Toggle Main Menu Toggle Search

Open Access padlockePrints

Risks of Offline Verify PIN on Contactless Cards

Lookup NU author(s): Dr Martin Emms, Dr Leonardus Arief, Professor Aad van Moorsel



Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.

Publication metadata

Author(s): Emms M, Arief B, Little N, van Moorsel A

Publication type: Report

Publication status: Published

Series Title: School of Computing Science Technical Report Series

Year: 2013

Pages: 11

Print publication date: 01/02/2013

Source Publication Date: February 2013

Report Number: 1369

Institution: School of Computing Science, University of Newcastle upon Tyne

Place Published: Newcastle upon Tyne