Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

81–90 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#81
post #42

Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.

And it is patented..

[flagged]

Re: Target's EasySweep – Simplifying Skimmer Detection

#82
post #42

Since it's only implied how it works and there seems to be some confusion in the comments. It seems like the technique is to simply create a very form-fitting insert which won't fit properly if some device is overlaid onto the machine. The insert is not left in the device, but is just used for a quick in-and-out check.

And it is patented..

Sure is. Good thing criminals are too dumb to find it, and especially too dumb to replicate it. I'm sure they will never be able to modify their skimmers to circumvent it. They will rue the day they messed with Target's IP lawyers!!! https://patents.google.com/patent/US11507762B2/

Re: Target's EasySweep – Simplifying Skimmer Detection

#83
post #52
post #42

Earlier quoted context omitted.

And it is patented..

But also, freely licensed.

Only for large retailers, though. Why not directly offer the CAD file for download right on that page, or make the resulting product available for purchase?

Re: Target's EasySweep – Simplifying Skimmer Detection

#84
post #83
post #52

Earlier quoted context omitted.

But also, freely licensed.

Only for large retailers, though. Why not directly offer the CAD file for download right on that page, or make the resulting product available for purchase?

Likely to avoid defeat attempts. The corporate email requirement acts as a first-line defense to at least try to stave-off would be skimmers / scammers grabbing the CAD file and working out the measurements needed to defeat it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#85
post #79
post #71

Earlier quoted context omitted.

They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think…

I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already. The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.

“Sorry. I know you’re on assistance because you can’t afford food, but for your security we’re not going to let you buy food with your government benefits as you may become a scam victim.

Come back when your state government decides to pay to re-issue every card with better technology.”

That’s cruel. The move to EMV was only recently mandated for EBT (if I remember correctly and it was done at all) because so many people were having their benefits stolen by mag stripe skimmers.

You can’t use a stick against powerless people to affect change. It just makes them suffer.

Even if Target did mandate contactless, the stock would plummet on news of all the lost sales and the CEO would be out. The new one would reverse it immediately.

Re: Target's EasySweep – Simplifying Skimmer Detection

#86
post #54

Earlier quoted context omitted.

I think there are also just lots of POS systems in the US that aren't on EMV yet. Major retailers are on EMV but random old rural businesses probably aren't.

Some big chains still haven't switched. I was in a major home improvement store a few weeks ago, and it was swipe-only. Either Home Depot or Lowe's.

Lowe's. Lord help the poor souls who maintain that system; it looks like the kind of thing that's just chock full of COBOL.

Re: Target's EasySweep – Simplifying Skimmer Detection

#87

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Skimming is pretty much a solved problem in Europe already. We got rid of the mag stripe, so trivially cloning a card is no longer possible. Furthermore we don't allow offline transactions, so a skimmer must somehow get in between the connection from the terminal to the card and execute a separate transaction right before or after the genuine one.

It is still not 100% impossible, but the "overlay" type of skimmer this protects against has been eliminated for a few years now.

Re: Target's EasySweep – Simplifying Skimmer Detection

#88
post #66

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

Ironically, contactless has been the source of new types of skimmer attacks. A skimmer could just add an nfc coil and wouldn't even need to physically touch the card anymore.

Re: Target's EasySweep – Simplifying Skimmer Detection

#89
post #45

Earlier quoted context omitted.

Makes me think about intentionally corrupting the magstripe on my cards. I wonder if that’d cause any issues. I can’t remember having to fall back from the chip to a swipe in ages, and I have a couple of cards, so I could keep one as a backup with a working stripe just in case (long ago I found myself far from home and low on gas, with no cash, a dead cell phone and a “suspicious transaction” blocked credit card, and…

It's only an issue with EMV Fallback, which you'd probably not need if you have a backup card that is good. Basically if the chip or near-field antenna on your card fail, the fallback is to collect a magnetic stripe read. Properly-configured readers don't need the stripe read to complete a transaction.

Properly configured merchants don't even need the payment terminal to complete a transaction. They should be able to key the card number if all else fails. I say corrupt your magstrip if it makes you feel better.

Re: Target's EasySweep – Simplifying Skimmer Detection

#90
post #42

Earlier quoted context omitted.

And it is patented..

[flagged]

  > It's literally just a box-shaped piece of plastic with specific dimensions, attached to a handle. That's it.
That could be said about a very large number of useful products. It doesn't lessen their utility.

https://news.ycombinator.com/newsguidelines.html#comments

Post reply on HN