Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

411–420 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#411

Post by linkdink »

naet wrote: post #24
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> No digital records

Is it really no digital records, or just fewer/obfuscated digital records? I would think that the ATM keeps tracks of the serial numbers of the notes it gave you?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#412

Post by toss1 »

Key security measure, and it is trivial - just start it as a new habit, and remind all your family & friends who didn't read the article.

>> most importantly, covering the PIN pad with your hand defeats one key component of most skimmer scams: The spy camera that thieves typically hide somewhere on or near the compromised ATM to capture customers entering their PINs.

>>Shockingly, few people bother to take this simple, effective step. Or at least, that’s what KrebsOnSecurity found in this skimmer tale from 2012, wherein we obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits — all in the clear.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#413

Post by jabroni_salad »

grishka wrote: post #136
quickthrower2 wrote: post #109

Hopefully we can go contactless on ATMs. Seems antiquated to insert a card.

Wait, there are still places in the developed world where there are no contactless ATMs?

I've only seen one contactless ATM in my life and it's at a wells fargo, which I refuse to do business with.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#414

Post by japanuspus »

dwringer wrote: post #406
hugobitola wrote: post #398

Earlier quoted context omitted.

How could entering a 4 digit PIN be slower than "printing a piece of receipt, handing over a pen and waiting for the customer to sign"?

Generally (at least in my part of the US) people stopped being asked to sign for small purchases several years ago; usually now convenience stores and big box stores under a certain dollar amount just ask you to tap a button instead of sign.

This is the same with PIN in Europe (at least for contactless): Below a certain amount you do not have to enter the PIN.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#415

Post by Mister_Snuggles »

NavinF wrote: post #348
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

I've heard this argument but I honestly don't understand it. This is the reality for making credit card purchases in Canada, having to remember PINs for credit cards is something I've never heard anybody complain about.

Maybe it's because the prevalence of Interac already trained us to deal with PINs.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#416

Post by dezgeg »

acdha wrote: post #375
NavinF wrote: post #357

Earlier quoted context omitted.

It takes a few more seconds. Never gonna happen.

The time is moot in almost all situations as long as it doesn’t take you longer to enter the PIN than it does for a cashier to finish tallying items. The concern I’ve heard businesses raise is that people won’t remember it but that’s also a chicken and egg problem since people will remember what they use regularly. Of course, since it’s the 2020s and not the 1990s we don’t need either since NFC is widely supported an…

Hm, where is it possible to enter the PIN that early? Everywhere I have seen the reader will only ask PIN once the full amount to be charged is known.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#417

Post by Mister_Snuggles »

meragrin_ wrote: post #400
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

> What about it is inconvenient? You have to remember not one, not two, not three, but several digits. Not only that. You have to look at a keypad. Oh, and you have to push buttons. Not once, not twice, but several times! Pity the poor fool who accidentally pushes the wrong button. More looking at a keypad and button pushing! Yeah, I don't get it either. My only guess is the customer support calls for forgotten pins…

Don't they have to deal with those forgotten PIN calls anyway? Don't you need a PIN to get cash out of an ATM?

My debit card and its PIN are used for a few different things - in-store payments, using the ATM, and authenticating when in-person at a bank. The last one is interesting - each desk at the bank, both the tellers and the offices where you talk to someone, has a terminal and every interaction starts with putting in your debit card and entering your PIN.

Extending this to credit card is no big deal - my main bank syncs the PIN between the debit and credit cards. I only have a credit card with the other bank that I use and I haven't set foot in one of their branches in 20 years, so I have no idea whether they sync the PINs or use their cards for in-person authentication.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#419

Post by toomuchtodo »

fastball wrote: post #328
toomuchtodo wrote: post #275

Earlier quoted context omitted.

Wouldn’t it be cool if payment terminals were also Qi enabled so even if the phone was dead it could provide enough power wirelessly to enable payments to be made?

That's actually already how NFC works. The chip being read doesn't need its own source of power – the EM field in the terminal induces a current in the target NFC chip and then uses that same EM field to read the contents. That's why your contactless debit card doesn't need a battery. Powered devices like a phone have read/write NFC chips that the device will write data to on demand, usually waiting for some form of…

Brilliant. TIL!

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#420

Post by db48x »

memco wrote: post #196
timo555 wrote: post #190

Earlier quoted context omitted.

Another low-tech thing I have done to protect myself is I have physically cut the numbers off my cards with scissors. My name and expiration date are still there. This way when I pay at a restaurant in the US and the card is out of my sight I don't worry about someone writing down the card details. So far not a single business has refused me when I hand them my modified card with the numbers cut off.

Some companies issue their card without the numbers written on them so I don’t think it’ll be concern.

Although you will be out of luck in the very rare situations where the merchant has to fall all the way back to a completely offline transaction on paper. Usually they use a little plastic roller device that impresses the number onto carbon paper to reduce errors, which is why they were embossed rather than printed in the first place.
Post reply on HN