First Contact - Vulnerabilities in Contactless Payments
summary
Research demonstrates practical bypasses of contactless verification by manipulating EMV fields and modes, including bypass PIN by changing CTQ/TTQ and pretending to be a mobile wallet, implemented with NFC readers and an EMV card simulator. Tests cover ~57 Visa and Mastercard cards across regions and identify ~30 banks vulnerable to replay cryptogram attacks and other CVM downgrades. Mastercard often enforces CDA while Visa commonly omits it; several banks remediate after disclosure but many still accept forged transactions.
AI-written summary · about
chapters (13)
- 0:00Start
- 3:50CONTACTLESS, A MODERN FORM OF PAYMENT?
- 9:10ARE PAYMENTS STANDARDIZED?
- 11:20FORMAT OF COMMUNICATION
- 12:58Reading The PPSF
- 13:41Card responds with AID
- 14:14Terminal selects AID
- 14:27Card provides PDOL
- 15:02Terminal sends requested data
- 15:43Card provides Application Cryptogram
- 16:37Terminal conducts risk analysis
- 27:29CONTACTLESS FRAUD
- 36:54BLAME GAME
related talks
59mHow Smartcard Payment Systems Fail
23mAll Your Payment Tokens Are Mine: Vulnerabilities of Mobile Payment Systems
34mJourney to the Heart of Contactless Payment
38mMission mPOSsible
23mPoint of Sale System Architecture and Security
24mSeamless and Secure: The Rise of Payment Passkeys
35mEveryone can see your credit card details
32mSecurity horror stories in payments