Cloning Credit Cards: A combined pre-play and downgrade attack on EMV Contactless

Michael Roland, Josef Langer

Research output: Chapter in Book/Report/Conference proceedingsConference contributionpeer-review

25 Citations (Scopus)


Recent roll-outs of contactless payment infrastructures -- particularly in Austria and Germany -- have raised concerns about the security of contactless payment cards and Near Field Communication (NFC). There are well-known attack scenarios like relay attacks and skimming of credit card numbers. However, banks and credit card schemes often mitigate these attacks. They explain that attacks are impractical (e.g. in a relay attack an attacker needs to have RF access to a victim's card while performing a payment transaction) or even impossible (e.g. skimmed data does not contain the dynamic authorization codes that are normally required to perform a payment transaction). This paper introduces an attack scenario on EMV contactless payment cards that permits an attacker to create functional clones of a card that contain the necessary credit card data as well as pre-played authorization codes. The card clones can then be used to perform a limited number of EMV Mag-Stripe transactions at any EMV contactless payment terminal.
Original languageEnglish
Title of host publicationProceedings of the 7th USENIX Workshop on Offensive Technologies (WOOT'13)
Number of pages12
Publication statusPublished - 2013
Event7th USENIX Workshop on Offensive Technologies (WOOT'13) - Washington, D.C., United States
Duration: 13 Aug 201313 Aug 2013


Workshop7th USENIX Workshop on Offensive Technologies (WOOT'13)
Country/TerritoryUnited States
CityWashington, D.C.
Internet address


Dive into the research topics of 'Cloning Credit Cards: A combined pre-play and downgrade attack on EMV Contactless'. Together they form a unique fingerprint.

Cite this