31

Is it possible to read the credit card details (name, number, expiry) of a Visa payWave card via NFC on a Samsung Galaxy Nexus? What about other NFC-enabled credit cards?

If it's not possible, is there some way to retrieve a unique ID from the card?

Also, any references or example code would be a great help.

2 Answers 2

35

There are at least 2 Android apps that can already do this: Squareless and Electronic Pickpocket RFID.

Some references:

4
  • 1
    These are great resources for understanding how to read EMV data in Java but they seem to be based on USB/serial card readers. How can EMV data be read on Android via the NFC API? (Obviously, it's possible if the above 2 apps can do it.) Mar 11, 2012 at 14:14
  • 1
    Example translation of selectApplication() in the last link above: byte[] selectApplication(IsoDep tag) throws IOException { byte[] command = new byte[]{0x00, 0xA4, 0x04, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x04}; return tag.transceive(command); }. The tag you would get from the NFC Intent: IsoDep tag = IsoDep.get(getIntent().getParcelableExtra(NfcAdapter.EXTRA_TAG);.
    – NFC guy
    Mar 12, 2012 at 15:18
  • Thanks. I actually figured this out myself but I wasn't really sure, so thanks for the confirmation on this. Some final questions: are the APDU commands/responses used with ISO14443 devices the same as those from ISO7816? Is there a good reference for the ISO14443 APDU commands, aside from buying the docs from ISO? Mar 13, 2012 at 10:38
  • Not all ISO 14443-4 devices use ISO 7816-4 APDUs, but quite a few do (such as payment cards).
    – NFC guy
    Mar 13, 2012 at 11:52
1

Triangle.io also has an API that allows you to do this free of charge and you can integrate it in your own application. You can download the sample application from Google Play.

Disclaimer: I work for triangle.io

4
  • Of course it is safe to use :) We use RSA 2048 bit encryption with keys unique to each application and provide only encrypted information. A typical setup our clients use is to send the encrypted information over HTTPS to their back end and decrypt the data there for further processing. This way, no data in the clear is transmitted in the phone internally.
    – Ameen
    Oct 31, 2013 at 15:25
  • Your triangle.io initialization procedure suddenly has started to fail in my project. That sucks Jun 5, 2014 at 14:11
  • @Bagzerg, there have been no downtimes. Were you having connectivity issues on your end or were you using a trial key that expired? Please use co[email protected] to reach out to us so that we can take a look.
    – Ameen
    Jun 12, 2014 at 0:52
  • I'm currently using Triangle.io and it's great!
    – MosesA
    Jun 25, 2014 at 9:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.