← Payment Systems: Magstripe, Tokenization, NFC and EMV
Level 3 · Operator75 min
Contactless limits and the cumulative-limit bypass
Why tapping stops asking for a PIN after five times, where that counter really lives, and two pieces of published research that got past it — one resetting the counter without ever knowing a PIN, one making a plastic card present as a phone to an offline reader anyone can buy.
Enrolment required
Module 1 of this course is free to read. The rest needs an enrolment — and so does nothing else on this site: the workbench, the APDU decoder and the whole capture corpus stay open to everyone, signed in or not.
What this module covers
- 01Before the rule, there was liability
- 02The cumulative limit
- 03Three checks, and the gap between them
- 04The offline PIN, and the status word that means yes
- 05What the card writes down
- 06Two schemes, two attack surfaces
- 07And then the terminal went offline
- 08The fixes, and why they are cheap
- 09What to test