Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

381–390 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#381

Post by xtiansimon »

NavinF wrote: post #348
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

“Banks are willing to eat the tiny reversed transactions…”

Banks? A chargeback goes to the business.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#382

Post by Closi »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story.

Alternatively - do what Monzo does in the UK and issue cards with a magnetic stripe that is disabled in the backend by default.

If you try to use the magnetic stripe, it sends you an alert that says "Someone (possibly you) tried to pay using the magnetic stripe. Do you want to allow the magnetic stripe for the next hour?"

Then if you travel to a country that relies on magnetic stripe, similarly it sends you a message saying "You have travelled to X - sometimes you may need to enable the magnetic stripe in order to use an ATM. Do you want to temporarily enable the magnetic stripe?"

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#383

Post by Closi »

NavinF wrote: post #357
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

How often do you have to do it though? It's only for high-value transactions (>£45) and the rest is contactless.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#384

Post by sbarre »

NavinF wrote: post #357
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

Do you say this because you believe that Americans are exceptional compared to the rest of the world? Because the rest of the modern world has made the change without trouble.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#385

Post by asib »

> Lastly but most importantly, covering the PIN pad with your hand defeats one key component of most skimmer scams: The spy camera that thieves typically hide somewhere on or near the compromised ATM to capture customers entering their PINs.

> Shockingly, few people bother to take this simple, effective step.

I haven't taken cash out of an ATM (or carried cash altogether) for years now, but I never really used to do this as I always assumed it was protecting against the threat of someone looking over your shoulder and then subsequently mugging you.

If I ever end up using a cash machine again, I will be sure to cover the digits. Thanks Krebs!

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#386

Post by Merad »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#387

Post by micromacrofoot »

sbarre wrote: post #384
NavinF wrote: post #357

Earlier quoted context omitted.

It takes a few more seconds. Never gonna happen.

Do you say this because you believe that Americans are exceptional compared to the rest of the world? Because the rest of the modern world has made the change without trouble.

it’s because american corporations put profit above all else, and someone probably crunched the numbers and determined that faster transactions make them more money despite higher occurrences of fraud

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#388

Post by jamesbfb »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

I’m in Australia and an American friend who is visiting was shocked at how nearly everywhere from small cafes to supermarkets all support payments with Apple/Google pay and tap and go.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#389

Post by michaelmior »

Mister_Snuggles wrote: post #250
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

When I first moved from Canada to the US, before I got an American credit card, I used my Canadian card to tap as I was so used to doing. More than once, the clerk looked at me as though I were a wizard.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#390

Post by ghaff »

Closi wrote: post #383
NavinF wrote: post #357

Earlier quoted context omitted.

It takes a few more seconds. Never gonna happen.

How often do you have to do it though? It's only for high-value transactions (>£45) and the rest is contactless.

In Ireland I’ve had to enter a PIN for as little as 15 Euros. It’s very variable. Never run into this in Europe before and it’s been something of a pain because I don’t have a PIN on any of my personal cards. Fortunately I found I do have one on my corporate card.
Post reply on HN