Hackers can bypass Visa's contactless spending limits

The researchers and Visa disagree on the severity of the threat presented by the hack

card and contactless reader

Researchers at Positive Technologies have discovered a way to bypass the 30 spending limit on contactless Visa cards, widening the potential for large payouts on stolen cards.

There are two security measures involved in a contactless card transaction that can be bypassed to enable a fraudster to siphon a much larger amount from a victim's card than before, without needing a PIN.

The first measure relates to a contactless card's default programming which won't allow it to complete transactions over 30. This can be bypassed, as can the measure on a terminal which requires additional verification such as a PIN or in the case of mobile wallets, through which this hack can also work, fingerprint identification.

The fraud is facilitated by a man in the middle (MITM) attack; hackers could just manipulate two data fields that are exchanged between the card and terminal. According to the researchers, this can be done using a device like a skimmer on an ATM.

Advertisement - Article continues below
Advertisement - Article continues below

"The most practical way to implement the attack probably consists of adding an extension to the terminal that acts as a man-in-the-middle between the terminal and card," said Frederik Mennes, director of product security at OneSpan. "The extension should look as if it is a genuine part of the terminal, and this is similar to skimming attacks against magstripe-based payment cards, whereby a fake terminal is used to read the content of a card's magstripe."

Stealing a card the old fashioned way to then use on the attacker's own terminal would allow them to charge what they want to the card - a useful trick considering frequent 30 transactions will usually trigger a bank to freeze the card due to suspicious activity.

Visa disagrees with the researchers, saying the attackers must have physical access to the card to carry out the attack.

"One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer," said a Visa spokesperson to Forbes. "Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world."

Speaking to IT Pro, a Visa spokesperson took issue with the controlled environment in which the tests were carried out. The spokesperson pointed out that the research undertaken typically relies on physically stolen cards that have not yet been reported to the issuer, and the issuer not validating some cryptographic and transaction data elements or identifying this as an issue through traditional detection systems.

"Research tests may be reasonable to simulate, but these types of schemes have proved to be impractical for fraudsters to employ in the real world," said the spokesperson. "Visa's multi-layered security approach has resulted in fraud remaining stable near historically low rates of less than one-tenth of one percent.

Advertisement - Article continues below

"The device tells the card that verification is not necessary, even though the amount is greater than 30... [then] the device then tells the terminal that verification has already been made by another means," said Positive Technologies.

Visa facilitates the attacks by not requiring issuers or acquirers to have checks in place that block unverified transactions.

The attack vector isn't necessarily UK-specific, although it's where the hack was tested. Five major banks that issue Visa card were tested and all were found to be vulnerable to the hack. The hack has been proven to work in transactions over 100 and the limit isn't yet known.

"It falls to the customer and the bank to protect themselves," said Leigh-Anne Galloway, head of cyber security resilience at Positive Technologies and researcher on the project. "While some terminals have random checks, these have to be programmed by the merchant, so it is entirely down to their discretion. Because of this, we can expect to see contactless fraud continue to rise."

Contactless fraud is on the rise, according to UK Finance. Fraud from contactless cards and devices rose from 6.7 million in 2016 to 14 million in 2017 and 8.4 million was lost in the first half of 2018. People are advised to regularly check statements, and set up additional security measures such as SMS alerts.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020

How to use Chromecast without Wi-Fi

5 Feb 2020
Microsoft Azure

Microsoft Azure is a testament to Satya Nadella’s strategic nouse

14 Feb 2020
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020