Think that £30 limit on contactless payments is going to protect you from big thefts? Think again.&nbsp;



<hr class="wp-block-separator"/>



Security researchers have found a way to bypass that limit on Visa cards. Their hack, which isn’t limited to U.K. cards, could let opportunistic crooks drain accounts with a single tap, and they claim they don’t even need to steal the credit card. And little on Visa’s side is being done to address this fresh fraud threat.



Forbes&nbsp;let the researchers—Leigh-Anne Galloway and Tim Yunusov from cybersecurity company Positive Technologies—try it out on a personal Visa card. They extracted three successful payments of £31 ($38). On their own cards they made contactless payments as high as £101, though it’s possible more could be stolen with just a tap.



Their hacks show how contactless fraud could get a lot worse. Typically, if a bank sees multiple £30 contactless payments, the card will cease to work, as fraud detection systems suspect it’s in the hands of a thief. But if it’s possible to make large transactions in one tap, the potential for significant frauds rises.&nbsp;



READ MORE | <a rel="noreferrer noopener" aria-label="Is Forex A Scam Or Money Goals? (opens in a new tab)" href="https://www.forbesafrica.com/investment/2019/04/01/is-forex-a-scam-or-money-goals/" target="_blank">Is Forex A Scam Or Money Goals?</a>



Card thieves can now make larger payments than they could before. But now, they don’t even need to steal the card. Criminals could, for instance, take a payment from a card when the user wasn’t looking with their own mobile payments machine (though a malicious merchant would eventually be caught by banks’ fraud systems if they used the same terminal). 



Or even more dastardly, it’s possible to take a payment reading from a credit card using a mobile phone, send the data to another phone and make a payment on that second device going beyond the limit, the researchers claimed. For the hack to work, all the fraudsters need is to be close to their victim.



“So that means if you found someone’s card or if someone stole your card, they wouldn’t have to know your PIN, they wouldn’t have to impersonate your signature, and they could make a payment for a much higher value,” said Galloway.



There should be some limits on just how much a hacker could steal. Galloway said that while it may be that thieves could go much higher than the £101 they tested, into the hundreds or possibly thousands, fraud detection systems at the banks may be able to spot any wildly high transactions. 



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“What we found is that actually, we can make reasonably high-value payments. So in the U.K., we’re able to make payments of £100 without any detection,” she added.</blockquote>



They’re still testing whether the hack would work elsewhere in the world, but Galloway confirmed it was not limited to a single country. The limit, of course, differs between nations. For instance, in the U.S., it’s considerably higher at $100.



No fix planned?



That doesn’t detract from the finding that the limit set on Visa cards can be broken. But Visa isn’t planning on updating its systems to deal with the hack. The financial industry giant argued that such a hack wouldn’t be likely to occur in the real world as the criminals would need to have their hands on the card and this doesn’t happen frequently.&nbsp;



A spokesperson for the company went as far as to say that despite the research there wasn’t a security problem that needed addressing.



“One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer,” a Visa spokesperson told&nbsp;Forbes, noting that Visa was continually working on improving its fraud detection tech.&nbsp;



“Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world.”



READ MORE| <a rel="noreferrer noopener" aria-label="#30Under30: Technology Category 2019 (opens in a new tab)" href="https://www.forbesafrica.com/30-under-30/2019/07/01/30under30-technology-category-2019/" target="_blank">#30Under30: Technology Category 2019</a>



Galloway disagreed that the fraudster would need to steal the card. As their tests showed, the hacker only needs to get close enough to the victim’s card for a short period of time to take a payment. This kind of “skimming” has long been proven possible, even if it relies on the card owner being caught unawares.



The Visa spokesperson also claimed that Visa’s global contactless fraud rate declined by 33% between 2017 and 2018 and in Europe by 40%. But data from UK Finance shows fraud using contactless caused £19.5 million of losses during 2018, up from £14 million in 2017. 



UK Finance did, however, note this was “low” in light of total spending of £69 billion over the same year. And neither UK finance nor Visa said they’d ever recorded a case of contactless fraud in which the card hadn’t been stolen.



How the contactless hack works



To carry out their hack, the researchers used a specialized piece of hardware to intercept and insert messages in the communications between the card and the reader. For instance, they could tell the card that verification—like a PIN—wasn’t needed, even though the requested amount was more than £30. They then told the terminal that verification has already been made by another means.&nbsp;



The researchers said these checks hadn’t been made mandatory by Visa, as they had been by its rivals. And as banks follow the guidelines laid out by Visa, it could be doing more to address the issue, Galloway said. Though Visa said that card issuers are ultimately responsible for validating transactions.



For the attack using two mobiles, Galloway explained that it was possible to use one smartphone to tap a card and effectively clone it for a short period. That first mobile takes what’s known as a “payment cryptogram” from the card. This is essentially a signature that is supposed to guarantee the authenticity of future payments. 



READ MORE | <a rel="noreferrer noopener" aria-label="Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/01/31/cryptocurrency-thefts-scams-hit-1-7-billion-in-2018-report/" target="_blank">Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report</a>



The cryptogram is sent to the second phone, which simulates the card as if it were making a mobile payment. The hackers can then go beyond the limit by doing the same interception attack as before.



Stephen Ridgway, cofounder and chief technology officer at cybersecurity startup th4ts3cur1ty.company, said that addressing such attacks at a technical level could be problematic. 



“There may be no ‘quick fix’ for this, even if the payment providers mandate authentication for payments over £30, if the card and reader are susceptible to a ‘man-in-the-middle’ attack that tricks the system into believing that authentication has already taken place,” he said.&nbsp;



As for what concerned cardholders can do to protect themselves, keeping cards physically secure is vital. For anyone worried about someone reading their card through their wallet, there are covers that can prevent such “skimming” from working. Ridgway said another cheap solution was to use a phone cover, as they often provide the same protection. And monitoring transactions could help consumers detect fraudulent transactions before banks do.



Improving bank security and fresh new regulation should also improve matters. Ridgway said that should contactless limit bypasses become common, it’s very likely that payment providers will quickly learn to recognize and block them. 



And incoming new EU rules could also prove a boon. From September 2019, banks will need to ensure a PIN is required once total contactless payments exceed a value of £130 or when five contactless transactions have been made in a day.



-Thomas Brewster; Forbes

960×0

Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds

Businessman Looking Secretly to Woman Using Laptop

Is Forex A Scam Or Money Goals?

Entersekt never would have been established in 2007, were it not for the audacious claims by a B.Comm student and the activities of an unknown bank fraudster, which stirred up the emotions of four electronic engineering students: Christiaan Brand, Dewald Nolte, Altus van Tonder and Niel Müller.
The Stellenbosch-based software house is a fast-growing African player, which wants to establish itself in the States, the United Kingdom and beyond. Most of the major South African banking groups have already signed up Entersekt, which has been certified by Visa, MasterCard and American Express to integrate with their 3-D secure payments system. It has become an ally of the domestic banking industry in dealing with online fraudsters.
Bank corruption is one of the principal cyber-crimes in the world. According to the South African Banking Risk Information Centre, the South African banking industry incurred losses of R263.3 million ($29.6 million) in 2009/2010 for card fraud. These fraudulent activities increased by 53% in 2010/2011 to R403.1 million ($45.4 million).
According to Schalk Nolte, chief executive of Entersekt, independent statistics from IT Web show that web phishing in South Africa amounted to R320 million ($36 million) in 2011. In the second half of 2012, bank fraudsters used online banking to harvest around R100 million ($11.3 million) illegally. The country has registered 3% of the world’s phishing activities, while 46% occur in the States and 19% in the United Kingdom.
Dewald Nolte remembers how, during a challenging week filled with tests, a self-assured B.Comm student confronted him and a group of engineers, while they strolled to the Langenhoven Student Centre for a meal.
“Here I am, relaxing, and you poor guys are working so hard but I’m still going to make a fortune, much more than you engineers,” he said.
Nolte, Brand, van Tonder and Müller, who all possessed an entrepreneurial spirit, became more committed to pursuing a successful business career after the encounter. The group met weekly to brainstorm the inception of the right business. Their ‘aha’ moment came through default, not design. Brand’s mother became victim of an online banking fraudster and lost R20,000 ($2,250). Brand couldn’t believe how this was possible in an age of one-time password (OTP) access logins and online security systems.
The four students worked around the clock for over a year in a virtual garage to mastermind Entersekt.
Their enormous investment of time and money to invest seed capital for the establishment of Entersekt, conjures images of Bill Gates, the Beatles and the 10,000-hour rule mentioned by Malcolm Gladwell in Outliers. He claims that 10,000 hours are needed to secure greatness and mastery; Mozart, The Beatles and Gates are some examples. The Beatles performed in Hamburg, Germany over 1,200 times between 1960 to 1964, amassing more than 10,000 hours of playing time. Gates spent 10,000 hours programing on a high-school computer in 1968, aged 13.
The four students amassed their 10,000 hours by developing a prototype, which was conceptualized into a company in 2008. Its revolutionary technology was registered at a patent-office in the same year.
The pioneers needed the intervention of two more leaders to propel the idea from their virtual garage to the commercial marketplace.
Earlier in his career, Schalk Nolte was one of 33 expatriates sent to Nigeria by Vodacom to manage a possible new venture. The deal was eventually scuttled because of shareholder concerns. Twenty eight of the expatriates remained in Nigeria to form a new management company to run V-mobile Nigeria. With Nolte at the helm of network expansion, they grew their clients from 300,000 to a couple of million, while the numbers at the base station increased from 300 to 2,500.
Nolte was approached to join Entersekt, after it had been patented but was not yet commercially formed. He realized that banks wouldn’t do business with a virtual garage start-up.
“We had to establish a presence and an address and the technopark in the technological hub [of Stellenbosch] was appealing,” he says.
Through Schalk Nolte’s acquaintance with Ramzi Mansour of Carita Investments in Nigeria, he set up a meeting in Centurion between Mansour and Dewald Nolte.
“He decided to invest in us not only because of the idea of our business but because of the people. He said he could see the passion in our eyes,” says Dewald Nolte.
Securing the finances was a considerable challenge for the students, who lacked collateral, especially in 2008 when the global recession was in full swing.
“We had to pull through tough times, pay ourselves nothing and invest everything into the seed capital of the company to succeed. In hindsight, it proved to be the right way of doing it,” says Schalk Nolte.
In internet banking a two-factor authentication system is used based on something you know, your username and password, and something you have, a cellphone. Unfortunately, such an authentication system, which relies on browser communication, can be defeated.
In the real world, people are sent a phishing e-mail; if they click on the link, they will get routed to a fake banking website, which fools them into entering their username and password. This fake site, in real time, runs a script and enters the credentials into the real bank account. When the real bank receives the credentials it sends an OTP or asks the user to generate this OTP on the token. When you enter your OTP, it is intercepted by the man in the middle, who now has access to your username, password and OTP.
The beauty of Entersekt’s system, however, is that it uses industry-standard electronic certificates to create a secure out-of-band communication channel, based on mutual authentication between a bank and its customers’ mobile devices, according to Nolte. These certificates are deployed using a light-weight application that is available for hundreds of cellphone models on the iOs, Blackberry, Android Windows Phone and Java platforms. An electronic transaction initiated through any channel (online banking, card-not-present and via the ATM) is sent to the bank customer’s mobile device for confirmation before the transaction takes place.
In the OTP system it goes via the internet, where the fraudsters have access, while this system is beyond the reach of fraudsters as customers respond to real-time requests for transactions by selecting ‘accept’ or ‘reject’. The bank retains control over the process of registering users and all communication is encrypted end-to-end and cannot be intercepted by any other party, says Nolte.
The result is true out-of-brand, two-factor authentication that counters phishing and other kinds of fraud. This system has cut online banking fraud for Entersekt’s clients to zero and annually re-issues certificates per client.
“We have found that our contracts become a net saving for the banks and not a cost increase.
When Entersekt sold their technology to Nedbank, the crime moved to other banks.
“It’s like a burglary in your street. If you increase your security and use more burglar-bars, the criminals might target your next-door neighbors,” he added.
Although the company has established a local footprint—with eight of their 10 clients based in South Africa—it has received international recognition and the demand for its services is growing. Entersekt has patented their technology in the States, United Kingdom, China and India and is aggressively pursuing markets in Nigeria and Kenya.
“We were nominated at the world’s biggest security conference in San Francisco in 2011 as one of the top 10w most innovative companies globally. We are 18 to 24 months ahead of our competitors in terms of technology,” says Nolte.
Protection to safeguard their assets is one thing; expansion to ensure a bigger global presence is a different proposition all together.
“We have a staff presence and a small office in London and we are about to open an office in Atlanta in the States… We have to be where the new ideas, the standards and the concepts are created,” he adds.

Tag: Cyberfraud

FORBES AFRICA SOCIAL MEDIA

Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds

Is Forex A Scam Or Money Goals?

Delete Fraud. Enter.