Digital pickpockets using smartphones to steal credit cards

Digital pickpockets using smartphones to steal credit cards »Play Video


To understand how it's done, you need to understand our attraction to speed and convenience.

In an effort to speed up credit card transactions at the cash register, major credit card companies have adopted a "contactless" payment systems like MasterCard's Paypass. It relies on radio frequency identification or RFID technology. RFID enabled credit cards are embedded with a hidden microchip that stores all the account information necessary to complete a transaction.

It's the same information on a card's magnetic strip. The difference is how it's communicated during the transaction. The RFID enable card uses a hidden antenna to broadcast the information to an electronic credit card reader. The user completes the transaction by tapping the card over and electronic reader at the register. With the traditional card swipe, the account information is read off the magnetic strip.

Now smartphone manufacturers, including Samsung, Nokia, Motorola, LG and HTC are releasing phones that are "NFC" or Near Field Communications enabled. NFC is form of RFID technology that takes advantage of both transmitting and receiving data via the smartphone.


Enter the hackers or code writers (depending on your point of view) who have not only written software to make the credit card info meaning meaningful, but software that leverages the smartphone's ability to use NFC to transmit data to an electronic reader.

For years, digital pickpockets have built RFID readers that can electronically sniff someone's wallet or purse for account information embedded on an RFID enabled credit card. That step has all but been eliminated by the cell phone manufacturers. The newest versions of Android smartphones have the hardware to do the same thing and more.




KOMO News has elected not to name the application or the firmware modification because we don't want to encourage others to do this behavior.

We visited eight Seattle area stores that were equipped to accept a contactless payment system like Paypass with and without the store's knowledge. The Problem Solvers were able to use a variety of credit card numbers that had been scanned into the phone as if they were stolen by digital pickpocket.


"That's frightening" says Robbie Watson of Zelo Bike Shop after we showed him how I used a credit card that wasn't my own to make a purchase at his store. Since the electronic transaction doesn't include the cardholder's name, there was no way for Watson to verify the account number I was using was actually mine.

"Even if you showed me your ID, I couldn't verify the account," said Watson. "There's something not right about this"

At Seattle Cigar and Tobacco, owner Naeen Ahmad realized the same problem when we showed him how we used the phone in his store. There's no way to verify the info broadcast by the phone to the reader is my credit card.

"I think it's very dangerous, extremely dangerous. It's like anybody's credit cards are not protected anymore," said Ahmad.

Security consultant Steve Manzuik believes it's going to fall on the credit card industry to make contactless transactions more secure.

"It's a feature that hasn't been very well thought out," said Manzuik, who works with Leviathan Security Group, a Seattle firm that works with corporations on fixing their computer security breaches.

"The payment card industry wanted to speed things up a little and make it much faster for people to buy things," said Manzuik. "They are moving to this standard, which clearly isn't as secure."

MasterCard Worldwide says it's aware of the situation we were testing.

"The circumstances under which it can occur in the real world are extremely rare," MasterCard spokeswoman Beth Kitchner said in a written statement.

"We don't consider this to be a serious threat to our cardholders. MasterCard strives to stay far ahead of fraud. However if even one cardholder is impacted, we have a zero liability policy," Manzuik said.

Nobody is going to buy a phone and be able to start scanning credit cards in an hour says Manzuik. But if you have the technical ability, it's not that hard to figure out.


"It's the fact that they are doing it insecurely, that's the problem," Manzuik said.

There is now a cottage business growing on the internet of devices to protect credit cards, driver's licenses and passports embedded with microchips from the electronic sniffing of an RFID reader. Most products consist of foil lined wallets and sleeves.

