Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

401–410 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#401

Post by ghaff »

iam-TJ wrote: post #374
Nursie wrote: post #334

Earlier quoted context omitted.

> if there is no connectivity FYI, you don't need internet connectivity to pay using apple/android pay. And waving my phone at a payment device is massively more convenient than having to go to an ATM to withdraw cash, and then pay with said cash.

No connectivity for the retailer's device, not for the customer device. There are also quite a few payment terminals that still do dial-on-demand to get authorisation from the merchant service provider (Chip&PIN/NFC Contactless). I still see those in the UK especially at independent fuel stations. The additional delay waiting for the terminal to dial and connect sometimes makes me think it has failed - had a few occa…

I have definitely been in stores where their card readers were down and it was cash only.

Personally I default to chipped credit cards but carry a few bucks with me too.

Also in general I don’t like to be utterly dependent on my phone especially if I’m traveling.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#402

Post by ginko »

trasz wrote: post #359
gumby wrote: post #355

Earlier quoted context omitted.

Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.

NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.

NFC seems strictly better than QR code payments to me.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#403

Post by pinebox »

kibibyte wrote: post #318
mepiethree wrote: post #310

Earlier quoted context omitted.

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062

Thanks, but the post you linked is making me irrationally angry. Why does a gas pump card reader need full internet connectivity?! It's outrageous! Just use the two wires to talk to a head unit in the building! Then it brings up the gas pump advertising screens which are already a sore point for me (two conveniently located stations have these, so I can't go there anymore because I find the accompanying audio intolerable).

The whole situation smells like it involves a lot of vendor lock-in, too (which I always hate to see).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#404

Post by samatman »

Semaphor wrote: post #371
samatman wrote: post #366

Earlier quoted context omitted.

America having invented the dining (later credit) card, we have some customs remaining from when they worked analog. I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

Hey, if you are proud of your security issues, good for you :)

The chargeback is always there, in the background, keeping people honest, broadly speaking. I generally wave my watch at something and carry on with my day, due to the innovative work of Americans. I mean probably a few Germans at Apple, but they're Americans now, and that's what matters.

But having a clunky thing at home you stick your debit card in is okay too! I guess.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#405

Post by ghaff »

SllX wrote: post #267
phinnaeus wrote: post #21

Earlier quoted context omitted.

I think it's clear the person you're replying to isn't from the US since they seem unaware of how prevalent even magnetic swiping is in the US (or was when I left before the pandemic, when I visited a few months ago it seems interest in contactless has finally started to catch on).

Also from the US. The last business I encountered that insisted on swiping cards was this past Spring, a toy vendor in a local mall. Contactless is normal, and my issue is I will sometimes want to pay someone a tip that only takes Venmo which I just don’t have nor want to have. Cash-only is far more prevalent than card swiping, and even that is incredibly rare.

I reluctantly set up Venmo but I really don’t like services directly connected to my bank account.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#406

Post by dwringer »

hugobitola wrote: post #398
micromacrofoot wrote: post #387

Earlier quoted context omitted.

it’s because american corporations put profit above all else, and someone probably crunched the numbers and determined that faster transactions make them more money despite higher occurrences of fraud

How could entering a 4 digit PIN be slower than "printing a piece of receipt, handing over a pen and waiting for the customer to sign"?

Generally (at least in my part of the US) people stopped being asked to sign for small purchases several years ago; usually now convenience stores and big box stores under a certain dollar amount just ask you to tap a button instead of sign.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#407

Post by aunterste »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

maddening maybe, but because of the simple equation that the fraud losses from continuing to use swipe and issue cards without chip are high, but the margins on credit cards, due to the high rates are high enough to cover it. Carrying a balance on a credit card in Europe and South America is not very common (your account bank will grant a decently priced overdraft facility (not the crazy US fees there), rebates/points/miles are lower - so it just pays to be complacent here for the industry.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#408

Post by [deleted] »

Mister_Snuggles wrote: post #250
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

[deleted]

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#409

Post by Nursie »

ghaff wrote: post #399
Nursie wrote: post #361

Earlier quoted context omitted.

That's why I said "in most countries". In most non-US countries credit cards enforce PIN usage the same way as your debit cards appear to.

Well except that debit cards always require PINs in the US and credit cards only sometimes do in eg Europe.

Generally in Europe, when a card is inserted into a terminal for a chip transaction, PIN entry is required. There is no particular delineation between whether it's credit or debit like this. Contactless transactions have a small percentage chance to request PIN, but contact transactions always do it, as all european cards (AFAICT) have put the PIN CVM ahead of the signature CVM, or just dropped the signature CVM entirely, for around 20 years now.

I wasn't aware that Chip+Signature cards even exist in europe.

Whereas the US is all over the place with different methods for different cards, and mag stripes still in use, sometimes requiring you to enter a PIN alongside that, all largely driven by retailer reticence to update their hardware.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#410

Post by Nursie »

iam-TJ wrote: post #374
Nursie wrote: post #334

Earlier quoted context omitted.

> if there is no connectivity FYI, you don't need internet connectivity to pay using apple/android pay. And waving my phone at a payment device is massively more convenient than having to go to an ATM to withdraw cash, and then pay with said cash.

No connectivity for the retailer's device, not for the customer device. There are also quite a few payment terminals that still do dial-on-demand to get authorisation from the merchant service provider (Chip&PIN/NFC Contactless). I still see those in the UK especially at independent fuel stations. The additional delay waiting for the terminal to dial and connect sometimes makes me think it has failed - had a few occa…

Offline transactions are available in many systems up to certain limits defined by both th card and the terminal. They get reconciled later.

Merchants not having connectivity is a rather small problem in this day and age really, with ubiquitous mobile data connections. (Yes, I am aware someone will be along shortly to tell me they have yet-another-edge case where it doesn't work for them. I don't really care, for the vast majority it is a massively convenient way to conduct business.)

Post reply on HN