Security expert reveals RFID credit card hack

At this week's Black Hat DC security conference, security expert Adam Laurie used a Python-based script to reveal significant security failings in the RFID technology used in some credit cards.

Using the Python tool and some hardware available from his website, Laurie was able to bring up the name and account number from an American Express card belonging to an audience volunteer on the large viewing screen for everyone to see. This was done without touching the man, or even removing the card from his wallet.

RFID tags are found in many places these days, such as credit cards, the Oyster travel cards used in London by public transport customers, inside clothes and other retail products and in most modern passports. This test reveals the worrying possibility that thieves could surreptitiously obtain sensitive information at a distance using little more than a handheld scanner device.

The number displayed on the presentation screen was not the number on the front of the card, but according to Laurie, could still be used for online transactions. Laurie stated that he had spoken directly to American Express about this issue and its response was: "We are comfortable with the security of our product".

Today the EU revealed draft guidelines stating that RFID tags on retail items will have to be deactivated to ensure purchaser privacy.

Email to a friend

Print this page