Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

91–100 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#91

Post by yakkers »

callalex wrote: post #65
whartung wrote: post #40

Earlier quoted context omitted.

It annoys me that none of the gas stations I use have the "tap to pay" that actually works. They seem to have the sensor on the pumps, but they never work.

My pet theory is that transitioning to wireless payment also opens up user expectations for the vendor to participate in way more payment networks than just Visa/MC/Discover/AmEx. If you have a wireless reader but no agreement with Apple Pay, or Google Pay, or Samsung Pay, or WePay, or WhateverSomeNewMBACrap users will start putting in reports that the reader is “broken”.

I’ll absolutely admit knowing very little about the nuances of payment networks in the US, particularly with contactless —- but my experience (in Australia) is that payment terminals that support contactless inherently support Apple/Google/etc Pay, even if the payment terminal is unaware of those things, in which case the transaction will work the same as a contactless card transaction (e.g. transactions >$100 require PIN).

Re: Target's EasySweep – Simplifying Skimmer Detection

#92

Post by pertymcpert »

MBCook wrote: post #85
gorkish wrote: post #79

Earlier quoted context omitted.

I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already. The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.

“Sorry. I know you’re on assistance because you can’t afford food, but for your security we’re not going to let you buy food with your government benefits as you may become a scam victim. Come back when your state government decides to pay to re-issue every card with better technology.” That’s cruel. The move to EMV was only recently mandated for EBT (if I remember correctly and it was done at all) because so many pe…

[flagged]

Re: Target's EasySweep – Simplifying Skimmer Detection

#93

Post by crote »

exabrial wrote: post #48

We wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.

That's EMV, and it is still not 100% foolproof because the card itself doesn't have a display and Allow/Deny button.

Re: Target's EasySweep – Simplifying Skimmer Detection

#95

Post by gorkish »

NoMoreNicksLeft wrote: post #29
HWR_14 wrote: post #26

Earlier quoted context omitted.

You read it wrong. It's not permanently attached. They stick a very precise 3D object in the chip slot, and if it doesn't fit, that means the slot isn't the exact same as how the reader was made from the manufacturer. So you get a cashier to do that at the start of their shift, and if anything is detected they call out a more trained repair man/security professional to figure out if there is a skimmer.

So the skimmer asshole pays some Target employee $100 to replace the very precise 3d object with one that hides the skimmer when no one's looking? I need a solution that lets me, the card holder, check these. This ain't it. Hell, some of the internal skimmers just solder jumper wires to pcb pins/testpoints don't they? There's nothing mechanical for a card to touch. Target's got so many telescreen cameras in the store…

> I need a solution that lets me, the card holder, check these. This ain't it.

No you don't. All you need to do is use a payment method that is actually secure. Demand it. When they tell you tap doesnt work, ask why. Hand your card to the cashier and make them scan it on the register's reader.

Re: Target's EasySweep – Simplifying Skimmer Detection

#96

Post by kalupa »

monkeymeister wrote: post #84
crote wrote: post #83

Earlier quoted context omitted.

Only for large retailers, though. Why not directly offer the CAD file for download right on that page, or make the resulting product available for purchase?

Likely to avoid defeat attempts. The corporate email requirement acts as a first-line defense to at least try to stave-off would be skimmers / scammers grabbing the CAD file and working out the measurements needed to defeat it.

ah, nothing like security through obscurity!

Re: Target's EasySweep – Simplifying Skimmer Detection

#97

Post by strictnein »

gorkish wrote: post #66
adrianmonk wrote: post #38

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

> This hunk of plastic from Target is a solution looking for a problem

When you're dealing with tens of thousands of terminals that you want to check on a regular basis across thousands of stores, having a device that verifies things quickly is a solution to a real problem.

Re: Target's EasySweep – Simplifying Skimmer Detection

#98

Post by gorkish »

MBCook wrote: post #85
gorkish wrote: post #79

Earlier quoted context omitted.

I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already. The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.

“Sorry. I know you’re on assistance because you can’t afford food, but for your security we’re not going to let you buy food with your government benefits as you may become a scam victim. Come back when your state government decides to pay to re-issue every card with better technology.” That’s cruel. The move to EMV was only recently mandated for EBT (if I remember correctly and it was done at all) because so many pe…

Where did I suggest this? The customer payment terminal is not the register. Both have card readers; one is fantastically less likely to be tampered with than the other. There is absolutely nothing wrong with putting your cashier in between the customer and a potentially fraudulent payment. What happens when that person gets their EBT account drained by a criminal because of a skimmer? I'm not trying to marginalize anyone; get real.

Re: Target's EasySweep – Simplifying Skimmer Detection

#100

Post by sangnoir »

crote wrote: post #87
adrianmonk wrote: post #38

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face,…

Skimming is pretty much a solved problem in Europe already. We got rid of the mag stripe, so trivially cloning a card is no longer possible. Furthermore we don't allow offline transactions, so a skimmer must somehow get in between the connection from the terminal to the card and execute a separate transaction right before or after the genuine one. It is still not 100% impossible, but the "overlay" type of skimmer thi…

You are correct: but I think all these measures are in place because liability is placed on financial institutions rather than individual victims. The owners of the payment infrastructure are correctly motivated to holistically solve the problem, unlike in the US were the person woth the least power and control is burdened with having to contend with "Identity theft" and losing money by default to make up for the fraud.
Post reply on HN