Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN

Abstract

In this paper we present an attack, which allows fraudulent transactions to be collected from EMV contactless credit and debit cards without the knowledge of the cardholder. The attack exploits a previously unreported vulnerability in EMV protocol, which allows EMV contactless cards to approve unlimited value transactions without the cardholder's PIN when the transaction is carried out in a foreign currency. For example, we have found that Visa credit cards will approve foreign currency transactions for any amount up to €999,999.99 without the cardholder's PIN, this side-steps the £20 contactless transaction limit in the UK. This paper outlines our analysis methodology that identified the flaw in the EMV protocol, and presents a scenario in which fraudulent transaction details are transmitted over the Internet to a "rogue merchant" who then uses the transaction data to take money from the victim's account. In reality, the criminals would choose a value between €100 and €200, which is low enough to be within the victim's balance and not to raise suspicion, but high enough to make each attack worthwhile. The attack is novel in that it could be operated on a large scale with multiple attackers collecting fraudulent transactions for a central rogue merchant which can be located anywhere in the world where EMV payments are accepted.

Relay Cost Bounding for Contactless EMV Payments

“…Therefore the attacker will have more opportunities to perform the attack and it will be less clear for the user that anything is going on. That such attacks are possible using cheap hardware, namely mobile phones, has been demonstrated in, for example, [17,11,12,20].…”

The Applicability of Ambient Sensors as Proximity Evidence for NFC Transactions

“…From the banking sector's point of view, this time limit will be reduced gradually to 400ms from 2016 onward [14,17,18]. For transport-related transactions, the performance requirements are stricter, where transaction times should not exceed 300ms [18,19].…”

A Methodology for Protocol Verification Applied to EMV® 1

“…In principle, payment protocols are designed to be secure, with adequate and effective cryptographic methods employed to ensure confidentiality, integrity, authentication, identification, etc. In practice, relevant attacks [9,17,19,18] still occur in the industry, with financial fraud related to payment systems rising in the last few years: for example, in the UK, there has been a 80 percent increase in value of losses between 2011 and 2016, when the fraud losses were £618 million [24].…”

“…The discovery in [39] allows attackers to buy goods from retailers, whereas the discovery in [9] allows attackers to extract money from the victim's account. Relay attacks [17,18] allow fraudulent transactions to be collected from contactless cards without the knowledge of the cardholder. In the area of formal methods, the first comprehensive formal description of EMV [15] used an F# model translated to Applied-pi [6], in order to make it amenable for analysis with the ProVerif verifier [7].…”

“…Other works [10,30] have analysed cryptographic aspects, focusing on protocols for secure key agreement and channel establishment. Finally, we worked on a Z encoding of Kernel 3 [25] that lead to new discoveries [18,20].…”