At a recent conference, security researcher Kristin Paget showed how to create counterfeit credit cards by sniffing RFID info from a volunteer’s existing card. As Forbes reports:
With a Vivotech RFID credit card reader she bought on eBay for $50, Paget wirelessly read a volunteer’s credit card onstage and obtained the card’s number and expiration date, along with the one-time CVV number used by contactless cards to authenticate payments. A second later, she used a $300 card-magnetizing tool to encode that data onto a blank card. And then, with a Square attachment for the iPhone that allows anyone to swipe a card and receive payments, she paid herself $15 of the volunteer’s money with the counterfeit card she’d just created. (She also handed the volunteer a twenty dollar bill, essentially selling the bill on stage for $15 to avoid any charges of illegal fraud.)
Paget notably doesn’t need to actually swipe the card to grab the data; the RFID chips can be read at short distances without the cardholder knowing. As the Forbes article points out, there are about 100 million RFID-equipped cards in circulation, including MasterCard’s PayPass and American Express’s ExpressPay.
[via Slashdot]