Here's a video that shows how easy it is for people to set these up.
Would you have spotted the fraud?
31–40 of 56 posts
Re: Would you have spotted the fraud?
#32I've started to pull and wiggle the card slot a bit before sticking the card in. From these photo's, I have the impression these skimming devices should be a little 'looser' than the regular thing. However, it may be completely useless. My second countermeasure is screening the number pad with my hand while entering my PIN. They can probably make out the PIN from hand movements, but I'm hoping it'll be too much troub…
I'm a wiggler as well.
Re: Would you have spotted the fraud?
#33Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…
In Europe, they could do away with the magnetic strip on cash cards. All terminals from recent years support the smartcard interface to the chip on the card. Presumably they keep the strip around for when you visit a country that doesn't use the smart card interface, so they can charge you an arm and a leg for exchanging currencies. And that recent case in Germany where the chips didn't support the year 2010, so you…
Hm, should I glue a strip of tinfoil on the magnetic strip? Or what would be a good way to disable it?
Re: Would you have spotted the fraud?
#34It depends how well glued solid it is.
Ever since I read about these a few years ago I got into the habit of pushing and trying to move around parts of the ATM, like windows, the card reader, brochure boxes, etc to see if they can come off.
Also, inspect by touch for places where a camera or stray wire could hide, that are out of view, under perhaps a display sign, brochure box, on the upper part of the keypad that might be hidden from view.
Also, use other hand to cover up fingers when entering pin.
Re: Would you have spotted the fraud?
#35It depends how well glued solid it is. Ever since I read about these a few years ago I got into the habit of pushing and trying to move around parts of the ATM, like windows, the card reader, brochure boxes, etc to see if they can come off. Also, inspect by touch for places where a camera or stray wire could hide, that are out of view, under perhaps a display sign, brochure box, on the upper part of the keypad that m…
I do the same thing, people look at me like I'm crazy.
Re: Would you have spotted the fraud?
#36It depends how well glued solid it is. Ever since I read about these a few years ago I got into the habit of pushing and trying to move around parts of the ATM, like windows, the card reader, brochure boxes, etc to see if they can come off. Also, inspect by touch for places where a camera or stray wire could hide, that are out of view, under perhaps a display sign, brochure box, on the upper part of the keypad that m…
I wonder if there's a risk that some random bank security reviewer would consider this to be tampering.
Re: Would you have spotted the fraud?
#37That scared the shit out of me, because I'm a Citibank customer, and I live in Woodland Hills. In fact, I just noticed that they just put a giant opaque enclosure around their ATMs for privacy recently, wonder if this is why.
OC, luckily, I never actually use the Citi ATMs, thank god.
Re: Would you have spotted the fraud?
#38Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…
> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.
Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter?
(I'm not saying your wrong, I'm just wondering why it would help?)
Re: Would you have spotted the fraud?
#39Another thought... When someone steals account information using such methods, it is unlikely the ATM owner/operator who is responsible for losses. After all, it would be really hard to prove conclusively that it was the fault of a particular ATM's lack of security that led to future thefts. Perhaps strong correlation could be shown, but the legal costs associated with reimbursement likely outweigh the efforts, at le…
I was just a victim of ATM fraud (presumably by skimmer) and according to the detective who handled the police report, there is almost no cooperation from banks and card providers. It is not in their interest that you know how much fraud there is out there. I have heard figures of over 8-10% in the US. That's a lot of overhead to be passing onto the consumer.
8-10% of what?
Re: Would you have spotted the fraud?
#40Given how entrenched the ATM card standards are, it will be hard to make fundamental changes to improve security. If one could replace all ATMs in existence, one obvious solution is to issue RNG cards. Perhaps, to make them easy to use, the challenge/response could be electronic ala the "Java Ring" technologies (from TI) advocated by Sun a decade ago. What could be done given that the fundamental use of an ATM machin…
Could smart phones be used to provide a "have something" security model?
Could an OTP generator like RSA SecurID do the trick? Let's say you enter two memorized numbers and then the last two numbers on the fob to make the four digit PIN (you would not want the whole PIN to be on the fob). Bonus: you need to use it for web logon as well.
Some customers will pay extra for such services. Potentially avoiding hassles like ATM fraud and identity theft in the first place is worth a small fee per month to me because of the massive timesuck that could take place if they happened.