Comcast has folded its Wi-Fi-based intruder detection feature into Xfinity Shield, a repackaged bundle of physical and cybersecurity offerings. The US telco launched WiFi Motion in 2025. Xfinity Shield also includes cybersecurity protections built into the Xfinity Gateway router. The Wi-Fi sensing technology harnesses the radio waves beamed around a user's home to detect motion and potential intruders. "Using Xfinity Gateway intelligence, WiFi Motion detects changes in the home's radio frequency signal between the Xfinity Gateway and a Wi-Fi connected device, then sends instant notifications to customers through the Xfinity app when unexpected activity is detected," Comcast said. "It provides an added layer of awareness without recording video, capturing images or identifying individuals." The company does not consider this a home security service, merely a feature, because it is not managed by a dedicated security provider. Not every connected device can support the sensing feature. It uses the Xfinity Gateway, Xfinity Wi-Fi extenders, and up to three other compatible devices around the home. Crucially, these devices must be stationary. Think thermostats and home speakers, not smartphones or toothbrushes. Comcast advises users to position the router and extenders so that their signals pass through the areas where they want to detect motion. Open spaces such as hallways work best, and the company urges routine testing to ensure coverage is maintained. A setting in the Xfinity app allows WiFi Motion to ignore small pets. Animals weighing around 18 kg (40 pounds) or less will not trigger alerts when this setting is enabled, and the app warns this may also exclude small children. Customers can also adjust the sensitivity of the motion detection, choosing from low, medium, and high-sensitivity modes. Comcast says the latter works best in single-family, detached homes, whereas those who share walls with neighbors may want to choose the less-sensitive settings to avoid meaningless notifications. The telco also assured customers that WiFi Motion does not track individuals or their precise movements, and cannot identify specific people. It added that it "does not monitor motion and/or notifications generated by the service." The small print, which also accompanied the 2025 launch, suggests the service may not be quite as private as the marketing implies. Comcast states: "Subject to applicable law, Comcast may disclose information generated by your WiFi Motion to third parties without further notice to you in connection with any law enforcement investigation or proceeding, any dispute to which Comcast is a party, or pursuant to a court order or subpoena." Comcast does not specify what information may be disclosed or which "third parties," beyond law enforcement, might receive it. How it works Users can establish "sensing areas" by placing Wi-Fi devices around parts of the home with regular foot traffic. Comcast describes each sensing area as a long oval extending between two connected devices. Sensing areas can be established through walls separating rooms, although in two-storey or multi-storey homes, the telco encourages customers to avoid placing Wi-Fi equipment directly above or below each other. "Motion is detected within the sensing area when movement disrupts the wireless signals that travel between your Xfinity WiFi equipment and selected WiFi-connected devices within the sensing area," said Comcast. "Notifications will be sent only when motion disrupts the wireless signals in the sensing area between the WiFi equipment and your connected devices." Not a novel feature Comcast is the latest, but not the first, to harness Wi-Fi radio waves for motion detection. Companies such as Cognitive Systems and Origin Wireless have been developing other uses for wireless signals. Beyond domestic intruder alerts, the technology can measure occupancy and foot traffic in commercial buildings, helping operators reduce energy consumption and make better use of leased space. Wireless signals can also be used to support caregivers in places like assisted living centers. Wi-Fi transmissions can help track activity patterns and build a greater understanding of patients' fall risks, for example. Boffins began working on an official Wi-Fi sensing standard in 2020. Following a draft published by the IEEE in 2023, the 802.11bf standard was ratified in 2025. Major chipmakers including MediaTek, Qualcomm, and others are now working on embedding the standard into their Wi-Fi 7 chips and beyond. SaaS biz Plume, which provides smart home services to consumers and ISPs, has offered Wi-Fi sensing since 2020, around the time the 802.11bf working group began devising the standard. ®

Researchers affiliated with the University of Massachusetts Amherst have found that you can get payments out of certain expired contactless credit cards, a process detailed at the recent USENIX Security 2026 conference. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza describe their findings in a paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments." Credit cards, the authors explain in their paper, have expiration dates, but the way these dates get checked and enforced isn't consistent. Thus, they were able to devise an attack that makes expired contactless cards appear to be valid to payment terminals. The Europay, Mastercard, and Visa (EMV) payment process involves a payment card (card or digital wallet in a phone) and a point-of-sale terminal communicating over a direct NFC channel, linked to a payment network (eg, Visa, Mastercard, Discover) that links the merchant to a bank and a card issuer. The transaction process relies on the EMV contactless protocol, which the authors say is fragile because the transaction flow is selectively authenticated – some of the data gets sent between the card and terminal in plaintext and is only later linked to cryptographic verification using Offline Data Authentication (ODA) and issuer-verified cryptograms. This leaves an opening for unwanted intermediary interference, which requires only the necessary knowledge and mobile phones acting as NFC proxies. And indeed, the researchers demonstrated that they could meddle in a way that revives expired contactless payment cards to make purchases. "Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection," the authors state in their paper. What's more, they say, the wallet Card Transaction Qualifiers settings steer transactions toward online authorization checks instead of rejecting the transaction immediately. That shifts the enforcement burden to the card issuer where behavior varies and may rely on the POS terminal evaluation rather than conducting a full security check during transaction authorization. The EMV protocol is implemented in EMV kernels. American Express, Discover, Mastercard, and Visa each run their own kernels. Visa's kernel, the authors observe, is a bit more permissive than others. It doesn't bind the expiration date cryptographically. The Visa kernel allows the POS terminal to evaluate processing restrictions based on the Application Expiration Date, the authors explain. But the card issuer relies on an expiration date from a different data field in the online authorization request. These two dates should be cryptographically bound to each other, but they're not. This gap allowed the researchers to devise an attack using NFC proxy devices, as demonstrated in this video. Mastercard, American Express, and Discover configurations resisted the attack; Visa contactless cards did not. "The card gives the checkout terminal an expiry date to read," the authors explain in a summary of their work. "In the Visa contactless configuration we tested, that particular date was not covered by the card’s digital signature. Someone positioned between the card and terminal could therefore alter what the terminal sees while leaving the card’s normal security checks looking valid." Since Visa's approach kicks the authentication handling down the road to the bank involved, the attack's success depended on how the bank handled the transaction. Some of the banks tested succumbed, while others didn't. Raja Hasnain Anwar, lead author and a doctoral candidate at UMass Amherst, told The Register in an email that the reason Visa cards are affected by this attack has to do with the way different card manufacturers have different protocols for handling contactless transactions. "These protocols have most messages in common to ensure global acceptance on different types of terminals; however, each manufacturer has their design choices to make for additional mechanisms," he said. "Often, these design choices end up in a compromise to ensure backward compatibility with old POS terminals, and also to meet their performance criteria. "The security checks are in place, however, only a subset of these security mechanisms are invoked to make the transaction faster and smoother. There are other research studies that have shown issues with Mastercards as well. It comes down to the trade-off between performance and security, and often leaves room for this kind of vulnerability. No design is inherently bad." The authors say that they notified Visa of their findings in May 2025 and followed up in December 2025. Neither Visa nor the banks notified have confirmed that they've mitigated the expiration issue. Visa did not immediately respond to a request for comment. Let the dumpster dive for discarded cards begin. ®