Risks of offline verify PIN on contactless cards

Martin Emms; Budi Arief; Nicholas Little; Aad Van Moorsel

doi:10.1007/978-3-642-39884-1_26

Risks of offline verify PIN on contactless cards

Martin Emms
, Budi Arief
, Nicholas Little
, Aad Van Moorsel

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder's PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder's PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.

Original language	English
Title of host publication	Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers
Pages	313-321
Number of pages	9
DOIs	https://doi.org/10.1007/978-3-642-39884-1_26
Publication status	Published - 2013
Event	17th International Conference on Financial Cryptography and Data Security, FC 2013 - Okinawa, Japan Duration: 1 Apr 2013 → 5 Apr 2013

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	7859 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	17th International Conference on Financial Cryptography and Data Security, FC 2013
Country/Territory	Japan
City	Okinawa
Period	1/04/13 → 5/04/13

Keywords

Card Payment
Chip & PIN
Contactless Payments
Credit Card
Debit Card
EMV
NFC
Verify PIN

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-642-39884-1_26

Cite this

Emms, M., Arief, B., Little, N., & Van Moorsel, A. (2013). Risks of offline verify PIN on contactless cards. In Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers (pp. 313-321). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7859 LNCS). https://doi.org/10.1007/978-3-642-39884-1_26

@inproceedings{6b0e0ea5c82b4e22a25ba5efa7130a65,

title = "Risks of offline verify PIN on contactless cards",

abstract = "Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder's PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder's PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.",

keywords = "Card Payment, Chip \& PIN, Contactless Payments, Credit Card, Debit Card, EMV, NFC, Verify PIN",

author = "Martin Emms and Budi Arief and Nicholas Little and \{Van Moorsel\}, Aad",

year = "2013",

doi = "10.1007/978-3-642-39884-1\_26",

language = "English",

isbn = "9783642398834",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

pages = "313--321",

booktitle = "Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers",

note = "17th International Conference on Financial Cryptography and Data Security, FC 2013 ; Conference date: 01-04-2013 Through 05-04-2013",

}

Emms, M, Arief, B, Little, N & Van Moorsel, A 2013, Risks of offline verify PIN on contactless cards. in Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 7859 LNCS, pp. 313-321, 17th International Conference on Financial Cryptography and Data Security, FC 2013, Okinawa, Japan, 1/04/13. https://doi.org/10.1007/978-3-642-39884-1_26

Risks of offline verify PIN on contactless cards. / Emms, Martin; Arief, Budi; Little, Nicholas et al.
Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers. 2013. p. 313-321 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 7859 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Risks of offline verify PIN on contactless cards

AU - Emms, Martin

AU - Arief, Budi

AU - Little, Nicholas

AU - Van Moorsel, Aad

PY - 2013

Y1 - 2013

N2 - Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder's PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder's PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.

AB - Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder's PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder's PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.

KW - Card Payment

KW - Chip & PIN

KW - Contactless Payments

KW - Credit Card

KW - Debit Card

KW - EMV

KW - NFC

KW - Verify PIN

UR - https://www.scopus.com/pages/publications/84883271551

U2 - 10.1007/978-3-642-39884-1_26

DO - 10.1007/978-3-642-39884-1_26

M3 - Conference contribution

AN - SCOPUS:84883271551

SN - 9783642398834

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 313

EP - 321

BT - Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers

T2 - 17th International Conference on Financial Cryptography and Data Security, FC 2013

Y2 - 1 April 2013 through 5 April 2013

ER -

Emms M, Arief B, Little N, Van Moorsel A. Risks of offline verify PIN on contactless cards. In Financial Cryptography and Data Security - 17th International Conference, FC 2013, Revised Selected Papers. 2013. p. 313-321. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-642-39884-1_26

Risks of offline verify PIN on contactless cards

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this