Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

421–430 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#421

Post by Reason077 »

mindcrime wrote: post #378
Reason077 wrote: post #332

Earlier quoted context omitted.

> "At best I've found chip reading to work about 60% of the time ... Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe" Here in the UK, many (most?) new payment terminals don't have mag-stripe readers at all. And I expect banks will start issuing new cards without a magnetic strip in the near future, if they haven't done so already. I agre…

But if your card's chip is broken, can't you just get your bank to send out a new one? Of course I can. But that means I have to stop and take time out of my day to call my bank and dick around with them. And then if the new card comes with a new number (I don't know if it will or not), and/or expiration date (that almost certainly will change), then I have to login to EVERY SINGLE ONE of the places online where I us…

It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

Your new card will have a new number and expiry date, but the old one will remain valid.

In any case, these days my web browser remembers card numbers and fills them in automatically, so it’s really not such a big deal to update card numbers online.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#422

Post by garyrichardson »

derefr wrote: post #272
garyrichardson wrote: post #269

Earlier quoted context omitted.

You must be in the US -- America is the only place where mag stripe still exists. Everyone else is using tap or chip and pin.

Do you mean that credit cards in other countries don't have magnetic stripes, or just that nobody uses them? Living in Canada, there's basically no instance where we'd swipe our credit cards, but they've still got mag stripes; and when I visit the US, I sometimes have to swipe my card, and it does work to do so.

You're right. Poor choice of words. I seem to recall it's around 2025ish where most cards won't have mag stripes. Mag stripes only exist today because of the US. Everyone else uses the chip for either chip and pin or tap.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#423

Post by micromacrofoot »

hugobitola wrote: post #398
micromacrofoot wrote: post #387

Earlier quoted context omitted.

it’s because american corporations put profit above all else, and someone probably crunched the numbers and determined that faster transactions make them more money despite higher occurrences of fraud

How could entering a 4 digit PIN be slower than "printing a piece of receipt, handing over a pen and waiting for the customer to sign"?

Signing is very rare these days, non-existent for small purchases... and still seemingly rare for larger ones. I've spent hundreds of dollars in single transactions without signature or pin.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#424

Post by ThePowerOfFuet »

NavinF wrote: post #357
neilalexander wrote: post #354

Earlier quoted context omitted.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

It takes less time, as the PIN is entered before the receipt is even printed.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#425

Post by ThePowerOfFuet »

canadianwatcher wrote: post #317
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

"When Canada" I want to call out this country wide edict. I've seen this done in both the United States and Canada. I do not know your personal situation, but I'm fairly sure it wasn't across the entire country of Canada.

It sure was.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#426

Post by ThePowerOfFuet »

qazxcvbnmlp wrote: post #313
mepiethree wrote: post #310

Earlier quoted context omitted.

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

> Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

> > Who are these businesses?

> Airline ticket counters…

> Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad.

The rest of the world figured this out long ago; this is already a solved problem.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#427

Post by ThePowerOfFuet »

Merad wrote: post #386
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless t…

> This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change.

In Europe you can buy card terminals for €30 with no monthly fee, and you don't even have to be a registered business entity.

Now that I check, that same company exists in the US too:

https://sumup.com/

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#428

Post by ThePowerOfFuet »

kevin_thibedeau wrote: post #347
inquirerGeneral wrote: post #344

Earlier quoted context omitted.

There are not many anymore without a CHIP reader, because VISA and Mastercard FINALLY stopped the delay of shifting liability for all fraud to the individual gas station in summer 2021.

All my local stations are still on mag stripes.

> All my local stations are still on mag stripes.

Then they continue to be part of the problem (and liability for fraud is on them).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#429

Post by iggldiggl »

unstatusthequo wrote: post #219
akira2501 wrote: post #164

Earlier quoted context omitted.

Charged as in has a full and operational battery. A card with a chip in this does not require that. I can also intentionally give someone else my card to effect a purchase and neither myself nor my phone actually has to be there. Fraud clearly hasn't had a deleterious effect on the entire system, and the penalties for fraud align incentives to fight fraud properly. It's not such a large problem that I'm willing to ta…

If your threat model is a modern phone running out of battery, I suggest an external battery pack. Portable, powerful, and allows you not to carry a slow chip and pin.

Maybe I've picked the wrong phones, but I've also found them to occasionally completely die without any advance warning even if treated carefully, so I remain a bit wary about using them for anything ultra-critical.

And mobile phone providers over here don't guarantee even two nines of reliability, never mind that even 3½ days of no service per year is already too much for some critical things, like being able to get at your money.

And the local public transport association for example tries to disclaim any responsibility for any sort of problems if you're using their mobile ticketing app – if it doesn't work, though luck, your problem, buy a new ticket or pay a fine. Even if you've bought a monthly season ticket there are no special provisions, and the rules don't even differentiate between technical issues caused by myself [1], those caused by third parties (like the mobile service provider) or those caused by the public transport provider respectively its app developers themselves.

[1] Although while I can take care to keep it sufficiently charged, not letting it fall to the ground or whatever, I still can't prevent it from just randomly dying anyway, or the manufacturer issuing some borked update or whatever

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#430

Post by dymk »

derefr wrote: post #277
dymk wrote: post #253

Earlier quoted context omitted.

USPS delivers to them, guaranteed

Delivers... new gas pumps? Because often with self-serve pumps, the pump and the card reader are one-and-the-same. Probably modular in some internal sense, but not with an expectation of owner serviceability; more "call the manufacturer" serviceability.

Delivers card readers... Gas pumps aren't a single monolithic unit.
Post reply on HN