Skip to main content

The Dangers of Verify PIN on Contactless Cards

Emms, Martin and Arief, Budi and Defty, Troy and Hannon, Joseph and Hao, Feng and van Moorsel, Aad (2012) The Dangers of Verify PIN on Contactless Cards. Technical report. CS-TR-1332 (KAR id:58711)

PDF Author's Accepted Manuscript
Language: English
Download (1MB) Preview
[thumbnail of TR1332.pdf]
This file may not be suitable for users of assistive technology.
Request an accessible format


Contactless / Near Field Communication (NFC) card payments are being introduced around the world, allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Although the terminal needs to be able to verify a PIN, it is not clear if such PIN verification features should be available on the NFC card itself. We show that contactless Visa payment cards have (largely redundant) functionality, Verify PIN, which makes them vulnerable to new forms of wireless attack. Based on careful examination of the Europay, MasterCard and Visa (EMV) protocol and experiments with the Visa fast Dynamic Data Authentication transaction protocol, we provide a set of building blocks for possible attacks. These building blocks are data skimming, Verify PIN and transaction relay, which we implement and experiment with. Based on these building blocks, we propose a number of realistic attacks, including a denial-of-service attack and a newly developed realistic PIN guessing attack. The conclusion of our work is that implementing Verify PIN functionality on NFC cards has no demonstrated benefits and opens up new avenues of attack.

Item Type: Monograph (Technical report)
Uncontrolled keywords: Security attacks; NFC; EMV; Visa; fDDA; Chip & PIN; skimming; Verify PIN; relay; payments; credit card; debit card.
Subjects: Q Science > QA Mathematics (inc Computing science)
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
Depositing User: Budi Arief
Date Deposited: 17 Nov 2016 10:12 UTC
Last Modified: 16 Nov 2021 10:23 UTC
Resource URI: (The current URI for this page, for reference purposes)
Arief, Budi:
  • Depositors only (login required):


Downloads per month over past year