Effectively those constitutes similar risks: (temporarily) loosing control of card data (doing so online is an entirely different discussion). I consider the biggest risks to be those factors that I don't know about - if I can see it, hold it, control it, etc, then I can do something about it; that's what bugs me about radio.
The difference is that, when handing a card over to a clerk, you usually get to see the individual & keep an eye on your card (most of the time), and nowadays we're offered the device itself that we can swipe/slot the card in & PIN/sign, so actually handing a card over is becoming less of an issue.
I've done a real-world test with my own NFC-enabled mobile & this card, simulating the card in my wallet in my right jean pocket & someone (wife/brother/dog/whatever) sitting next in a seat to me with the mobile in their left - you can get real close in situations like a rush-hour bus, crammed office elevator, cinema, busy pub or event queue.
You actually go to shops that allow you to swipe the card yourself? Personally I find places that allow customer swipe/card insertion to be in the minority. Almost every place I go it's all "doesn't work in there I have to swipe it here". It's ludicrous. And I indicated as much in the handy survey that I got sent by Colmar Brunton about payment experience. How timely.
But in terms of the NFC and what not... my understanding is that the card draws power from the NFC field, so you'd have to be either close enough for a low power device to pick it up (relatively unlikely) or they have to have a device broadcasting with a lot of power (even less likely). And even if they can pick it up, it's not like the card just broadcasts it's number and PIN details - they'd basically have to pretend to be a payment terminal and process a transaction, but even then that still isn't enough since the communications would only be valid for that one fake transaction - you couldn't do a replay attack since the encrypted data would be useless.
I think perhaps you're being way too paranoid about a situation that ultimately is very, VERY unlikely.
Kyanar: You actually go to shops that allow you to swipe the card yourself? Personally I find places that allow customer swipe/card insertion to be in the minority. Almost every place I go it's all "doesn't work in there I have to swipe it here". It's ludicrous. And I indicated as much in the handy survey that I got sent by Colmar Brunton about payment experience. How timely.
The requirement for all terminals to have pinpads that support customers swiping/inserting their own cards was originally going to occur in the June 2011 cutoff, but it seems that this was never implimented because there would have been issues with all in one terminals that would have required an exception.
With EMV6 this is mandatory (with the exception of all in one terminals) so we'll see that occur in June 2014 when every EMV5.x terminal is cut off the network, and it's expected that every terminal will also have to ny NFC capable for this deadline also.
Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly
to your computer or smartphone by using a feed reader.
Trusted
Retired Mod
Biddle Corp
