Nearly All U.S. Home Depot Stores Hit By Credit Card Theft • Hacker News Board

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#101

Post by aianus » Thu, Sep 04, 2014, 6:25 PM UTC

vertex-four wrote: post #94

aianus wrote: post #23

Earlier quoted context omitted.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

> It breaks square and the like Paypal provide a Chip-and-PIN payment system for mobile devices here in the UK[0]. It'll break Square no more than it breaks everything else; I have no doubt that Square already have a working prototype of such a thing. [0] https://www.paypal.co.uk/blog/paypal-here--paypal-s-new-chip...

Good god that thing is hideous.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#102

Post by driverdan » Thu, Sep 04, 2014, 6:29 PM UTC

TallGuyShort wrote: post #59

99% correlation sounds high, but I wonder what the correlation is with other stores, and with what statistical confidence you can actually conclude that Home Depot was the victim here...

Exactly, correlation is not causation. I bet they have an even higher correlation with Walmart.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#103

Post by driverdan » Thu, Sep 04, 2014, 6:31 PM UTC

mzuvella wrote: post #10

aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

That's simply not true. Numbers without full cardholder info (address, cvv) are nearly worthless.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#104

Post by josho » Thu, Sep 04, 2014, 6:41 PM UTC

Istof wrote: post #93

jvm wrote: post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

I believe it is chip and signature... I got mine from Bank of America... no pin necessary when the chip is used (and it still has the magnetic strip for stores that don't have chip readers).

The roll out for chip and pin in Canada started the same, but within the last year, I've found mag only readers to be extremely rare.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#105

Post by josho » Thu, Sep 04, 2014, 6:45 PM UTC

DangerousPie wrote: post #52

DrTarantism wrote: post #50

Earlier quoted context omitted.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

How is that? I have a Chip+PIN enabled credit card and if the shop doesn't support that I can still swipe the magnetic stripe. I don't see why they don't just provide credit cards with both options for a while until enough of the PoS hardware has been upgraded that they can get rid of the magnetic stripe. I guess cost plays a role, but I would assume that the decrease in fraud might offset that somewhat.

This is exactly what will happen. During the transition you will still be able to use mag swipe, then after some period the reader will force the use of the chip and only use mag swipe as a fallback when a chip error occurs. I suspect after a short while mag swipe will be removed entirely, but it remains in many places outside of the US as a fallback.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#106

Post by MichaelGG » Thu, Sep 04, 2014, 6:45 PM UTC

__david__ wrote: post #44

aianus wrote: post #26

Earlier quoted context omitted.

Toronto, Canada

I've never used a contactless method. Is it NFC (or something similar)? Is it really faster than swiping your card? I had the impression you still had to do something on your phone to authorize it...

Even in 2007 in Denver, Amex issued me a credit (not charge) card with a little RFID chip. Worked at a fair number of places. Just get the card near and it beeps and you go on your way.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#107

Post by Crito » Thu, Sep 04, 2014, 7:29 PM UTC

bartwe wrote: post #98

Crito wrote: post #89

Earlier quoted context omitted.

> "I'm quite surprised by the blasé attitude the US has to card security." Currently, if my CC information is stolen, I am not liable for any fraudulent charges. So why would I care? CC security is for the CC companies and the merchants, not for the consumers. That is why Americans (with the exception of those with Europe Envy or those who are merchants) don't care. There is no reason for them to. (In past discussion…

Except you do pay for it indirectly, with additional overhead, through banking fees paying for insurance.

My credit union has absolutely negligible fees and, since I don't carry a balance on my CC, I give them a negligible amount of money as well. The cost of merchant fees passed on to the consumer is not something that I notice and therefore not something that I care about. I really do not have a reason to want C+P.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#108

Post by crpatino » Thu, Sep 04, 2014, 7:29 PM UTC

bluedino wrote: post #95

Aren't debit cards part of the problem? I only use my credit card and then just pay that as I go. Much easier to dispute charges on a credit card. Also, if the card is stolen and my bank account is emptied, with a credit card all that would happen is that my credit limit on one of my cards is temporarily reduced.

The card attached to my main account (where my employer sends my salary) is private. My main credit card is from the same bank and I pay it directly from there. Credit card gets used at places that I trust. Dispute charges can be a time consuming process, and you have to pay some token amount to avoid punitive rates anyways.

I have another account in a different bank, were I send small electronic deposits periodically. I retire about 1/2 of that in cash at ATM, to pay either at places that do not accept cards or I do not trust (i.e. gas stations). I have to keep a small balance in the account, and it is not always practical to use cash, so I use the corresponding debit card at places I neither trust or distrust.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#109

Post by MichaelApproved » Thu, Sep 04, 2014, 9:52 PM UTC

hayksaakian wrote: post #33

MichaelApproved wrote: post #25

Earlier quoted context omitted.

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

Could you do a frontend validation? At the point of accepting a card, before it is tokenized?

Yes, I just need time to write the code. It's quicker to refund the money right now. I should have some time to write the code in the next few months.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#110

Post by nucleardog » Thu, Sep 04, 2014, 10:55 PM UTC

josho wrote: post #104

Istof wrote: post #93

Earlier quoted context omitted.

I believe it is chip and signature... I got mine from Bank of America... no pin necessary when the chip is used (and it still has the magnetic strip for stores that don't have chip readers).

The roll out for chip and pin in Canada started the same, but within the last year, I've found mag only readers to be extremely rare.

Even travelling through a lot of small towns in rural areas I don't think I've run into a magstripe-only reader in the past couple years at least.

There was a period where it was a guessing game every time you paid for something whether it was magstripe or chip (some locations even had a chip-capable machine, but didn't have the service enabled with their payment processor, so you still used the magstripe...).

It's pretty consistent now.