Live data from Hacker News

Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

krebsonsecurity.com

71–80 of 116 posts

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#71
post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Many of us in the US still use exclusively cash for POS. For us, blasé attitude is to be expected.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#72
post #60
post #35

Earlier quoted context omitted.

Why do they use ICQ?

You mean, while the rest of the world have moved on to something else? It is popular in Russia. For some reason, it became popular way back then and that's what nearly everyone uses ever since. Why did the rest of the world switch?

Probably because the other services let you have a handle easier to remember than "5767576".

Although the fact I still remember mine, more than a decade after I've last used it, discredits my claim somewhat.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#73
post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

When I last heard this discussion it went like this: Visa to store : "People have been asking us for chip + pin and we're ready! Just pay a one time fee of $199.99 for the upgraded reader and note that C+P cards carry an additional .5% service charge for the more complex handling they do."

Literally using it as a revenue generating opportunity and a way to raise fees. My friend who owns the store declined to participate as they weren't interested in raising their prices just to pay Visa more money. Had Visa come at it the other way, reducing fees due to likely less fraud it would have been a different story.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#74

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

As a hosting provider, we also see our fair share of fraud. It's truly amazing at to me how many fraudulent CCs are attempted. I can't detect 100% -- but pretty close. I've also made suggestions to stripe with a similar response.

Stripe provides a fingerprint, and it would be nice if stripe provided a service to rate/track various card fingerprints and receive a score when adding/authorizing a card -- or develop some community based feedback scoring system with feedback from companies like ours!

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#75

Earlier quoted context omitted.

How is that? I have a Chip+PIN enabled credit card and if the shop doesn't support that I can still swipe the magnetic stripe. I don't see why they don't just provide credit cards with both options for a while until enough of the PoS hardware has been upgraded that they can get rid of the magnetic stripe. I guess cost plays a role, but I would assume that the decrease in fraud might offset that somewhat.

It's a complicated issue. Banks are partly afraid of adopting something new. If Bank A is amongst the first American banks to switch and something goes wrong, Bank B may win its business due to customer frustration

I highly doubt that banks really care about "customer frustration." If they did, then they would be focused on fixing a million different existing problems.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#76
You should be able to easily dispute charges at a "big box store" that were not chip-and-pin transactions, and that did not use the three-digit security extension to the number.

I've had a chip card for, what, some seven or eight years in Canada.

Here is a July 2007 story about how RBC (Royal Bank of Canada) logged 10 million chip transactions:

http://www.newswire.ca/en/story/14243/rbc-marks-10-million-w...

"RBC today announced it recently surpassed over 10 million successful chip transactions at compatible merchant locations in Canada and worldwide. This milestone comes four years after RBC became the first Canadian financial institution to begin issuing chip cards nationally to its Platinum Avion Visa cardholders in 2003."

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#77
post #23

Earlier quoted context omitted.

The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

> - You have to tip waiters with them standing right there and judging you.

In the US currently you write down the tip and leave, they can then charge you whatever they feel like after you're gone. As a tourist I was really paranoid about this, as by the time I looked at my statement when I got back I had no idea which charge was which restaurant and how much it should have been.

A common thing to do in the UK is pay without tip on card, then tip in cash

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#78
post #66
post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

Maybe they will be. As of now, I have never seen a card with a chip in person at all. In my entire life.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#79
post #66
post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

Only one of my cards is chip and sig, and I had to go out of my way to get it. It's not the default for all new cards, and certainly not for existing cards.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#80

Earlier quoted context omitted.

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

When I last heard this discussion it went like this: Visa to store : "People have been asking us for chip + pin and we're ready! Just pay a one time fee of $199.99 for the upgraded reader and note that C+P cards carry an additional .5% service charge for the more complex handling they do." Literally using it as a revenue generating opportunity and a way to raise fees. My friend who owns the store declined to particip…

Literally using it as a revenue generating opportunity and a way to raise fees.

This is the crux of it. In the US, every change is an opportunity to raise margins. Vinyl to CD. Book to Kindle. It kills me when the dead tree version is less than the Kindle version, but it's the same thing at work as with C+P.

Post reply on HN