Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#41

Post by notch656a »

maherbeg wrote: post #32
reaperducer wrote: post #16

Earlier quoted context omitted.

I often just leave the house with my phone and buy stuff with apple pay. I admire your uncomplicated, predictable life. Sometimes I want to buy something from a guy with the ice cream cart at the park. Sometimes I need to tip a valet, a doorman, a hotel maid, or another service worker. Sometimes I want to buy Girl Scout cookies from the girl with the table on the corner. Sometimes I want to buy something from one of…

You'd be surprised how often you can ask "do you have a venmo?" and just tip service workers via the QR code.

As a double advantage, it ensures the workers tips are 1099-K'd when their venmo hits $600 aggregate and they can't weasel out of the social contract of paying up for muh roads.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#42

Post by [deleted] »

Scoundreller wrote: post #28
skunkworker wrote: post #22

I'm still a little surprised I can't easily get chip-only credit cards that have no magnetic strip on the rear, but rather have a backup card that has a strip, and use chip/tap for everything else.

Could always cut out the chip and place it on another recipient card. Nobody looks at the card for chip+pin transactions, but you’ll lose “tap” payment ability. I suppose you could get an “associate card” and destructively disable the chip and magstripe to accomplish your goal.

[deleted]

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#43

Post by mwint »

Scoundreller wrote: post #28
skunkworker wrote: post #22

I'm still a little surprised I can't easily get chip-only credit cards that have no magnetic strip on the rear, but rather have a backup card that has a strip, and use chip/tap for everything else.

Could always cut out the chip and place it on another recipient card. Nobody looks at the card for chip+pin transactions, but you’ll lose “tap” payment ability. I suppose you could get an “associate card” and destructively disable the chip and magstripe to accomplish your goal.

Would a good rubbing with a rare earth magnet clear the magstripe?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#44

Post by tialaramex »

bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

As the article says, some smaller outfits still use card stripe data.

The impetus to get retailers to start using the chip was "Liability shift". The payment networks gradually changed the rules (I think in the US pay-at-pump gasoline purchases were last to get this, while big retail stores were earlier) so that the liability if a transaction is latterly discovered to be fraudulent is with the retailer who accepted the dodgy transaction, not the payment network if the retailer didn't use the chip.

But I imagine if you're a little store in the country, maybe you do six card transactions per day, almost all of them with customers you know personally who just find the card more convenient, liability shift isn't a huge worry for you, while the cost of a new payment terminal is a significant issue.

The actual payment infrastructure doesn't care about any of this. Those old impression machines? Mag stripe? Put the card in manually? Tap your iPhone? In all cases the actual transaction which moves money, "Settlement", just needs the account number to take money from and amount to transfer. These different methods have different "Authorization" behaviour but Authorization is about mitigating risk for the retailer, and the bank, and only very tangentially intended to have any benefit for you to customer, it doesn't move money, and it isn't mandatory.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#45

Post by woodruffw »

kQq9oHeAz6wLLS wrote: post #35
naet wrote: post #24

Earlier quoted context omitted.

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> Already there are a (small) number of modern restaurants that don't accept cash in my area. Is that even legal?

It isn't in NYC[1]. We have some local businesses that ignore the law, and are (supposedly) being fined daily for continuing to violate it[2]. I'm not sure if the city has managed to collect yet.

[1]: https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=3...

[2]: https://nypost.com/2021/12/04/nyc-businesses-told-to-pay-up-...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#46

Post by TaylorAlexander »

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in pure magstripe readers such as parking meters and other older devices. Having ruined my magnetic stripe, Apple has protected me from mag stripe attacks. An idea so bold, no one but Apple could have thought of the magnetic card wallet.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#47

Post by powvans »

woodruffw wrote: post #40

I can't help but smile when I see these skimmers. It's amazing how advanced they are! I would love it if my bank would let me use my virtual debit card with a contactless flow to withdraw cash. I'd imagine that's much harder to replay or otherwise manipulate. I've seen some ATMs (mostly Chase?) with the contactless symbol on them, but I've never been able to get them to work.

I always use the Chase Debit cards stored in my Apple Wallet to access Chase ATMs. Works great. You can use the Apple Wallet cards to unlock the ATM vestibule doors after hours too.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#48

Post by Eduard »

sneak wrote: post #4
ilaksh wrote: post #3

ATMs, ATM cards, banks and fiat currency are all obsolescent technologies.

Most technologies with a huge installed base are obsolete compared to the state of the art. The larger the installed base, the higher the likelihood it is lagging behind the current patch revision. Magstripes and internal combustion engine ground vehicles are probably the two biggest examples outside of sociology/government.

What's the state of art for sociology/government?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#49

Post by naet »

kQq9oHeAz6wLLS wrote: post #35
naet wrote: post #24

Earlier quoted context omitted.

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> Already there are a (small) number of modern restaurants that don't accept cash in my area. Is that even legal?

It must be in my area, and it seems to be legal at the federal level in the USA.

"There is no federal statute mandating that a private business, a person, or an organization must accept currency or coins as payment for goods or services. Private businesses are free to develop their own policies on whether to accept cash unless there is a state law that says otherwise."

https://www.federalreserve.gov/faqs/currency_12772.htm

It may be illegal to refuse cash as payment for an existing debt but businesses are free to choose how (and with whom) they conduct business, including which forms of payment they accept.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#50

Post by woodruffw »

powvans wrote: post #47
woodruffw wrote: post #40

I can't help but smile when I see these skimmers. It's amazing how advanced they are! I would love it if my bank would let me use my virtual debit card with a contactless flow to withdraw cash. I'd imagine that's much harder to replay or otherwise manipulate. I've seen some ATMs (mostly Chase?) with the contactless symbol on them, but I've never been able to get them to work.

I always use the Chase Debit cards stored in my Apple Wallet to access Chase ATMs. Works great. You can use the Apple Wallet cards to unlock the ATM vestibule doors after hours too.

Good to know that it works with their own cards! I don't actually have a Chase debit card; I was hoping that my virtual debit card would work with their machines :-)

(The bank I use does actually use JPMC as their customer bank, so I was hoping that Chase ATMs would see my card as a "whitelabeled" Chase card. But no such luck.)

Post reply on HN