Flaw in Apple Pay, Samsung Pay, Google Pay Allows Fraud

At an event during Black Hat Europe 2021, Timur Yunusov, senior security expert at Positive Technologies, recently discussed bugs in contactless payment apps that could potentially lead to fraud involving lost or stolen mobile phones.

According to Yunusov, the key to this scam lies in the convenience of paying for subway and bus tickets without unlocking a mobile device. American, British, Chinese, and Japanese users can simply add a payment card to a smartphone and use it as a transport card.

“To perform the attack, smartphones with Samsung Pay and Apple Pay must be registered in these countries, but the cards can be issued in any other region,” said Yunusov. “The stolen phones can also be used anywhere, and the same is possible with Google Pay.”

Yunusov and his team tested a series of payments to see exactly how much could be spent on a single transaction using this method, and the team stopped at 101 pounds. “Even the latest iPhone models allowed us to make payments at any PoS terminal, even if a phone’s battery was dead,” provided the phone used a Visa card for payment and had Express Transit mode enabled.

According to Yusinov, a missing offline authentication of the data makes this exploit possible, although EMVCo specifications exist to secure these transactions.

“The only problem is that now big companies like MasterCard, Visa and AMEX don’t need to follow these standards when we talk about NFC payments – these companies diverged in the early 2010s, and everyone is now doing what they want here,” he said.

Apple Pay, Google Pay and Samsung Pay apps are all vulnerable to this threat.

According to Yusinov, MasterCard came to the conclusion that ODA is an important part of their security mechanisms and decided to stick to it. All terminals worldwide that accept MC cards should therefore carry out the ODA, and if it fails, the NFC transaction will be declined.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web