A very interesting story about finding and hacking a ATM Skimmer

mittman said:

Scary stuff.

I can see it being even easier to capture a transaction from a phone pay app.

One thing I have gotten in the habit of doing is changing my PIN every month. Having a rotation of them based on something I can remember instead of just one makes me feel a little safer.

Click to expand...

Engadget's Summary said:

While it remains to be seen if Apple Pay catches on with consumers, there should be no doubt that Apple Pay is an extremely safe way to make a credit card payment. In fact, it's likely much safer than how most users are currently making credit card payments today.

Remember that merchants in an Apple Pay transaction never have access to user credit card information and, as a result, users never have to worry about their information being compromised in a security breach. Further, security at the device level is effectively impenetrable as tokens, along with the encrypted keys responsible for the cryptogram, are all securely stored in the Secure Element.

And as an extra security precaution, iPhone owners will have the ability to unlink or temporarily suspend a token connected to a stolen device, thereby rendering Apple Pay inoperable until the device is retrieved.

So while the Apple Pay user experience has been set up to be impressively simple, there are a myriad of complex safety measures at work behind the scenes to help ensure that sensitive user data remains free from prying eyes. The use of token-based payments is something the banks have been pushing for and something the credit card networks are similarly excited for.

The only variable, really, is how consumers take to it. Safety, though, shouldn't be a concern.

Click to expand...

RollTide1017 said:

If you are talking about something like Apple Pay, then you are wrong. In fact, Apple Pay is probably more secure then actually using your card because the store never sees your actual cc number when using Apple Pay.

...

Click to expand...

mittman said:

Bottom line is that you do not have to have the device to mimic a device. Capturing session data is half the problem. The other half does require a great deal of processing power, but someone will do it.

Click to expand...

RollTide1017 said:

Apple Pay would not work with a mimicked device. Apple Pay uses a secure element which is a physical chip in the iPhone that does all the processing of a payment. The operating system doesn't even have access to the data stored on this chip. The only data passed between this chip and the OS is encrypted with AES-256 and includes a unique ID that changes each time you use Apple Pay. Any session data captured would would be useless as far as Apple Pay is concerned, unless they get a hold of the security element in your iPhone as well. The articles I linked to go over some of this.

In fact your cc number is not even stored on the device. When you add a card to Apple Pay, it contacts the bank and a unique number is created to represent your card and linked to that security element in the phone. A mimicked device wouldn't be able to process a transaction because the authentication keys wouldn't match without that chip. AES has been around since 2001 and hasn't been cracked so a thief is not going to crack those keys. AES-256, according to security experts, would take a billion years to brute force.

Look, I get passionate about this because I think Apple Pay, or a similar system, is the way we will pay for stuff in the future. It is much more secure to use Apple Pay at Best Buy them swiping your card. Could someone find away to compromise it in the future? Possibly, but credit cards have been compromised for decades and folks are still okay with using them. Folks with iPhones should also feel safe using Apple Pay.

I don't know anything about Android Pay security so, that could be a whole different ballgame.

Click to expand...