to get something chip less and be able to use my online banking app like how Google pay works but I don't want to use a Google related payment product.

Doesn't that defeat the purpose?

at first I've disabled them too. One year later I've re-enabled them. It's convenient.
And the limit for contactless payments can be changed to something smaller. at least this happens with my main payment card.
Also, lately I've seen that there are RFID blocker bags for the cards, small enough to fit into the wallet.




I've bought some from Aliexpress, cheap and good, but probably you can find other sources where you don't have to wait for months for the products to arrive.

The only issue I see in Contactless cards are the limits the amount it had in a transaction I really think it is just good enough to make fast transactions only like when you are grabbing a meal or a coffee at Starbucks or fueling up your car, It makes sense because it can only accommodate transactions that are cheap and will not exceed the caps limit, Well I think that the card cannot be hack by hackers because it had a secure radio interface and the hacker will need to be on proximity to hack your card, If a technology like that exist, I really think the system on the banks is the one that will be attacked by hackers and not your limited Contactless card.

I've disabled it on all my cards.

I've seen some of those contactless ATM on my city, and I have never used it because i've heard bad stories about it. Apparently banks have configured by default that you can withdraw X amount of fiat through the ATM with the contactless card only, without even asking for any passwords, so if you lost the card it's already too late, you are going to lose money. Luckily the amounts you can withdraw are limit but still it's a pain in the ass. Some banks have it at $50, others at $300 or more. There's people removing their chips from their debit cards. There are tutorials on how to do it:

https://www.youtube.com/watch?v=GEhgf4PpRdo

Anything that allows to spend money without a password is just dumb, disable or remove it.

I was thinking yesterday (having recently got my new contact less card) how good the system was and how we don't need bitcoin (for money transfers) with this great system and I have since come to realise how awful they are.

I watched a video of a hacker being able to get ahold of people's long number, name and expiry date using the contact less part of the cards which is enough to spend money from them. Since banks say "if an unexpected payment gets made you won't lose any money" it makes me wonder what is going to happen if someone manages to dot enough card readers around and steal large sums of money from people then the banks wouldn't be able to cope.

The 50 richest people together have just slightly less than all the money that exists. There are some foolish wealthy people out there too that might get scammed from this.