We have all been in the uncomfortable position of being at a checkout and opening our wallet to realize that we either have no money or that we have less than the amount we need to pay. This has changed with debit or credit cards, especially since they introduced contactless payment. An extremely useful feature, but it has also become dangerous. Many users of Visa cards in the United Kingdom have been faced with these dangers
Researchers Leigh-Anne Galloway and Tim Yunusov have identified flaws in the contactless process of Visa cards. These flaws allow hackers to bypass the payment limits of the cards. Such an attack was carried out on 5 major banks in the UK and all the Visa cards tested were victims of the bypass of the limit. Of course, according to the researchers, such an attack is possible to carry out with cards and terminals not only in the UK but also outside it.
Let's now see how such attacks work. Hackers modify the data exchanged between the card and the terminal during contactless payment in two processes.
The first is that, particularly in the UK, if payments require additional cardholder verification for payments over £30, cards will indicate that they cannot do so and will therefore prevent the payment. The second is that the terminal uses special settings, which require the card or mobile wallet to provide additional cardholder verification, such as through PIN entry or fingerprint verification on the phone.
It has been observed that both checks can be bypassed by using a device that intercepts the communication between the card and the terminal. In essence, the device tells the card that verification is not necessary, even though the amount is greater than £30. The device then informs the terminal that verification has already been done in another way.
Visa does not require terminals to perform checks that block payments if verification is not available. Research has shown that contactless card fraud in 2016 was £6.7 million and in 2018 £8.4 million.
The researchers stress that card security should be a matter for the issuing bank, not Visa. Also, while this is a relatively new type of fraud and not a priority, it means that greater losses could be created for both banks and customers.
The advice to card users, whether Visa or any other company , is to monitor their account statements in a timely manner to detect fraud early. It is also necessary to implement additional security measures, such as payment verification limits and SMS notifications, if available with their bank.
