Hackers can bypass Visa's contactless spending limits

The researchers and Visa disagree on the severity of the threat presented by the hack

card and contactless reader

Researchers at Positive Technologies have discovered a way to bypass the 30 spending limit on contactless Visa cards, widening the potential for large payouts on stolen cards.

There are two security measures involved in a contactless card transaction that can be bypassed to enable a fraudster to siphon a much larger amount from a victim's card than before, without needing a PIN.

The first measure relates to a contactless card's default programming which won't allow it to complete transactions over 30. This can be bypassed, as can the measure on a terminal which requires additional verification such as a PIN or in the case of mobile wallets, through which this hack can also work, fingerprint identification.

The fraud is facilitated by a man in the middle (MITM) attack; hackers could just manipulate two data fields that are exchanged between the card and terminal. According to the researchers, this can be done using a device like a skimmer on an ATM.

Advertisement - Article continues below
Advertisement - Article continues below

"The most practical way to implement the attack probably consists of adding an extension to the terminal that acts as a man-in-the-middle between the terminal and card," said Frederik Mennes, director of product security at OneSpan. "The extension should look as if it is a genuine part of the terminal, and this is similar to skimming attacks against magstripe-based payment cards, whereby a fake terminal is used to read the content of a card's magstripe."

Stealing a card the old fashioned way to then use on the attacker's own terminal would allow them to charge what they want to the card - a useful trick considering frequent 30 transactions will usually trigger a bank to freeze the card due to suspicious activity.

Visa disagrees with the researchers, saying the attackers must have physical access to the card to carry out the attack.

"One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer," said a Visa spokesperson to Forbes. "Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world."

Speaking to IT Pro, a Visa spokesperson took issue with the controlled environment in which the tests were carried out. The spokesperson pointed out that the research undertaken typically relies on physically stolen cards that have not yet been reported to the issuer, and the issuer not validating some cryptographic and transaction data elements or identifying this as an issue through traditional detection systems.

"Research tests may be reasonable to simulate, but these types of schemes have proved to be impractical for fraudsters to employ in the real world," said the spokesperson. "Visa's multi-layered security approach has resulted in fraud remaining stable near historically low rates of less than one-tenth of one percent.

Advertisement - Article continues below

"The device tells the card that verification is not necessary, even though the amount is greater than 30... [then] the device then tells the terminal that verification has already been made by another means," said Positive Technologies.

Visa facilitates the attacks by not requiring issuers or acquirers to have checks in place that block unverified transactions.

The attack vector isn't necessarily UK-specific, although it's where the hack was tested. Five major banks that issue Visa card were tested and all were found to be vulnerable to the hack. The hack has been proven to work in transactions over 100 and the limit isn't yet known.

"It falls to the customer and the bank to protect themselves," said Leigh-Anne Galloway, head of cyber security resilience at Positive Technologies and researcher on the project. "While some terminals have random checks, these have to be programmed by the merchant, so it is entirely down to their discretion. Because of this, we can expect to see contactless fraud continue to rise."

Contactless fraud is on the rise, according to UK Finance. Fraud from contactless cards and devices rose from 6.7 million in 2016 to 14 million in 2017 and 8.4 million was lost in the first half of 2018. People are advised to regularly check statements, and set up additional security measures such as SMS alerts.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Microsoft Windows

Memes and Viking funerals: The internet reacts to the death of Windows 7

14 Jan 2020

Openreach offers free full-fibre installation for thousands of homes

14 Jan 2020