Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

121–130 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#121

Post by jeremy_wiebe »

thetwentyone wrote: post #24

Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.

> Since it's only implied how it works and there seems to be some confusion in the comments.

Seems like a lot of TLDR; :)

The article says exactly how it works.

> The usage is very simple: Insert the tool into the payment terminal’s chip card slot. If it can insert fully, the terminal is safe. If it gets stopped, there might be a skimmer!

Re: Target's EasySweep – Simplifying Skimmer Detection

#122

Post by jalk »

briffle wrote: post #50
adrianmonk wrote: post #38

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Of course they can be made that way. The countermeasure built into gambling equipment like slot machines is incredible. But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..

So the reason that gas, in LA area at least, have different prices for cash and card (typically ~$0.25/gal more for card) is not because of additional risk for the gas station, but just classic US exorbitant fees?

Re: Target's EasySweep – Simplifying Skimmer Detection

#123

Post by Animats »

This is only a small part of Target's loss prevention operation. Target is known for being both aggressive and sneaky about loss prevention. They use cameras and face recognition extensively, and they have an in-house forensic lab that can process fingerprints. Sometimes they will let a shoplifter get away with stealing for a while, until the total passes the felony threshold. Then they have them arrested. Sometimes followed, because they want to know where the stolen goods are going and catch the fence.[1]

If they find a skimmer, they will probably go back over the video until they find who put it there. Former Target security guard: "All cameras are functional and can look in any direction. Many are 4K and can zoom."

[1] https://www.paypath.com/Small-Business/why-target-is-the-wor...

Re: Target's EasySweep – Simplifying Skimmer Detection

#124

Post by despideme »

jalk wrote: post #122
briffle wrote: post #50

Earlier quoted context omitted.

Of course they can be made that way. The countermeasure built into gambling equipment like slot machines is incredible. But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..

So the reason that gas, in LA area at least, have different prices for cash and card (typically ~$0.25/gal more for card) is not because of additional risk for the gas station, but just classic US exorbitant fees?

The price difference is a way to pass along credit card fees that otherwise would have to be paid by the station operator. It used to be against the credit card networks’ merchant agreements to have separate cash and credit prices — but a good number of LA gas stations rolled the dice and did it anyway. That rule changed a few years ago, and now most stations split their pricing. (I believe that’s also why ARCO gas now takes credit cards, after holding out for decades — they are now allowed to pass along the cost to the customer.)

Re: Target's EasySweep – Simplifying Skimmer Detection

#125

Post by birdman3131 »

MBCook wrote: post #71
gorkish wrote: post #66

Earlier quoted context omitted.

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think…

Walmart still refuses to go contactless because they went in on the QR code in the app. Annoying.

Re: Target's EasySweep – Simplifying Skimmer Detection

#126

Post by zirgs »

whoopdedo wrote: post #69
js2 wrote: post #16

Earlier quoted context omitted.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

Some skimmers have a camera to capture an image of the card's CVV as well as another copy of the name/number/date.

Good thing that the back of my phone has neither of those.

Seems like a good idea to wrap the card in something opaque.

Re: Target's EasySweep – Simplifying Skimmer Detection

#127

Post by Terr_ »

birdman3131 wrote: post #125
MBCook wrote: post #71

Earlier quoted context omitted.

They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think…

Walmart still refuses to go contactless because they went in on the QR code in the app. Annoying.

I was unpleasantly surprised by that last week, where I had left my wallet in the car (an unusual event) and couldn't pay by tap my phone.

Re: Target's EasySweep – Simplifying Skimmer Detection

#128

Post by throwaway2037 »

Animats wrote: post #123

This is only a small part of Target's loss prevention operation. Target is known for being both aggressive and sneaky about loss prevention. They use cameras and face recognition extensively, and they have an in-house forensic lab that can process fingerprints. Sometimes they will let a shoplifter get away with stealing for a while, until the total passes the felony threshold. Then they have them arrested. Sometimes…

Your quoted first paragraph: You make it sounds like this is something bad. What is wrong with Target's actions? I am confused.

Re: Target's EasySweep – Simplifying Skimmer Detection

#129

Post by kotaKat »

birdman3131 wrote: post #125
MBCook wrote: post #71

Earlier quoted context omitted.

They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think…

Walmart still refuses to go contactless because they went in on the QR code in the app. Annoying.

That’s because Walmart is using Walmart Pay as a vehicle to track you and your shopping purchases. They can’t track your habits the same way with just a card.

Kroger finally gave up on Kroger Pay if only because they realized customers were still entering their alternate ID/phone number during checkout so they could still link your data together.

The funny part is Walmart in Canada fully allows contactless… almost as if they don’t care they aren’t getting that customer data up there.

Re: Target's EasySweep – Simplifying Skimmer Detection

#130

Post by tyoma »

sangnoir wrote: post #100
crote wrote: post #87

Earlier quoted context omitted.

Skimming is pretty much a solved problem in Europe already. We got rid of the mag stripe, so trivially cloning a card is no longer possible. Furthermore we don't allow offline transactions, so a skimmer must somehow get in between the connection from the terminal to the card and execute a separate transaction right before or after the genuine one. It is still not 100% impossible, but the "overlay" type of skimmer thi…

You are correct: but I think all these measures are in place because liability is placed on financial institutions rather than individual victims. The owners of the payment infrastructure are correctly motivated to holistically solve the problem, unlike in the US were the person woth the least power and control is burdened with having to contend with "Identity theft" and losing money by default to make up for the fra…

This is plainly untrue. The US has an absurdly consumer friendly legal environment; you simply say you didn’t do the transaction and your money is immediately refunded; it is up to the payment infra to eat the losses.

The reason mag stripe and associated technologies stuck around is precisely because US banks were good enough at real-time fraud detection that the cost of fraud was And identity theft is absolutely a thing in Europe. As a random example, here is Sweden: https://globalinitiative.net/analysis/21752-2/

Post reply on HN