Why you should keep your NFC debit card in a tinfoil wrapper.

[reddragdiva]

"GREAT NEWS!" said my bank. "WE'RE SENDING YOU A NEW NFC CASH CARD! BUY STUFF WITH JUST A SWIPE, NO PIN! YOU LUCKY THING!"

As a computer professional, I was not entirely thrilled. Not much can be nicked from an Oyster card (which has long been known skimmable), but a bank card is rather a different matter.

And guess what, it's been done: Channel 4 report, researcher's piece with more details. They can get everything off the card except the three-digit security code on the back, and there's enough online retailers (e.g., Amazon) that don't require that. (And though I've yet to see reports, it strikes me as really obvious to skim a card and get an NFC-enabled phone to pretend to be that card. Ker-ching.) The card owner's name is definitely on Barclaybank cards, others may or may not include it.

You can buy expensive anti-skimming wallets (with a wire mesh that forms a Faraday cage) — or you can just give your cash cards a fetching tinfoil hat.

Double layer of tinfoil, folded, about the size of the card. Note wifi symbol on card.

Put your Oyster, which you probably want still skimmable, at the other end of the card wallet from the tinfoil cash card, so that reflections from the tinfoil don't mess up its signal.

The above has worked well for me in practice for the past few weeks — I just keep an eye on which side I swipe on the Oyster reader. The tinfoil absolutely blocks the Oyster, so I'm pretty confident it blocks the cash card.

Edit: American Express Blue cards are also reported to give full customer details, unencrypted. If you have an NFC-capable Android phone, test your card with Electronic Pickpocket. (The crooks already have this app and better ones.) Then call your bank and scream blue murder if usable amounts of personal details are skimmable.

Comments

[quiet000001]

Is that something they're sending out to everyone now, or as your existing card needs to be replaced anyway? Just wondering if I need to watch the mail since sometime the UK-US thing doesn't work so well...

[reddragdiva]

Everyone. "Here's a l33t new card! By the way, your old card's dead, we killed it."

[quiet000001]

Oh joy. They'd better not kill my old one until the new one arrives.

(I'm still cranky because you need some card reader thing to use online banking and do you know how many times I have asked for one to be re-sent since I never got it? No. Neither do I. BECAUSE I HAVE ASKED SO MANY TIMES NOW.) (To be fair, I should just call them sometime, but I tend to not have the energy to deal with the time zones and crap. I JUST WANT A CARD READER THING.)