Module 15 of 22 · Operator · 75 min
Contactless limits and the cumulative-limit bypass
Why tapping stops after five times and asks for a PIN, where that counter really lives, and two pieces of published research that got past it: one resetting the counter without ever knowing a PIN, one making a plastic card present as a phone to an ordinary unattended terminal.
Enrollment required
Module 1 of this course is free to read. Buying the course opens every other module, the transaction lab and search across the course. The workbench and the APDU decoder stay free for anyone.
The course is tied to your account, so you sign in first and come straight back here.
One payment for this course. Access for as long as the course exists, with every update and new research module that follows, at no further cost.
No hardware is sold here, and none is needed to read the course.
Payments are final. Module 1 is free so you can judge the course before you pay. Terms
Already enrolled? Sign in
Open the free workbench →What this module covers
- 01Three limits, and none of them is the one people mean
- 02The comparison is inclusive, and one book says otherwise
- 03Nobody assigned these a tag
- 04A wall in one country, a gate in another
- 05Where the decision is written down
- 06Two bits, and a limit that stops applying
- 07Why Mastercard was not on that list
- 08A kernel that does compare them
- 09The counters the card keeps itself
- 10Before the rule, there was liability
- 11The cumulative limit
- 12Three checks, and the gap between them
- 13The offline PIN, and the status word that means yes
- 14What the card writes down
- 15Two schemes, two attack surfaces
- 16And then the terminal went offline
- 17The fixes, and why they are cheap
- 18Four limits, four owners
- 19What to test
- 20Where to read next