Android loophole allows Google Wallet to leak credit card details via NFC, fix coming
A loophole in Android allows a niche scenario to leak credit card details via an NFC reader even when the phone is locked.
Daily reminder to leave NFC off and only turn it on when needed since Google Pay and other apps seem to have no concept of only being used when the app is explicitly open.
I've had it twice now where I was standing a little too close to the tap-to-pay terminal on the bus since it was nearly full, and it counted that I "tapped" in again. This is while I was still a full nearly 5 inches away, browsing a completely different app.
Not to mention, how is this not a setting in google pay or the quick menu??? Google removed NFC toggle from the quick menu so you need to turn it off, otherwise it feels like someone could just "tap" to steal money from your unlocked phone from 6+ inches away. Baffling to me.
detailed on GitHub, a security issue that’s been given the marker CVE-2023-35671 affects Android devices and allows access to full credit card details through NFC devices like the popular Flipper Zero tool.
Gotta worry about card skimmers for nfc
“Loophole” huh? Sounds like a security issue.
This fucking pisses me off. No wonder my credit card details were stolen last month. I only ever use NFC.
That's their one shot. No more mobile payments for me. Deactivated now.
Did you read the article? Unless someone had physical access to your (unlocked) phone and was able to pin an app, then tap it against specialized hardware (unlikely you could get a normal card terminal to run this exploit), it's extremely unlikely that this is how your details got stolen.
