Toggle Main Menu Toggle Search

Open Access padlockePrints

Risks of Offline Verify PIN on Contactless Cards

Lookup NU author(s): Dr Martin Emms, Dr Leonardus Arief, Professor Aad van Moorsel



Contactless card payments are being introduced around the world allowing customers to use a card to pay for small purchases by simply placing the card onto the Point of Sale terminal. Contactless transactions do not require verification of the cardholder’s PIN. However our research has found the redundant verify PIN functionality is present on the most commonly issued contactless credit and debit cards currently in circulation in the UK. This paper presents a plausible attack scenario which exploits contactless verify PIN to give unlimited attempts to guess the cardholder’s PIN without their knowledge. It also gives experimental data to demonstrate the practical viability of the attack as well as references to support our argument that contactless verify PIN is redundant functionality which compromises the security of payment cards and the cardholder.

Publication metadata

Author(s): Arief B; van Moorsel A; Emms M; Little N

Editor(s): Ahmad-Reza Sadeghi

Publication type: Book Chapter

Publication status: Published

Book Title: Financial Cryptography and Data Security

Year: 2013

Volume: LNCS 7859

Pages: 313-321

Series Title: Lecture Notes in Computer Science: Security and Cryptology

Publisher: Springer Berlin Heidelberg

Place Published: Berlin


DOI: 10.1007/978-3-642-39884-1_26

Notes: Presented at: 17th International Conference, FC 2013, Okinawa, Japan, April 1-5, 2013, Revised Selected Papers.

Library holdings: Search Newcastle University Library for this item

ISBN: 9783642398834