Risks of Offline Verify PIN on Contactless Cards
Date: April 2013
Publication: Proceedings of the 17th International Conference on Financial Cryptography and Data Security 2013 / Lecture Notes in Computer Science, Volume 7859
Page(s): 313 - 321
Source 1: http://fc13.ifca.ai/proc/9-2.pdf
Source 2: dx.doi.org/10.1007/978-3-642-39884-1_26 - Subscription or payment required
Abstract or Summary:
Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.
Do you have additional information to contribute regarding this research paper? If so, please email firstname.lastname@example.org with the details.