RFID Credit Card Numbers easily read off cards and cloned to hotel room key.

Just saw this video which was posted on Reddit.

In summary, RFID card readers can be bought cheaply on the web/eBay. By just swiping the machine near a card, he was able to pick up their credit card number and expiry date. With yet another cheaply bought machine he was able to clone that information onto a hotel room keycard and use the keycard to buy things in store.

In this case a tin foil hat (or aluminum) works to block the RFID.

However, looking in the comments on Reddit:

This only works for non-EMV cards, as the information that gets sent over RFID is the same that is stored on the Mag Stripe. They do that so the existing infrastructure doesn't need to get changed much.

With EMV-compliant cards, this attack isn't possible. EMV gets used nearly everywhere except in the United States.

Based on that comment, should we not be worrying about this?

Comments

  • Based on that comment, should we not be worrying about this?

    In short, No. You can't use it for online transactions and you can't use it in store here (or almost anywhere else).

    These days the attitude is that the number and expiry date are (more or less) public information, and the CCV/EMV validation are for authentication.

    There might be some places you could try to buy things over the phone without a CCV still, not sure.

    Note that this also is information that any store person you hand your card to has.

    • Yes with CCV. And magnetic stripes need to go. But for now excuse me I'm going to make a tin-foil condom for my paywave cards…

  • The cloner machine is "a rogue terminal"

  • I keep my Visa card in a wallet which blocks the signal anyway, so the opportunities for skimming it would be very limited.

Login or Join to leave a comment