3 ms·

Kind of a rant, sorry. Chips are great, but in-store fraud transactions (from unauthorized purchases) have scaled downward, until... Google Wallet, and Apple

by joshmn 11y ago

Kind of a rant, sorry. Chips are great, but in-store fraud transactions (from unauthorized purchases) have scaled downward, until... Google Wallet, and Apple Pay. In fact, it's now easier to perform in-store credit card fraud, thanks to such technologies. This is important because stores are becoming more and more complacent with chip tech, when what they should really be doing is not allowing transactions via Google Wallet, Apple Pay, or any similar technologies. We'll hear on the news that chips are a big deal — and don't get me wrong, they are — but with new technologies comes new opportunities, and it's now 100x easier to perform a fraudulent in-store transaction, it really makes me laugh how much of an afterthought we're giving these technologies when all you have to say is "chip" and everyone's like "oh okay that's safe."

InclinedPlane 11y ago
This is a story. I'm going to need to see some data.
peteretep 11y ago
> In fact, it's now easier to perform in-store credit > card fraud, thanks to such technologies. How is it easier for someone to perform fraud using Apple Pay? You'd need to both have and then unlock either my phone or watch to make a payment using them, which is still two-factor authentication...
- mike_hearn 11y ago
  Apple Pay is an effective way of 'laundering' stolen card details due to weak enrollment procedures.
  - nommm-nommm 11y ago
    More info: http://www.nytimes.com/2015/03/17/business/banks-find-fraud-abounds-in-apple-pay.html http://www.nytimes.com/2015/03/17/business/banks-find-fraud-... An industry consultant, Cherian Abraham, put the fraud rate at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. Mr. Abraham wrote in a blog post, one of the first to spotlight the issue, that the Apple Pay fraud “is growing like a weed, and the bank is unable to tell friend from foe. No one is bold enough to call the emperor naked.” The vulnerability in Apple Pay is in the way that it — and card issuers — “onboard” new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process “frictionless,” the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early.
    - ubernostrum 11y ago
      This has largely been debunked elsewhere -- the fraud is entirely on the poor verification by the banks. When I got an iPhone supporting Apple Pay, I added two cards to it. One just set up with nothing more than entering the information. The other one triggered a phone call to the issuing bank where I had to jump through multiple verification hoops to convince them I was the cardholder. Apple can't fix the first bank's security problem, and I don't really expect them to.
      - serge2k 11y ago
        I had to call the bank for one and install the companies app (and login) for another. Both took a few minutes, not really an issue.
    - rwmurrayVT 11y ago
      It isn't that the process is so simple. It's that it allows fraudsters to convert their "fullz", previously used best online, to in-store Apple Pay cards. You could theoretically call into the victim's bank, and with their SSN + address + etc. add the card to Apple Pay. This would allow you to use the card in-store. Contrast this with previous use, where you the potential damage might range from taking over the account and performing online transactions. Being able to go from online transactions to in-store transactions is huge. But it's not so simple as just "type in the cc #, zip, and cvv". You need their entire details and to be very methodical. The issue is... people are easily convinced to part with all their identity information.

by joshmn 11y ago

InclinedPlane 11y ago

This is a story. I'm going to need to see some data.

peteretep 11y ago

> In fact, it's now easier to perform in-store credit > card fraud, thanks to such technologies. How is it easier for someone to perform fraud using Apple Pay? You'd need to both have and then unlock either my phone or watch to make a payment using them, which is still two-factor authentication...

mike_hearn 11y ago
Apple Pay is an effective way of 'laundering' stolen card details due to weak enrollment procedures.
- nommm-nommm 11y ago
  More info: http://www.nytimes.com/2015/03/17/business/banks-find-fraud-abounds-in-apple-pay.html http://www.nytimes.com/2015/03/17/business/banks-find-fraud-... An industry consultant, Cherian Abraham, put the fraud rate at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. Mr. Abraham wrote in a blog post, one of the first to spotlight the issue, that the Apple Pay fraud “is growing like a weed, and the bank is unable to tell friend from foe. No one is bold enough to call the emperor naked.” The vulnerability in Apple Pay is in the way that it — and card issuers — “onboard” new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process “frictionless,” the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early.
  - ubernostrum 11y ago
    This has largely been debunked elsewhere -- the fraud is entirely on the poor verification by the banks. When I got an iPhone supporting Apple Pay, I added two cards to it. One just set up with nothing more than entering the information. The other one triggered a phone call to the issuing bank where I had to jump through multiple verification hoops to convince them I was the cardholder. Apple can't fix the first bank's security problem, and I don't really expect them to.
    - serge2k 11y ago
      I had to call the bank for one and install the companies app (and login) for another. Both took a few minutes, not really an issue.
  - rwmurrayVT 11y ago
    It isn't that the process is so simple. It's that it allows fraudsters to convert their "fullz", previously used best online, to in-store Apple Pay cards. You could theoretically call into the victim's bank, and with their SSN + address + etc. add the card to Apple Pay. This would allow you to use the card in-store. Contrast this with previous use, where you the potential damage might range from taking over the account and performing online transactions. Being able to go from online transactions to in-store transactions is huge. But it's not so simple as just "type in the cc #, zip, and cvv". You need their entire details and to be very methodical. The issue is... people are easily convinced to part with all their identity information.