Four measures to ensure the security of RFID credit cards

Worries about RFID security are not new. However, when American Express and Chase began issuing RFID-enabled credit cards in 2005, these concerns grew. When researchers at the University of Massachusetts announced in October 2006 that they had broken through the security features of credit card RFID, this concern was further escalated.

RFID use

So far, RFID chips have only been used for labels for commodities, shipping containers and livestock. These chiplets can transmit data about the product of the tag to a card reader that records this data via radio signals. The application of RFID has its own benefits. One benefit is that containers with RFID capabilities can automatically track inventory. Since the RFID system automatically transfers the data to the supply chain management system, the goods no longer need to be manually registered. However, this technique also provides the same convenience for thieves. Thieves can use RFID security loopholes to deceive shipping products or track the shipping products themselves in order to steal labeled goods.

RFID security concerns

Because RFID is embedded in some credit cards, this opens the door to credit card fraud. Security and privacy experts say their biggest concern is that RFID cards can openly "distribute" personal information in the air. Some people worry that some malicious users can make a card reader to steal credit card numbers, even if they put the credit card safely in their pockets.

The findings of the University of Massachusetts are not helpful. In one experiment, the school "sniffed" the user name and account number of a credit card with an embedded RFID chip using only a $ 150 home-made device. In order to eliminate this concern, the credit card company responded by refuting these findings.

First, credit card companies argue that their customer information is fully protected. They said that the RFID signal is encrypted with 128 bits, and the actual user name and card number are not transmitted. Instead, their facility uses a pseudo-number that can be translated into user account information in the process of processing credit card business. However, the researchers countered that they checked Visa's credit card, Master's "OneSmart" card and American Express ExpressPay's credit card, all of which issued unencrypted user names and account numbers.

Then, these credit card companies claimed that the 20 research samples (only 20 cards) used by the researchers were too few. They have not received any reports of such attacks so far, nor have they seen the equipment made by the researchers. However, this kind of vague security. Ambiguous security is unsafe.

RFID security challenges

However, the RFID chip in the credit card itself has some security problems that need to be understood. RFID chips are very small, as are memory and storage capacity. This limits the number of digits and encryption keys it can hold, making it difficult to implement things like public key exchange for strong encryption.

Another helpful thing is that most RFID chips are static. The small capacity of this chip makes it difficult to make a programmable chip that can be fine-tuned. Once the information is burned into the chip, the data in the chip cannot be changed. Some chips have limited remote programming capabilities. However, such chips are rare.

Keeping RFID credit cards safe: best practices

Don't study this argument further, let's study some best practices for protecting the security of RFID credit cards. Unfortunately, for many consumers with such credit cards, there are not many protective measures, because the security measures of these credit cards are still immature. Carrying a credit card in a box capable of blocking radio signals is unrealistic for most users, and it is also unrealistic to use a knife to remove the RFID chip from the credit card.

However, it is still possible to see if this kind of credit card can meet certain minimum security requirements before filling out the application form. Before signing the agreement, RFID credit card applicants should ask the card issuer four questions:

1. What data is actually sent? Is the credit card number or a fake number representing the credit card sent? The RFID chip can be programmed to send a fake number that matches the account number on the back-end system of the card processor. If this fake number is sniffed by someone, the number is useless for credit card thieves.

2. Is the data sent from the credit card encrypted? If it is encrypted, what is its length? If the credit card sends the user ’s real information, including the cardholder ’s name, account number, and expiration time, then all the data must Transmit in an encrypted manner. Strong encryption measures should be used, at least 128 bits.

3. How far can the credit card data be sent? The data transmission distance of the RFID chip can only be a few feet and cannot be transmitted outside the parking lot. The shorter the transmission distance, the lower the risk of maliciously capturing this data.

4. Does this credit card issuer have a back-end anti-fraud system? Check if this issuer uses a fraud detection system similar to Fair Issac's "Falcon Fraud Manager" (Falcon Fraud Manager). This system cannot protect the data loss of the credit card itself, but it can prevent fraudulent transactions using maliciously stolen data from RFID credit cards.

Remember, RFID credit card security is still evolving. Although these suggestions cannot provide overall RFID security, these suggestions can provide cardholders with some control methods and protective measures to mitigate threats.