Credit Card, Bank Card NFC. The most useless function every invented - Page 1
Forum section: electronics / general

author: Benta
author_rank: Super Contributor
timestamp: March 01, 2022, 08:41:57 pm
content: Can some one explain the advantages of NFC on payment cards? Apart from making a hipster look cool, of course.Sticking the card into a reader instead of putting it on top of it is no major benefit to me. I still have to retrieve it from my wallet and replace it again, which is the biggest part of the operation. Benefit ~0.On the other hand, I now have to place the cards in special sheaths to avoid skimming from a criminal walking by. Result: the cards no longer fit in my wallet slots. Inconvenience: 100.On top of that, NFC transactions below 50 Euro require no PIN. Security risk: 100.The idiot that thought of this should be... (add own wish).

author: Kim Christensen
author_rank: Super Contributor
timestamp: March 01, 2022, 08:54:13 pm
content: Some banks allow you to turn off NFCs on your cards if you ask them to... (I assume NFC is the same as "tap" here in Canada where you just wave your card near a reader)

author: Benta
author_rank: Super Contributor
timestamp: March 01, 2022, 09:06:11 pm
content: Yep, it's the "tap" function.But "some banks" doesn't really help, does it?So if you wave your wallet over the terminal: security: 0.Skimming risk: 100.Great.

author: ataradov
author_rank: Super Contributor
timestamp: March 01, 2022, 09:07:00 pm
content: It is much harder to skim them than they typically make it sound. Also, NFC is an active request response. So, any skimming would require a transaction to be performed on the spot. And to perform the transaction you need to have a valid account with the bank. You can't resell card numbers on the dark net or whatever.Just don't buy into paranoia and your life would be much better.I love NFC, spares me the need to plug in the card into dirty slots. Also, less scratching on the plastic.

author: wraper
author_rank: Unknown
timestamp: March 01, 2022, 09:14:03 pm
content: Quote from: Benta on March 01, 2022, 08:41:57 pmPlacing together 2-3 cards with RFID is way more effective than all of those shielding wallets. Actually it would be way more effective to make a wallet with a built-in jamming device like thishttps://www.amazon.com/TICONN-RFID-Blocking-Cards-Contactless/dp/B07T8PYBKM#

author: ataradov
author_rank: Super Contributor
timestamp: March 01, 2022, 09:15:56 pm
content: And yes, If you have more than one NFC card next to each other in the wallet, NFC does not work for either of them, they will just step on each other.

author: Bud
author_rank: Super Contributor
timestamp: March 01, 2022, 09:31:14 pm
content: Quote from: Benta on March 01, 2022, 09:06:11 pmCan you provide a real life Single example of this skimming happened which caused an unauthorized transaction by the skimmer ?

author: Benta
author_rank: Super Contributor
timestamp: March 01, 2022, 09:59:30 pm
content: Quote from: wraper on March 01, 2022, 09:14:03 pmNo. I tested this already 10 years ago in an RFID project. Stacking 5...10 cards on the reader surface was no issue. They were all read.NFC might be more tricky.

author: langwadt
author_rank: Super Contributor
timestamp: March 01, 2022, 10:09:12 pm
content: Quote from: Benta on March 01, 2022, 08:41:57 pmit is extreme convenient and the risk is minimal, the reader cannot read my card when it my wallet is closed so the card is next to two other cards, but it can read it when I flip it open so the card is not next to the other cards

author: ANTALIFE
author_rank: Frequent Contributor
timestamp: March 01, 2022, 10:23:51 pm
content: I guess the other thing is wear & tear of EMV contacts (which NFC would not need to worry about). Like I know SIM card connectors are typically rated for 5,000 cycles, and suspect EMV contacts are a few orders of magnitude moreEDIT:7361E0225S05LF is an assembly that's rated for 200,000 cycles, while 7311S0725A06LF is a bare connector rated for 10,000 cycles. Lets say we use the connector 100 times a day and ~35,000 times a year. So 7361E0225S05LF is expected to "last" ~6yrs which is not too bad, but 7311S0725A06LF will likely have issues within the first year

author: ataradov
author_rank: Super Contributor
timestamp: March 01, 2022, 10:32:13 pm
content: My bank used to issue cards for 2 years and by the time 2 years rolled in, the card was all scratched and bent out of shape. And there is no chance I used it anywhere close to 5000 times. So, plastic is the most affected part. At least in my experience.The new cards are issued for 4 years, and without the need to plug it in or swipe, there is way less physical wear on the card.

author: tszaboo
author_rank: Super Contributor
timestamp: March 01, 2022, 10:36:25 pm
content: I can pay with a phone with NFC, and I cannot stick it into a POS terminal.If you are unhappy with the 50 EUR transaction limit, you can only do that 3-4 times a day, there is a cap on it. Don't loose your card, duh.

author: ANTALIFE
author_rank: Frequent Contributor
timestamp: March 01, 2022, 10:38:30 pm
content: Quote from: ataradov on March 01, 2022, 10:32:13 pmSorry I meant the EMV contacts/connector on the PCBA, not the actual card itself

author: mariush
author_rank: Super Contributor
timestamp: March 01, 2022, 10:42:25 pm
content: I don't even carry my cards with me. I have the banks app on my android phone and use phone's NFC feature to pay for things. Works in stores, works in buses or trams... costs approx. 50 eurocents a ride and just have to bring the phone close to the thing, no need to search in my pockets for the wallet and pull out a single card, enter a pin while everyone watches and so on, not to mention it's more sanitary not to touch keypads these daysCan even withdraw money from ATMs without my cards... just go in the app, enter some amount and I get a unique code as a text that's valid for a few minutes. Enter the code in the ATM and the amount and it spits out my money.As for wallets, there are modern wallets that can shield cards until you remove them ... ex :https://www.amazon.com/Ridge-Authentic-Minimalist-Blocking-Wallet/dp/B01M5J3NB1/No need to have chunky wallets holding 100 things

author: ataradov
author_rank: Super Contributor
timestamp: March 01, 2022, 10:49:47 pm
content: Quote from: ANTALIFE on March 01, 2022, 10:38:30 pmYes, this stuff must be robust and I assume they would be designed for somewhat easy maintenance. Those contacts can get 5000 insertions a day easily.

author: rob77
author_rank: Super Contributor
timestamp: March 01, 2022, 11:13:37 pm
content: Quote from: Benta on March 01, 2022, 08:41:57 pmapparently your knowledge in the area is absolute zero... old fashion embossed cards are the security risk 100a criminal can't skim your contactless card , there is absolutely no usable attack vector in existence which would the attacker allow to skim your card and actually get the money.only option would be to have a contract signed with a payment processor to get a terminal and go outside swiping people with the terminal and then get arrested sooner than you receive the summary payment of the transactions you "collected"

author: thm_w
author_rank: Super Contributor
timestamp: March 02, 2022, 02:21:41 am
content: Quote from: ataradov on March 01, 2022, 10:49:47 pmThe thing is, for the ones I've used, there is no way you as an end user can take it apart to fix any pins.As soon as you look at it the wrong way, its going to brick itself and you have to send back to the manufacturer to repair it and re-load whatever software keys.Many will fail before they reach rated insertions, because of dirty or bad cards bending the pins.NFC is so much better in terms of maintenance, zero wear on any components.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: March 02, 2022, 02:35:50 am
content: I have no idea why this works the way it does, but here in the northwestern US tap payments process in 2-5 seconds while reading the chip and processing takes 5-10 seconds. I know that doesn't sound like much, but it is enough to heavily weight my preference for the NFC method.The process is also less user involved. You wave your card over the sensor and when it beeps you are done and can start putting it back in your wallet. The reader requires more precision to insert the card and the feedback is a screen message that the card has been properly inserted (requires visual attention). After whatever delay another screen message and usually and audio cue lets you know you can remove the card. So perceptually the tap is one step while the card reader involves two.

author: SmallCog
author_rank: Frequent Contributor
timestamp: March 02, 2022, 03:08:22 am
content: I'm gathering by your rant that this technology is somewhat new there? Or has it only just upset youI'm surprised if it's new, I reckon it's been here for about 10 years, and nobody I know has ever been skimmed.Personally I don't carry my wallet around. We have the option to use digital drivers licenses here, and my phone has my card details in it for tap payments.These are secured via finger print.If I loose my phone or it's stolen neither my money or license are available or of much use to anyone unless I've lost my finger at the same time, unlike if I lost my physical cards.

author: georges80
author_rank: Frequent Contributor
timestamp: March 02, 2022, 03:12:59 am
content: I've just linked my most often used cards onto my phone app. Phone is in pocket or in my hand, takes mere seconds to tap & pay and the phone app logs the transaction so you can keep an eye on your spending.As stated above, at least in the US (where they have steam powered computers I guess), the insert/read process takes 5 - 10 seconds and you have to keep an eye on the stupid POS display for when you can 'remove' the card. Tap & pay is essentially instantaneous and touchless.Some times you have to move with the times. At the very least covid accelerated tap & pay in the US - it was pretty uncommon a couple+ years ago. In oz tap & pay has been in use for many years and is available pretty well everywhere.cheers,george.

author: SilverSolder
author_rank: Super Contributor
timestamp: March 02, 2022, 01:30:13 pm
content: I like having my payment methods independent of my phone (i.e. carrying a stack of cards + some cash) - 'cause you never know, and I'd hate having my wallet exposed to the risk of running out of battery lol!A few years ago, there was a severe weather outage here, no power for almost a week. Gas stations were running generators to keep the shop and pumps lit. The problem was, the comms network was down, so they accepted cash only - no phone apps, no credit cards, just good old reliable paper money! I felt vindicated carrying some old fashioned bills, and was able to fill my car...

author: DiTBho
author_rank: Super Contributor
timestamp: March 02, 2022, 11:15:31 pm
content: NFC + Smartwatch = AppealYou can pay contactless for your train tickets, tube tickets, just turning the wrist of the hand and your finger to confirm.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: March 02, 2022, 11:21:13 pm
content: Quote from: SilverSolder on March 02, 2022, 01:30:13 pmHaving backups and alternate methods is wise whatever you use as a primary. During the pandemic many stores were not accepting cash.

author: retiredfeline
author_rank: Frequent Contributor
timestamp: March 02, 2022, 11:28:41 pm
content: Most useless? Certainly not when Covid was rampant and people here were paranoid about touching keypads because of fomite transmission. As a payment method it had already been established before that, but it took off in 2020. I daresay tap to pay is now the principal payment method these days.

author: SmallCog
author_rank: Frequent Contributor
timestamp: March 03, 2022, 01:43:06 am
content: Quote from: SilverSolder on March 02, 2022, 01:30:13 pmAlways a good idea to have a little cash on you, and independent means of payment.Personally I have $20 on me as a "just in case" and it's not uncommon for me to have the same $20 note for months without spending it.I also have an account with a separate bank that uses a separate card network (visa/mastercard) with about a months worth of spending in the account as a just-in-case for bank outages, identity theft, etc.I don't however see the need to carry large amounts of cash. I have some cash in a safe place for situations like you described but I don't see the need to carry it everywhere I go.Been a while since I've seen paper money, we moved to more durable (and colourful) notes years ago

author: Halcyon
author_rank: Unknown
timestamp: March 03, 2022, 05:37:48 am
content: NFC cards are orders of magnitude harder to duplicate or fake than the old mag-stripe cards.Non-contact means less wear and tear on cards, particularly in places like Australia where card payments represented about 75% of consumer payments last year.You can use your phone as an NFC payment device, negating the need to carry a physical card at all.Payments can be completed much faster, for example, at parking station boom gates.ATM/payment terminal skimmers traditionally read the magstripe data from cards and optically captured your PIN. Now that magstripe has been disabled (at least in the first instance when attempting to pay), these skimmers are now useless.NFC card skimming although theoretically possible, it's not really practical. Instances of skimming in Australia fell by 37.3% in the last financial year alone and if you go back further, it just keeps falling year-on-year. Most banks (here) will reverse/refund disputed transactions without question.NFC means I don't have to touch a grubby payment terminal that all and sundry have touched after picking their nose or adjusting their bollocks

author: Berni
author_rank: Super Contributor
timestamp: March 03, 2022, 08:02:36 am
content: Yep i find NFC payment cards useful too. It is more convenient without any major down side.The one generation older chip with contacts uses the same kind of one time key exchange to sign a transaction, only difference being that the communication happens over gold plated pads rather than over a magnetic field. As others have said this means you must perform the transaction right there on the spot (so more work, less profitable and easy to get caught). It is impossible to clone a card this way.The more important part now is that a device with NFC like a phone or smartwatch or whatever can emulate a NFC payment card. There is no need for a wanky new proprietary system to enable payment with these devices. Not even a need for a special service for this like ApplePay or GooglePay (Unless you own a device made by a manufacturer that actively takes steps for that to be impossible on there devices for the purpose of creating a monopoly...) Lots of large banks have mobile banking applications that can NFC emulate a regular Visa or MaserCard or whatever payment card.Using a mobile phone is NOT the replacement for a wallet (like where would you keep your ID card, drivers license, registration...etc). It just provides a convenient alternative for a case where you might have forgot your wallet at home, in your car, at work..etc and it allows electronic banking to happen between mere mortals rather than only with companies. I can give the guy next to me 6.58€ exactly to the last digit by simply scanning a QR code, no need to muck about with finding change for the 50€ piece of paper i have in my wallet. This is the future of money.

author: Halcyon
author_rank: Unknown
timestamp: March 03, 2022, 08:15:41 am
content: Ultimately, it gives consumers another choice. I use NFC 99% of the time. If you don't like it, simply don't use it? It causes no harm having it there. Perhaps one day if the chip part of your card dies or for some reason the terminal has a fault, you can still pay for things.

author: BradC
author_rank: Super Contributor
timestamp: March 03, 2022, 09:10:18 am
content: Quote from: SmallCog on March 02, 2022, 03:08:22 amI've seen it done as a proof of concept. It's a one time thing. The device "skims" the card and can be used once only due to a "rolling code" (it's a bit more complex). Any transaction in Australia >= $100 requires a PIN. So the skim can be used once for a transaction < $100 and only if the card holder hasn't used the card between the skim and the attempt.It's not incredibly secure in the traditional context, but it's secure enough to make the labour involved not worth the effort.

author: retiredfeline
author_rank: Frequent Contributor
timestamp: March 03, 2022, 09:13:06 am
content: Quote from: BradC on March 03, 2022, 09:10:18 amWas raised to >= $200 at the beginning of the pandemic.

author: Halcyon
author_rank: Unknown
timestamp: March 03, 2022, 09:22:34 am
content: Quote from: retiredfeline on March 03, 2022, 09:13:06 amThat was supposed to be temporary but kept getting extended. I don't mind it though.

author: DiTBho
author_rank: Super Contributor
timestamp: March 03, 2022, 09:29:57 am
content: Quote from: Berni on March 03, 2022, 08:02:36 amYup, and alsoGarmin-Payto pay for your Ski-lift. Some ski resorts accept it.I might buy a Garmin smartwatch but don't like this proprietary payment feature.

author: Brumby
author_rank: Unknown
timestamp: March 03, 2022, 01:14:19 pm
content: Quote from: Halcyon on March 03, 2022, 09:22:34 amI wouldn't be at all surprised if it was a permanent change.The non-contact thing has been a brilliant function within a Covid world. Whether card or mobile device, reducing physical contact is the best infection control you could have in a retail setting. I've seen people do a "hover" with their card, so even it doesn't touch the terminal.From what I have observed, it's also faster processing a long line of customers than card insertion or swiping.As far as risk is concerned, from what I understand, the financial institutions have policies in place to deal with fraudulent transactions ... something they have had to deal with since credit cards came into being.

author: SeanB
author_rank: Super Contributor
timestamp: March 03, 2022, 05:29:32 pm
content: NFC works well, and in general with almost 99% of the transactions they are online, with the card validating to the terminal, and the terminal validating to the bank immediately. Offline most of the time NFC will error out, or ask for you to insert the card, and require a PIN entry, so that it can store the transaction for later processing. Here the limit before NFC asks for the PIN is R500, roughly $33US, and pretty much every single merchant rund either NFC or chip and pin.The only standout is the good old SA Post Office, still using XP as front end processing, and with terminals that have NFC and chip on them (as the old ones wore out and got replaced) that is unused, as the POS application they use has no ability to use those features, so they are still using swipe and PIN for transactions, though of course only for some, as most transactions you need to pay in cash.

author: Halcyon
author_rank: Unknown
timestamp: March 03, 2022, 09:53:57 pm
content: Quote from: Brumby on March 03, 2022, 01:14:19 pmSince getting rid of the old magnetic stripes here, cases of card fraud has fallen which ultimately save the banks a lot of money. As technology improved, fraudsters had to find new ways of stealing from people. As chips and NFC became more prevalent, the instances skimming dropped significantly, but instances of "card-not-present" fraud started increasing. By 2017-2018 financial year, CNP fraud accounted for 85% of all fraud on Australian cards. Basically, it's not the technology on the card itself that crooks are exploiting, rather stealing cards from mailboxes and selling those details online is a popular move.

author: rob77
author_rank: Super Contributor
timestamp: March 04, 2022, 08:33:11 am
content: Quote from: Halcyon on March 03, 2022, 09:53:57 pmthat's something that can be solved by 3-D secure , it's being heavily implemented in europe. once all card issuers, payment processors and merchants will implement it , stealing the card itself or copying it will be pointless.

author: Berni
author_rank: Super Contributor
timestamp: March 04, 2022, 10:16:54 am
content: Yep these days most cards use additional authentication whenever used online. Be it enter a SMS code, approve the transfer trough the banks website, approve it via the banks phone app etc... Making it much more difficult to pull off something like this.I still have a separate prepaid debit card for online stuff, so they can only steal how much is on that card.

author: SilverSolder
author_rank: Super Contributor
timestamp: March 04, 2022, 03:06:05 pm
content: When cars were made more difficult to steal, car-jackings increased instead... criminals will be criminals, they just go for the lowest hanging fruit?

author: BrokenYugo
author_rank: Super Contributor
timestamp: March 04, 2022, 05:05:23 pm
content: I'd find mine more useful if it didn't autorun the transaction as debit and force me to manually punch in a pin number anyways.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 04, 2022, 05:36:12 pm
content: So yeah. NFC is convenient, and reasonably secure. It only works reliably at very short distances, despite some lab experiments claiming to have shown communication with NFC devices at several meters - it's either bullshit or requires very expensive equipment. Contrary to RFID in general, NFC is tuned for very short distances.Now there's still the possibilty of losing your card and anyone can use it for NFC payments - but as some have said, it's limited to a relatively low amount per day. Of course, it could still be pretty annoying if you're broke. But these days you can declare the loss of a card very quickly (as long as you are aware of it...) and it'll get blocked.All in all, it's a relatively convenient feature with not that many downsides. What I personally find more concerning is the way it's linked to a completely cashless society, which is a big can of worms, and the topic largely beyond this thread.

author: SilverSolder
author_rank: Super Contributor
timestamp: March 04, 2022, 07:32:36 pm
content: Quote from: SiliconWizard on March 04, 2022, 05:36:12 pmNot wishing to stray the topic off course, but I agree with that. I think some form of cash (or cash equivalent) will always exist, even if people begin using cigarettes instead of bills etc. :-)

author: langwadt
author_rank: Super Contributor
timestamp: March 04, 2022, 09:36:29 pm
content: Quote from: SiliconWizard on March 04, 2022, 05:36:12 pmif for nothing else because if you have your card blocked or lost, you are totally screwed waiting for a new card arriving inthe post

author: Halcyon
author_rank: Unknown
timestamp: March 05, 2022, 01:44:49 am
content: Quote from: rob77 on March 04, 2022, 08:33:11 amSome banks here implement 2FA for online purchases. My bank uses "Verified by Visa".A lot of it comes down to personal security too. I treat my wallet like I would a wad of cash. I don't leave it laying around and I don't just chuck it at the front door when I arrive home. Gone are the days when crooks break into houses looking for electronic equipment of valuables, they go for your cards and identification (drivers licence etc...) and sometimes your car keys.I also use a PO Box (I don't even have a mailbox at my house), that way, new cards are never sitting out on the street, unattended.Quote from: SilverSolder on March 04, 2022, 03:06:05 pm100%

author: edtyler
author_rank: Contributor
timestamp: March 05, 2022, 02:19:03 am
content: Defcon in 2018 and 2019 had several presentations where NFC cards were read from a distance of > 5 meters.Are you suggesting that no one would ever attempt to steal money from a gullible hipster carrying NFC enabled cards?Fortunately, the solution is easy. Simply drill a hole through the card, breaking the NFC antenna and rendering the "feature" inoperative.

author: ataradov
author_rank: Super Contributor
timestamp: March 05, 2022, 02:20:41 am
content: Can you link those presentation?They may have read some aspect of the card, which is also questionable. But there is no way to perform a transaction without having a real bank account linked to the terminal. It is impossible to read and store some information from the card and use it later.If anything, the weakness here is the fallback mode, which is how a lot of the abuse happened initially. I think this is going away now too.

author: edtyler
author_rank: Contributor
timestamp: March 05, 2022, 02:22:21 am
content: Sorry, but you are wrong. Cards can be "skimmed" from a relatively long distance. See the presentations at Defcon 2018 and 2019.The chip feature is relatively more secure and requires physical contact, which will always be more intentional.

author: ataradov
author_rank: Super Contributor
timestamp: March 05, 2022, 02:23:24 am
content: Can you name specific presentations?All I can find are passive relay attacks to extend the range. But ultimately the connection must terminate at the bank.

author: edtyler
author_rank: Contributor
timestamp: March 05, 2022, 02:39:36 am
content: Replying to both folks that asked for links.Try using your favorite search engine to look for "defcon nfc hacking". It turned up stuff as far back as 2013. The proxy more is quite interesting, but the presentation I saw in 2019, if I recall correctly, was on a dish type antenna with high gain and a very narrow beamwidth used to activate a specific target.Of course, there is more to this than simply stimulating the card to provide information. One needs a payment terminal that can be used to submit the fraudulent transactions.However, simply waving one's hands and saying it "has never been done" does little to prove one's point.As I said in another reply, if you don't like NFC, drill a small (4mm or so) hole through the card, breaking the antenna trace and the NFC function is disabled forever. If you like NFC and feel there is no problem, good for you.I agree with the original poster - NFC offers ZERO value to me and pose an additional, unnecessary security risk. An even greater risk is putting all of this stuff on your mobile phone. I hope you never go to Defcon, because i suspect you will be on the "Wall of Sheep" or worse in less than an hour.

author: Halcyon
author_rank: Unknown
timestamp: March 05, 2022, 02:44:00 am
content: Quote from: edtyler on March 05, 2022, 02:19:03 amReading cards in a lab environment is one thing. Stealing card details to the point where you can use it for payment is entirely different. In Australia, almost all cards have NFC (that's over 50 million debit and credit cards in circulation), yet instances of fraud are lower than they have ever been. It goes to show that the technology is secure and stealing someone's details, especially in public and without being noticed just isn't feasible.In my profession, part of my job is actually examining electronic devices in instances where card skimming devices have been used. In the last 10 years, I think I've seen maybe 3 or 4 of them and all of them have been designed for use with magnetic cards only. I'm not suggesting that it can't happen, but it would be akin to going to the effort of breaking into a Government building to steal a pen, why the hell would anybody bother? The risk and complexity involved is extremely high for something that has little to no reward.

author: ataradov
author_rank: Super Contributor
timestamp: March 05, 2022, 02:44:22 am
content: All you will find are relay attacks. This does extend the range, but assumes that you have a terminal on the other side. You can talk to the card all you want, but you can't perform transactions without having that terminal liked to the bank account. You can risk doing so, and may be find some dodgy bank that won't report you immediately, but the risk is way too high.But if anyone wants to drill their cards - do it, I don't really care.

author: edtyler
author_rank: Contributor
timestamp: March 05, 2022, 03:43:15 am
content: Overall, I'd agree that the risk is low and does require a terminal to submit the fraudulent transactions. The fact that detected fraud has gone down does not necessarily mean that undetected fraud is not present.One thing I have noticed about NFC transactions if that the user rarely gets a paper receipt showing the amount charged for later comparison against the bank statement. They are too concerned about convenience. I'd expect these folks don't even review their credit/debit card statements. So, there is a greater chance for undetected fraud.I advise people that are concerned about this issue to either request non-NFC cards or drill a hole to break the antenna. My (45 and 30) kids love the ease of use. I am much more concerned about security than they are. To each, their own...

author: edtyler
author_rank: Contributor
timestamp: March 05, 2022, 03:49:07 am
content: Relay attacks are demonstrated in some of the Defcon talks. But, there were others with focused RF energy that allowed reading from greater distances.One can trade convenience for security. I choose more security. Others choose convenience. The only thing that is important is to recognize there is a trade-off and to be able to properly asses one's risk and decide if mitigation is needed.I'm not claiming that everyone should drill their cards, just that people should be able to make an informed choice. When banks claim "NFC is super secure", I beg to differ.

author: Halcyon
author_rank: Unknown
timestamp: March 05, 2022, 03:54:02 am
content: Quote from: edtyler on March 05, 2022, 03:43:15 amI also think the cases of "undetected fraud" are also decreasing as consumers are becoming more and more aware of scams and are more vigilant in checking their bank accounts/transaction statements. Particularly as apps have made this process so much easier. Many banks will even notify you via push notifications when a transaction occurs.As for receipts, that behaviour hasn't changed (at least here). Receipts are still printed by the card terminal, but for me, I say "no" to them as I don't have any use for them. It's just scrap paper to me.

author: austfox
author_rank: Regular Contributor
timestamp: March 05, 2022, 09:46:20 am
content: Quote from: BradC on March 03, 2022, 09:10:18 amI realise NFC via phones are active, and hence can have a 'rolling code', but wouldn't a passive card always have the same code?

author: langwadt
author_rank: Super Contributor
timestamp: March 05, 2022, 09:59:56 am
content: Quote from: austfox on March 05, 2022, 09:46:20 amthe chip cards are not passive, they get power from the communication to run a processor on the card

author: Berni
author_rank: Super Contributor
timestamp: March 05, 2022, 10:54:43 am
content: Quote from: austfox on March 05, 2022, 09:46:20 amEven if the NFC card is emitting sending a fixed sequence you still need electronics to create the sequence and send it back. So you need digital logic and circuitry to extract power from the NFC field anyway. Once you have that you can power any sufficiently low power digital circuitry. So this way you can have pretty much all of the functionality of a gold contact smart card chip, just that the communication method is different.A lot of people also don't know that these SmartCards used in bank cards, satelite TV cards, cellular SIM cards are all a common interface and contain tiny microcontrollers with firmware inside. This rarely does anything more than store data and do a bit of cryptography, but some SIM cards from certain carriers do actually have software functionality built in (phones typically used to show this as the "SIM Menu" where the items on the menu are actually "functions" inside the SIM firmware)

author: PlainName
author_rank: Super Contributor
timestamp: March 05, 2022, 08:05:26 pm
content: QuoteOr, since you're the one pushing this stuff, you could just supply a link to the exact thing you're talking about, saving potentially hours of finding many of the wrong thing.Thereisan actual link somewhere, isn't there?

author: SL4P
author_rank: Super Contributor
timestamp: March 07, 2022, 03:52:50 am
content: Easy solution, my NFC cards are only linked to accounts that have my ‘transaction funds’ typically less than $300-300 at a time.SMH, but I won’t die because of it.

author: m98
author_rank: Frequent Contributor
timestamp: March 07, 2022, 01:22:03 pm
content: To everyone trying to mutilate their card, you can most likely just deauthorise NFC payments in your online banking/bank app. If it's on your smartphone, you can even simply turn NFC on and off as you need.Relay attacks, as risky as they are for a criminal because payment service providers virtually x-ray their clients, are also soon going to become impossible by distance-bounding protocols.

author: tooki
author_rank: Super Contributor
timestamp: March 07, 2022, 02:45:08 pm
content: Quote from: austfox on March 05, 2022, 09:46:20 amThe thing people don’t know about the chips (both of them, for electrical and NFC) is that they aren’t little memory cards, they’re actually cryptographic processors. So it’s not simply a matter of replaying a transaction.But indeed, Apple Pay is apparently even more secure than the card’s own NFC (according to various sources, including the head of security at a credit union I spoke to). (I don’t know anything about Samsung Pay so I can’t comment on its relative security.)

author: m k
author_rank: Super Contributor
timestamp: March 07, 2022, 04:24:28 pm
content: Here cash is the law.Though, for decades, some have been rejecting it, like electricity company.Magnet stripe for money is also illegal.Skimming news have disappeared, so are stripes.I find myself being more concerned that bad guys are rooting the system, or the phone.But I'm far from everything and possibly paranoid.

author: twospoons
author_rank: Frequent Contributor
timestamp: March 07, 2022, 08:46:17 pm
content: Quote from: thm_w on March 02, 2022, 02:21:41 amAs a contractor currently working for a company making payment terminals I can confirm the extreme lengths we go to to prevent unauthorised tampering. There are tamper switches and security grids everywhere. As soon as any kind of intrusion is detected the thing will wipe its cryptographic keys, rendering it useless.The biggest risk, around here anyway, is some low-life nicking the NFC card and running around using it for transactions below the limit requiring a PIN (here its $80).I hear the small retailers don't like them because the banks charge extra for NFC transactions. That may be different elsewhere in the world.

author: NiHaoMike
author_rank: Super Contributor
timestamp: March 08, 2022, 02:31:40 am
content: Quote from: twospoons on March 07, 2022, 08:46:17 pm

author: Berni
author_rank: Super Contributor
timestamp: March 08, 2022, 06:16:24 am
content: Everyone seams to have higher limits for contactless card PIN entry. Over here you can only do up to 25€ without a pin and something like every 10 pinless payments you have to enter a pin anyway.What was an issue at some point with contactless bank cards is that the non encrypted memory area had a fair bit of personal information inside of it. This is data that any RFID reader will spit out if you try to read a bank card. Later on they stopped putting the credit card owners details in there.

author: Haenk
author_rank: Super Contributor
timestamp: March 10, 2022, 03:32:19 pm
content: I think the "risk" part of contactless payment can be neglected - the PIN-less transactions are limited to AFAIK a combined 150 EUR.

author: Bassman59
author_rank: Super Contributor
timestamp: March 11, 2022, 03:24:00 pm
content: Quote from: edtyler on March 05, 2022, 02:39:36 amYou are making the claim. You need to provide the evidence to support that claim. "Do your own research!" is not an acceptable response to a request for that evidence.

author: Bassman59
author_rank: Super Contributor
timestamp: March 11, 2022, 03:24:37 pm
content: Quote from: Haenk on March 10, 2022, 03:32:19 pmAll transactions should require a PIN, then. Anyone who says, "... but that takes too long!" is an idiot.

author: tom66
author_rank: Super Contributor
timestamp: March 11, 2022, 04:15:14 pm
content: Quote from: edtyler on March 05, 2022, 03:43:15 amWhenever I use a contactless card or Apple Pay I receive a notification on my phone within a minute of making the transaction.I can also easily dispute any contactless transaction and the max payment is £100 by contactless alone.

author: tooki
author_rank: Super Contributor
timestamp: March 11, 2022, 04:47:16 pm
content: Indeed, I usually get the confirmation within 5 seconds.

author: Infraviolet
author_rank: Super Contributor
timestamp: March 13, 2022, 02:36:28 pm
content: Where banks don't offer you cards without contactless functionality you can always take a scalpel or other sharp implement and make deep scratches at certain points on the card (this will vary by card manufacturer) so as to break the antenna loop. Chip and pin functionality will be unaffected.As far as arguments abouta need for always needing a PIN go, this is sensible. A PIN isn't perfectly secure, and maybe contactless RFID/NFC isn't so insecure, but contactless without a PIN is definitely extra attack surface (even if a PIN gets required on some proportion of transactions) and reduces security, even if only by a small amount, for no conceivable benefit. If paying quickly matters there is a thing called exact change, keep it in your pocket, price up your stuff before you're at the till, count it up in advance and hand over the coin/note pile as you walk up. cashiers love it, much faster than ****ing around with NFCs which always decide not to work when there's a big queue and a need to hurry.Really we should all be endeavouring to use actual cash as much as possible, to keep in circulation the one form of payment which is not under threat whenever infrastructure is disrupted by malicious (foreign governments, own governments, criminals...) or accidental (power cuts, broken fibre cables, software updates...) events. Card payments should be reserved for their true purpose, online or other purchases of the kind where the buyer and seller are physically separated such that exchanging physical cash is impractical.

author: Marco
author_rank: Super Contributor
timestamp: March 13, 2022, 02:48:26 pm
content: As I've said before, given how cheap transistors are they should have done time of flight measurements of the signal and made that part of the standard (so the NFC device remodulates a PRNG sequence it receives from the terminal on a different frequency in some analogue circuitry to send its data, the terminal measures the lag). They still should for a new version.MITM would be gone and it would just become a digital key for a true proximity lock.Mobile phone payment would still be more secure, because you see a vendor independent confirmation of the payment details without having to rely on a possibly compromised terminal ... but I hate having to have a mobile with me everywhere so meh.

author: Berni
author_rank: Super Contributor
timestamp: March 13, 2022, 05:09:50 pm
content: Cash is still the primary way of payment here.Pretty much everyone doing face to face business will take cash, while not everyone has a POS terminal to accept cards. So i tend to keep 10 to 100€ of cash on me. Yet find myself using cards more often because it is faster and more convenient.It is more the US that had big dollar counterfeiting issues, to the point where a lot of places would only accept cards.

author: PlainName
author_rank: Super Contributor
timestamp: March 13, 2022, 05:31:22 pm
content: Problem with cash is that things like buses don't give change, and those and car parks charge stupid values like £3.29.Can't remember the last time I paid cash for anything, but I notice in the likes of Lidl that those using cash take far longer on checkout than those dabbing a card (even when it needs a PIN check). Also can't remember the last time I had to patch a hole in my pocket because of the coins, or had to find a cashpoint before going anywhere or doing anything.

author: Bassman59
author_rank: Super Contributor
timestamp: March 14, 2022, 05:56:19 pm
content: Quote from: Berni on March 13, 2022, 05:09:50 pmI think counterfeiting is probably low on the list of reasons why many places only accept cards here in the US.In no particular order:A: credit card issuers are all competing with each other to get customers to use cards instead of cash. They do this by offering "rewards," which used to be points to be used for purchases through "partners," but now is increasingly just either a 5% discount at point of purchase (Target does this with their store-brand "Red Card), or some percentage of "cash back," commonly 1%, but for certain "categories" like groceries and gas station purchases the cash back can be 5%. Of course the categories change frequently, so you need to be on your toes to take maximum advantage, but cash back is always better than "points" you have to redeem for products.YES -- it is obvious that cash back isn't free. It is paid out of the swipe fees charged to merchants so they can accept card payments. Of course the merchants have to charge 3% to 5% more for their products just to cover the cost of the swipe fees, and sadly the merchant agreements between the card issuers and the retailers generally precludes the retailer from offering a cash discount. So from a consumer perspective, you're paying for the swipe fee, anyway, so you might as well use the card and get the "benefits."So to that end -- I will pay for purchases at my locally-owned coffee shop or record store or guitar shop in cash, and they get the benefit of not having to pay the swipe fee. For the big box chains? Screw 'em, I'm going to use the cards that give me the benefits.B: some merchants see the cost of swipe fees as being lower than the labor cost to manage counting and handling cash. I asked my friend who runs a local coffee roaster/shop about this, and he said from his small perspective, he goes to the bank regularly anyway so dealing with cash is no big deal. And he appreciates the savings from not paying the swipe fees. But, with the big box stores, it's a lot easier for all transactions to be electronic so they don't have to have the armored car come and take a million dollars in cash to the bank.C: Employers do not trust employees to not steal cash from the till, even though the tills are counted out at the start of a shift and counted in at the end. (Employees don't trust employers, either; different issue.) Employers will embrace any idea that keeps workers from handling large amounts of cash.

author: PlainName
author_rank: Super Contributor
timestamp: March 14, 2022, 06:27:47 pm
content: QuoteAnother US thing is civil asset forfeiture: the police apparently pull trivial traffic stops and then confiscate any cash they find. Even if the traveller isn't charged with anything, the cops keep the money. Clearly, using a card instead of cash circumvents that.https://www.nlg-npap.org/civil-asset-forfeiture/

author: ve7xen
author_rank: Super Contributor
timestamp: March 14, 2022, 08:29:05 pm
content: Quote from: edtyler on March 05, 2022, 03:49:07 amWhat you seem to be claiming, though, is that it is possible to clone a card remotely via NFC. In other words, that having temporary access to your card could be used by an attacker to make arbitrary transactions in the future. Barring some major undisclosed problem with the technology, that is not the case, it's a challenge-response system and the nonce is provided by the transaction processor, so you basically have a few seconds to execute the attack before the transaction times out. Any attack would need active access to your card while the transactions are being completed...the relay attack. With fancy antennas and so on maybe you can make this happen at some significant distance, but you still need to be doing this in sight of both the card and the terminal simultaneously. The activity at the terminal would also look pretty suspicious, not to mention someone waving a yagi around pointing at restaurant patrons or whatever. So maybe you can manage to pull off a couple of low-value transactions before you need to tear down your setup and move on. It's a far, far less valuable and higher risk attack than card skimming, and I think pretty impractical. The actual risk seems low, and it's certainly much more secure than the old magstripe or America's chip+sign system.

author: twospoons
author_rank: Frequent Contributor
timestamp: March 14, 2022, 08:38:49 pm
content: Don't forget the carrier is 13.5MHz, so any antenna with decent gain is going to be huge.

author: tom66
author_rank: Super Contributor
timestamp: March 15, 2022, 03:25:20 pm
content: Also, since it's powered for passive NFC cards... NFC has peak power of 1W for distance of ~2-3cm max. How much power do you need to get NFC to work at say 2-3m? The card is only going to be chirping at a few milliwatts, so how well will you receive the response at your attack distance?Rough calculation: inverse square law, assuming the antenna is omnidirectional, you're going to be looking at 100W+ transmitter powers. I think you might notice someone walking around with a 100W radio-transmitter. You might even just about feel it! Sure the attacker could use a very directional antenna but now the attack has to become a lot more careful - where is the card positioned in the wallet, pocket, etc.?

author: edtyler
author_rank: Contributor
timestamp: March 15, 2022, 04:05:40 pm
content: I often see 2mW (+3dBm) transmitters in the HF band with a range of 20M, using an Omni type antenna. High power transmitters to power the NFC device are easy to conceal, but an efficient antenna would not be. The demos I saw used a somewhat directional magnetic loop, which had a 2M diameter - not too easy to conceal. But, there are wire antennas that could be concealed, especially if one wanted to work at a fixed location for a while.

author: Marco
author_rank: Super Contributor
timestamp: March 15, 2022, 06:07:13 pm
content: Quote from: tom66 on March 15, 2022, 03:25:20 pmUp to 20 meters, radiation is an unwanted byproduct, not a mode of operation. For inductive coupling, size and ferrite can substitute for power.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 15, 2022, 07:51:56 pm
content: This is just completely unrealistic for any real-world use. There are definitely many worse sources of concern than this, just move on.

author: Berni
author_rank: Super Contributor
timestamp: March 16, 2022, 06:44:23 am
content: Theft prevention is not about making it impossible to steal something. Just making it difficult enough for the thief to not bother.Yes a RFID repeater attack is possible on a NFC bank card, but it takes so much setup(needs one person skimming the card and another using the stolen card info at a POS terminal simultaneously) to be able to steal one maximum contactless transaction worth of money.Besides if you are worried about it you can still just get a metal sleeve for your card or a wallet with metal sheets embedded in it. This shields the card from harvesting enough power to power itself, so it wont work. Yet the card is still usable as NFC once you pull it out of there.For me personally i don't bother with shielding my bank card since even if they do manage to pull it off i would loose at most 25€ and get a SMS about the transaction, so i can take countermeasures. I have lost more money to stupider things before.

author: tom66
author_rank: Super Contributor
timestamp: March 16, 2022, 08:05:42 am
content: All of this is also pretending that we care that the bank loses the money.At the end of the day, a fraud attempt like this (especially against a credit card in basically every Western country and probably beyond, but in all of EU also against debit cards) is protected for the consumer.So unless you live on a bank balance of 100 euros regularly, it's unlikely you'll miss the funds. You'll get a notification, call your bank up, cancel the card and the transactions, and "7-21 working days later" the money will be back home.

author: Bassman59
author_rank: Super Contributor
timestamp: March 16, 2022, 09:04:39 pm
content: Quote from: tom66 on March 16, 2022, 08:05:42 amI don't particularly care if the bank loses money, that's for sure. If my credit card is compromised, they'll sort it out.The only thing I worry about is a debit card. Now I never use a debit card for purchases, just for the rare ATM withdrawal. Why? Because even though I'll eventually be made whole by the bank if the card is compromised, the last thing I need is for mortgage or other payments to bounce in the interim.Really, there's no good reason to use a debit card for purchases. Use a credit card, get the consumer protections/warranty extensions/etc the card issuers give as benefits. Take advantage of the 1-cent cash back. Just pay it off every month and there's no cost to using a credit card.

author: PlainName
author_rank: Super Contributor
timestamp: March 16, 2022, 10:04:45 pm
content: QuoteIt's instant settling of a debt, as opposed to having several debts hanging around for a month before they all hit you at once. If you are not the sort that gets turned on with columns of numbers and really understand that your current balance of, say, £300 is actually going to be a debt of £50 next week already so, no, you can't afford that fish'n'chip supper tonight, then not having any debt around longer than it takes to pocket your card is dead useful.That isn't saying that credit cards don't have advantages, some of which you note. But debit cards are not advantage-free and there are good reasons for using them.A quite good reason for having one (credit card), even if you don't want the delayed debts, is for credit worthiness. If you have no cards and no debts your credit rating will be lower than if you have a card and some debts. Shove a fiver on the card, pay it off every month, and your credit rating is boosted quite nicely since it shows you can regularly service debt.

author: twospoons
author_rank: Frequent Contributor
timestamp: March 16, 2022, 11:11:27 pm
content: Plenty of low-margin retailers wont accept credit cards because the transaction fees just about wipe out any profit. I've heard Amex is particularly bad - higher fees and slow to pay.

author: Monkeh
author_rank: Super Contributor
timestamp: March 17, 2022, 12:58:59 am
content: Quote from: Bassman59 on March 16, 2022, 09:04:39 pmSome of us get consumer protections and reasonable warranties as a given, instead of a benefit of placing oneself into debt to a private company which doesn't care about you.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 17, 2022, 01:52:28 am
content: That may depend on your country. Over here, debit cards have good consumer protection. The thing to be aware of though, is that the "higher end" the card is, the better the protection (like those "premier", "gold", "platinum" cards). And yes, those are available as debit cards too, at least over here. Not sure about the USA.

author: Berni
author_rank: Super Contributor
timestamp: March 17, 2022, 06:37:49 am
content: I just use a debit card all the time.Here in Europe i don't really see the benefit of a credit card other than getting a cheep 1 month loan of money.A few years ago i had to do some google research on what this "cashback" thing even is, because i got a foreign issued card and it shown cashback in the browser UI. It is simply not a thing here. Same for credit score. No such thing here. Your bank loans here get approved on the basis of providing paperwork that proves you have enough regular income to pay them every month. If you rack up too much debt you can get any assets to your name repossessed.Debit cards also get fraud protection, they can have monthly limits etc... so they can't just drain you whole bank account in the case of fraud. For internet payments i use a separate prepaid visa debit card where i can transfer funds using my banks web ui. I only keep a few hundreds of Euro in there, so that is the most i can loose to fraud anyway.

author: Marco
author_rank: Super Contributor
timestamp: March 17, 2022, 08:16:45 am
content: Because of the recent EU law making credit card surcharges illegal credit cards are slowly going become the norm just as in the US (just as the US is removing similar laws and already has precedent making forbidding surcharges by contract invalid).Extra insurance and easier chargeback are good services, if you pay for other people using credit cards you might as well derive benefit from it. Sucks to be forced into it by corrupt Eurocrats, but it is what it is.

author: Faranight
author_rank: Unknown
timestamp: March 27, 2022, 12:44:04 pm
content: Well, I have to say I am personally not a big fan of contactless payment cards.I was a bit upset when my bank suddenly notified me they were going to issue me a new contactless card without offering any options at all to stay with non-NFC cards (some rare banks still offer this choice, mind you). Angry as I was, I ended up drilling a small 2mm hole through my card where the NFC coil is located. You have to place your card against a strong light and you'll be able to see where the wires inside the plastic are. Thus I converted my brand new NFC card to a brand new non-NFC one. If anyone is interested it does work - it stops the NFC from working, but the contact payment isn't affected at all.Was funny to see all those cashiers trying to place my card onto a NFC reader and then waiting a long time wondering why it isn't working.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 27, 2022, 06:10:49 pm
content: I've recently seen that they want to generalize contactless to ANY payment of any amount. It's going to appear relatively soon in the EU from what I've seen. Dunno about the rest of the world.This means all transactions will be issued through NFC. A pin code will still be required above the max amount allowed for what is currently contactless payments, but you won't insert your card anymore in a reader. Not sure what it really brings to the table (apart from less wear of the cards and readers...) But for people who don't like NFC for payment cards, this is probably not good news.

author: Monkeh
author_rank: Super Contributor
timestamp: March 27, 2022, 06:13:04 pm
content: Quote from: SiliconWizard on March 27, 2022, 06:10:49 pmBack to cash they go then.

author: PlainName
author_rank: Super Contributor
timestamp: March 27, 2022, 08:48:41 pm
content: Quote from: Monkeh on March 27, 2022, 06:13:04 pmOr a phone wallet, which may be more acceptable to them.I would see it as the phone showing a QR code which the payment terminal scans and then contacts the user's bank to authorize a transfer, the bank does the transfer, then the vendor sees that it's paid for. Things like Tesco Pay are almost there. Previously it would have been unheard of because of the 2-5day transfer timescale, but nowadays I can get notification from my bank that I've just spent money at Tesco before I've pulled the phone away from the reader.The reverse could work: the payment terminal shows the QR code which the phone scans. Either way the phone has a link to the bank, a does the vendor, so it's all matched up in realtime.

author: Halcyon
author_rank: Unknown
timestamp: March 27, 2022, 10:35:31 pm
content: Quote from: Monkeh on March 17, 2022, 12:58:59 amI happen to agree with Monkeh here. I'm of the exact opposite mind. I don't have a credit card, but do have several Visa debit cards (which work the same way as a credit card, albeit without the credit).Most (all?) banks here will offer protections to a certain amount and refund/reverse unauthorised purchases without questions asked.Unless you have a specific need for rewards that come with certain cards and you're disciplined enough to pay the balance every month as not to incur interest charges, credit cards will certainly cost you more for very few benefits compared to a regular bank card, particularly if you pay a monthly or yearly fee.As for warranty extensions, they are almost pointless in countries with strong consumer laws. Regardless of manufacturers warranties (extended or otherwise), Australian consumer law applies to all consumer products (including motor vehicles). If a product fails after the warranty expires, depending on the type of product, you could be entitled to a free replacement or refund. For example, Apple was one company that was forced to provide an explanation of what Australian consumer law covers after numerous consumers complained about them declining refunds/replacements:https://www.apple.com/au/legal/statutory-warranty/au/In some cases, Australia Consumer Law offers more protections than the paid AppleCare+ extended warranty.

author: retiredfeline
author_rank: Frequent Contributor
timestamp: March 27, 2022, 10:44:51 pm
content: Quote from: Halcyon on March 27, 2022, 10:35:31 pmNever had a problem. You can set up automatic debit. Of course now you would probably worry they might take the wrong amount and drain your bank balance. It all comes down to what risk you can live with.

author: PlainName
author_rank: Super Contributor
timestamp: March 27, 2022, 11:16:08 pm
content: QuoteKind of. If you buy of Aliexpress your local laws are irrelevant. Suppose you buy from the Amazon marketplace and the vendor is that same Aliexpress one, just advertising on Amazon. Which law applies? I think that technically you (the buyer) are the importer and responsible for stuff like warranties. That's how Amazon gets away with a '1 month return and then up yours' policy, I think.Edit: The other week I bought a low-cost item on Amazon and would normally have not done so because of the reviews saying the thing breaks. But I was offered a 2-year extended warranty for £1 which made the deal sweat. I normally wouldn't have taken the warranty, but it's so cheap and takes any worry about longevity away. Strangely, it's the first time I've been offered a warranty on such a low cost item, so maybe they've been reading the reviews too!

author: Monkeh
author_rank: Super Contributor
timestamp: March 28, 2022, 12:32:53 am
content: Quote from: retiredfeline on March 27, 2022, 10:44:51 pmNever seen that occur - have seen a card transaction for a few tens of dollars of flowers from a vending machine somehow transform into over $65k, though.. quality US bank goes 'looked legit, not our problem'.

author: Halcyon
author_rank: Unknown
timestamp: March 28, 2022, 05:28:14 am
content: Quote from: dunkemhigh on March 27, 2022, 11:16:08 pmAustralian Consumer Law applies to any company who sells a product or provides a service in Australia, regardless whether or not the company is based or headquartered in Australia. So yes, companies such as Aliexpress, Amazon etc... are still bound by the legislation here if they choose to offer their products for sale in Australia. They don't get to opt-out of their responsibilities just because they aren't in the country. If they want Australian customers, they must comply with our laws.Also, resellers don't get away with it simply because they didn't manufacture the product. The seller is just as liable as the manufacturer. One cannot fob a customer off onto the other (that's illegal).I've personally had an ACL claim against a US-based company in the past, which was ruled in my favour. Whilst the company didn't really get a legal "smack", it cost them a total refund + an additional 100% of the purchase cost at the time. That's money in my pocket for their stuff-up.

author: Berni
author_rank: Super Contributor
timestamp: March 28, 2022, 05:44:31 am
content: Quote from: dunkemhigh on March 27, 2022, 08:48:41 pmI already have this. My phone emulates a NFC Visa debit card using an app.This means i am not limited to using it at one specific supermarket chain, having to set up an account with banking details with them, install there app on my phone for just that one store etc...This works on any POS terminal that accepts a Visa NFC card. This means pretty much every vendor in my country that takes cards (unless they have such an old POS terminal that only takes chip&pin cards, but i haven't seen one of those in a long time). These days some ATMs are supporting NFC too, so i means i can also withdraw cash using just my phone.However i rarely use it and instead just use my actual Visa card. The reason being convenience. Here is the comparison of the process for paying 20€ at a cash register:- Visa card: Take wallet out of pocket, Take card out of wallet, The cashier can already see i want to pay with card and pushes the button, I press the card on the POS terminal, Wait for beep beep, Leave- Paying with phone: Take phone out of my pocket, Tell the cashier i want to pay with card, Unlock my phone, Open the menu and launch the banking app, Wait for app to load, Enter the unlock pin into the app, Press the NFC pay button, Place the phone on the POS terminal, Wait for beep beep, Leave

author: jmh
author_rank: Contributor
timestamp: March 28, 2022, 09:32:58 am
content: Quote from: dunkemhigh on March 27, 2022, 08:48:41 pmThat did surprise me on our last trip to China. No-one used cards, all transactions were done via smartphones and QR code and WeChat/Pay/whatever I forget. Even vending machines, which annoyed us as there was no way to even use cash or cards. The only time we needed cash to get into a museum one of the party simply asked some random person and they used their phones to transfer the value, random person handing over the cash amount.On NFC, son #1 refuses to have a card with it. When the bank issues a new one it comes with NFC, he complains and they send a non-NFC version. As to the rest of us, even the wife can use it now (!) so it had better stay!

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2022, 10:45:44 am
content: QuoteBut technically they are not offering a service in Australia - you are going to their website in China and importing yourself. Further, what penalty can Australia action against Aliexpress? I guess they could stop any import from there, but that's a rather big stick for, say, a camera that broke after 3 months.The situation with Amazon isn't very clear - they are not reselling anything, just handling what are essentially adverts. Sometimes they act as drop shipper, but often they don't handle the goods in any way. The closest they get is acting as a money broker (like PayPay, and I'm pretty sure PayPal isn't responsible for whatever you decide to import).

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2022, 10:49:58 am
content: QuoteBut it's still NFC, which is the bad boy. Although on a phone you can control when it's actually transacting. My new phone, which I don't use, has NFC but my favourite which I use all the time doesn't. Sometimes life's a bitchI agree about the hassle of getting the app going and paying for stuff, but if you don't want to use NFC on card, or just not have to carry them, it's a reasonable solution.

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2022, 10:51:05 am
content: QuoteOh. I'll let the patent application drop, then

author: MadScientist
author_rank: Frequent Contributor
timestamp: March 28, 2022, 10:56:58 am
content: People talking about NFC skimming clearly don’t understand how end to end contactless cards transfers work. You can’t successfully initiate a transfer simply by having the NFC details

author: MadScientist
author_rank: Frequent Contributor
timestamp: March 28, 2022, 11:00:15 am
content: Quote from: Halcyon on March 28, 2022, 05:28:14 amMany larger countries have extra territorial laws The EU has many. But the fact remains that the company unless it has a legal presence in the area is immune to any civil judgements.

author: Zipdox
author_rank: Regular Contributor
timestamp: March 28, 2022, 11:07:54 am
content: You do realize you can disable contactless payment through your bank? You can also change the PIN requirement threshold. At least with my bank.

author: kjpye
author_rank: Contributor
timestamp: March 28, 2022, 11:17:26 am
content: Quote from: dunkemhigh on March 28, 2022, 10:45:44 amThey quote prices in Australian dollars, calculate prices for postage to Australia, and collect Australian GST, which they presumably transfer to the Australian Government. And the item I ordered on AliExpress a couple of weeks ago, and was then shipped from Sydney the next day and I had within 4 days of ordering (AusPost can be vaguely efficient occasionally) -- was that imported by me?

author: MadScientist
author_rank: Frequent Contributor
timestamp: March 28, 2022, 11:18:54 am
content: Quote from: kjpye on March 28, 2022, 11:17:26 amYes. DDP still makes you the importer

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2022, 04:38:59 pm
content: QuoteI can sell you something and do all of that if you like, and I guarantee I don't even know where Australia is never mind have a business operation there. When whatever I send you turns out to an EMC bomb equivalent, the only comeback you'll have is to get your bank to do a chargeback (but I'll insist on a funds transfer so that won't be possible). Plus, when you report to TPTB that the thing you bought is killing off mobile phones in a 20 mile radius, it's not me they'll be coming after but the importer. That is, you.QuoteIn that particular case I would be inclined to think you are not, but I wouldn't want to have to argue that in court. When you order, you don't know if there is a warehouse full of stuff already here or if it's going to be coming in by boat. But either way, how are you going to force the vendor to satisfy your grievance? Suppose they deign to actually answer emails but just send a page full of smileys, what are you going to do?

author: ve7xen
author_rank: Super Contributor
timestamp: March 28, 2022, 06:10:52 pm
content: Quote from: dunkemhigh on March 27, 2022, 08:48:41 pmWhat do you see as being better with this scheme than with NFC? It's only going to be remotely secure if the code is one-time-use and also requires a round-trip through your bank for manual authorization. So then it depends on your phone's Internet service, your bank's app or SMS or whatever authorization mechanism and so on all working properly. It seems a lot more likely to cause delays / issues at checkout, and it's definitely more cumbersome than the existing contactless payment scheme.Going the other way where the vendor shows a code with the amount and their recipient account details and you authorize the transaction on your phone seems more reasonable, but still depends on the bank's app and the Internet, and still more cumbersome and not substantially different than NFC.

author: PlainName
author_rank: Super Contributor
timestamp: March 28, 2022, 07:03:32 pm
content: QuoteIt ain't NFC.Technically that's irrelevant, but if someone is convinced that 5G causes covid19 then they're not going to accept that NFC on a phone is a bit different to NFC on a card which is really tricky to subvert anyway.And, as mentioned just a tiny little bit before your post (do you actually read stuff before skipping to the end and posting?) some phones don't do NFC.

author: Halcyon
author_rank: Unknown
timestamp: March 28, 2022, 07:28:36 pm
content: Quote from: dunkemhigh on March 28, 2022, 10:45:44 amThey would still be considered a reseller, same as Amazon and eBay. Although ACL doesn't apply to auctions or private sales between individuals.A shitty camera off Aliexpress is also unlikely to pass the test of "reasonable quality" under the law. If you pay $20 for a camera and it lasts 3 months, that's probably going to be "reasonable" in the circumstances. If you pay $2000 for a camera, then it's not reasonable for it to last only 3 months. In that instance, you could go back to the manufacturer of the product (even if you didn't buy it directly from them) to seek a remedy. In my experience, most decent companies who care about their reputation will understand their obligations under consumer law and do the right thing. Even car dealers and manufacturers are slowly starting to get with the program.

author: Berni
author_rank: Super Contributor
timestamp: March 29, 2022, 11:37:25 am
content: Quote from: dunkemhigh on March 28, 2022, 10:49:58 amWhat makes NFC trough an app worse than a QR code?In both cases the phone and POS terminal have to communicate in some way to make the transaction happen. Only difference being that NFC is bidirectional so the phone can hand back the approved and signed transaction key directly to the terminal while the QR code method goes back trough the internet. In both cases the phone app is the middle man to make things happen and in both cases a server in the internet in involved to execute the transaction. Both are immune to skimming (by listening to NFC data or your internet data trough a fake cell tower) since the data is only relevant for that one transaction, so it can't be used to complete an extra fraudulent transaction.Only thing is that to scan a QR code you have to aim your phone at it, sometimes having issues with lighting and glare. On the other hand NFC just needs to be plonked down against the terminal.

author: tooki
author_rank: Super Contributor
timestamp: March 29, 2022, 01:15:41 pm
content: 1. Because there are crazies who think anything wireless is going to kill them.2. Because there are people who think NFC can be easily skimmed while their card or device is still in their pocket.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2022, 01:33:54 pm
content: QuoteLack of NFC hardware (said for the third time already)?

author: Berni
author_rank: Super Contributor
timestamp: March 29, 2022, 05:54:38 pm
content: Quote from: dunkemhigh on March 29, 2022, 01:33:54 pmSo does NFC then win a point for the lack of camera hardware?The NFC hardware in a phone only does something when the phone tells it to like all the other RF interfaces on a phone (and can be turned off completely much like bluetooth or wifi) Even when turned on my phone the NFC only appears to work once the phone is active (as in lock screen unlocked). Then when you actually want to pay at a POS terminal using NFC the app has to take over control of the NFC interface to make it emulate a tag (rather than the normal operation as a tag reader). So the NFC is not running at all when the phone is in the pocket, let alone making banking card data available.As for the people concerned with electromagnetic radiation the NFC is the lowest power transmitter in the whole phone. The WiFi chipset can pump out 100mW at 2.4GHz while the cellular chipset can pump out >2W of RF power at lots of bands from 900MHz to 3500MHz, yet you hold that right up against your head when making a phone call.

author: PlainName
author_rank: Super Contributor
timestamp: March 29, 2022, 09:36:52 pm
content: QuoteIf you had a device with NFC and no camera, sure. A smart watch, for example, might do it.QuoteHa! Youreallyhaven't read previous messages but just dived in.Quote from: dunkemhigh on March 28, 2022, 10:49:58 amQuoteDoesn't matter. The people you need to explain that to aren't going to listen to reason or science. If they were then you'd not have to explain it in the first place, see.

author: ve7xen
author_rank: Super Contributor
timestamp: March 30, 2022, 12:03:25 am
content: Quote from: dunkemhigh on March 28, 2022, 07:03:32 pmI mean yeah, I guess if you're trying to appease irrational people whose preferences make no sense, you can come up with many alternative schemes that have no real advantages. They will probably come up with some reason that QR codes are mind control or something next. There's no point in trying to appease them, and our widespread technological infrastructure certainly shouldn't.The end user isn't even the one financially on the hook if things go wrong, they really have no say over it. If I had my way they'd get rid of their stupid SMS-based OTP for every $10 transaction online and replace it with standards-based TOTP, but that's not my decision to make, as frustrating as it is.QuoteIndeed, and that is why many credit cards have NFC built-in. It's the same thing. Are you following what this thread is about? I missed the part where the conspiracy nuts and their complete misunderstanding of the technology entered the conversation as a serious concern.

author: PlainName
author_rank: Super Contributor
timestamp: March 30, 2022, 12:23:31 am
content: QuoteQuote from: edtyler on March 05, 2022, 03:43:15 amYou're welcome.One reason I suggested QR codes is because my bank uses them effectively to perform 2FA using a phone. My local supermarket uses them for purchases (to perform the same function as NFC). My phone doesn't have NFC and my PC doesn't have an NFC reader, so QR code has made life a lot easier for me. If your phone has NFCandyou use it then you may not fully appreciate what the lack of same means when you'd like to use that feature and can't. Maybe like if your PC only had a trackpad instead of a mouse.

author: PlainName
author_rank: Super Contributor
timestamp: March 30, 2022, 12:25:52 am
content: QuoteWell, you live and learn! I always thought that phones gained NFCaftercredit/debit cards (that is, to emulate cards) rather than vice versa as you seem to suggest.

author: Halcyon
author_rank: Unknown
timestamp: March 30, 2022, 01:19:58 am
content: Quote from: tooki on March 29, 2022, 01:15:41 pmBasically, yep!

author: tooki
author_rank: Super Contributor
timestamp: March 30, 2022, 01:51:41 am
content: Quote from: dunkemhigh on March 30, 2022, 12:25:52 amContactless cards predate NFC in phones by many years. Contactless credit card terminals were already widespread here in Europe by the time NFC in phones hit the street.

author: ve7xen
author_rank: Super Contributor
timestamp: March 30, 2022, 08:27:00 pm
content: Quote from: dunkemhighIndeed, so virtually everyone with a credit card has access to it at this point. Penetration of the technology nears 100%. Why reinvent the wheel?Quote from: edtyler on March 05, 2022, 03:43:15 amSo ask for one? The process on the pin pad for receipt generation is usually identical whether contactless or contact payment is used, and depends mostly on the merchant's policy. This has nothing to do with NFC.Quote from: edtyler on March 05, 2022, 03:43:15 amIf you don't like NFC that's...fine...you can disable it and use contact payment instead. But that doesn't make those asinine beliefs justification for a new system that serves the same basic purpose just...worse. I was under the assumption that we were being rational here, on a technical forum, and that the above discussion of the security model around NFC was enough to get past that. So thank you for reminding me that's not actually the case and that we need to spend more time emphasizing that NFC is pretty secure as long as you remain in physical control of the card/device. Just don't give your card to anyone and the NFC-related risk is effectively zero.Quote from: edtyler on March 05, 2022, 03:43:15 amThere's no reason such a system couldn't work, but it has a lot more dependencies and limitations than the NFC system. You can't reasonably implement it in a credit card, or many other devices you might want to put it in like a smartwatch, since it requires a camera. It depends on an active Internet connection on the user's device. I'm not seeing much benefit here.I don't actually bother with phone-based NFC, it's not really more convenient than just tapping the card, but it's handy if I forget my wallet.

author: PlainName
author_rank: Super Contributor
timestamp: March 30, 2022, 09:40:11 pm
content: Quote from: ve7xen on March 30, 2022, 08:27:00 pmHey, don't put words onto my keyboard! Idid notwrite that and I think you're a dick for making out I did. Please edit it RIGHT NOW to put the record straight.AND the other quotes which look like they are attributed to me but are not mine. In fact, most of what you quoted was written by someone the polar opposite to me.Sheesh. Put it right, please.

author: Berni
author_rank: Super Contributor
timestamp: March 31, 2022, 05:57:18 am
content: You do get a paper printout from the POS terminal after a NFC payment over here.But i would actually prefer it if they didn't give a printout since i don't want one. Once i hear the terminals happy fast double beep sound (transaction success) i usually turn around and leave before the terminal is done printing it.What am i supposed to do with that piece of paper the terminal prints out? If a malicous POS terminal could overcharge me then it could also print the false amount on the paper. I get a SMS notification of the transaction anyway (that went trough sterile hands of the servers, not the rouge POS terminal) that is more trustworthy. If i want to have an overview of my spending i will log into my internet banking and look trough the transactions there.The only thing having this piece of paper proves is that i was personally there when the transaction happened. Making it potentially useful in proving to a tax inspector that you actually ware on that business trip rather than making it a 'fictional trip' used to pay out yourself trip expenses.

author: Miyuki
author_rank: Frequent Contributor
timestamp: March 31, 2022, 08:37:51 am
content: Quote from: jmh on March 28, 2022, 09:32:58 amThat is mainly because small businesses/individuals can use their phones as a receiving terminalYou can use the same payment method to send money to your friend or soCard terminal as "west" knows it, is an expensive toy to operate

author: ve7xen
author_rank: Super Contributor
timestamp: March 31, 2022, 08:07:06 pm
content: Quote from: dunkemhigh on March 30, 2022, 09:40:11 pmSorry, my bad trying to trim the quote tags for readability.

author: PlainName
author_rank: Super Contributor
timestamp: March 31, 2022, 09:47:38 pm
content: Thanks, but could you just make it plain it is not a following quote from me by making the quote attribute the following:"quote author=edtyler link=topic=314731.msg4044100#msg4044100 date=1646451795"Otherwise the impression is that it is still my quote, just split into several parts.