Why Does My Credit Card Have a Hole in It?

[@ColinRichardson]

How long do you sit there with your arms crossed staring at the camera before you start your "hay everyone"??

[@TarahWheeler]

Approximately 20 seconds.

[@xmikemurphyx]

Yeah, the arm cross and thumbs up are super awkward. Content is good, but he always looks so closed off and unconfident. It always makes me feel like he's talking out of his ass instead of being confident with the material.

[@MachineWashableKatie]

@@xmikemurphyx Who are you, Rivelino?

[@ColinRichardson]

@@xmikemurphyx really? That may be a you problem. I got none of those feelings. I just thought it was funny.

[@zfjames]

@@xmikemurphyx That's just you

[@MSK120]

I actually discovered how to disable RFID/NFC cards the hard way when one day I got the idea, "Hey, what if I hole punch the corner of my badge so I can put it on my keychain?"

[@ThomasBlazon]

Hahaha, I ran into this with smart card access. Our maintenance guys drilled holes in their access cards, to loop a string thru for a lanyard, which nuked the card. So we had to hand out card pouches with lanyards so they would stop punching holes thru the cards.

[@DeviantOllam]

oh we see this all the time, too, with those little lanyard punches

[@chriswitmer9754]

Years back on a cruise they started using tap access cards instead of the mag stripes for the cabin doors and the same thing: people were poking holes with a hold punch to use with a lanyard and locking themselves out of their rooms. Did also see one couple with what I'm sure was a small knitted pouch around their necks to hold their cards, which can only be described as adorable.

[@Steven-dh4oh]

or order the card with the hole already there

[@LenKusov]

Oh yeah, I remember in college when they switched from physical Medeco keys to "tap your school ID to unlock your dorm room" this was a constant occurrence I cut mine out for a lanyard too but I KNEW the ID cards were NFC so I shined a flashlight through mine and found a spot with no antenna traces to cut out with an Xacto knife.

[@tumo07]

Punch the hole further from the edge of the card and it would work

[@JmbFountain]

I think there was a guide in a German tech magazine a while ago on how to disable NFC, and they advised checking with the lamp and then cutting away next to the pads with an exacto knife

[@blerrik]

Or cut into the side (any side) for about 1/4 inch (and use superglue if the cut annoys you). You'll cut through the antenna coil itself. Works just as well since the chip is powered from the coil and a cut coil will not power it enough.

[@mostlybikes]

@@blerrik that's what I did!

[@AlienResidents]

@@blerrik Exactly what I do

[@wobblysauce]

Yep. Just clip the coil

[@matt79de]

Which mag would that be?

[@deimosian]

Also I'm pretty sure Samsung Pay predates Apple Pay, and was significant in that they held the patent on using the wireless charging coil as a magstripe emulating transmitter. Back before NFC payment was ubiquitous and I daily drove a Note5 I would routinely have cashiers say "oh, sorry we don't take Apple Pay" as I held it up to their stripe reader for it to then beep and accept it anyway. It really gave off the "I am a technowizard" vibe.

[@zimpenfish]

The Wikipedia pages have Apple Pay launching 10 months before Samsung Pay - but it's possible that Samsung Pay rolled out in a particular locale before Apple Pay did (e.g. Brazil was 2016 for Samsung but 2018 for Apple.)

[@dfgsdja]

I was using my nexus 5 to pay for things like 8 years ago. I am not sure why everyone thinks apple invented this.

[@andymorris5732]

A few others were in the game before Apple and Samsung. Google Wallet was one of the first mainstream NFC payment services back in 2010 or so. I also remember Isis (cringe… renamed softcard) as being an early NFC payment system. I had a NFC compatible case for my iPhone 5 in 2013, which allowed tap to pay using the Softcard system.

[@Hans-gb4mv]

@@dfgsdja because many people think that Apple invented everything. The GUI, the mouse, the smartphone, ...

[@BenjaminSeuser]

Samsung bought that tech from a company called LoopPay. It was available separate from Samsung phones before it became the basis for Samsung Pay.

[@kellenwalburn5238]

It may be silly, sure. But as someone who hissed at a goose (it hissed at me first) because I wanted to establish dominance and make it move off the sidewalk I was on (I worked), im a firm believer in "it ain't stupid if it works"

[@thygrrr]

That's easy to say for someone with balls the size of Jupiter.

[@firebird77clonefirebird89]

Something can be stupid as hell and still work fine.

[@NithinJune]

Hmmm 🤔 will have to try the goose tip...

[@DoofusZero]

@@NithinJune Hisses at goose...promptly gets ass kicked 🤣🤣

[@kcrtxbw.4349]

The bank not giving out no-tap cards is the real sucker here

[@SamK4074]

I quite like the idea of drilling a hole to disable the antenna. It reminds me of that early Xbox 360 hack that involved carefully drilling into the DVD drive's controller chip to cut a line inside the chip to enable flashing of custom drive firmware that allowed loading of copied discs. Companies even made jigs that sat over the chip, to allow super precise drilling - and if you drilled too deep, or in the wrong spot, you killed the drive.

[@ChristopherHallett]

The first tap-to-pay debit card I got here in Australia in the 2000s was clear plastic on the back, so you could see the little copper wires of the antenna doing laps around the circumference. I don't have any NFC enabled on my phone so I don't need to mod my card.

[@jsfetzik]

I still have an AMEX card like that. You could easily see the antenna. ;-)

[@elvishfiend]

Yeah, same here - a debit card from CommBank that was mostly transparent, you could see the coils, it was pretty cool

[@SierraGolfNiner]

Oh yea. I had the American Express "Blue Cash" card that was transparent way back in the day - you could see the radio loop which was super cool. Maybe like 2004ish? It had chip and NFC capabilities, I assume for international travel reasons because NO WHERE in the US did any of that ever work to my memory.

[@1480-b5g]

oh youre so smart and know everything dont ya? lol so many folks missing the actual point here

[@unitof]

I think N26 did the transparent card for a while too. 2010s minimalism take on 90s transparent plastic everything.

[@amd2800barton]

Also useful for if you want to protect your card from RFID/NFC sniffers paced near payment terminals. An RFID blocking wallet is useful at protecting the cards normally, but won’t protect if the shady gas station attendant hid a reader right under the counter where you remove your card from the shielding of the wallet.

[@jeffbrownstain]

A bump for this comment

[@DeviantOllam]

totally true

[@TheSimoc]

It doesn't need to be an attendant. It can be just another customer in queue with a reader in pocket. Furthermore, if you actually use the contactless payment, ie. are reading the card with the terminal, there's not even need to be in the same queue, because passive reception is possible from fairly long distance in the moment you do the legitimate reading which in that very moment feeds the power to the card. Even though in all other moments the thief would need to be nearer, in order to feed the power for card to operate. Contactless payment cards are among the most severe security disasters of the entire millenium, and the ongoing prevalence of apologist attitude towards that is something I can never really understand. HUGE thanks for Ollam for having deviance to finally call out the issue! Thanks also for calling out the sluggishness of WinBloats 10!

[@GaryMarriott]

This is of course why the banks put an upper limit on tap-to-pay transactions & mostly indemnify customers against tap fraud, being that the amount of loss from fraud is way lower that their additional profit from the feature. BTW if your bank will not indemnify you against tap fraud, go elsewhere if you need this service.

[@GaryMarriott]

@@ts757arse That's inflation for yer, BTW I did some tests a while back with "RFID" shielded wallets, bags etc & although most of them blocked RFID, almost all of them only reduced marginally the reading range of NFC ( I think because its an inductive not radiative process ). Best solution I have found for blocking NFC reads from by wallet is placing all the NFC cards together which seems to prevent most readers getting anything useful.

[@MatthewJamesMullin]

I was worried this was going to be a weird paranoid thing at the start. This is actually really cool. Thanks for the tip!

[@SIGJNF]

Hi Deviant! Indeed, phone-based payments do work even if the device doesn't have connectivity. It's all about the secret token that's needed to perform the handshake between the terminal and the card. I saw a video about the NFC implants and how one KZbinr with such an implant had asked, I think Venmo, for such a secret token, so that he can program it onto his implant and pay with his hand.

[@judgesh]

There's also this great presentation from Leigh-Anne Galloway & Tim Yunusov kzbin.info/www/bejne/j56tZYiCo8iBrck

[@graealex]

I too was sure that the payment and authentication information is just stored in trusted memory, and no actual network is required, at least from the phone. The vendor terminal will still require it, at least for larger values, or if you have exceeded the budget for small payments without authentication.

[@Sycraft]

To add to that, if the phone has network, it'll report the transaction to the bank and if there's a discrepancy, it can be shut down, but if not it'll just wait to report the transaction until it comes back online. There are basically three exchanges that go on: The phone to the terminal, the terminal to the bank, and the phone to the bank. The last one doesn't have to happen right away, it is a check on the first two.

[@mateuszzimon8216]

@@Sycraft My virtual wallet, when tap'd uses GPS on phone to veryficartrion also. U need no less than 30m .

[@TradieTrev]

As an electrician in Australia, my drivers licence has a chip on it no ever uses.... Never got in trouble if it never worked; so we just smash 1000V DC across it with our test tools lol.

[@greatleader4841]

Wait...The drivers licenses have chips in them? Is that all of australia or just your part? im in SA.

[@nimernimer]

@@greatleader4841 we have them in Qld as well

[@mycosys]

@@greatleader4841 no chip in NSW (the main state ;) )

[@TransitAndTeslas]

We just use barcodes in the US. Passports and Passport Cards do have chips and they do scan them.

[@cericat]

@@greatleader4841 Seems to only be QLD.

[@Broadcast1Channel]

Google Wallet, Android pay in 2011 and Apple Pay in 2014 were quite late entry into contactless payment. Contactless (tap and pay) systems have been around since 1995. In the county I'm in we have had contactless bank cards from 2007.

[@eric_d]

I ALWAYS request cards without tap to pay. Most of my banks used to give them to me after a little arguing, but I haven't been able to get one without it for a few years now. I am definitley going to try your trick on my cards from now on.

[@Dee_Just_Dee]

Clever. I have to test a lot of card readers in my line of work, so I soft-disabled the tap on my bank card to avoid making any accidental tap payments. But this is even better.

[@Kinkajou1015]

Android Pay (the predecessor Google Pay) was around in 2012. There was even a promotion to use it where you would get a small credit (it was like 5-10 dollars) to use it. I had used it a few times with my Nexus 7tablet to redeem that credit at McDonalds. Apple Pay didn't roll around till 2 years later in 2014. Regardless, like you I hated that I was thrust into having tap and pay cards because my phone picks them up, but I am not brave enough to try and do what you have done here. I just try and keep my wallet and phone air gapped a few inches.

[@dgwdgw]

Keep fighting the good fight re: which NFC tech came first. I'm super tired of holding out my Android phone at a drive-thru, getting asked if I want to use Apple Pay, and having to say yes because if I say "no, Google Pay", the cashier's head will explode in confusion.

[@toobigtofit3584]

@@dgwdgw To be fair Google's strategy for NFC payments (amongst many other things) was incompetent and ineffective, and they lost any first actor advantage. I had Google Wallet when it was early in its life, on my Galaxy Nexus. You could only use certain Citi credit cards, or fill the account like debit. And then Verizon was doing its best to stifle Google Wallet because they wanted to push their competitor (ISIS, or I think it was called SoftCard before that), so you needed to download an APK if you wanted to use it on a VZW Nexus. Hell, even the name has flip flopped so many times I forget what it's called anymore. I think it went from Google Wallet to Android Pay to Google Pay back to Google Wallet.

[@CrossRoadsOfTime]

I've noticed what I think is a rather big problem with the nfc Google pay, it's no safer then the tap to pay cards are. because I found out you don't need to unlock anything to use tap to pay. you could have your phone set up to require finger/face to unlock the phone, and have the screen off and tap to pay will still work! you'd have to auth twice to see if the payment went though. (once to get into the phone home screen then again to get into the google pay screen) but to actually pay with it you don't need to auth at all. so those remote reader attacks work just as well on a phone with google pay as they do with a regular card with tap to pay.

[@mateuszzimon8216]

@@CrossRoadsOfTime IRC limit is 50USD right into limit where bank can make easy charge back, Also in latest update they require authentication or unlocked device (biometric, or minimum pin u can't use maze to unlock your phone)

[@hbhbhbhb]

I had an indentation made into a access badge once by the card holder, just where the antenna was. Hardly noticeable, killed the NFC entirely

[@yobgodababua1862]

The worst overlap I've experienced was at some European train stations. The turnstiles can both sense NFC and scan a QR code, but if you have your QR code displaying on your NFC enabled phone (because the tickets you have were delivered as a QR code) the phone will pop up your NFC options/wallet when you get too close, hiding the QR code. It took several attempts of trying to sneak up and get the QR code scanned before the NFC could kick in or, in one case, a friendly staff member with a handheld non-NFC scanner to get to my train. All these devices need a simple "stop doing NFC for a minute" switch somewhere...

[@bufordmaddogtannen]

Any android phone have the ability to toggle NFC at will, either through the settings or by defining a quick icon on the swipe menu. Which is exactly what I used before each payment, since sime versions of Google pay would allow payments as long as the screen was on, even with a locked phone.

[@Rindhalu]

As a Capital One rep, I wish I could recommend this video to certain callers. Also wish we were able to request non tap to pay enabled cards still... And no this does not violate any agreement.

[@z00h]

Are the non tap enabled cards not available to regular punters anymore? Or does it depend on the bank?

[@Rindhalu]

@@z00h It is pretty much a requirement these days and actually would cost more for the bank to issue one or the other as stupid as that sounds, so they just issue the one that is tap enabled.

[@AdvancePlays]

In Europe financial institutes need to provide non-contactless cards when requested by the customer. I've worked at 2 now and it's just a simple check box on the systems. I think card production is mostly outsourced to a few big plants that handle multiple banks and societies, so it's not a big imposition for the banks to offer it.

[@Rindhalu]

@@AdvancePlays I am very well aware, but at the same time, we're in the US where things are different.

[@NithinJune]

I mean you’re a rep not a lawyer I wouldn’t make that guarantee lol

[@SkyTechElectronics]

A lot of smaller credit unions are using these new ones where everything including the antenna is under the contact pads. I assume this is just a manufacturing cost thing but it makes disabling the NFC antenna damn near impossible.

[@brodriguez11000]

Might require a pulse laser.

[@chriswitmer9754]

The downside to the "tap and pay" I run into at some frequency is when the POS terminal isn't working with tap and people actually have to put the chip in and can't remember their pin (in Canada we use pin for Debit/creidt transactions almost exclusively).

[@RSterkenburg]

Agreed. Chip and Signature never really existed in Canada, probably because it's nonsensical. Chip and Pin did predate Contactless payment of course. Contactless in common use predated the announcement of Apple Pay by a full 5 years.

[@Icefumy]

That's why in Europe the POS terminal would ask for the PIN after a set number of contactless payments, I believe it was about 3-5 times. Above a certain value it always asks regardless. (I believe mine is set at payments higher than 25€, as far I recall.)

[@ailivac]

Never thought of using a bright light to see where the antenna is. I don't have a need to disable the RFID on any of my cards, but it's still interesting to see. Cards from different banks also seem to us different layouts for the traces. (Also I'm now partially blind from my Nitecore MH12 on full blast accidentally peeking out from behind the edge of a card)

[@allenshepard7992]

Thanks for the video. Norfolk Virginia has issues with people sitting in malls with an oversized antenna pulling $1 and $2 dollar transactions off of NFC cards. They get smart and use an in state but out of city business [ read as out of jurisdiction] address. The people are smart - they move like locus from one mall to another then onto another city. Very troublesome to prosecute. Being able to nuke the antenna and keep the chip is great. Also hearing you say "apple pay is secure" is the good house keeping seal of approval.

[@joshua7551]

I believe you can use Tasker with an NFC trigger to ignore certain NFC tags. I have root on my phone so I'm not sure if that requires privileges but I do recall being able to ignore my work badge when it was picked up by NFC on my phone.

[@nikomo]

My phone will just straight up ignore payment cards. You can open up NFC Tools and read that there is a card there, but it doesn't pop up anything if I'm on the home screen and put the card where the NFC antenna is on the phone.

[@Hans-gb4mv]

But that doesn't solve the issue of a payment terminal reading both the card and the phone.

[@joshua7551]

@@nikomo same. My badge was the only thing that caused issues. I ended up cloningnthe badge and using my phone as my badge in the end but I never really had issues after I set up tasker. My battery was half dead by 11:00 but that wasnt a huge deal

[@elvinhaak]

@VoidField101x Yes, it will make sure that your phone is not freezing below 0 degrees with this nifty automatic heater-system below.

[@BrianG61UK]

Ignoring the card is one thing. However, being able to read other NFC things in the presence of that ignored card is way more difficult, if not impossible.

[@MikrySoft]

For bonus points, figure if you could splice in a tiny switch (maybe just a membrane keypad dome?) back into the antenna, so that it still works when you squeeze it.

[@smokeysify]

Almost like this would be a more secure default for the cards.

[@DomThatDubstep]

A neat idea for regular use but in this case it may not work if the phone case puts too much pressure on the card. Would be cool to cut a slot for a small jumper you can add/remove

[@MikrySoft]

​@@DomThatDubstep 1.2-2.2kg to press the dome should be enough, looking at Snaptron site, especially SQ, F and GX series of domes

[@MikkoRantalainen]

Or just exposed metal plus some foil tape next to the hole and you move the tape whenever you need the antenna?

[@life_with_bernie]

I had a 1970 Plymouth wired up so that the starter relay wouldn't engage unless I shorted two terminals together with my ring. A similar "switch" could be done on the card with two bare pads that a ring could short together while tapping.

[@Dave01Rhodes]

I believe the reason EMV chips caught on all of a sudden in the US was because the rules changed. Before, the issuing bank was always responsible for handling fraud. But now, if the merchant doesn’t accept the card’s most secure payment method, then the merchant is responsible for any fraud. So they scrambled to support chips. If only it had come a year later, all the merchants would have scrambled to support NFC.

[@autohmae]

exactly, it was a really 'nice' trick by the banks

[@mateuszzimon8216]

That's why u get cheap stip reader, and scramble strip. Or just neodymium magnet

[@jackiecs8190]

No, merchants have been held responsible for fraud for a long while now

[@Dave01Rhodes]

@@jackiecs8190 since October 2015, when credit card issuers said they would hold the merchants liable for accepting fraudulent cards if that merchant didn’t have a chip reader.

[@MikkoRantalainen]

I think it should be perfectly okay for the bank. As far as the bank is concerned, your card simply "happens" to have a broken NFC antenna and unless you need a replacement card because of that issue, it just appears to the bank that you simply never ever use the NFC feature. I actually had one card that was still in mint condition visually but its chip features were flakey and I had to replace it. I guess there was a fracture in the chip or one of the wires because it might have been temperature sensitive whenever it happened to work or not. The bank even agreed to replace the card without having to pay for the new card.

[@phillyphakename1255]

Legally, the card is property of the bank, so you are destroying/changing the bank's property. Probably violates the cardholder agreement, and maybe violates a law or two. Functionally, though? No one will care. As for card replacements, they do wear out. I had one for a few years that started getting flakey with the chip read, so I requested a new one and they replaced it for free. Same story with friends and family. Not a big deal to replace, the cards cost em a dollar or two to make. As long as you aren't requesting a new one everyday, they won't care.

[@MobiusGT]

@2:37 android phones had tap to pay at least a full 3 years before apple pay came out

[@st_us]

Video Starts at 6:30, he made the hole to deactivate wireless pay.

[@ChuckvdL]

Had the same issue with trying to put an ORCA card (a regional tap to pay transit card) anywhere near a phone with NFC enabled. And of course disabling nfc on that card makes it un-usable. So I end up using rf shield sleeves around my cards

[@jdmillar86]

Here, (Canada) tap-to-pay first appeared, at least in my experience, on gas pumps. The cards definitely came out before NFC phones.

[@chriswitmer9754]

My experience (also Canada) was vendors getting the tech for their POS devices a little before the banks and credit cards introduced the technology. This goes back to "chip" cards as well, of all places my small barber shop (with three people working there) had the first chip reader I saw in person months before my bank even released a statement that they were "coming soon".

[@brodriguez11000]

Reducing the skimmer problem.

[@--zero]

As soon as I saw the title I figured it was to disable tap-to-pay, but I didn't consider hitting just the antenna to keep chip payment active. We've had chip and pin up in Canada for a long time now, with tap to pay being around for a while as well. It always amazes me how far behind payment cards were in the USA. I remember reading about a special USA model of a Samsung phone with "MST" payment, that could somehow transmit card data to a magstripe reader, and I had to ask one of my friends down south why such a thing would be needed.

[@GamesFromSpace]

Transmitting to a magstripe reader is a pretty clever idea, and easy in theory. It's basically a cassette tape reader, and only reads what's in front of it one "line" at a time. So you could trick it using an electromagnet, just like those now-old bluetooth adaptors for tapedecks.

[@mycosys]

the normal way to do this is just a hole punch a few mm from the edge of the card. You can find a heap of instructions online

[@brocktechnology]

When tap first came out I drilled all my cards to protect against remote cloning. That turned out to not be much of a threat in the real world(I also live in rural Canada where criminals think crowbars are high tech) so last time my cards where replaced I didn't drill them and started using tap and it's pretty darn handy.

[@Hans-gb4mv]

You can't clone a card via NFC. While it is technically possible to skim the card and make a payment, you not only need the terminal, you also need an agreement with a payment service provider. And those do some serious vetting before they'll give you an account. Combine that with the fact that most cards will only allow small payments without PIN and that hasn't been worth it for criminals to attempt.

[@Gellis12]

@@Hans-gb4mv you can technically copy a card via nfc and use it at a store, but only for a single transaction, and only if the actual owner of the card doesn't use it before the thief tries to use the copy they skimmed. It's pretty similar to a rolling code garage door opener in that sense.

[@TheSimoc]

@@Hans-gb4mv While not actual cloning, it is well possible and easy to sniff the card number which you can use to make payments in shops where CVC is not asked, and even if it was, CVC is way too easy to brute force. Even if there are undocumented mechanisms to lock the card after certain amount of failed CVC attempts, it is too easy to circumvent it by writing a simple python script which makes only one or a couple attempts in a row, and then waits a week or couple before trying the next one, so in between the failed attempt counter has in most likelihood been reset. Considering it is extremely easy to sniff thousands of card numbers thanks to the ahh-so-wonderful contactless payment, adding them all into the python script to be tried in turns, you will practically get right hits with CVC all the time, because CVC has only one thousand possible combinations, so for thousand card numbers to try with you by average get one successful hit every round in *first try*. And then go on by giving a couple more tries for each one once every week or two. Furthermore, contactless cards allow real-time relay attacks which is even simpler to implement and evade. So, I warmly recommend everyone to drill their contactless cards, and not let the convenience - which could have been implemented securely but for sake of stupidity wasn't - to lead into apologism.

[@TheSimoc]

In a rural village you might be relatively safe with your contactless card, but in everywhere else, the promoted real-world safety is only and merely due to unobservance. Meaning, how many times does anyone check their accounts for transactions? Honest answer is, most do practically never in any memorable interval, nor do I even though I am very security-concious person, if not outright paranoid. And adding the fact that many legitimate shops have totally different actual company name than what reads in their advertisement signs, most beneficiary names in your account sheet is not recognisable anyway, you just think er... don't remember what that might have been, maybe it was some individual corner shop, snackbar, special shop, or a franchise of a known chain, none of which never have their actual name in their neon signs. And most of the time, they were indeed such, completely legitimate transactions. But you never bother to actually dig them out further, you just accept the fact you don't remember where have you shopped, and you don't recognice those company names. Thus, if there was some or a few fraudulent transactions committed by a card number stolen from you, it by all likelihood will go unnoticed as long as amounts are kept somewhat modest. Especially considering that majority of people are way, way more "relaxed" about observing their accounts than I am. Well, even if one notices a seemingly fraudulent transaction from their account, AND bothers to confirm its fraudulence and make a claim, there is absolutely no way to proof it was anyhow caused explicitly by contactless fraud. It will be recorded in statistics as "just another card number fraud". And taking into consideration the heavy marketing push of contactless payment and arrogant denialist propaganda about their "safety", you can be sure they are not even by accident recording any fraud as contactless one unless there is undeniable proof for such. Still, considering how all but impossible it is to prove the contactless fraud to be the source for a specific case of stolen card number, the statistically admitted number (no pun intended) of the contactless fraud is HUGE. And the most sickening is the way they make apologism by stating how small percentage it is per the legitimate transactions. It is same as stating "murdering is not a problem, murders are soooo small percentage per the living people!"

[@MikrySoft]

@@TheSimoc Your card has not one, but 3 numbers associated with it. One is printed and encoded on magstripe, second is for the chip and third is for NFC. It's trivial for bank to see that they got a transaction with NFC number using magstripe or online and flag it as fraud. Your only option is to emulate a NFC card at a normal reader, but that only gives you one transaction - and you need to make it before the cards owner uses it. Only the relay attacks are a real threat, but that's easily mitigated by having the bank notify you about every transaction (every bank here in Poland will send you a push notification from the app if you configure it) or use a card with a built-in fingerprint reader needed to perform any transaction (at least one bank here provides it by default).

[@Allen-by6ci]

5:25 TLDR, to kill the antenna on the NFC so that tap to pay does not work, but chip and magstripe do work.

[@Relkond]

The lengths we go to in order to keep our tech happy.

[@DanielTekmyster]

This is your bank, we received notice from an un named three letter gov’t agency that they are unable to effectively track you; they have had to move to using outsourced methods from your phone manufacturer and are tired of paying the premium. With this coming to light, we will be issuing you a new card. Thank you -bank manager

[@hughbrackett343]

The conundrum of a free laptop from Deviant: It's either clean as a whistle or you're pwned the second you open the box. Edit: Possibly as soon as the box gets near any of your devices.

[@gaveintothedarkness]

Deviant's box. You dont know which state it is until you open it.

[@SystemX1983]

@@gaveintothedarkness Schroedinger's laptop? 😆

[@Brightly2109]

TLDW is that he put a hole in his card to disable tap-to-pay

[@theteenageengineer]

Ok so that laptop was Dell trying to compete with the Panasonic Tough Book. Also great idea for how to knock out NFC while still keeping the chip enabled. Another thing worth saying is that if you are trying to do the mod yourself you need to use a drill bit that’s flat on the bottom and I would guess that not many people have a key machine or some tiny end mills laying around so just keep that in mind if you are not trying to go all the way through the card

[@higihups]

Just use a sharp knife like a razor blade and cut the antenna. Way less people will ask about holes in your card.

[@mycosys]

or just use a hole punch near the edge of teh card like people have been doing for a decade

[@smorrow]

What actually is so bad about going all the way through the card?

[@davidmowbray6352]

I just asked my bank for a card without rfid.

[@GamesFromSpace]

I've been meaning to extract the NFC coil/etc from a bank card and put it into a ring. Just so I can wave my hand over the machine to pay for stuff.

[@honzanijaky4132]

Btw, there are tiny sleeves for credit cards that still fit everywhere the card does and block the antenna of the card, so it doesn't work contactlessly unless you remove it from the sleeve.

[@honzanijaky4132]

Or you could just stick aluminium foil to the card and it would work similarly well.

[@DrGeekthumb]

If you want to "opt out" of tap to pay for security reasons rather than interference, some mobile banks let you actually stop your card from being used with tap to pay. I know for the UK Revolut allow this and I think Starling do also.

[@lathiat]

Apple Pay works offline because the actual card is on the phones secure element but Android Pay uses “host card emulation” where the actual card is on a cloud server and the phone thus needs internet to work. (To answer the subtitle question). I am not sure if any android or Samsung etc options support a true native card on the phone.

[@higihups]

Google and Samsung pay are able to work offline. Android pay is not common around here, so I do not know about that.

[@Megaranator]

I doubt people would use it much if that was the case, having to hold the phone there waiting for the spotty mobile connection to download the key

[@MarvinCZ]

Neither of those services have the actual card or a copy of it. That's the beauty of the system. They just have a token with limited validity that can be used to generate payment information without using the card information. That payment info is then verified between the merchant, the card association and the bank (involving some crazy cryptography), without the merchant ever getting your actual card information. Both Apple Pay and Google Pay can work offline, they just need to refresh the tokens every once in a while.

[@brettfo]

Minor fact check... adoption of and migration to EMV officially started in 2011 in america. Apple pay was released in 2014. In 2015, liability shifted to merchants for non-emv transactions which explains why it might appear like apple pay was leading the industry forward. However, this 2015 date was set in 2011/12. Feels like we've had these things forever but it's still pretty recent. Anyhow, it didn't sound right but also seemed plausible... needed to know the answer!

[@MikkoRantalainen]

I see your camera quality has now by leaps and bounds better video quality than the older videos you had. The audio is clipping quite a lot, so maybe re-check the mic amp settings and post-processing filters?

[@Monkey_on_Call]

4:35 "So what do you do?!" You get a real wallet...

[@TheReduxGB]

Google's confusing naming and constant changes got me confused with another app. Comment is irrelevant now

[@zimpenfish]

Wikipedia has Android Pay in September 2015, almost a year after Apple Pay. It was only announced in May 2015, 7 months after Apple Pay debuted in the US. Are you thinking of Google Wallet (which is an entirely different non-EMV thing)?

[@ScarfmonsterWR]

Here in Poland I remember banks rolling out phone contactless payments way before Apple and Google were a thing. When Apple revealed their solution there was a lot of talk about "why are Americans so excited about this, it's been a thing since ages".

[@mikeuk1927]

@@ScarfmonsterWR I wonder when Americans and other countries will adopt somethibg alike to blik payments. It's so convenient and I was shocked to find out that's not available outside of Poland.

[@TheReduxGB]

@@zimpenfish You are right. Google's constant name changes and app merges got me confused. They have done something similar to this recently with the Google meet/duo app.

[@MarvinCZ]

@@zimpenfish That's indeed just an issue with Google's renames again. Google had NFC mobile payments as early as 2012, maybe 2011. It's not that easy to find now. You can find a 2012 CNET article "Is NFC killing Google Wallet?" (I don't think I can do links here), where they explain how wrong Google was for implementing mobile payments through NFC.

[@ThymeCypher]

1. Android Pay was first, but evolved into Google Pay; it was a different approach however in which Google paid for you then you paid Google. This was changed as it meant all transactions were considered to be to Google so rewards reflected that - often only 1%. 2. Most of the card is just useless plastic, you probably don’t need to be careful. My card split right above the mag stripe almost to the end of the card and both chip and stripe still worked. I only replaced it because I forgot my bank uses those ATMs that pull the card into another dimension and it almost got stuck.

[@frzen]

In reference to 3:40 or so: yes you can use apple/google/samsung pay without network connectivity in my experience. Revolut is good too, with their physical card you can temporarily disable or reenable NFC* *disabling NFC stops you from getting contactless charged on the train or something it won't stop the card from being actually detected by a reader which was your issue.

[@ColinRichardson]

"apple/google/samsung pay works without connectivity".. Semi true.. The 'users' phone/watch/device doesn't need connectivity.. The 'reader' (eg, the business owner) needs connectivity.

[@lathiat]

The default android pay uses a cloud based “host card emulation” where it’s in the cloud so does not work without network. Apple Pay does and I think some phones and maybe Samsung pay uses the secure element. But many don’t so need a network connection. See Wikipedia for “host card emulation”

[@NGC1433]

@@lathiat None of OEM pay apps use "host whatever emulation." This tech stack is called tokenisation and works without network for limited amount of times and limited sums. Wallet on the device loads 5 or 10 single use "keys" that are used for each payment and tries to request new ones via internet before they run out. Please stop trying to look smarter than you are buy spewing some words you imagine to be fancy. Or in other words - shut the fuck up and go read some documentation from VIsa or Mastercard on this topic. It all is easily available in their developer portals.

[@shepardpolska]

I am pretty sure all android phones have an option in that slide down menu to dissable NFC on your phone completely, just like you can disable wifi or GPS.

[@JaredConnell]

@@ColinRichardson of course the payment processor needs connectivity, how else would it charge the card? Print out an old school carbon copy paper and mail it in to the bank??

[@DavidLindes]

It occurs to me to wish for a momentary button of sorts built in to the card, that would physically disconnect the RF antenna (much as you did) with the normally-open switch, but then if you squeeze the card in the right way (or perhaps any of several (2? 3? more?) available ways, with multiple electrical paths), it closes the circuit and the card can be used. I imagine this could be done -- either a membrane-type button that's just two contacts around a void in the central plastic (where the user would squeeze the thickness of the card in a particular spot), and/or an edge-based thing where squeezing the edges at a certain spot would close the connection (seems more ergonomic)... that'd solve the phone problem.

[@ConstantlyDamaged]

Huh. Your cards still have mag stripes? Here (Australia) there are few that have that still, but all new cards for a while are just NFC + chipcard.

[@Thermalions]

Also from Australia, but all my cards (various banks) still have mag stripe (as backup to NFC/chip), and issued within the last couple of years. The no mag stripe might not be as widespread with banks as you think.

[@marcogenovesi8570]

USA hasn't been cutting edge for a while now. Even in EU many newer cards just don't have magnetic strip anymore

[@MarvinCZ]

When it comes to banking, USA is a couple decades behind in most aspects.

[@ConstantlyDamaged]

@@Thermalions Huh. Probably just my bank being an early de-adopter.

[@loreleihillard5078]

As someone from Australia where tap-to-pay is the standard expected payment and has been for years now, this concept is so alien to me

[@rubyschnee4493]

I wonder how long it took him to notice he gave everyone his card information

[@pabloqueima]

I'm pretty sure it's fake info

[@im_justin]

1111 2222 1111 2222 isn't a real card number

[@notsparks]

That's actually a great method to solve this. I bought some cheap rf blocking sleeves on Amazon which is my current solution as I have this trouble regularly... now I'm considering drilling a small hole in my credit card so I don't have to fuss with pulling a card out of a sleeve and putting it back when I need it.

[@docwil2541]

lol, I'm pretty sure you have me on your mailing list. I like the controlled way you went at cutting the RFID. Its not the sledgehammer approach of degaussing or microwaving your card. And its so much more controlled then a drillpress or CMC.

[@DeviantOllam]

credit to Babak for thinking of the TigerShark. i'm more of a seldgehammer guy. 😂

[@docwil2541]

@@DeviantOllam lol Yeah, I'm an old retired cop and now a PI, I'm not exactly subtle. I tend to go for the most direct route to get what I need. I'm enjoying the fireside chats.

[@bllfrg777]

@@DeviantOllam Back in the days of the early Wave Technology™card b.s. I was not into it, so I took a ball peen hammer to the center of the little chip. Mind, this was back before chip and pin was being attempted, so it only killed the transmitter. Worked a treat.

[@raitchison]

Tap to pay was on Android via the original Google Wallet app years before Apple Pay,. It never saw widespread adoption because Google only supported it on Nexus (and later early Pixel) phones and if you didn't have one you needed to root to install it. I remember quite a few times I saw the little contactless symbol on a payment terminal and would just pay with my phone and 9 times out of 10 cashiers looked at me either like I was a wizard or like I was some sort of "hacker".

[@cbrian]

I used to get that look all the time.

[@AugustERaven]

As a Canadian it's so funny you guys didn't have chip and pin until tap, I got my first card at 7 years old, and all my cards have had chip didn't have tap until the past 10 years. I've only ever swiped or had to sign like 4 times in 20 years.

[@benyspensierijr.5973]

An NFC blocking sleeve on the card would have worked just as well and still given you the flexibility to still tap with the card.

[@NithinJune]

It would prevent Apple Pay from working on his phone though which he says is a higher priority for him.

[@benyspensierijr.5973]

@@NithinJune I see what you mean, it would also shield the phone's NFC. I didn't think about that.

[@michaelwiley6979]

Funny enough a passport card is actually only valid for ground and boat transportation and not valid at an airport (I learned the hardway at an airport ticketing counter without enough time to run back and grab an alternate form of ID)

[@AshManXP]

Jump to 7:00

[@jaykoerner]

Jump to +0:00 this isn't meant to be a how to video

[@andrew051968]

Note that Australia (and I believe most of Europe) were using tap to pay since 2006 - way before Apple Pay. I believe it’s only new in the USA. I don’t think I ever had my iphone pick my cards up, maybe because Apple Pay can’t receive payment here, only send them? Since digital drivers licenses and Apple Pay I now only carry my phone.

[@z0mb13k1ll2012]

In Canada you can just ask the bank to disable it, and as far as I am aware it does not scan with anything after that (rather than just scanning and showing a blank tag)

[@dfunited1]

I thought it was going to be a tactile dimple, so you always know which way it's oriented without ever looking. I do it with my housekeys. Stopping the NFC makes sense too

[@nurmr]

Or makes it easier to remove because it stops it sticking to the card that it's up against.

[@plsuh]

This also applies if you use an NFC FIDO key (e.g., YubiKey 5 NFC) and want to authenticate with it on your phone.

[@rjhikes6248]

There are phone cases that also block the chip in cards from communicating. I’m not sure if they affect phone reception but you can always take your phone out of the case in a pinch. Beats disabling features.

[@marcogenovesi8570]

I keep the wireless cards inside a metallized card pouch (you can get them for cheap, search "nfc blocker") which blocks NFC (I checked, does not read the card if it is in the pouch). Maybe that is an issue for your phone too if you keep them in the same case but for most people where the cards are in a wallet it's ok like that

[@tylerkannas3714]

I was avoiding this recommendation for so long because it seemed super click baity, but this was a genuinely good video for what it was. I was absolutely not disappointed by the explanation.

[@levijohnston8906]

FYI: the giveaway link in the video is allcaps, but when entered into the website, it gives an error. Might want to htaccess redirect for anycase, or update future vids to put in the lowercase the site needs.

[@henrikkristiansen3869]

3:40 : Apple pay for example works without network connectivety, its works exactly the same way as tap-to-pay on you plastic card. just that the card info is locked behind the phones biometric security, making it more secure.

[@Throneos]

The German bank N26 gives out transparent cards as standard. They are slightly smoky plastic but you can clearly see all the antennae running through them. There are even more than one coil. It's a free online bank so if you live in Europe you can just open an account to get the cool card.

[@tecker83]

I know this is older but if anyone finds this my new debit cards had little itty bitty wire traces coming out of the top of the chip pads (they are not the same as the typical pads that are standardized) that then went into an absolute spaghetti of antenna connections below the surface. I found that if I took a small screwdriver or xacto knife and scraped those small wire traces the antenna feature died. No cutting into your card, chip still works, no one would notice.

[@cardude1957]

I had this exact conversation with my bank, "Can I get a card without tap-to-pay". The answer is a resounding, "Uhhhh, no". I carry several cards in a wad in my pocket and when tapping the whole wad against a reader without taking one card out results in an error on the POS that often says something like, "only 1 card". So I took a strong flashlight, blasted it through the card, and marked a small dot on an antenna line on all cards except the one I use 99% of the time. I drilled a through hole on many cards and I never get a second look, but a partial drill with some nail polish is a nice touch.

[@MultiVogon]

We had a staff member complain their proximity card no longer worked on any doors... when they bought it in, they'd punched a hole in it so they could hang it round their neck... 😑

[@thomast6741]

Commenting just to improve the KZbin algorithm. Keep up the great work and the good content!

[@DeviantOllam]

Thanks! Will do!

[@stco2426]

I have an account (not one of those you mentioned) where the phone app allows you to turn on or off certain features of the card, such as whether it's near the phone (uses location and merchant location), Y/N to ATM withdrawals, Y/N to contactless, etc. Kinda handy and it works. Interesting to test whether this is tied to the reader in some way or not. Thanks!!

[@pineappleroad]

I know with my bank, the settings just tell the bank to block transactions

[@GrumpyIan]

Just FYI all you need is a piece of metal (a sheet the size and thickness of the credit card) and it'll make a barrier so the NFC scanner can't pick it up.

[@charlottelanvin7095]

I've been reading about "card clash" on the London public transport system. You offer your phone or wallet or purse and there may be multiple chips in there and it's a mixup. As you need to tap in and tap out, confusion can ensue

[@JD-gn6du]

My bank is behind the curve with NFC, but I don’t want to use it once it’s available and I was thinking about this exact topic over the weekend while trying to set up some GPS tracking units that I can hopefully catch some thieves with.

[@jaimemunoz5920]

I just wrapped my card in aluminum foil. I don't really travel and honestly my card and my bank card stays home digital version on my phone with NFC so it's like kind of redundant so I just wrapped it in aluminium foil so that even in the extremely rare chance someone was going by and somehow had a powerful enough reader to read it it would make it harder.

[@pcs9518]

With the new digital pick pockets getting close to people’s cards using their phones to initiate a tap to pay POS transaction without your knowledge this is very helpful.

[@ChronicBongitis420]

Thie video brought to mind an episode of NCIS from awhile ago where a woman was walking down the street with a cell phone and stealing people's credit card information wirelessly. I think the episode aired around the time credit card companies started rolling out this technology in the US.

[@sexytgirl757]

used to be an apprentice welder and i'd often have my card in my side pocket of my cargo pants which was usually pretty close to where i was welding, killed the nfc chip in it after a few months

[@MyNameIsNoneOfYourBusiness-v5g]

The card manufacturers are actively working to prevent this by changing the core of new cards to opaque black plastic. The flashlight can no longer shines through the card to see the antenna.

[@chriscich]

They make sleeves for credit and debit cards that block RFID. Or you could wrap it in Aluminum Foil. No need to drill out the antenna.

[@harrodharrod5239]

I figured out why the hole was there immediately, but the reason for it is completely different from what I thought you were gonna say (was expecting something about security, paying something without your knowledge, ...)

[@tlhIngan]

I have an active NFC jamming card - it's an active chip that basically sees NFC and responds with a colliding signal. The key is it collides but doesn't disable itself (which is how NFC handles collisions - it reads until a collision and that happens when a chip tries to send a 1 but reads a 0 from another chip, which means the chip sending 1 detects it and temporarily disables itself until the next read while the chip sending 0 (which doesn't know about the collision) keeps going. After that it disables itself for the next read which will let the first card send. A jammer sends constant 0 and disables cards in its proximity so they can never be read.

[@MrJoerT]

3:47 Yep. Tapping your phone to pay doesn't require network on the phone side. Discovered this during a huge phone network outage, and the only think I had to pay with was the phone. I just gave it a shot, and turned out it worked 😅

[@micahnightwolf]

I always thought those phone case wallets were kinda dumb because if you lose your wallet, you also lose your ability to disable your cards.

[@olenilsen4660]

What kind of bars do you go to, where people ask you why there´s a 3mm half-hole in your card???

[@laptop006]

Tap payments are so ubiquitous in Australia that the card would be near useless here, although we picked it up almost as early as Europe did.

[@gaveintothedarkness]

In Canada we have a wireless fare payment card called PRESTO and they tell you explicitly not to hole punch through it or it could wipe out the antenna. If you are worried about violating TOS, or want to do it a lazy way, a hole punch in the right spot will do the same result with some deniable plausibility.

[@matthewmiller6068]

No real loss since most big stores like WalMart don't accept contactless payment and also so many that support it (gas stations especially) the tap readers seem broken more often than not these days.

[@jacobbarber8665]

You're right that the NFC payment system doesn't require both devices to have an active network connection. They just figure your phone is more likely to than the POS system, so it banks in the phone as the reliable end. IT support will tell you how awful it is keeping that stuff online.

[@lexbailey]

Sometimes this won't work: A friend of mine had a card where the antenna was entirely contained behind the chip contacts, so they couldn't disable the contactless mode without making the card useless. They cut away everything around the chip, almost the whole card was gone and it still did contactless payments.

[@cbrian]

Yep. My Samsung galaxy Nexus had Google wallet in 2011. And places started enabling the readers until 2014 when apple pay came out and apple had to get their cut from retailer, so retailers started turning off the readers. It took about 2 years to get back to where it was in 2011.

[@TroyRubert]

As someone who has worked for capital one specifically heavy spend credit cards, I can't think of a single reason why anyone would get upset.

[@zachfoss4152]

We've had these in Canada for a decade or so. Always baffled me how it never caught on in the states.

[@Omgitssoup]

Back when NFC first rolled out mainstream to cards around the mid-late 2000's here in the states i had a bank card that i just used a hole puncher on LMAO. I kinda went overkill, but got to the same solution as you.

[@turbo2ltr]

both my credit cards I use regularly that also have tap to pay are metal and light doesn't pass through them at all..

[@tfodthogtmfof7644]

We have had to use a bunch of old laptops as portable temporary console servers on remote routers for upgrades that require the entire drive of the router to be formatted and rebuilt from a usb drive.