Flaw Found in Barclays Contactless Card

ViaForensics recently discovered that user data can be stolen from NFC chips in Barclays Visa card without users even knowing about it. The investigation was done in conjunction with Channel 4 News. 

"All I did was I tapped my phone over your wallet and using the wireless reader on the phone I was able to lift out the details from your card," Thomas Cannon of ViaForensics told Channel 4 News. "That includes the long card number, the expiry date and your name. None of it was encrypted, it was simply a case of the details coming out through the air." 

Typically, this would not be enough information to perform "cardholder not present" transactions over the internet or the phone, because most retailers require the three-digit signature (CVV) code from the back of the card and a valid address. However, during the course of the research it was found that there are some major online retailers that do not require this information. 

For example, Channel 4 News was able to create a new account on Amazon's website, with a different name and billing and delivery address to the card they scanned, and was able to order and receive products without any link to the cardholder. Amazon does not require the CVV code on the back of the card to process purchases.

For more information, click here to find out more information. 

Visa Reached Deal with Intel and Vodafone Targeting Mobile Payments

Vodafone plans to install Visa's payWave platform on smartphones that have NFC support. The company will launch the service first in some countries in Europe, including Germany, Netherlands, Spain, Turkey and UK this year.

According to Vodafone CEO Vittorio Colao, "The Vodafone mobile wallet represents the next stage of the smartphone revolution."

The potential benefit for Visa could be huge as currently Vodafone has about 400 million customers in more than 30 countries.

PC Magazine  reported payWave techology is from Oberthur Technologies and Visa signed a deal with the company to allow customer to use their phones to pay for goods and service via NFC. However, there is an interesting twist.

However, Visa will be required to approve individual devices for its payment app, providing an additional factor for consumers to consider when selecting a new phone.

....

Here's how it will work, according to Visa: users will need to purchase an NFC phone from their carrier. That phone will have to be approved by Visa. Then, the consumer will need to contact either their own bank, financial institution, or another service provider, and set up an approved account with Visa. Once that back-end arrangement has been facilitated, the purchase process will be similar to Google Wallet - at the point of sale, the user will enter a PIN, and then Visa will facilitate the payment between the user's account and the retailer.

Greene said that the Visa payWave systems will work with many wallet providers, including Google's own mobile payments solution, Google Wallet. Both Google and Isis, a rival mobile payments system backed by carriers, have committed to a broad rollout in 2012, Greene said, in response to a question about when Visa would roll out its payWave in phones solution.

If you don't like this option, you probably don't have other choices after 2013.

Visa has also set a 2013 deadline to phase out magnetic-striped cards in the U.S.