Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

243
active users

shakedown.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#nfc

0 posts0 participants0 posts today
Replied in thread
Public *
Kevin Karhan :verified:

@hisold My bank stopped issuing #girocard cards with #magstrip 10+ years ago as magstrip was phased out and #NFC was phased in as well as #PSD1 being introduced.

  • Even before that merchants rarely accepted magstrips and those who did asked for #ID as soon as purchases [i.e. fuel at a gas station) exceeded like €100 because unlike #Chip + #PIN the payment processor does not guarantee them that the payment will be accepted and the amount guaranteed.

That's the main push factor: Alongside lower processing fees and faster processing, the Chip+PIN & #NFC systems actually request a blockage of the amount and will automatically decline without incuring fees if the balance / limit is below that amount - sometimes even before the PIN has been entered (it'll just not show it until the PIN is entered so fraudsters can't just abuse this as a means to check balance.

  • There's a nice podcast with #JohnBoseak where he explains how stuff used to [and allegeldy still does] work in the #USA re: #CreditCards. Given that I worked for a #PaymentProcessor in the past this is some basic knowledge re: #security, because one needs to understand how stuff like CNP ("Card not Present") works and how the system is architected to the point that even if someone were to hack the database of said payment processor, they'd never find any CCs or the CVVs stored there at all.

It's also insightful because #fraud would be way more rampant if the card issuer, payment processor and card system operator [i.e. AMEX, VISA, MasterCard] didn't all run their own AFE [Anti-Fraud Engine] each automatically assessing risks within less than a second for every transaction.

  • That's why one can get their #CC blocked when using a #VPN and why fraudsters need the location of their victims because if I had a CC and used it regularly and someone were to try to swipe a skilled copy of that at a Walmart or Best Buy on the East Coast of the USA less than 24 hours of my last use in Germany, that would automatically get declined as fraud and the person at the cashier will call security because noone is travelling that quickly that far.

But that's just some cold OSINT based off #TechSupport and peeking behind the curtains professionally...

  • There's way more but I can't go into details on that.

Rest assured if you have a CC you can be as certain that someone tried to abuse it as I'm certain my bank blocked fraudulent money orders against my account because of AFEs working - it's just > 99% of all fraud attempts get blocked instantly and merchants rate-limited or kicked off the system when they do something suspicious.

  • Same reason why one can't frame someone for a crime by just wiring obviously illicit funds to their account: AML (Anti-Money Laundering) will catch that and unless the account holder were to ask "Where's the money/transaction?" #FinCEN et. al. won't even bother calling the account holder up simply because "oops I wired money to the wrong account. Can you please send it back?"- #scam is a well-known method to turn unsuspecting people into money launderers.

So yeah, that "#magstrip" may be just lacquer but unless it's specifically advertised otherwise only holds the CC & CVV as well as service codes [i.e. chip+pin only] to tell the terminal "Don't accept magstrip, mandate Chip+PIN"]...

  • Outside the #USA, this is the norm due to #PSD2 exceeding #PCIDSS by quite a lot!

Only underdeveloped countries like the #US still use #Magstrips and #credit and not Chip+PIN & #debit!

YouTubeMiami’s Darklord of Credit Card Scams | John BoseakBy Danny Jones
Public
Cappy Ishihara

Looking for aspiring Linux hardware and software hackers to work on NFC-F/FeliCa (Secure NFC) support in Linux! We're interested!

Imagine Linux emulating transit cards— also logging into SEGA (Aime), Namco (BaNaPassPort), Konami (e-Amusement) arcade games!

Join us @hq and let's turn Linux phones into transit (or arcade) cards! Let's ride the train, on Linux! #nfc #nfcf #felica #linux #hardwarehacking

Public
Brian Greenberg :verified:

⚠️ Mobile security risk: New Android malware "SuperCard X" enables contactless payment fraud via NFC relay attacks 📱💳

Here’s how it works:
🔹 Victims are socially engineered through fake bank alerts (smishing + calls)
🔹 Tricked into installing a rogue app posing as “security software”
🔹 NFC data is intercepted from real debit/credit cards
🔹 Attackers relay stolen credentials to PoS terminals and ATMs for fraudulent cashouts

Why it matters:
• Attackers no longer need stolen physical cards — just proximity + deception
• Banking customers, payment providers, and card issuers are all at risk
• Google is working on Android protections — but vigilance is key now

🛡️ Tip: Always scrutinize app installs, verify messages before acting, and keep Google Play Protect enabled.

#CyberSecurity #MobileSecurity #Malware #NFC #FinancialFraud #ThreatIntel #security #privacy #cloud #infosec

thehackernews.com/2025/04/supe

The Hacker NewsSuperCard X Android Malware Enables Contactless ATM and PoS Fraud via NFC Relay AttacksSuperCard X malware exploits NFC relay and social engineering to steal card data in Italy, enabling ATM fraud.
Public
Efani

🚨 A new Android malware campaign is using NFC relay attacks to clone credit cards — and it’s nearly invisible to antivirus tools.

Security researchers have discovered 'SuperCard X', a malware-as-a-service (MaaS) platform that allows cybercriminals to steal card data and make contactless payments using compromised Android devices.

Key highlights from the report:
- Distributed via social engineering scams through fake SMS or WhatsApp messages
- Victims are tricked into installing a malicious app disguised as a bank “verification” tool
- Once installed, it uses NFC to read card chip data and sends it to a second attacker device
- Attackers use a companion app to emulate the victim’s card and make payments or ATM withdrawals

🔍 What makes it dangerous:
- SuperCard X requests minimal permissions, making it hard to detect
- It uses ATR-based card emulation and mutual TLS (mTLS) for secure communication
- Malware is not flagged by any antivirus engines on VirusTotal
- Transactions are small, instant, and look legitimate to banks — making them harder to detect or reverse

🛡️ Google responded saying Play Protect is active and currently no such apps are listed on Google Play. But since these apps spread outside the store, Android users remain at risk — especially if they sideload apps or fall for impersonation scams.

This is a textbook example of how mobile payment infrastructure is being exploited — and why NFC security deserves more attention in mobile-first threat models.

At @Efani we’re committed to helping protect high-risk users from silent, evasive mobile threats just like this.

#Cybersecurity#AndroidMalware#NFC
Public
🏳️‍🌈🎃🇧🇷Luana🇧🇷🎃🏳️‍🌈

How does stuff like those nfc chips some people implant on themselves work for credit card payments and stuff? Does it work like Apple Pay or something like that? Does the bank need to do anything to support it or do they just see it as a regular apple/google pay device?

Also, if the banks don’t need to do anything to support them then why don’t we have like open source reimplementations of google pay for postmarketOS or something?

#nfc#OpenSource#BodyHacking
ExploreLive feeds
About