Hackers can bypass Visa's contactless spending limits

The researchers and Visa disagree on the severity of the threat presented by the hack

card and contactless reader

Researchers at Positive Technologies have discovered a way to bypass the 30 spending limit on contactless Visa cards, widening the potential for large payouts on stolen cards.

There are two security measures involved in a contactless card transaction that can be bypassed to enable a fraudster to siphon a much larger amount from a victim's card than before, without needing a PIN.

Advertisement - Article continues below

The first measure relates to a contactless card's default programming which won't allow it to complete transactions over 30. This can be bypassed, as can the measure on a terminal which requires additional verification such as a PIN or in the case of mobile wallets, through which this hack can also work, fingerprint identification.

The fraud is facilitated by a man in the middle (MITM) attack; hackers could just manipulate two data fields that are exchanged between the card and terminal. According to the researchers, this can be done using a device like a skimmer on an ATM.

"The most practical way to implement the attack probably consists of adding an extension to the terminal that acts as a man-in-the-middle between the terminal and card," said Frederik Mennes, director of product security at OneSpan. "The extension should look as if it is a genuine part of the terminal, and this is similar to skimming attacks against magstripe-based payment cards, whereby a fake terminal is used to read the content of a card's magstripe."

Advertisement - Article continues below
Advertisement - Article continues below

Stealing a card the old fashioned way to then use on the attacker's own terminal would allow them to charge what they want to the card - a useful trick considering frequent 30 transactions will usually trigger a bank to freeze the card due to suspicious activity.

Visa disagrees with the researchers, saying the attackers must have physical access to the card to carry out the attack.

"One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer," said a Visa spokesperson to Forbes. "Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world."

Speaking to IT Pro, a Visa spokesperson took issue with the controlled environment in which the tests were carried out. The spokesperson pointed out that the research undertaken typically relies on physically stolen cards that have not yet been reported to the issuer, and the issuer not validating some cryptographic and transaction data elements or identifying this as an issue through traditional detection systems.

Advertisement - Article continues below

"Research tests may be reasonable to simulate, but these types of schemes have proved to be impractical for fraudsters to employ in the real world," said the spokesperson. "Visa's multi-layered security approach has resulted in fraud remaining stable near historically low rates of less than one-tenth of one percent.

"The device tells the card that verification is not necessary, even though the amount is greater than 30... [then] the device then tells the terminal that verification has already been made by another means," said Positive Technologies.

Visa facilitates the attacks by not requiring issuers or acquirers to have checks in place that block unverified transactions.

The attack vector isn't necessarily UK-specific, although it's where the hack was tested. Five major banks that issue Visa card were tested and all were found to be vulnerable to the hack. The hack has been proven to work in transactions over 100 and the limit isn't yet known.

Advertisement - Article continues below

"It falls to the customer and the bank to protect themselves," said Leigh-Anne Galloway, head of cyber security resilience at Positive Technologies and researcher on the project. "While some terminals have random checks, these have to be programmed by the merchant, so it is entirely down to their discretion. Because of this, we can expect to see contactless fraud continue to rise."

Contactless fraud is on the rise, according to UK Finance. Fraud from contactless cards and devices rose from 6.7 million in 2016 to 14 million in 2017 and 8.4 million was lost in the first half of 2018. People are advised to regularly check statements, and set up additional security measures such as SMS alerts.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now


video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020
cyber security

Microsoft AI can detect security flaws with 99% accuracy

20 Apr 2020

Businesses brace for second 'Fujiwhara effect' of 2020 as Patch Tuesday looms

9 Apr 2020

Most Popular

Microsoft Windows

Microsoft's latest Windows 10 update is causing yet more issues

26 May 2020

Nokia breaks 5G record with speeds nearing 5Gbps

20 May 2020
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020