No, the system was designed to be convenient.

I don't know how serious this problem is, but since this is the first we're hearing about it it must be pretty rare, as contactless cards are much more widely used in, say, Hong Kong.

We're designing an easy method of paying for small items, not arming nuclear weapons. We'll accept 1 in 1e6 errors.

Here in Australia we have PayPass which is Mastercard. Most places have eftpos terminals (handheld pin entry things) where they just tap the card and it charges your card.

It scares me that they could charge any amount and you wouldn't know.

They can't charge any amount -- pinless transactions are capped to around $20 (depending on the vendor).

Generally $50 here in Canada.

Contactless transactions are limited to a small amount without entering a PIN.

But a fraudulent "merchant" could still install a custom machine at a busy spot, and charge a good percentage of all passing NFC payment cards. Do this in a tourist area or near airport / other terminal, targetting foreign cards, and there's a good chance the fraud detection does not kick in before the weekend is over, and you have $20 x 50,000 "customers" x 2 days = 2 million in bank, converted immediately to bitcoin or similar and laundered before banks open on Monday.

Why, yes, I've been the receiving end of a similar scam. It was Visa Electron and PIN-less purchases, then a new opt-out feature. The math was more like 5 customers, but 10,000 euro limit. (No, I did not lose that, or even close, by being lucky.)

Time for RF-blocking wallets to become more mainstream perhaps? That gives control back to the customer.

I have a credit card that had the contactless payment feature. It is more convenient, but the lack of 2 FA (have card, know PIN) made it really weird to use. Eventually I turned off the contactless feature (via the internet banking branch).

Are there any nice, good quality RF-blocking wallets? I've only found poor quality fake-leather / synthetic fabric wallets when I've looked.

I got an RF-blocking card that you can put in your current wallet.

Just went on a search, since I needed a new wallet, and bought this:

http://www.idstronghold.com/RFID-Blocking-Secure-Wallet-Bi-F...

I have no affiliation with this company. The linked story and my need for a new wallet and google did the trick.

Millions of people use this exact system here in Hong Kong each day. It's amazingly convenient to be able to pay for train, bus, groceries, food in seconds without having to even take the card out of your wallet. People love it here.

But what happens when you have two contactless cards? The system in the article says it won't work if multiple cards are detected... but this would mean you'd have to take the card out of your wallet.

In Hong Kong you verbally ask to pay by for example Octopus (the most popular card) and it activates that option only. So I don't think double charging is possible here.

Barring wallets that block radio signals, yes - there are tons of them.

Outside those, I agree, there's quite a large possibility for issues, though this seems weird that it seems to be happening from significantly larger distances than it's designed to work under. To such an extent that I suspect some / all of these people are simply not remembering correctly - they swung their purse between hands, bringing it near the reader, or something. People are forgetful, and this is way way outside what anyone else can replicate that I've seen.

FWIW this will no longer be an issue when everything moves to the user's phone. You'll choose a default 'card' but will be able to change it to a preferred card before any transaction.

yeah, and then you can have real encryption too. I'm hugely in favor of phone-NFC eclipsing cards.

The approval step is "you hold your card within inches of the pickup". What these people were probably doing (their protestations to the contrary) was holding up a wallet. Which does work, if only one card in the wallet is contactless.

The story on the BBC site concerns people who attempted to pay with their chip card by placing it in the reader but had their contactless card charged instead, which was still in their purse/wallet. In some instances, the transaction was processed twice using both forms of payment.

The first customer was able to obtain a refund after demonstrating the problem to the store manager.

It's limited to only work for amounts below a certain threshold and also will randomly ask for the PIN sometimes. It's meant to be this easy.

isn't it a keyfob that you press and hold up - if you don't have to press it, what's to stop a thief from simply walking through a crowd charging anyone unfortunate enough to have one of these?

isn't it then just cash that you can take without touching?

It's not a keyfob, it's built into the card itself.

The security measures are pretty good actually:

- Can't pay for things costing more than £20 via contactless (have to use chip and pin, the 'normal'/old method)

- After a certain number of continuous contactless payments, it will ask you for your PIN to verify the cardholder is still in possession of the card. This 'counter' is reset to 0 every time you pay for using Chip and PIN. E.g. if you alternate between contactless and Chip and PIN, you'll never have to enter your PIN for the contactless payment.

- If your card does get skimmed, your bank will cover you for any losses.

Skimming is possible yes, but you really have to be pretty close (the article is the exception here, not the norm). Within a few cm of the card, which it's certainly possible to skim someone's card - the person would almost certainly notice.

Actually, it's impossible to skim anyone with a regular reader. Because NFC cards are active, they need to receive a decryption key from the terminal first, before they broadcast their own data. Commercial readers are not able to read bank cards, they mostly show the card's type,and that's it, every memory bank is marked as private and cannot be read without the authorization key. So a skimmer would need to use an actual payment terminal obtained from a bank, and only such terminal would be able to read and charge money from contactless cards. But to get such a terminal,you would need to register with a bank and would be super easy to trace down.

That's interesting. Apparently that certainly wasn't the case previously: http://www.forbes.com/sites/andygreenberg/2012/01/30/hackers...

http://www.v3.co.uk/v3-uk/news/2163404/researchers-punch-hol...

Yes, absolutely. Read the article though - she read an RFID card, which yes, can be read by anyone,using any reader available on the marker. This is NOT how new contactless cards are implemented - new ones use NFC for active transmission, which requires a valid authorization key to release their details. With RFID she could've read anything she wanted from these cards.

So how shops do it? What is the thing that makes it possible for a shop to charge you for grocery while making it impossible for someone to skim you on the bus with a shop terminal?

(serious question)

Shops have proper authorized terminals, that have authentication keys. The terminal sends the key to the card, then the chip on the card replies with its own details. You cannot read bank cards with commercial NFC readers that you can just buy.

If you manage to get a proper shop terminal(which are only given to proper registered businesses) then yes, you could theoretically skim peoples' cards in a bus or any other public place. The only problem with that is, that you can only charge at most 15 quid, and you cannot get the card details back, so you can't use it for internet payments. And because the bank has your details they can very very quickly track the payments back to you and stop you from stealing money(and not even pay out any money to your account). So yes, the trouble is completely not worth it, which is why probably no one will do that.