Fast … but is it secure?

As anyone who reads the IT press knows, some security measures have been introduced in the UK to make online banking safer. And now there’s an interesting little story where APACS, the UK payments association, announces that UK banks are to introduce ‘contactless’ payments. If a transaction is under £10, customers will be able to simply hold their credit or debit card up to a secure reader: no signature or PIN required.

According to the APACS press release, ‘Contactless cards provide customers with a fast, effective, easy-to-use alternative to cash, building on the same highly secure technology of chip and PIN cards’.

This system may prove fast, effective and easy-to-use, but I don’t see how it builds on chip-and-PIN! The only security safeguard, it seems, is a request for a PIN number every so often or after any ‘suspicious’ activity. That’s something, but it doesn’t add up to real security.

Although the value of the transactions will be limited, I don’t think that this will necessarily deter criminals. If they want my card anyway, surely this is just a bigger incentive? Also, if it’s possible for an instore device to read the card, where’s the guarantee that a hand held reader operated by a criminal standing nearby won’t be able to access the same data?