Think that £30 limit on contactless payments is going to protect you from big thefts? Think again.&nbsp;



<hr class="wp-block-separator"/>



Security researchers have found a way to bypass that limit on Visa cards. Their hack, which isn’t limited to U.K. cards, could let opportunistic crooks drain accounts with a single tap, and they claim they don’t even need to steal the credit card. And little on Visa’s side is being done to address this fresh fraud threat.



Forbes&nbsp;let the researchers—Leigh-Anne Galloway and Tim Yunusov from cybersecurity company Positive Technologies—try it out on a personal Visa card. They extracted three successful payments of £31 ($38). On their own cards they made contactless payments as high as £101, though it’s possible more could be stolen with just a tap.



Their hacks show how contactless fraud could get a lot worse. Typically, if a bank sees multiple £30 contactless payments, the card will cease to work, as fraud detection systems suspect it’s in the hands of a thief. But if it’s possible to make large transactions in one tap, the potential for significant frauds rises.&nbsp;



READ MORE | <a rel="noreferrer noopener" aria-label="Is Forex A Scam Or Money Goals? (opens in a new tab)" href="https://www.forbesafrica.com/investment/2019/04/01/is-forex-a-scam-or-money-goals/" target="_blank">Is Forex A Scam Or Money Goals?</a>



Card thieves can now make larger payments than they could before. But now, they don’t even need to steal the card. Criminals could, for instance, take a payment from a card when the user wasn’t looking with their own mobile payments machine (though a malicious merchant would eventually be caught by banks’ fraud systems if they used the same terminal). 



Or even more dastardly, it’s possible to take a payment reading from a credit card using a mobile phone, send the data to another phone and make a payment on that second device going beyond the limit, the researchers claimed. For the hack to work, all the fraudsters need is to be close to their victim.



“So that means if you found someone’s card or if someone stole your card, they wouldn’t have to know your PIN, they wouldn’t have to impersonate your signature, and they could make a payment for a much higher value,” said Galloway.



There should be some limits on just how much a hacker could steal. Galloway said that while it may be that thieves could go much higher than the £101 they tested, into the hundreds or possibly thousands, fraud detection systems at the banks may be able to spot any wildly high transactions. 



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“What we found is that actually, we can make reasonably high-value payments. So in the U.K., we’re able to make payments of £100 without any detection,” she added.</blockquote>



They’re still testing whether the hack would work elsewhere in the world, but Galloway confirmed it was not limited to a single country. The limit, of course, differs between nations. For instance, in the U.S., it’s considerably higher at $100.



No fix planned?



That doesn’t detract from the finding that the limit set on Visa cards can be broken. But Visa isn’t planning on updating its systems to deal with the hack. The financial industry giant argued that such a hack wouldn’t be likely to occur in the real world as the criminals would need to have their hands on the card and this doesn’t happen frequently.&nbsp;



A spokesperson for the company went as far as to say that despite the research there wasn’t a security problem that needed addressing.



“One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer,” a Visa spokesperson told&nbsp;Forbes, noting that Visa was continually working on improving its fraud detection tech.&nbsp;



“Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world.”



READ MORE| <a rel="noreferrer noopener" aria-label="#30Under30: Technology Category 2019 (opens in a new tab)" href="https://www.forbesafrica.com/30-under-30/2019/07/01/30under30-technology-category-2019/" target="_blank">#30Under30: Technology Category 2019</a>



Galloway disagreed that the fraudster would need to steal the card. As their tests showed, the hacker only needs to get close enough to the victim’s card for a short period of time to take a payment. This kind of “skimming” has long been proven possible, even if it relies on the card owner being caught unawares.



The Visa spokesperson also claimed that Visa’s global contactless fraud rate declined by 33% between 2017 and 2018 and in Europe by 40%. But data from UK Finance shows fraud using contactless caused £19.5 million of losses during 2018, up from £14 million in 2017. 



UK Finance did, however, note this was “low” in light of total spending of £69 billion over the same year. And neither UK finance nor Visa said they’d ever recorded a case of contactless fraud in which the card hadn’t been stolen.



How the contactless hack works



To carry out their hack, the researchers used a specialized piece of hardware to intercept and insert messages in the communications between the card and the reader. For instance, they could tell the card that verification—like a PIN—wasn’t needed, even though the requested amount was more than £30. They then told the terminal that verification has already been made by another means.&nbsp;



The researchers said these checks hadn’t been made mandatory by Visa, as they had been by its rivals. And as banks follow the guidelines laid out by Visa, it could be doing more to address the issue, Galloway said. Though Visa said that card issuers are ultimately responsible for validating transactions.



For the attack using two mobiles, Galloway explained that it was possible to use one smartphone to tap a card and effectively clone it for a short period. That first mobile takes what’s known as a “payment cryptogram” from the card. This is essentially a signature that is supposed to guarantee the authenticity of future payments. 



READ MORE | <a rel="noreferrer noopener" aria-label="Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/01/31/cryptocurrency-thefts-scams-hit-1-7-billion-in-2018-report/" target="_blank">Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report</a>



The cryptogram is sent to the second phone, which simulates the card as if it were making a mobile payment. The hackers can then go beyond the limit by doing the same interception attack as before.



Stephen Ridgway, cofounder and chief technology officer at cybersecurity startup th4ts3cur1ty.company, said that addressing such attacks at a technical level could be problematic. 



“There may be no ‘quick fix’ for this, even if the payment providers mandate authentication for payments over £30, if the card and reader are susceptible to a ‘man-in-the-middle’ attack that tricks the system into believing that authentication has already taken place,” he said.&nbsp;



As for what concerned cardholders can do to protect themselves, keeping cards physically secure is vital. For anyone worried about someone reading their card through their wallet, there are covers that can prevent such “skimming” from working. Ridgway said another cheap solution was to use a phone cover, as they often provide the same protection. And monitoring transactions could help consumers detect fraudulent transactions before banks do.



Improving bank security and fresh new regulation should also improve matters. Ridgway said that should contactless limit bypasses become common, it’s very likely that payment providers will quickly learn to recognize and block them. 



And incoming new EU rules could also prove a boon. From September 2019, banks will need to ensure a PIN is required once total contactless payments exceed a value of £130 or when five contactless transactions have been made in a day.



-Thomas Brewster; Forbes

960×0

Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds

Take a close look at trading activity on BKEX—a cryptocurrency exchange founded in 2018 and registered in the British Virgin Islands—and you’ll see something odd. Compare its transactions side-by-side with those of Binance, one of the largest crypto exchanges in the world, and you’ll notice BKEX’s trading history is a replica, printing the same numbers delayed by a few seconds. 



According to CoinMarketCap, BKEX has $1.1 billion in daily volume, making it the 20th-largest exchange on the planet. Yet it seems to be simply copying Binance’s trade history and passing it off as its own, in perhaps the laziest attempt in history to fool people into thinking it’s a lively place to trade digital assets.   



A new report by Alameda Research, a 20-person crypto trading firm with offices in Hong Kong and Berkeley, California, reveals a clever set of tricks used by crypto exchanges to fabricate volume. 



In the wake of other reports on phony trades, including one by digital asset manager Bitwise indicating that 95% of all transactions are bogus, Alameda felt it could create better research by leveraging its trading data and experience. 



READ MORE | <a rel="noreferrer noopener" aria-label="Is Forex A Scam Or Money Goals? (opens in a new tab)" href="https://www.forbesafrica.com/investment/2019/04/01/is-forex-a-scam-or-money-goals/" target="_blank">Is Forex A Scam Or Money Goals?</a>



The startup was cofounded in 2017 by Sam Bankman-Fried, 27, an MIT alum and former trader at high frequency trading outfit Jane Street. Gary Wang, 26, a fellow MIT grad and former Google software developer, is his cofounder. The firm has $100 million in assets, and over the past month it has traded $1 billion a day on average, making it one of the largest crypto trading firms in the world. 



Exchanges make money by charging users to trade, and they have many reasons to artificially inflate volume. More activity means a higher rank on the still-popular website CoinMarketCap, which can attract new users. 



Exchanges also charge fees to new cryptocurrency projects that want to get listed in their marketplace, and the perception of popularity helps them command higher rates. Since an exchange’s place of business is just a website or an app, and many located outside the U.S. are unregulated, it can publish any numbers it wants and call them trades. 



Meanwhile, CoinMarketCap continues to insufficiently vet exchanges’ transaction volume, often taking companies at their word and publishing dubious numbers. 



According to Alameda’s research, another method exchanges use to juice their statistics is sneaking in large, fake transactions amid a flurry of smaller ones. CoinEgg, a Hong Kong-registered exchange that trades $1.1 billion a day reported by CoinMarketCap, recently employed this tactic with litecoin (LTC) trades. 



During a period when Alameda observed 15 different offers to buy and sell litecoin in a maximum quantity of 134 LTC, several trades printed as large as 2,000 LTC, as if a buyer appeared out of thin air. 



Trading marketplaces typically publish their “order book,” showing a list of bid prices at which people are willing to buy an asset, plus a separate set of offer prices where people are willing to sell. 



READ MORE | <a rel="noreferrer noopener" aria-label="How Cryptocurrency Scams Work (opens in a new tab)" href="https://www.forbesafrica.com/investment/2019/05/14/how-cryptocurrency-scams-work/" target="_blank">How Cryptocurrency Scams Work</a>



For instance, Bill might be willing to buy bitcoin at $10,000, while Mary wants to sell at no less than $10,050. For a trade to happen, a new buyer must be willing to pay the $10,050 that Mary is offering, and the vast majority of trades that clear will align with orders that previously showed up in the order book, unless two users place offsetting orders at the same exact time. 



Yet on some exchanges, trades get executed at prices and sizes that fall outside anything sitting on the order book. On Digifinex, a Singapore-based crypto trading venue, Alameda observed bids and asks for bitcoin between $8,296 and $8,298, but several trades printed at $8,290 and $8,293, prices lower than what anyone was willing to sell at.



On LAToken, a Moscow digital exchange, Alameda saw bids and offers with a maximum size of 1.6 bitcoin in the order book. Implausibly, several trades sailed through at sizes up to 20 bitcoin. LAToken founder Valentin Preobrazhenskiy says his platform only has a “tiny share” of 20-bitcoin orders and that exchanges use inflated volumes as a marketing tool. 



“The situation would change when large exchange-ranking sites would add a section for trading volumes based on trades reported to regulators,” he says. On Singapore-based ABCC, the best bid and offers Alameda saw were for sizes less than one ether, yet several transactions materialized with sizes of up to 11 ether. 



Among trading venues, there’s also the well-worn method of simply printing transactions that fall in the middle of the bid and ask prices, which Alameda’s research spotted in IDAX and Coineal. In total, Alameda’s report gives examples of fishy trading patterns on 60 different crypto exchanges. Aside from LAToken, none of the exchanges named above responded immediately to&nbsp;Forbes’&nbsp;request for comment.&nbsp;



The methodology behind Alameda’s research was to test each exchange on six different criteria. First, they manually looked at an exchange’s order book and observed where trades printed. If more than 10% of transactions didn’t appear on the order book, it failed on this dimension. Another test involved observing the percent of an exchange’s trades that took place at the best available bids or offers.&nbsp;



A third criterion was to analyze how much Alameda itself traded on a given exchange, since the startup deals in “virtually every cryptocurrency,” considers its algorithms “exchange-agnostic” and estimates that it trades 5% of all global crypto volume. 



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“If we trade more than .5% of an exchange’s reported volume, we consider that exchange to pass according to this criterion,” the report  reads. For more details on its methodology, see the full report.</blockquote>



Beyond exchanges’ bad behavior, the report has other provocative insights. It claims that crypto—including both “spot” trades of actual digital assets and derivatives, like bitcoin futures—trades $38 billion in real volume a day, and 87% of that happens on Asian exchanges, with just 9% happening on U.S. venues. The strict regulatory environment in the U.S. is likely a contributing factor in Asia’s dominance, Alameda says.&nbsp;



Compared with Bitwise, which released a follow-up fake volume reportin May 2019, Alameda thinks more crypto volume is real. For large exchanges like OKEx and Huobi, which were founded in China, Alameda estimates about 70% of their transactions are authentic. 



Bitwise is much more skeptical, as is the Blockchain Transparency Institute, which has estimated that more than 60% of Huobi’s volume is fake and more than 90% of OKEx’s volume is fabricated. 



A Huobi spokesperson says it doesn’t engage in wash trading, but that it has observed some market-makers doing so on its platform, and it takes steps to stamp them out.



 An OKEx spokesperson says the company isn’t involved in and doesn’t tolerate wash trading, adding, “Recently we have joined the Data Accountability &amp; Transparency Alliance (DATA) led by CoinMarketCap, as a commitment to reveal as much data as possible.”



-Jeff Kauflin; Forbes Staff

Cryptocurrency Mining In Africa As Poor Sheperdherder Proves A Point

The Anatomy Of A Fake Cryptocurrency Trade: How Exchanges Create Phony Transactions

Millions of cryptocurrency investors&nbsp;have been scammed out of massive sums of real money. In 2018, losses from cryptocurrency-related crimes amounted to&nbsp;US$1.7 billion. The criminals use both old-fashioned and new-technology tactics to swindle their marks in schemes based on digital currencies exchanged through online databases called blockchains.



From&nbsp;researching&nbsp;blockchain,&nbsp;cryptocurrency&nbsp;and&nbsp;cybercrime, I can see that some cryptocurrency fraudsters rely on&nbsp;tried-and-true Ponzi schemes&nbsp;that use income from new participants to pay out returns to earlier investors.



Others use&nbsp;<a href="https://www.buzzfeednews.com/article/ryanmac/cryptocurrency-scammers-are-running-wild-on-telegram">h</a>ighly automatized and sophisticated processes, including automated software that interacts with Telegram, an internet-based instant-messaging system popular among people interested in cryptocurrencies. Even when a cryptocurrency plan is legitimate, fraudsters can still&nbsp;manipulate its price in the marketplace.



An even more basic question arises, though: How are unsuspecting investors attracted to cryptocurrency frauds in the first place?



RELATED | <a href="https://www.forbesafrica.com/investment/2019/04/01/is-forex-a-scam-or-money-goals/">Is Forex A Scam Or Money Goals?</a>



<h4 class="wp-block-heading">Fast-talking swindlers</h4>



Some cryptocurrency fraudsters appeal to people’s greed, promising big returns. For example, an unknown group of entrepreneurs runs the scam bot iCenter, which is a&nbsp;<a href="https://medium.com/@nickcryptoltc/ponzi-investment-schemes-new-and-improved-on-the-blockchain-icenter-co-f9ee68f6c8fe">P</a>onzi scheme for Bitcoin and Litecoin. It doesn’t provide information on investment strategies, but somehow&nbsp;promises investors 1.2% daily returns.



The iCenter scheme operates through a group chat on Telegram. It starts with a small group of scammers who are in on the racket. They get a referral code that they share with others, in blogs and on social media, hoping to get them to join the chat. Once there, the newcomers see encouraging and exciting messages from the original scammers. Some newcomers decide to invest, at which point they are assigned an individual bitcoin wallet, into which they can deposit bitcoins. They agree to wait some period of time – 99 or 120 days – to receive a significant return.



During that time, the newcomers often use&nbsp;social media to share their own referral codes&nbsp;with friends and contacts, bringing more people into the group chat and into the investment scheme. There’s no actual investment of the funds in any legitimate business. Instead, when new people join, the person who recruited them gets a percentage of the new funds, and the cycle continues, paying out to earlier participants from each round of newer investors.



Some members work especially hard to bring in new funds, posting&nbsp;<a href="https://www.buzzfeednews.com/article/ryanmac/cryptocurrency-scammers-are-running-wild-on-telegram">t</a>utorial videos and pictures of themselves holding large amounts of money&nbsp;as enticements to join the scam.



<h4 class="wp-block-heading">Lies and more lies</h4>



Some scammers go for straight-up deception. The founders of scam cryptocurrency OneCoin&nbsp;defrauded investors of $3.8 billion&nbsp;by convincing people their&nbsp;nonexistent cryptocurrency was real.



Other scams are based on impressing potential victims with jargon or claims of specialized knowledge. The Global Trading scammers claimed they took advantage of&nbsp;price differences on various cryptocurrency exchanges&nbsp;to profit from what is called arbitrage – simply buying cheaply and selling at higher prices. Really they just took investors’ money.



Global Trading used a bot on Telegram, too – investors could send a balance inquiry message and&nbsp;get a response with false information&nbsp;about how much was in their account, sometimes even seeing balances&nbsp;climb by 1% in an hour. With returns looking like that, who could blame people for&nbsp;sharing the scheme&nbsp;with their friends and family on social media?



<h4 class="wp-block-heading">Exploiting friends and family</h4>



Once a scheme has started, it stays alive – at least for a while – through social media. One person gets taken in by the promise of big returns on cryptocurrency investments and spreads the word to&nbsp;<a href="https://news.bitcoin.com/crypto-scams-comprise-0-6-fraud-australian-consumer-watchdog/">f</a>riends and family members.



Sometimes big names get involved. For instance, the kingpin behind&nbsp;GainBitcoin&nbsp;and other alleged scams in India convinced a number of Bollywood celebrities to&nbsp;promote his book, “Cryptocurrency for Beginners.” He even tried to make himself&nbsp;a bit of a celebrity, proclaiming himself a “cryptocurrency guru,” as he&nbsp;led&nbsp;efforts&nbsp;that&nbsp;costinvestors between&nbsp;$769 million and $2 billion.



Not all the celebrities know they’re involved. In one blog post, iCenter featured a video that purported to be an&nbsp;endorsement by Dwayne “The Rock” Johnson, holding a sign featuring iCenter’s logo. Videos of Justin Timberlake and Christopher Walken were deceptively edited so they appeared to praise iCenter, too.



<h4 class="wp-block-heading">Fraudulent initial coin offerings</h4>



Another popular scam technique is called an “initial coin offering.” A potentially legitimate investment opportunity, an initial coin offering essentially is a way for a startup cryptocurrency company to raise money from its future users: In exchange for sending active cryptocurrencies like bitcoin and ethereum, customers are promised a discount on the new cryptocoins.



Many initial coin offerings have&nbsp;turned out to be scams, with organizers engaging in cunning plots, even renting fake offices and creating fancy-looking marketing materials. In 2017, a lot of hype and media coverage about cryptocurrencies fed a huge wave of initial coin offering fraud. In 2018,&nbsp;about 1,000 initial coin offering efforts&nbsp;collapsed, costing backers at least $100 million. Many of these projects had no original ideas –&nbsp;more than 15% of them&nbsp;had copied ideas from other cryptocurrency efforts, or even plagiarized supporting documentation.



Investors looking for returns in a new technology sector are still interested in blockchains and cryptocurrencies – but should beware that they are complex systems that are new even to those who are selling them. Newcomers and relative experts alike have fallen prey to scams.



In an environment like the current cryptocurrency market, potential investors should be very careful to research what they’re putting their money into and be sure to find out who is involved as well as what the actual plan is for making real money – without defrauding others.



&#8211;Nir Kshetri; Professor of Management, University of North Carolina – Greensboro



&#8211;The Conversation



<img loading="lazy" decoding="async" src="https://counter.theconversation.com/content/114706/count.gif?distributor=republish-lightbox-advanced" alt="The Conversation" width="1" height="1" style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important; text-shadow: none !important">

Tag: scam

FORBES AFRICA SOCIAL MEDIA

Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds

The Anatomy Of A Fake Cryptocurrency Trade: How Exchanges Create Phony Transactions

How Cryptocurrency Scams Work

Is Forex A Scam Or Money Goals?