How susceptible to fraud are contactless payment cards?

According to new research by the consumer watchdog Which? and cited by online media outlet Telegraph UK, contactless payment cards were used more than 1 billion times during 2014-2015 in Europe, but they can be easily and cheaply exploited for fraud when using inappropriate card readers.

Researchers have used inexpensive card-reading technology purchased from a mainstream website and were able to bypass security measures and remotely steal key details from 10 contactless cards. The information they manage to steal included the card number, expiry date and a list of the last 10 transactions carried out on the card. However, none of the cards revealed their CVV security codes.

Although it is difficult to make online purchases without the cardholders name and CVV code, the researchers succeeded to order two items – including a GBP 3,000 TV – from a mainstream online shop using the ‘stolen’ card details, combined with a false name and address.

Security features like Verified by Visa and MasterCard SecureCode help to ensure that fraudsters can’t easily use the cards they steal, but Which?s tests suggest that some online shops sacrifice financial security in favour of an easier checkout.

Peter Eisenegger, a security expert who helped develop European standards for contactless cards, warned that it may be possible for criminals to obtain card readers that can read details from further away than the one in the Which? test.

Official fraud figures for contactless cards show losses attributable to contactless fraud are less than 1p per GBP 100. However, a spokesperson for the UK Cards Association admitted that, although levels of encryption have increased, it is still possible for card details to be read remotely.

Which? added that it is difficult to know the true scale of theft via contactless readers, as it is almost impossible for the victim to know whether their card details had been lifted this way.