The researchers travelled on the tube on a cloned card, reset its credit level from a laptop and caused gates to jam closed.
Transport for London (TfL) said that its Oyster cards are secure, that personal information is kept separate from journey information and that anyone caught using a cloned card would be prosecuted.
The system is checked every 24 hours and the best any Oyster criminal could get is a day's free travel, the company claimed.
Radboud researcher Wouter Teepe presented evidence on the crack to the Dutch parliament, which has already delayed installation of a €1bn automated payment transport system based on the same core technology.
At the heart of an Oyster card is the Mifare chip, made by Philips spin-off NXP.
Designed in the 1990s before processors of that size could handle strong encryption, Mifare has suffered at least three published cracks, according to security experts who have urged TfL to upgrade the system.
Researchers crack London tube card security
Researchers from Radboud University in the Netherlands have successfully cracked the security of the Oyster card used for fare payments on buses and tubes in London..
Add iTnews as your trusted source
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.jpg&h=140&w=231&c=1&s=0)
Partner Content
From data overload to decisive action – accelerating decisions with AI agents
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Australian mid-market businesses to access deeper AI and security expertise with First Focus-Integris partnership
iTnews State of Security Breakfast comes to Sydney
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Protecting the Human Operating System: How Technology Teams Can Perform Under Pressure in an Always-On World
SPONSORED RESOURCES
Closing the cyber security execution gap: How IT leaders are building cyber resilience
Tech Skills Report
Rethinking Ransomware Recovery: Closing the Detection and Recovery Gap in Asia Pacific
Strategies to Counter the Ransomware Threat in APJ
Craft your ideal hybrid multicloud strategy
Cloud Resilience Summit
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
