This instructable explains how we removed the smartcard chip of our contactless payment card and adapted it to upgrade Lieven's Sonic Screwdriver for contactless payments.

Built by Lieven Scheire and Maarten Weyn
Helping hand behind the scenes: Kurt Beheydt

youtube link

Step 1: Contactless Payments???!

Most new debit and credit cards have the possibility to be used for contactless payments. These cards have a slightly different chip and antenna inside. They are recognized by the wireless logo, moreover you have to enable this option at your bank (some banks enable it by default). The amount you can pay without a PIN code is very limited and depending on the country. [floor limit]

The cards use RFID (Radio Frequency Identification) to communicate wirelessly with the payment terminal instead of using the contacts which are visible on the chip.

When the card is held in the very close proximity of the payment terminal the electromagnetic field of the terminal RFID reader powers the chip wirelessly, which enables the chip to modulate the wireless coupling between the card and the terminal in order to exchange information.

An XRay view of the card (courtesy of Jayefuu) shows the inside of a card with the antenna, the chip and the terminals where the antenna is connected to.

So you need a chip and an antenna which can work on 13.56 MHz, but no one says this antenna has to be inside the card....

Frame-08-10-2018-01-38-28.tiff
Download

Step 2: Removing the Chip From the Card

First we need to remove the chip from the card.

Using acetone you can easily remove the chip from the card, just put it in a glass container and wait one to two hours. Make sure you protect your hand and do not spill the acetone, there is a reason the card disintegrates in acetone...

Important disclaimer: this step is non-reversible!

Step 3: Create Your Own Antenna

WARNING!!! this is a very technical part, if you do not care about how and why things work, just skip this and go to the next step...

The operating frequency of the wireless communication is 13.56 MHz, most smartcards are tuned a bit above this frequency. This is because anything in the vicinity will impact the resonance frequency anyway.

The RFID standard which is used for this wireless communication is the ISO/IEC 14443 specification (Identification cards -- Contactless integrated circuit cards -- Proximity cards).

Two important implementations of this protocol are Mifare and MVP. The later one are the smart cards which are used for payments.

The size of a banking card is defined by the ISO/IEC 7810 standard and is normally the ISO/IEC 7810 ID-1 format, resulting the dimensions of 85.60 × 53.98 mm and part 1 of ISO/IEC 14443 defines different types of such the antenna coil as shown in the figure [source]. Typically class 1 is used, but smaller sizes (towards class 2 is also used). This depends on the card manufacturer. A nice breakdown of different cards can be found in this [technical report]. They also measured the resonance frequency, and most cards were tuned between 14 MHz and 18 MHz. The coil size, the resonance frequency and the quality factor are important parameters when designing the antenna coil.

The resonance frequency is dependent on the capacitance and the inductance of the coil. Every chip has a specific internal capacitance, but it is not that trivial to find the specifications of your chip. For a mifare plus chip e.g. of class 1, according to NXP 17pF is the recommended internal capacitance and 70 pF for class 2. The Micropass® 6323 smartcard chip of WISekey for example has a internal tuning capacitance of 95 pF.

If you would know the capacitance C you can calculate the ideal inductance L of your coil by

Fres= 1 / (2 . pi sqrt(L . C))

where Fres should be between 14 and 18 MHz.

Which would result in a inductance between 0.8uH and 1.4uH for 95 pF capacitance or 4.6uH and 7.6uH for 17pF. (note this capacitance can be adapted later with an external capacitor.)

Now that you could know your targeted inductance you could use a calculator, for example this one.

For the antenna for the Sonic Screwdriver we had to use a radius of 4.5 cm to fit in the screwdriver, we used enamelled coper wire with a diameter of 0.315 MM and 8 turns resulting in a calculated inductance of 5.9 uH.

With a Network Vector Analyser you could then calculated the resonance frequency and and adapt your coil or inductance, but we do understand that that is something which is by default not installed in every domestic house.... An easier way is discussed in the next step: Trial and error!

Frame-08-10-2018-01-39-15.tiff
Download

Step 4: Create Your Own Antenna: the Easy Way

The easiest way to find the right antenna size and number of turns, is to find you someone with an NFC enabled android smartphone and use an NFC app, for example NFC Tools.

When you read out a wireless enabled card you will be able to see the tag type and e.g the serial number.

The trial and error method is quite easy:

Make a coil with much to many loops, e.g 15 loops and 4.5 cm diameter.
Connect them to the right terminals of the chip (see next step)
Check with your phone if you can read out the chip

If you can read out the chip, the chances are very high that you will also be able the read it with the payment terminal since the signal power of a payment terminal is much higher.

Step 5: Attach the Antenna to the Smartcard Chip

Ok now it is time to connect our antenna to the chip.

To solder the enamelled wire to the chip you have to remove the coating, this can be done under a small flame or using a knife (watch out not to cut the wire).
If you haven't done so, remove the old antenna, when you start soldering the two metal plates which are glued to the chip will probably also come apart. Take good notice to which terminals they are connected to.
Solder your antenna to the side terminals, make sure you only link to the ones which were connected to the metal plates.
Test with a multimeter if the two terminals are connect.
Test with your smartphone is you can read out your tag, if not adapt the antenna (only loosen 1 side and solder again).