COMPUTING SCIENCE Risks of Offline Verify PIN on Contactless Cards

Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder. © 2013 Newcastle University. Printed and published by Newcastle University, Computing Science, Claremont Tower, Claremont Road, Newcastle upon Tyne, NE1 7RU, England. Bibliographical details EMMS, M., ARIEF, B., LITTLE, N., VAN MOORSEL, A. Risks of Offline Verify PIN on Contactless Cards [By] M. Emms, B. Arief, N. Little, A. van Moorsel Newcastle upon Tyne: Newcastle University: Computing Science, 2013. (Newcastle University, Computing Science, Technical Report Series, No. CS-TR-1369)