NFC Payment & Security Threats

Abstract

This thesis goes through the known methods of NFC utilising contactless payment and the security issues and threats of each specific device or method. The thesis will cover the known in use devices in Finland and the methods for each device. The technology and origins of NFC is also explained in detail, as well as the protocols standards and Android development tools constantly keeping in focus the aspects that affect security. The thesis also includes two researches and the goal of the thesis is to map the security threats there are in NFC utilising contactless payment.

This thesis is conducted without a financial supporter, but the results will be forwarded to any party that might benefit from the results of the research.

The thesis does not handle or analyse any other forms of contactless payment other than those that utilise NFC technology. This means that even though some applications i.e. Mobile Pay are mentioned, they are not analysed or taken in count when defining the results of the research.

The sources and materials used in this thesis consists of previous studies, tests and articles, technology and component descriptions, a survey conducted via internet survey platform and personal tests and reports. Unfortunately, no reliable book source on the subject is available (for the information is either expired or irrelevant for this thesis). I have also used statements of bank personnel and representatives that have commented on NFC security issues during the last few years.

Research indicated that are some serious security threats in contactless payment methods that are not that well known for the public and for banks. There might be a possibility that some risks are known by banks and card companies but are chosen to be left uncommented for there are no easy answers. It was also found out that even though your “ordinary user” is not aware of the specific threats and factors, contactless payment is still not thought of as a 100% safe option but rather a concerningly unsecure one. The comments from bank representatives also revealed little about the safety aspect knowledge of the banks.

For the question, what can be done to prevent falling a victim to the explained attack scenarios in this thesis I found out some answers, but most of the results depend on either personal awareness or physical protection. The application side, as in any type of IT-security is hard to develop because the faster development of exploitation schemes in correlation to security solutions