Android application reads credit card data over NFC (The H)

The rationale is that these aren't a major target for fraud.

Previous experience says that there will be some serious holes resulting from bad assumptions in the banks, card companies, payment providers and consumer businesses. The main thing I'd worry about would be whether any of those holes impact the consumer, next after that whether they affect the retailer, and I have no interest at all in whether the banks, card companies or payment providers take a hit.

Examples of things the system is supposed to do, and how they'll probably go wrong:

1. These aren't normal credit cards. Data from a touch transaction shouldn't be valid for larger transactions and the card company should reject larger transactions

1a. But it probably won't. Sooner or later a bank is going to tell a customer that their $15 limit touch token bought $15000 of diamond jewellery in a country they've never visited.

1b. Lots of small transactions add up. Somebody's off-line transaction system or broken fraud pattern spotting will allow criminals to put thousand of dollars onto someone's card by keeping each purchase under $5

2. Some fraction of transactions are supposed to be checked. This should make small-scale fraud too risky because you'll be caught after a relatively small number of attempts

2a. But retailers are notoriously non-compliant on such checks. Given the choice between "possibly inconvenience a real customer" and "lose millions of dollars to fraud" apparently the second choice is always preferred.

2b. Small-scale fraud often involves insiders anyway. The same low-paid shop workers who agree to turn a blind eye to the use of a card in the name of "Mrs Jia Wong" used without a PIN by a 17 year old white guy with no ID to buy $500 of brand name spirits can be "persuaded" not to perform the manual check when the proximity card reader requests it.

3. Local laws should protect consumers so that the banks have to eat the cost of their own mistakes

3a. But repeated practical experience shows that judges and juries believe whatever they're told by the man in a smart suit from the bank, even when outsider engineers can see that it's completely bogus. So there's a good chance the bank can legally pin someone else's fraud on you by insisting that its systems work even if you have proof they don't. Increased scepticism towards the banks by the general public might help here, but don't count on it.

That's one plausible reason. Another is that the credit card companies are actually run by morons. This is the impression I get -- the last time they sent me a card, I was on the phone with them beforehand, and explicitly asked for one without any RFID. The woman on the phone had no clue what I was trying to ask for. She kept assuring me that the card would have PayPass, but I "didn't have to use it if it made me uncomfortable".

So as soon as I got the card, I shone a light through it and dremeled out the antenna. Problem solved, I suppose, but since the card has clearly printed on it that it is the property of the bank, not me, I'm on questionably legal ground.