Live data from Hacker News

ATM Skimmers

krebsonsecurity.com

51–60 of 76 posts

Re: ATM Skimmers

#51
post #40

You should ALWAYS put the hand over the other one while you type the PIN number. At least your PIN typing is not going to be recorded. It's something.

The standard skimmer "online kit" options include also replacement keypads - a thin (1mm) overlay over the real keys that record your physical keypresses.

Re: ATM Skimmers

#52
post #7

Earlier quoted context omitted.

I've yet to see a card where all the required information to clone the card isn't available on the strip too, have you?

You can clone a "magnetic card" from a chip card - it's magnetic stripe will be identical, but you won't have the private key of the chip. And afterwards, if the bank knows that it is supposed to be a chip-capable card; and the location (country) is supposed to be chip-capable, then all mag-stripe transactions are rejected even if the "all required information" is correct.

The banks could do this, but in general they don't seem to - it's too annoying for their customers when the chip is covered in dirt, a bit damaged, whatever.

Re: ATM Skimmers

#53
post #36

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

"my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours [...] He lost all of his money."

That's horrible. Not to try to minimize, but something doesn't sound right, though (in the US). Risk of loss on debit cards should be up to $50, if you notify your bank within the first 48 hours, under the Federal Electronic Fund Transfer Act.[1]

[1] https://en.wikipedia.org/wiki/Debit_card#United_States

Re: ATM Skimmers

#54

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

there certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer.

From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.

Re: ATM Skimmers

#55
post #35
post #31

Earlier quoted context omitted.

Some banks do RSA ids, and you have to punch the right number in at the time of withdrawal.

A search on Google didn't pull much up for me on which banks offer this. Do you know which banks off hand?

Charles Schwab will issue a two factor device for online banking, but it is not required for withdrawals AFAIK.

Re: ATM Skimmers

#56
post #36

A while ago I split my primary bank account into several different accounts with different purposes. One, that gets the bulk of my paycheck for bills/mortgage, gets autodrafted. I never do ATM withdrawals from this account. A certain amount is autodeposited into savings for which I have no ATM card whatsoever. A secondary checking account gets a much smaller slice of my paycheck and is used exclusively for ATM withdr…

Yes, I started doing this as soon as I got a debit card after two of my friends were beat up to surrender their pin numbers. One of my friends was held for 7 hours in a tunnel by a thug while his pal was busy taking as much cash as possible and when the limit was reached he started buying expensive, easy to sell goods. He lost all of his money. I learned my lesson from his very traumatic experience.

I met some partygoers in Budapest once who told of a similar tale.

They went into the wrong bar apparently, and upon leaving were told that they forgot to pay the cover charge. Which was $100 a head apparently.

So they grabbed one of the men and literally started beating him in front of the partygoers until they all emptied their debit cards into the ATM at the door of the club.

Re: ATM Skimmers

#57

This is an epidemic at gas stations in Southern California. I've been nailed by skimmers in LA, and a lot of my friends have too. My girlfriend refuses to use the debit cart option at Arco gas stations for fear of her card info being stolen again, and its a legit concern. They're impossible to spot unless you plan on trying to pry off the front of every payment kiosk, which as far as I know most banks and gas station…

there certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer. From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.

Yeah my first thought on reading the article is that if enough actors cared about this they would redesign the standard for card readers so that the card goes flush into the reader without any protrusions (some are already like this) and then market this fact so that machines that aren't flat are viewed with suspicion, but I'm sure the costs to replace all the machines out there and do the marketing would be enormous at this point, and you would need buy-in from a ridiculous amount of companies so it is unlikely to happen.

Re: ATM Skimmers

#58
post #9

Earlier quoted context omitted.

How do chips solve the problem? From my understanding, a man-in-the-middle scanner can gather enough information about query-responses to simulate the chip. This was one of the big problems identified with RFID chips embedded in passports because all a criminal would need to do is brush by other travelers with his skimmer.

I've seen two different kinds of reports: * Some banks cards were vulnerable due to faulty crypto. The banks phased those cards out. * Attacks based on a malicious PIN pad logging the PIN code, then feigning a chip error and telling the user to fall back to the magstrip, thus turning to traditional skimming. I haven't read anything that attacks the chip itself on current cards. Do you have any links? edit; Just found…

There's some evidence that the first attack was used in the wild, but the banks deleted the logs showing whether a PINless transaction took place so the customers were found liable for the charges.

Re: ATM Skimmers

#59
post #8

There also is the technique of completely replacing an ATM in say a mall. Read about that one a couple times. Some ATMs in convenience stores and even retail chains like Walgreens and CVS already look sketchy enough.

A couple years ago someone brought a fake ATM into Defcon.

I'd also like to point out that it was placed there by local criminals, not the conference attendees. It was however discovered by the attendees and the hotel was notified and the offending ATM was turned over to police.

Re: ATM Skimmers

#60

Earlier quoted context omitted.

there certainly has to be a method that could be devised to prevent this type of fraud. Visually a lot could be done that should foil someone looking to attach a skimmer. From continuous images, seamless faces to make it obvious something is added on, to screen based keyboards. I am sure a lot of thought is put into it. I would hazard that the losses are not sufficient to fix it.

Yeah my first thought on reading the article is that if enough actors cared about this they would redesign the standard for card readers so that the card goes flush into the reader without any protrusions (some are already like this) and then market this fact so that machines that aren't flat are viewed with suspicion, but I'm sure the costs to replace all the machines out there and do the marketing would be enormous…

It could happen if pushed by the companies that make the ATMs, rather than the banks.
Post reply on HN