How an Engineer Implanted Contactless Payment into the Legendary CASIO F-91W

Italian cybersecurity engineer Matteo Pisani decided to do away with the need to pull out a phone or card at the checkout. His choice fell on the CASIO F-91W — the very same digital watch from the 1980s that he, by his own admission, has been wearing “since I had acne on my face.” The idea was simple: touch your hand to the terminal and pay. The execution turned out to be far more intricate.

Taking It Apart to Understand It

The author started by dismantling an ordinary contactless card. Using a heat gun (around 100 °C), he carefully separated the chip from the plastic body with circular motions, trying not to melt anything. It turned out that the card belonged to a new generation: the chip is not soldered to the antenna but inductively coupled to it — a large antenna in the card body induces a current in the tiny coil of the module itself.

To “see” the radio waves, Pisani assembled a whole arsenal: a NanoVNA network analyzer, the Proxmark3 open platform for RFID research, and an RFID-RC522 module, from which he desoldered the capacitors and turned the printed antenna into a measurement probe.

“Fishing” Tuning

The most elegant part was the method of winding his own antenna. Precisely calculating the length and impedance is a lengthy affair, so the author, in his own words, took the path of the “lazy hacker.” He called the trick “fishing tuning”: he wound thin enameled wire (0.10 mm) onto a 3D-printed coil and then slowly let it out, watching the hf tune command on the Proxmark3 — it shows the voltage drop in real time. The deeper the dip, the better the resonance. Once he caught the maximum (around 11 mV), he trimmed off the excess. The final antenna came out to about 1.6 meters long.

Assembly

Placing the antenna on the back cover didn't work out: too many shielding metal parts. So Pisani 3D-printed a new front panel with a recess for the chip and a groove around the perimeter for the wire, and replaced the metal back cover with a plastic (PLA) one to reduce interference. He filled the display opening with clear UV resin, imitating glass. The central mechanism was left untouched — the watch still tells the time.

The result, judging by the description, works flawlessly: the author paid with the modified watch in stores and vending machines. A particular pleasure, he says, is the stunned faces of people at the register when they realize exactly what the purchase was paid with.

On the roadmap is protection against “pickpockets with a reader”: breaking the antenna and closing the circuit with a watch button, and eventually adding a second chip and coil, switchable at the press of a button. The author posted the STL files for the panels and a collection of documentation on GitHub, accompanying the material with the obligatory disclaimer: everything was done for educational purposes.

Source: Lobsters