How Do You Stop an ATM Skimmer?

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
This seems like a simple yet effective way of beating card skimmers. At least until the crooks find a new way to steal your money.

“What we’ve done is turn the card 90 degrees, so that when it’s taken into the card reader. It is not being taken in in the direction that allows the magnetic stripe to be read,” said Frank Natoli, executive VP and Chief Innovation Officer at Diebold. "Instead of moving the card over the read head, once it’s inside the card reader, we take the read head and move it across the stripe at 90 degrees,” said Natoli.
Click to expand...
 
And by the end of the day...all skimmer hardware will be redesigned.

Oh and, your bank will up their ATM fees to make you pay for the new hardware.
 
Or, you know, just move to chip and PIN. ;) But interesting idea nonetheless; the biggest issue I see is mechanical failure due to increased complexity of the reader.
 
The issue is a read head on the skimmer passing over the magnetic strip of your card. It doesn't matter what orientation the card is in. I'm pretty sure my old 1980s cassette deck used to read tapes no matter it's orientation.
 
How about a multi-factor ATM machine that requires additional NFC?
 
how about removing that magnetic stripe? does it have any use except for some ancient atm in zimbabwe that doesn't use the chip on the card? why do we still use such old technology if we already have something much more secure?
 
temujin987 said:
how about removing that magnetic stripe? does it have any use except for some ancient atm in zimbabwe that doesn't use the chip on the card? why do we still use such old technology if we already have something much more secure?
Click to expand...

Because magnetic readers are fucking everywhere. And no business anywhere wants to spend money to replace hardware, especially where compatibility is concerned and the hardware still works.
 
temujin987 said:
how about removing that magnetic stripe? does it have any use except for some ancient atm in zimbabwe that doesn't use the chip on the card? why do we still use such old technology if we already have something much more secure?
Click to expand...

It's out there, but it's estimated to cost merchants in the US something like $10B to upgrade their old readers. In a low margin retail business...
 
TwistedAegis said:
It's out there, but it's estimated to cost merchants in the US something like $10B to upgrade their old readers. In a low margin retail business...
Click to expand...

It makes sense to me to have the credit card companies foot the bill.

An easier fix would be to require all cards to have a pin assigned, not just when being used as debit.
 
TwistedAegis said:
It's out there, but it's estimated to cost merchants in the US something like $10B to upgrade their old readers. In a low margin retail business...
Click to expand...

$10B is a big number for sure... but how much would that be for EACH retailer?

They certainly spent money to install card readers in the first place... but they never thought they'd need an upgrade in the future?

I'm 37 years old. I remember old-fashioned cash registers... the addition of barcode scanners... and the first generation credit card readers. There's been quite a progression in the retail space. Did stores pay for that hardware?

So why not newer chip-n-pin card readers?

If no retailer ever spent money on upgraded hardware... we'd still be using these:

ewlcwrW.jpg
$(KGrHqZHJBQFG-3Z)lOSBRzdttUFOQ~~60_35.JPG


Clearly they saw the benefits of moving past this ancient hardware... so I'm curious as to why they's stop before the next-generation of hardware.

I get it... it's expensive. But so was the last few decades of retail hardware.
 
I just check every ATM machine I put my card into. I tug and pull on the reader to make sure it stays in place and if it is legit, it will not move.
 
They will just wait until the cost to refund fraud. purchases outweigh the cost of the new hardware rollout, which will probably be a few years or more away.
 
MScrip said:
$10B is a big number for sure... but how much would that be for EACH retailer?

They certainly spent money to install card readers in the first place... but they never thought they'd need an upgrade in the future?

I'm 37 years old. I remember old-fashioned cash registers... the addition of barcode scanners... and the first generation credit card readers. There's been quite a progression in the retail space. Did stores pay for that hardware?

So why not newer chip-n-pin card readers?

If no retailer ever spent money on upgraded hardware... we'd still be using these:

[IM G]http://i.imgur.com/ewlcwrW.jpg[/IMG] [IM G]http://i.ebayimg.com/00/s/NTY0WDkwMA==/z/in4AAMXQzr1Rzdtt/$(KGrHqZHJBQFG-3Z)lOSBRzdttUFOQ~~60_35.JPG[/IMG]

Clearly they saw the benefits of moving past this ancient hardware... so I'm curious as to why they's stop before the next-generation of hardware.

I get it... it's expensive. But so was the last few decades of retail hardware.
Click to expand...

Because the current stuff works. Same reason you have companies still running WindowsXP...hell the same reason all ATMs themselves still use WinXP.

These days the retail sector is blowing chunk with online purchases as opposed to yester year. Which means there's even less desire to want to replace functioning hardware when there's no standardized move by VISA or MasterCard or anyone to go chipped. AFAIK no one is even talking about it.
 
Fraud is built in. I'm already paying for it, from a consumer standpoint I don't care, do whatever you want. I'm going to swipe it the same anyway.

No liability, overnight replacement card, meh. I have no incentive to care. Retailers do what you want.
 
Who uses ATMs anymore? Srsly.
I haven't held actual cash in my hands for ..., years?
 
Skripka said:
Because the current stuff works. Same reason you have companies still running WindowsXP...hell the same reason all ATMs themselves still use WinXP.

These days the retail sector is blowing chunk with online purchases as opposed to yester year. Which means there's even less desire to want to replace functioning hardware when there's no standardized move by VISA or MasterCard or anyone to go chipped. AFAIK no one is even talking about it.
Click to expand...

There are some places that have already upgraded to newer chip-n-pin card readers. They obviously weren't using those same machines 10 years ago.

What made them upgrade?
 
canna said:
The issue is a read head on the skimmer passing over the magnetic strip of your card. It doesn't matter what orientation the card is in.
Click to expand...

I'm not so sure about that. This seems to imply that you can't read it top to bottom.
 
chip and pin is coming. The company I work for is currently migrating our older readers to ones with C&P.. This was due to Mastercard and Visa shifting liability over from card issuers to the merchant with non-emv capable readers a while back.

more info..
After the cutoff dates set, Mastercard & Visa will no longer assume liability for fraud cases on non-chip-enabled terminals. Mastercard’s qualifying date was April 19, 2013, and Visa’s qualifying date is October 1, 2015. Visa’s Technology Innovation Program (TIP) also promises to eliminate the need for merchants to validate their PCI compliance in any year in which 75% percent of merchant transactions originate from chip-enabled terminals. However, this benefit will only apply to terminals that support contact and contactless chip acceptance.
Click to expand...
 
TwistedAegis said:
It's out there, but it's estimated to cost merchants in the US something like $10B to upgrade their old readers. In a low margin retail business...
Click to expand...

They somehow managed in Europe and Canada though. It was no less expensive for merchants, but we found a way. Course, you guys still haven't bit the bullet and moved to the metric system either, which was also expensive for us to do, but we still did. Quit being so damn cheap America!
 
Im going to guess that the guys saying that the magnetic strip isnt necessary are not from the US. Here in the uk weve been using chip and pin for ages, by the time america adopts it we will probably be using retina scanners or some such future tech.

America just needs to get with the times, no excuses. Ive never used the strip on my card im not even sure why its there tbh.
 
magnetik said:
chip and pin is coming. The company I work for is currently migrating our older readers to ones with C&P.. This was due to Mastercard and Visa shifting liability over from card issuers to the merchant with non-emv capable readers a while back.

more info..

After the cutoff dates set, Mastercard & Visa will no longer assume liability for fraud cases on non-chip-enabled terminals. Mastercard’s qualifying date was April 19, 2013, and Visa’s qualifying date is October 1, 2015. Visa’s Technology Innovation Program (TIP) also promises to eliminate the need for merchants to validate their PCI compliance in any year in which 75% percent of merchant transactions originate from chip-enabled terminals. However, this benefit will only apply to terminals that support contact and contactless chip acceptance.
Click to expand...
Click to expand...

I read about this when it was announced not too long ago and have already had one card upgraded with a chip. Still have yet to use it though. I'm pretty sure it's all in response to the Target stolen credit card info snafu a while back.

I'm actually not very familiar with chip and pin. What makes C&P invulnerable to skimmers in a way that stripe and pin is not? Are chip skimmers not possible? I'm guessing there has to be some sort of encryption / remote authentication involved.
 
cyclone3d said:
It makes sense to me to have the credit card companies foot the bill.

An easier fix would be to require all cards to have a pin assigned, not just when being used as debit.
Click to expand...

For as long as the cost of fraud is less than the cost of upgrading the machines, the machines will not get upgraded unless they have no other choice.

Free market, man. Companies collude.
 
I still can't believe you guys still use the magnetic stripe cards. Us Canadians switched to chip and pin years ago and we were still one of the last places on earth to switch. I think it's just the US and Ethiopia left now.

P.S. How the hell does reading the cards sideways really help anything. They can just build a skimmer that reads the cards sideways (yes I am aware this is a lot more complex and might require several sets of contacts). Security by obscurity is never the answer.
 
scbundy said:
They somehow managed in Europe and Canada though. It was no less expensive for merchants, but we found a way. Course, you guys still haven't bit the bullet and moved to the metric system either, which was also expensive for us to do, but we still did. Quit being so damn cheap America!
Click to expand...

They started teaching Kids the metric system back in the 70's in this country in some places, I remember it. I thought, "cool! just move the decimal place!" yeah, and we even had the same road signs as Europe for a while too, but then for whatever weird reason, the push to go metric just sort of faded away.
 
TwistedAegis said:
It's out there, but it's estimated to cost merchants in the US something like $10B to upgrade their old readers. In a low margin retail business...
Click to expand...

Either that, or consumer confidence in credit card transactions continue to erode....in a low margin retail business.
 
why can't we just login with our username/pw at an ATM? Just send an update to whatever application is running on there and call it a day. Just put an onscreen keyboard on there for the login. done. no more need for cards.

of course people could put cameras in there to record what people type but... that would be pretty tedious to try to decipher.
 
It costs anywhere between $200-300 to upgrade retailers to new NFC payment systems. Unfortunately most small businesses don't even know how to operate them or have it disabled or it broke. Needs a few more years to iron out the bugs.
 
Automaticman said:
I read about this when it was announced not too long ago and have already had one card upgraded with a chip. Still have yet to use it though. I'm pretty sure it's all in response to the Target stolen credit card info snafu a while back.

I'm actually not very familiar with chip and pin. What makes C&P invulnerable to skimmers in a way that stripe and pin is not? Are chip skimmers not possible? I'm guessing there has to be some sort of encryption / remote authentication involved.
Click to expand...

We actually just went through some webinars with Verifone discussing EMV/c&p and migration/advantages/liabilities etc. Here is a link to the PDF they provided.

on a side note we had Ingenico 3070's pulled from the PCI list. Something our merchants said has never happened before. It took a while to find out why but it was due to skimmers being used in Brazil on them. They were pulled once it was found out that they were modified relatively easily.
 
Last edited:
motomonkey said:
They started teaching Kids the metric system back in the 70's in this country in some places, I remember it. I thought, "cool! just move the decimal place!" yeah, and we even had the same road signs as Europe for a while too, but then for whatever weird reason, the push to go metric just sort of faded away.
Click to expand...

It's because 90% of the population here in the US seems to have a arithmophobia. The only numbers they deal with are the time of day, prices they pay and speed limits they fail to obey.

The majority of people in technical fields use metric units and are perfectly comfortable with them. Excluding construction...don't even get me started on what numbers mean to builders.
 
scbundy said:
They somehow managed in Europe and Canada though. It was no less expensive for merchants, but we found a way. Course, you guys still haven't bit the bullet and moved to the metric system either, which was also expensive for us to do, but we still did. Quit being so damn cheap America!
Click to expand...

Hey, you're preaching to the choir. I'm in fraud and am 100% in moving to this standard sooner rather than later. But that's just the reality of the pushback, and 10s of thousands of small merchants (and their lobbying groups) make a hell of a lot of noise.

And while I have no sympathy for the Targets and Walmarts, I can definitely feel for a mom and pop shop barely scraping by needing to drop several hundreds of dollars in equipment upgrades.

magnetik said:
chip and pin is coming. The company I work for is currently migrating our older readers to ones with C&P.. This was due to Mastercard and Visa shifting liability over from card issuers to the merchant with non-emv capable readers a while back.

more info..
Click to expand...

Magnetik beat me to it; the CC companies aren't going to pay for it, are you kidding me? They're pushing the liability onto the merchants if they don't switch.

That being said, aren't we not even moving to chip and PIN, but a watered down version, chip and sig?

MetalX said:
Either that, or consumer confidence in credit card transactions continue to erode....in a low margin retail business.
Click to expand...

If anything, consumers don't care too much because the banks pay for it. So while it sucks at first, most don't feel the true pain of the loss. Credit/debit card transaction volume continues to grow quickly YOY.
 
Who was it said 10B was big money?

In the world of business, 10B is chump change. Back in like 2003 or so, the IRS levied a 1Billion Dollar increase to Simantec's Taxes for undervalued intellectual property transfer between the US and Europe.

that was a 1 Billion Dollar increase in their taxes for the year, it's nothing, it's chump change when you are talking about businesses as a whole.
 
magnetik said:
We actually just went through some webinars with Verifone discussing EMV/c&p and migration/advantages/liabilities etc. Here is a link to the PDF they provided.

on a side note we had Ingenico 3070's pulled from the PCI list. Something our merchants said has never happened before. It took a while to find out why but it was due to skimmers being used in Brazil on them. They were pulled once it was found out that they were modified relatively easily.
Click to expand...

Thatnks for the PDF. I think this paragraph sums up the security improvement pretty well:

Dynamic Data or Dynamic code – EMV cards
generate a “dynamic code” which means the security
code changes for each transaction. That way, if a card
is copied or compromised, the data cannot be used
to make multiple transactions. In contrast, the data
transmitted by magnetic stripe cards never changes
and, once compromised, can be used over and over
for countless fraudulent transactions.
Click to expand...
 
Kueller said:
It's because 90% of the population here in the US seems to have a arithmophobia. The only numbers they deal with are the time of day, prices they pay and speed limits they fail to obey.

The majority of people in technical fields use metric units and are perfectly comfortable with them. Excluding construction...don't even get me started on what numbers mean to builders.
Click to expand...

Except this doesn't make sense either since the metric system is simpler to compute since everything is a factor of 10...
 
Grahamkracka said:
Except this doesn't make sense either since the metric system is simpler to compute since everything is a factor of 10...
Click to expand...

hahaha...I use both systems at work. Was slightely annoying at first, but then a few extra braincells must have came back from the dead. Fractions are much easier to visualize for me.

I am also one of the few who still carries cash. I hate the idea of credit cards. I use my debit card, but only for big purchases. I don't know why credit cards bother me so much. Same with primaries. People voting on who they want to vote for later. It is madness. Credit cards, people borrowing money so they can pay it back and borrow more money.
 
TwistedAegis said:
Or, you know, just move to chip and PIN. ;) But interesting idea nonetheless; the biggest issue I see is mechanical failure due to increased complexity of the reader.
Click to expand...
Bank cards already aready require a PIN. As for the chip, its just a supposedly harder to copy version of the magnetic stripe. If the skimmer hooks in downstream of the card reader, it may not do much good.

The chip is an anti-counterfeiter measure against reproducing the physical card. Back in the 90's that was the primary type of fraud and chips were probably hard to counterfeit. 25 years later, I'm not so sure.

The PIN is probably better than signatures on credit cards because no one check sigs. Although the signature is likely harder to steal. For an ATM they mount a camera in sight of the keypad when they install a skimmer.
 
jpm100 said:
Bank cards already aready require a PIN. As for the chip, its just a supposedly harder to copy version of the magnetic stripe. If the skimmer hooks in downstream of the card reader, it may not do much good.

The chip is an anti-counterfeiter measure against reproducing the physical card. Back in the 90's that was the primary type of fraud and chips were probably hard to counterfeit. 25 years later, I'm not so sure.

The PIN is probably better than signatures on credit cards because no one check sigs. Although the signature is likely harder to steal. For an ATM they mount a camera in sight of the keypad when they install a skimmer.
Click to expand...

The chip contains data that isn't readable by simply swiping the card via a mag-reader. Thus, skimmers aren't able to capture the full amount of data needed to make purchses with the card. PINs are required for ATM transactions; but debit cards can also be used without the PIN for signature transactions at the point of sale.

Signature are worthless; A. There isn't a systemic way for banks/issuers to monitor this, B. I can easily print out a brand new card with my name and your numbers on it, and sign my own signature for the nice store clerk. Even better is writing, "Check ID" on the back of the card. Again, I get a counterfeit ID with my name and signature on it that matches your card...thanks again nice clerk for checking, I appreciate your diligence!
 
TwistedAegis said:
Or, you know, just move to chip and PIN. ;) But interesting idea nonetheless; the biggest issue I see is mechanical failure due to increased complexity of the reader.
Click to expand...

That isn't a unbeatable solution. It's all about the implementation of the system at the retailer which is where most of the hacks have taken place. There's already several documented cases where the terminal itself was hacked to accept any pin given and a couple where the cards pin was captured. EMV just reduces fraud, not eliminates it and in the end is a 20-year old standard.
 
You must log in or register to reply here.
Back
Top