Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

91–100 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#91

Earlier quoted context omitted.

As a double advantage, it ensures the workers tips are 1099-K'd when their venmo hits $600 aggregate and they can't weasel out of the social contract of paying up for muh roads.

This is, as far as I know, only true if you use the business "mode" in venmo. I certainly take in a lot more than $600 in aggregate per year via venmo (passthrough rent), and don't get a 1099-k.

1) That makes sense because the $600 threshold has never existed before. The first time this will ever be reported at this threshold is this year. According to Secretary Yellen the threshold was lowered to $600 because people earning that much are high-income billionares that need held accountable.

2) In non-business "mode" it's still not your choice if the sender tags it as 'goods or service.'

3) Customers and Workers may be wary to potentially violate ToS by defrauding Venmo and/or the IRS by falsely tagging a transaction that there is an easily electronically auditable record of. Venmo ToS explains your account may be terminated and funds 'held' if you do this, and tons of random people sending you money on a regular schedule is easily identifiable as not 'friends and family.' This is far easier to trace than someone spending putting $200 in singles in a drawer at the end of the night and spending $20 x 10 at the grocery store.

4) Your 'pass-through' rent situation is far less falsely identifiable as goods and services income. 2000x people sending $5 over a year is far more identifiable to a computer than the exact same few people sending you $1k a month or whatever. A very large number (high hundreds to thousands) of nodes sending small amounts over the course of the year easily 'sniffs out' someone providing goods/services and can be bet on to be found out by Venmo compliance sooner or later.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#92
post #49

Earlier quoted context omitted.

> Already there are a (small) number of modern restaurants that don't accept cash in my area. Is that even legal?

It must be in my area, and it seems to be legal at the federal level in the USA. "There is no federal statute mandating that a private business, a person, or an organization must accept currency or coins as payment for goods or services. Private businesses are free to develop their own policies on whether to accept cash unless there is a state law that says otherwise." https://www.federalreserve.gov/faqs/currency_127…

Well a restaurant bill is in some sense a debt for the food that was already provided.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#93

Earlier quoted context omitted.

> Already there are a (small) number of modern restaurants that don't accept cash in my area. Is that even legal?

Broadly speaking, doing business on the internet doesn’t have a separate set of laws. Many online retailers don’t accept cash.

Some do. Some you can go in person to pay for the good to be delivered online. Then, some (mullvad) you can mail cash. Don't, in America, they steal it. But you can.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#94

Earlier quoted context omitted.

As a double advantage, it ensures the workers tips are 1099-K'd when their venmo hits $600 aggregate and they can't weasel out of the social contract of paying up for muh roads.

This is, as far as I know, only true if you use the business "mode" in venmo. I certainly take in a lot more than $600 in aggregate per year via venmo (passthrough rent), and don't get a 1099-k.

Slight correction: it is true if the sender marked that payment as for "goods and services" on the confirmation screen[0]. When you are about to make a venmo transaction, there is a toggle for it. Afaik, it is fully up to the sender.

0. https://help.venmo.com/hc/en-us/articles/4407389460499-2022-...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#95

I think the magnetic strip needs to go. We hardly use them in Australia to the point where one of our major banks actually has a touch reader on their machine. Some sort of one-time verification would be great. An SMS or a push notification would go a long way to making this type of scraping harder. Or eliminate the card altogether - Cardless Cash.

Monzo (UK) doesn't allow magnetic stripes in ATMs unless you enable them in the app.

Chip and pin and NFC terminals have been a standard in the UK for over a decade now. I wouldn't be surprised if magnetic stripe readers still exist only for US tourists.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#96

Earlier quoted context omitted.

As the article says, some smaller outfits still use card stripe data. The impetus to get retailers to start using the chip was "Liability shift". The payment networks gradually changed the rules (I think in the US pay-at-pump gasoline purchases were last to get this, while big retail stores were earlier) so that the liability if a transaction is latterly discovered to be fraudulent is with the retailer who accepted t…

> Those old impression machines? Good point. Not only do I still have cards with mag stripes, I still have some with embossed numbers. And probably half of the people with credit cards are younger than the date when that was obsoleted.

A hotel I stayed at actually made an impression from my card in... I'm going to say maybe 2015 (I'm pretty sure this is before Trump, but it's after Marvel started re-publishing Miracleman). Hotel somewhere in the middle of Nottingham. Room nice enough, but no actual card machine.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#97

I think the magnetic strip needs to go. We hardly use them in Australia to the point where one of our major banks actually has a touch reader on their machine. Some sort of one-time verification would be great. An SMS or a push notification would go a long way to making this type of scraping harder. Or eliminate the card altogether - Cardless Cash.

For Mastercard:

> The magnetic stripe will start to disappear in 2024 from Mastercard payment cards in regions, such as Europe, where chip cards are already widely used. Banks in the U.S. will no longer be required to issue chip cards with a magnetic stripe, starting in 2027.

https://www.mastercard.com/news/perspectives/2021/magnetic-s...

I think it has been over a decade since my last magstripe transaction (in a convenience store I frequented that switched to chip readers in 2010).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#98
post #49

Earlier quoted context omitted.

It must be in my area, and it seems to be legal at the federal level in the USA. "There is no federal statute mandating that a private business, a person, or an organization must accept currency or coins as payment for goods or services. Private businesses are free to develop their own policies on whether to accept cash unless there is a state law that says otherwise." https://www.federalreserve.gov/faqs/currency_127…

Well a restaurant bill is in some sense a debt for the food that was already provided.

For sure, and I think even a cashless restaurant would take cash rather than let you leave for free. Presumably the ones truly refusing cash are the type that take payment before you incur any food debt.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#99
post #82

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in…

Those must have been some low-coercivity card stock. HiCo cards should be very resilient to this sort of thing.

Brand new Visa Debit card from Chase Bank. I’d have thought it was one of the good ones. I should say I’m actually not using the official Apple magnetic case but the Popwallet brand which includes a little finger holder thing. Perhaps they’re using more powerful magnets than apple.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#100
post #49

Earlier quoted context omitted.

It must be in my area, and it seems to be legal at the federal level in the USA. "There is no federal statute mandating that a private business, a person, or an organization must accept currency or coins as payment for goods or services. Private businesses are free to develop their own policies on whether to accept cash unless there is a state law that says otherwise." https://www.federalreserve.gov/faqs/currency_127…

Well a restaurant bill is in some sense a debt for the food that was already provided.

I'd love to see what happens if I eat a meal, then say, "Sorry, I only have cash."

They can be mad about it, but I don't think I'm breaking any laws by not having their preferred payment method to pay that debt, right? They can even ban me from the restaurant but—for that meal—I can't get charged with theft of services (or whatever the innkeeper laws are that relate to this situation)

Post reply on HN