The Growing Danger of 'Tap and Go' Credit Cards

While this Blog covers technology, this is an entry about the technology behind how products and services are paid for.  For the past few years Canada's banks and other credit card issuers have been issuing credit cards with smart chips in them where the card is inserted into a slot in point of sale terminals and the user keys in their PIN, this has made credit card transactions more convenient, more reliable and most importantly more secure than the older magnetic stripe technology that has been around since the late 1960's.  For one step forward to making credit cards more secure the industry has taken two enormous steps backward.

Another new technology that has appeared called PayPass by MasterCard and PayWave by Visa allow card holders to pay for purchases without signing a credit card slip or punching in a PIN.  Non contact payment systems use a technology called Radio Frequency Identification or RFID to store cardholder information on a microchip embedded in a credit card that can be called up by an RFID reader at a merchant's point of sale system.

The biggest downside to non-contact credit transaction systems is that there is no verification that the person making a purchase is the actual person that the credit card was issued to.  While MasterCard puts a limit of fifty dollars on PayPass transactions and Visa has a twenty five dollar limit on PayWave transactions.  The biggest fault isn't from the use of stolen or somebody's lost card that is found and used by somebody else, it's that RFID technology being in wide spread use.  RFID card readers can be purchased easily and inexpensively.  With minor modification RFID readers can capture information from cards as far as four feet away.  The information from captured credit cards can be recorded and used to produce clone cards.

MasterCards issued through Bank of Montreal or a retail chain in Canada are PayPass enabled, but MasterCards issued through credit unions are not.  Visa cards issued by RBC and TD have PayWave but ScotiaBank and CIBC do not have it.  If you have a credit card that is due for renewal soon ask them for a card that doesn't have PayPass or PayWave.  Some credit card issuers will issue a non RFID credit card upon request but some will not.

The potential for credit fraud from RFID harvesting has already spawned a cottage industry of companies providing metal protective sleeves to put credit cards in when they are not in use.  The metal sleeve keeps the signals from the RFID reader from reaching the credit card. 

Like some other technologies, Non contact credit card transaction were probably put out into the world without being thought out properly.  Until RFID credit cards can be better protected then maybe cardholder should hold off getting RFID credit cards even if it means changing credit cards.