Nearly All U.S. Home Depot Stores Hit By Credit Card Theft • Hacker News Board

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#91

Post by MichaelApproved » Thu, Sep 04, 2014, 4:15 PM UTC

GFK_of_xmaspast wrote: post #58

MichaelApproved wrote: post #25

Earlier quoted context omitted.

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

If you can "100% detect the fraudulent transactions from real ones" why don't you refuse to send the details to Stripe.

Time. I can eye ball the charges and know 100%. I need to add code that'll do the same and I don't have the time right now. For the few charges we get, it's easier to quickly refund than to write the code. It's something I will eventually write code to automate.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#92

Post by jahewson » Thu, Sep 04, 2014, 4:27 PM UTC

jahewson wrote: post #20

btbuilder wrote: post #6

Earlier quoted context omitted.

Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.

That's the case for chip and pin too, low-cost transactions can be authorised with just a swipe.

Correction: I meant "insert your card", not "swipe". Though low-cost transactions can still be authorised without having to enter a PIN, at least in the UK.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#93

Post by Istof » Thu, Sep 04, 2014, 5:32 PM UTC

jvm wrote: post #48

awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

I believe it is chip and signature... I got mine from Bank of America... no pin necessary when the chip is used (and it still has the magnetic strip for stores that don't have chip readers).

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#94

Post by vertex-four » Thu, Sep 04, 2014, 5:36 PM UTC

aianus wrote: post #23

jacquesm wrote: post #13

Earlier quoted context omitted.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

> It breaks square and the like

Paypal provide a Chip-and-PIN payment system for mobile devices here in the UK[0]. It'll break Square no more than it breaks everything else; I have no doubt that Square already have a working prototype of such a thing.

[0] https://www.paypal.co.uk/blog/paypal-here--paypal-s-new-chip...

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#95

Post by bluedino » Thu, Sep 04, 2014, 5:38 PM UTC

Aren't debit cards part of the problem? I only use my credit card and then just pay that as I go. Much easier to dispute charges on a credit card.

Also, if the card is stolen and my bank account is emptied, with a credit card all that would happen is that my credit limit on one of my cards is temporarily reduced.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#96

Post by chiph » Thu, Sep 04, 2014, 5:46 PM UTC

drzaiusapelord wrote: post #87

js2 wrote: post #66

Earlier quoted context omitted.

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

I have three cards. Only my debit/credit card has a chip and there's no pin. I can press it against one of the few readers that support this (Walgreens, Subway) and it'll work. My other two cards don't even have this. Of course, if these guys are storing my card in a non-encrypted way, its still the same issue as using swipe. On the plus side Google Wallet works at Walgreens. I have yet to see any other brick and mor…

I think the card you have is RFID enabled. They've been around for a while, and have some weaknesses (replay attacks [1], notably), against the ID they broadcast when inside an EM field.

The newer cards have a microprocessor inside them, with exposed contacts about 10mm from the left edge. With chip + pin transactions, the pin "unlocks" the payment authorization [2].

[1] https://www.chicagofed.org/digital_assets/publications/econo...

[2] http://en.wikipedia.org/wiki/Chip_and_PIN

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#97

Post by abcabc321321123 » Thu, Sep 04, 2014, 5:48 PM UTC

wlesieutre wrote: post #88

tedunangst wrote: post #79

Earlier quoted context omitted.

Only one of my cards is chip and sig, and I had to go out of my way to get it. It's not the default for all new cards, and certainly not for existing cards.

When my credit card expired recently I received a chip and sig replacement without requesting it. They're definitely starting to be offered by default.

The same thing happened to me.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#98

Post by bartwe » Thu, Sep 04, 2014, 5:49 PM UTC

Crito wrote: post #89

awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

> "I'm quite surprised by the blasé attitude the US has to card security." Currently, if my CC information is stolen, I am not liable for any fraudulent charges. So why would I care? CC security is for the CC companies and the merchants, not for the consumers. That is why Americans (with the exception of those with Europe Envy or those who are merchants) don't care. There is no reason for them to. (In past discussion…

Except you do pay for it indirectly, with additional overhead, through banking fees paying for insurance.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#99

Post by justincormack » Thu, Sep 04, 2014, 6:22 PM UTC

hackmiester wrote: post #78

js2 wrote: post #66

Earlier quoted context omitted.

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

Maybe they will be. As of now, I have never seen a card with a chip in person at all. In my entire life.

Try leaving the US?

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#100

Post by astrodust » Thu, Sep 04, 2014, 6:24 PM UTC

DrTarantism wrote: post #50

awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

They rolled it out in Canada without anyone getting into a flap. It just happened.

Readers wear out. As people buy new ones they were chip/pin ready. A lot of these terminals are rented as well, making it easier for providers to swap them.