Be Excellent To Each Other

So a post popped up on my Facebook feed the other showing a picture of a guy on a train clutching one of those portable electronic PoS things in his hand. Y'know the things, the waiter brings then over to your table if you're paying by card and it talks back to the central restaurant till system by Bluetooth or whatever. The content of the post claimed this guy was going round entering a sub-£30 amount on the terminal then holding it up to people's pockets and essentially stealing money via their contactless bank cards. The poster backed up their own claim by saying they'd tried it out with their local pub's system and it worked as described.

Now, obviously there's quite a few problems with the scenario as described and this specific example is almost certainly bullshit (the biggest red flag, of course, being the fact it's being circulated on fucking Facebook) but with certain things setup in advance the general idea didn't seem impossible. Which makes me think I'm missing something here because it surely can't be A Thing. So, here's the setup I was thinking of; what have I completely missed that makes it impossible?

• Firstly you'd need to be setup as an actual payment received somehow, it's not like those little handsets just spit out tenners from the side. I'm not convinced that would be too difficult though given the solutions doing the rounds that let people set themselves up to see artwork and whatnot they've made. As an example I'm thinking of that Square mob who will let you setup as a payment received for your small business using an app that runs on a tablet. Obviously at some point people are going to notice fraudulent transactions and start complaining to their bank and you're likely to get shut down but couldn't you make enough money in the interim to make it worth it?
• Second is the actual handset. The guy talking about how he 'proved' all this by testing it in his local pub is a fanny because of course that worked; he was using a dumb handset that was within communication distanct with the central till system that's doing all the actual work. Take that handset next door and it all falls apart. However you do get such things that come with a SIM card and communicate over the internet so would allow all this to work where ever you were. Well, I'm thinking of the ticket issuing machines train guards have up here and the card machines some taxis now which is presumably the same thing?
• Finally there's the local conditions to worry about. Apparently if you have multiple contactless cards near each other the reader just picks up a load of jumbled nonsense so you'd need to target someone with only one contactless card in their wallet. Hit enough people and that's probably not a problem. You'd also need to get close enough to the card. Obviously there's a max range here but surely that's smaller than the width of someone's wallet + the fabric of their trousers? On a busy tube train or whatever I don't imagine it would be difficult to subtly get the card reader up to and even touching someone's pocket.

Thoughts/criticisms/general abuse at my ignorance?

Yeah, the main issue is actually getting a way to receive the cash. Any old idiot can buy the card reader. Any reputable merchant would soon put a stop to any account being used in this manner.

It isn't theoretical. Charity collectors use them now, as people don't carry cash. I seem to recall that they collate the charges and bulk dump the collection later on.

As Myp says however, you've got to get the funds out of the recipients bank account. My guess is that whoever is issuing the card readers has a legal responsibility to ensure that they're legit people.

Would you be able to set up wifi sharing on your phone to connect the handset to the internet? That could be a way around it providing the handset doesn't need a base. I reckon the handsets my indian takeaway use only use the base as a charger. I could be wrong though.

Also, I don't take my card out of my wallet when I touch it on a machine so the range os alright.

Normal terminals have a range of a few centimetres, but the hackers build high gain tunable antennas so get more distance.

It's a thing, but as Myp has said, laundering the money afterwards is very hard because there's a strong paper trial that will at best lead to the charges being clawed back or at worst get you arrested really quickly. Coupled with that, the £30 cap is a strong deterrent. If a credit card skimmer on a cashpoint gets your card, the criminals can spend thousands on easily-resold consumer goods like TVs; £30 is small beans. I've seen infosec groups demonstrate the NFC hack but I haven't heard of any cases in the wild.

If you're very paranoid, people sell wallets with copper weave in the lining, designed to mess up the signal. Personally I think monetising paranoia is much better business than going to all that effort for less than £30 a go.

That would probably work (assuming the handset in question is internet aware and not expecting a local Bluetooth connection to the system as I suspect most of them do). The general problem you're solving there though is 'giving the handset a network connection' and there's umpteen ways round that. As I say, I'm pretty sure you'll be able to get handsets that essentially have a SIM card built in and are capable of phoning home all on their own so I think this is the least of the issues. I only called it out to point out how the guy talking about 'testing' the scenario using his local pub's PoS system wasn't actually testing it at all.

I bought a fantastic wallet with a pouch on the front that I could use for my oyster card, I was well chuffed. The bellends put NFC-blocking weave into the material rendering it completely fucking useless.

Yeah, the chance of this specific Facebook post not having been started by a company selling signal blocking wallet inserts is very close to zero.

There's a company I have my eye on who have told me their next wallet will have NFC blocking material inside but two NFC transparent pockets (one on each side) on the outside. Clearly, this is perfect. One for Oyster, one for bank card, no card clash.

Link me up! Currently I have a middle opening wallet - card on one side, oyster on the other. No card clash, and muscle memory ensures I get the right one.

Interestingly, on the 'card clash' subject, I have my work pass and my contactless debit card in the same place in my wallet but I can still happily get in and out of the building my just holding my wallet up to the reader. Is that likely to be using a different technology or something so there's no confusing overlap of info picked up?

http://thenoduscollection.com/collections/wallets

Maybe only one card pocket now though I'll email my contact there.


Probably. NFC is a confusing mishmash of frequencies, signal strength, and protocols; probably your (proprietary) pass and your bank card are quite different.

Very likely to be, yes. Most(*) systems used for building access use a standard that predates what's used in chip cards and they're not terribly compatible.


*Nope, have nothing to back this up

My phone does nfc apparently. Can I clone cards with it?

No. HTH HAND

Is £55 for a wallet a good price? Don't think I've ever bought one.

That sounds a lot. I have a jimi wallet and it's great. Look them up.

Also, my phone does NFC type stuff but I'm yet to find a use for it.

Watching a friend contort his wrist in an uncomfortable way so he could use his Iwatch to pay for something in a bar made me think that I'll stick with my contactless card for now. I still act surprised when I tap.

Put a card inside your phone case and you've can pay using your phone like all the other kids.

I don't have a contact less cash card

Bonus: if you lose your phone you've also lost your bank card!

Phone case? A case for your phone? You mean my pocket?

Also, if you end up in a place without Contactless, you have to whip your phone case off.

It's fine if you can lift the card reader up to your wrist, or if it's high enough anyway - but if it's not in an optimal position you do like a colossal bellend trying to reach down to it.

You hadn't told me about this preference...

Do you write headlines for Bella?

Don't you know what your fiancée does?

I am not sure *I* know that one...

Also the NFC stuff on your phone stops working!

And I actually use the NFC on my phone to turn my alarm off, so that's even less useful.

This week has taught me that I need to do something similar. I've had some serious getting out of bed issues

GOTO BED HOURS -3

What the shit? That's the worst ever solution!

Yeah, imagine waking up refreshed - awful.

Yeah - refreshed for work. LAME

Mine credible source ('London Skeptics in the pub') has this article linked to from a picture that sounds like the one Bamba mentioned:

https://tweetyaca.wordpress.com/2016/02 ... ard-fraud/

"Most contactless card readers still require connection to a phone line, but some are now available with wifi or GPRS connections. With one of these, the fraud could happen almost anywhere. So should you be worried?
No, not really. Relax. For a few good reasons."

Paypal do a portable card reader that accepts contactless payments. I think they're marketed to stall holders, boot fair sellers, small businesses, so must also be wireless and able to run on 4G/3G data I'd think.

I think there's a lot to be said for the whole "coming to" period that seems to be most of your 30s. Once you get into your 40s, fuhgeddaboutit. So make the most of it before it's gone.

The who with the what now?

I have a tag in the bathroom, and have to scan it to shut my phone alarm up.

The app is called Puzzle Alarm.

ME GRIM...LOCK SOLVE PUZZLE

I asked my wife for a new wallet for Christmas, the one she got me was leather but had some sort of lining in it to stop this "Electronic Pickpocketing" happening according to the bit of paper that was in the box.

Never need my wallet much in the week so don't take it to work, can use Apple Pay for food and drink at work and also for grocery errands my wife might give me in the week, annoying when I want something from say B&Q in the week and I forget that I don't have my cards but just get it the next day

Its pretty crap how many places don't have tap or Apple Pay still, Tesco are the worst offenders

You need a different case! Mine works perfectly to do this both for contactless payment and my Uni pass. I've only taken my phone out to take this photograph.