Is Your 'Contactless' Credit Card Secure?

You have probably noticed that most retail establishments now have you swipe your own credit card. That is based, at least in part, on a goal to never have your card leave your possession for security reasons. Of course, who knows what happens or who records the information from your credit card everytime you give it to a waiter or waitress at a restaurant...but that is another story. The newer trend is 'contactless' credit cards that don't even need to be swiped. They only need to be waved in the proximity of the reader.

This is accomplished using RFID chip technology. The RFID chip contains your credit card information, and the scanner is an RFID scanner that can capture that information. It is a little like wireless network technology though. What about others in close proximity? If the retail scanner can pick up your credit card info from 6 inches away, then couldn't any attacker with a pocket-sized RFID scanner that manages to get within 6 inches of your wallet do the same thing?

The Discovery show Mythbusters attempted to examine this very issue. However, according to co-host Adam Savage (as quoted in this article from The Register), when the Mythbusters team set up a meeting with Texas Instruments to get more information about the RFID technology and how it is protected, they were blindsided with an army of credit card industry lawayers. Savage says "they [MythBusters production team] were way, way outgunned and they [lawyers] made it really clear to Discovery that they were not going to air this episode talking about how hackable this stuff was."

So, we apparently won't get to see the Mythbusters episode, but is the implication of this strong-arm legal censorship that your contactless credit card is not secure? Do Visa, Mastercard, and American Express think that attackers can't figure this stuff out unless they see it on Mythbusters? In the wake of Savage's statement though, there has been some contention about the facts, and this recent story seems to tell a different story about the legal pressure. The bottom line? Are we sure that 'contactless' credit card data can't be intercepted by attackers?