8 ms·

Guy spotted wandering London Tube skimming contactless cards with POS device

148 points by butler14 11y ago

rbobby 11y ago
Yet another reason why we can't have nice stuff. Sigh.
- CydeWeys 11y ago
  I have a two-factor auth device that requires that I physically activate it by touching it in a certain way. Why the hell aren't contactless credit/debit cards similar? Why should I need to keep them in a Faraday wallet when they shouldn't be active except in those few second windows when I explicitly want them to be?
  - superuser2 11y ago
    There is no "point" to Contactless if you have to take the card out and touch it. At that point you may as well swipe it. Contactless as an idea is probably ill-conceived though.
    - tonylemesmer 11y ago
      Its very, very convenient. More-so than cash. 1. I don't have to carry cash 2. I don't have to go to the bank to get cash 3. I don't have to count the cash when paying 4. No change to worry about. 5. Transaction logs via bank statement The downside that this (OP) problem illustrates does need sorting and I was very sceptical of contactless before I used it, but its quite nice.
      - superuser2 11y ago
        Most credit and debit cards are not contactless and can only be read when inserted into a reader. Why not use one of those?
        tonylemesmer 11y ago
        These contactless cards can also be used on TFL (Transport for London) Underground entry points, directly debiting your bank account. There is no mechanical degradation associated with using a contactless card whereas in my experience swiping the mag-stripe is problematic. However as many have pointed out, there are potentially a boat load of skimming issues.
        takluyver 11y ago
        In the UK, most new debit cards at least do have contactless payment. I'm not sure about credit cards, but it's probably the same.
    - samwillis 11y ago
      I think the "point" of contactless is to make the transactions quicker. Where it used to (in the UK) take 30 seconds to put your card in the chip and pin machine, enter your pin number and wait for the transaction to be confirmed, now its literally 3 seconds. Over the course of a year that is a massive time saving for the retailer and so a cost saving (less staff). With chip and pin the customer was liable for all transactions when their pin number was used. It was your responsibility to ensure it wasn't exposed. Now with contactless there is no risk to the customer, the bank/retailer takes on the full risk of fraud for contactless payments. You will not be out of pocket for a fraudulent contactless transaction. This is why contactless transaction are limited to £30 (initially was £20), it limits the bank/retailers potential exposure to contactless fraud, its also handily set to just about the average card transaction in the UK.
      - superuser2 11y ago
        Interesting. In the US most businesses use magnetic stripe readers which take ~1 second from swipe to approval.
        josephmx 11y ago
        We stopped using that for lack of security, plus I think signing the receipt (and carbon copy) is time consuming, right?
        VLM 11y ago
        I don't do much legacy brick and mortar CC shopping anymore, but it seems completely random at Home Depot and Target if they want my signature or not. Maybe after X transactions in the last Y days they no longer need a sig. With a possible side dish of Z percent or lower of transactions are fraudulent from this store.
        gambiting 11y ago
        You can use swipe in some places in the UK, but then you have to wait for the receipt to print, the cashier to find a pen, you have to sign it and the cashier has to verify it, click on the terminal that they did, and get a final receipt printed. It's even more hassle than typing in a pin.
  - matthewmacleod 11y ago
    In that sense, wouldn't it be just as easy to insert the card into a POS device and supply the PIN? The point of contactless is to make it less bother to use cards. One of the tradeoffs for that is reducing the security – it's sort of a necessary condition. Losses are limited to maybe £150 in the UK (that's 5 transactions at the maximum of £30) without further authentication, and it's virtually certain that the card provider will refund these transactions too if your card is used without authorisation.
    - CydeWeys 11y ago
      It's significantly easier to simply touch the card than to have to insert it into a device that provides a keypad, and then type a PIN into said keypad. The keypad approach is safer though, and I'd prefer that for lots of situations, but there's no situation in which I'd want to be able to have money leave my card without me at least touching the damn thing to activate it.
- herbst 11y ago
  Contact less payments without verification is certanly not "nice stuff" but simply negligently and stupid.
  - lloydsparkes 11y ago
    Its nice because it makes payments significantly faster especially for small transactions. When your in a busy shop getting lunch, or a bar, it saves a significant amount of time and effort.
    - Majestic121 11y ago
      It does save you some time, but is this time worth the security downgrade? I guess it is up to each person to answer this question. The main issue I have with this is that no one gave me a choice : I received my card with this feature turned on and absolutely no way to have a card without it (I asked at the bank).
      - herbst 11y ago
        I changed banks about things like this. My bank once thought that i have to have Online Banking with my account, while all i wanted (and still do) is absolutely no remote access except with the debit card. They also told me that their eTan is much safer than the classic Tan system via post so they stopped it. I really think less is more when it goes about the safety of my money.
    - malka 11y ago
      When it comes to my money, i want safe. not convenient.
    - herbst 11y ago
      Honestly i have the few extra seconds. My security and peace are fully worth that. Also we have fingerprint scanners on android now. So contactless plus verification is not a issue at all. Contactless without verification is just lazy. There is really nothing to argue.
    - 11y ago
- mseebach 11y ago
  Yes, but the reason isn't what you suggest it is. The reason is that people like the OP on Facebook, whoever posted it here, and whoever up-voting it, are happy to feed the fear of strangers by propagating these kinds of stories. This story will probably make it into the tabloids tomorrow thanks to having gone viral. A lie gets halfway around the world before the truth has a chance to get its pants on.
mjs 11y ago
If you connect your card to Apple Pay you get an immediate notification every time your card is charged (might depend on the bank), which is useful for detecting this sort of thing. Actually I'm not sure why Apple Pay should be necessary--if you have the bank's app installed that should generate notifications on "purchase" as well.
- TheOtherHobbes 11y ago
  I'm not sure how many UK banks send them. Mine certainly doesn't. It's also been the slowest to roll out Apple Pay support.
  - soneil 11y ago
    Something I thought was interesting, I have a friend who banks with česká spořitelna, and she gets an SMS for each transaction. Nothing fancy, no app, no 'platform', just .. better banking in eastern europe than in the UK.
    - scrollaway 11y ago
      The UK has Mondo coming soon (https://getmondo.co.uk/ https://getmondo.co.uk/) which looks very promising. For the Eurozone, there's Number26 (https://number26.eu/ https://number26.eu/). I've been using them. They took a long time to send me their card but overall they're a million times better than any other bank in Europe. (If you want more info, email me)
- samwillis 11y ago
  I only seem to get the notification on the phone if it was a transaction initiated with Apply Pay. I don't get them when just using the contactless card. (I think 'modern banking with apps and notifications' is what new UK banks like Mondo[1] and Atom[2] are aiming to do) 1: https://getmondo.co.uk/ https://getmondo.co.uk/ 2: https://www.atombank.co.uk/ https://www.atombank.co.uk/
  - underyx 11y ago
deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]
awjr 11y ago
I don't get this. Credit Card fraud is used to acquire goods from unsuspecting traders. This requires a trader to have a POS and money is not usually credited for 1-4 weeks, by which time his/her account will be frozen and the police on the way.
- richmarr 11y ago
  Misleading title. He wasn't spotted "skimming contactless cards" he was spotted holding an object and doing nothing else with it.
- forgetsusername 11y ago
  No kidding. If you're collecting payments through a credit card processor, this sort of scam would be shut down and reversed almost immediately, since the credit card company is directly in the middle of the transaction.
  - cissou 11y ago
    While you're mostly correct, it doesn't prevent people from "trying" this sort of scam. IIRC Square had to fight many battles like this, where fake "merchants" would open a Square account, swipe stolen cards, move the money away from Square and close their account. It's many small time crooks, not one big operation (it doesn't take a genius to figure this out), so it's actually really hard to fight.
- nly 11y ago
  There was a presentation at 32C3 this year where it was demonstrated, live on stage, just how woefully easy it is to get an eBay bought PoS device working with someone elses merchant account. Once you've done so, all you have to do is issue a 'refund' to a card you control, perhaps already stolen itself, and then go and withraw the cash. Another method, that was actually demonstrated, was to issue a mobile phone topup, which many of these multi-function terminals can do. Like most exploits, cybercrime isn't going to be enacted through a single flaw, but through systemic failure in the industry to give a shit before rolling any of this crap out.
viggity 11y ago
wait, so there is no pin that you have to enter?
- tonylemesmer 11y ago
  nope, just swipe. It doesn't even verify the transaction with the bank because there is a £30 limit on transactions.
- deleted 11y ago
  [deleted]
- yoz-y 11y ago
  For contactless payment, no. But the transactions are limited in amount (according to the article in UK it is 30 GBP and here in France it is 20 EUR). You can also pay only a certain amount before having to use "standard" method with chip & pin.
  - Systemic33 11y ago
    I'm fairly certain you don't need to use chip, but you do need to use the PIN.
    - manarth 11y ago
      In the UK at least, PIN-challenges for contactless payment are random. I've heard it's supposedly approx 1 in 10 payments require the PIN, but I've been using contactless payment for just over 6 months, and it hasn't asked once (I've also used it a few times in mainland Europe, again, no PIN needed).
    - yoz-y 11y ago
      Sadly in France for any transaction over 20EUR you have to use the chip. I know that in several other countries you only need the PIN. Apparently this actually depends on the terminal configuration so I hope that once Apple Pay comes here it will not suffer from the same useless limitation.
est 11y ago
Tin foil wallets is already a thing these days.
- Rafert 11y ago
  Or solid aluminium if you're looking for something more fancy: https://www.secrid.com/en/ https://www.secrid.com/en/
YeGoblynQueenne 11y ago
For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.
YeGoblynQueenne 11y ago
For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.
YeGoblynQueenne 11y ago
For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.
belltyler 11y ago
"And I would have gotten away with it, too, if it weren't for you meddling kids!" - Guy carrying POS device
danso 11y ago
Naive person here: if this is a thing that works, how did it escape notice as an attack vector in the stages in which this technology was debated and standardized?
- matthewmacleod 11y ago
  It didn't. This is a known attack vector; the decision has been taken that the costs of cancelling fraudulent transactions are less than the benefits from allowing easier payment.
- yoz-y 11y ago
  It did not escape. That is why the contactless payment has very low limits, so the damage is not that big. Also, my card has to be really close to the terminal to work. (And I have a shielded wallet anyways)
- deleted 11y ago
  [deleted]
ck2 11y ago
How to disable contactless cards http://www.instructables.com/id/Disabling-Contacless-Payment-on-Debit-Cards/step2/How-to-disable-it-on-your-card/ http://www.instructables.com/id/Disabling-Contacless-Payment...
tomcart 11y ago
Maybe someone else can confirm, but that doesn't look like any TFL carriage i know. In fact, it looks a lot more like moscow: http://thumbs.dreamstime.com/z/inside-modern-subway-car-1214290.jpg http://thumbs.dreamstime.com/z/inside-modern-subway-car-1214... and was posted on EnglishRussia a week ago: https://twitter.com/EnglishRussia1/status/697017291494596608 https://twitter.com/EnglishRussia1/status/697017291494596608 It may have existed before this...
- joshcrowder 11y ago
  You're correct its definitely not a London Underground I dont think its a UK train either
- bechampion 11y ago
  yes that's not TFL by the looks of it.
- Someone1234 11y ago
  Agreed. That metal pole should be coloured (dark blue, dark red, or yellow) if it were a London Underground train. I even Google Image Searched it, and cannot find a train that looks like that. Plus the shape of the pole is all wrong...
- s_kilk 11y ago
  Definitely not a UK train.
- anton_gogolev 11y ago
  It is indeed a carriage from one of the Russian underground systems. I vaguely recall having seen this story sometime ago, and back then it was reported that this guy was spotted in Moscow underground, but these kinds of carriages can be seen in Moscow, St. Petersburg, Kiev and possibly other cities.
- richmarr 11y ago
  ...and here again in Poland, also a week ago: http://paczaizm.pl/jesli-zastanawiasz-sie-gdzie-spierdzielilo-twoje-50zl-na-koncie-gosc-z-terminalem-w-metrze-komunikacji-miejskiej/ http://paczaizm.pl/jesli-zastanawiasz-sie-gdzie-spierdzielil...
happywolf 11y ago
What this guy can take advantage will be victims don't check their bank statements carefully and he can get away with the money, or else he will be in pretty bad shape to handle all the charge-backs. I will say the chance of a stolen POS is low as his goal is to get the money. If he borrows the POS from his merchant friend for this purpose, then that is not cool at all. To me this is not a serious security threat to ordinary people.
- shiftpgdn 11y ago
  Charge a penny and then refund it to capture the details for a recurring charge. 30 days from then you can hit the card with a $5 charge using some ambiguous merchant name like "Card validation services". 90% of people don't inspect their bank statements close enough to notice something like this. Get 1000 people and that's a healthy sum for a criminal to live off of.
  - mseebach 11y ago
    > 90% of people don't inspect their bank statements close enough But 10% of people is more than enough (by a substantial margin) to get the operation shut down, the money (all of it) returned, and probably land the guy in jail.
domas 11y ago
Looks like this FB post is just a hoax. Linked FB post is not an original. There is an older story here in Russian: https://tjournal.ru/22625-staling-money-with-terminal https://tjournal.ru/22625-staling-money-with-terminal
shawabawa3 11y ago
I doubt he's actually skimming cards. The risk-reward is pretty terrible. It's hard to subtly press it up against someone's pocket, and the range is pretty bad, and the first time anyone notices your account is frozen and you'll be prosecuted
oavdeev 11y ago
Exact same photo was making rounds in Russian Facebook few weeks ago, judging by the door and the handle I bet it is indeed Moscow, not London. As in this case, no one saw the guy actually skimming cards. Also if he was doing really that, why not hide POS in a bag or his pocket?
- at-fates-hands 11y ago
  This was my reaction. If you're skimming cards, you probably want to make sure your target is unaware of what you're doing less someone sees you and notifies transit cops or some other authorities and you get arrested.
butler14 11y ago
For those inclined, you can get neat little leather sleeves that have two pockets, one protected, one not, here https://www.faradaystore.com/rfid-blocking/wallets/ https://www.faradaystore.com/rfid-blocking/wallets/. Helps me keep my debit/credit card safe(?), but if nothing else, stops it clashing with my Oyster, which can otherwise be a pain.
- gboudrias 11y ago
  At this price it might be cheaper to ship it from ThinkGeek (although they seem only only have the S.H.I.E.L.D. model nowadays...): https://www.thinkgeek.com/product/1d95/ https://www.thinkgeek.com/product/1d95/
  - butler14 11y ago
    yea there is sod all choice outside of the US from what I've seen. most RFID wallets seem to be an extension of Kickstarter's obsession with them a couple of years ago, and most manufacturers and sellers seem to be North American-based.
  - bryan11 11y ago
    One can make an RFID shield for a folding wallet fairly easily. Take a manila folder or something similar and cut it to tightly fit in the outside pocket. Cover that with aluminum foil, then cover that with packing tape. Place this in the outside pocket of the wallet, fold it so the RFID shield covers the contents, and cards inside are protected.
notliketherest 11y ago
Of course this is possible. Sign up for a Stripw account, feed it a PAN (credit card number), and charge it. With anti fraud mechanisms however, you're not going to get very far.
kombucha2 11y ago
this is stupid
yread 11y ago
I'm definitely NOT buying an RFID-blocking wallet if they have to do marketing with hoaxes like this
snake_plissken 11y ago
Why would anyone ever pull a scam like this? To get a POS terminal, don't you have to submit a lot of personal information? And then, how would you anonymously get the money from the bank? It's not like you could do this over a long time lime where you slowly accumulate < $30 charges and then one day withdrawal all of the money. You would surely get flagged?
Aoyagi 11y ago
This is Russia. I have no difficulties believing it's genuine.
molecule 11y ago
Other commenters have pointed out that this does not appear to be on the London Tube. The post mentions nothing saying that the poster took the photograph or that it was on the London Tube, the London-Tube association of the HN headline seems to be mis-inferred from the poster's location, Edinburgh, United Kingdom, although that's quite a ways from London...

148 points by butler14 11y ago

rbobby 11y ago

Yet another reason why we can't have nice stuff. Sigh.

CydeWeys 11y ago
I have a two-factor auth device that requires that I physically activate it by touching it in a certain way. Why the hell aren't contactless credit/debit cards similar? Why should I need to keep them in a Faraday wallet when they shouldn't be active except in those few second windows when I explicitly want them to be?
- superuser2 11y ago
  There is no "point" to Contactless if you have to take the card out and touch it. At that point you may as well swipe it. Contactless as an idea is probably ill-conceived though.
  - tonylemesmer 11y ago
    Its very, very convenient. More-so than cash. 1. I don't have to carry cash 2. I don't have to go to the bank to get cash 3. I don't have to count the cash when paying 4. No change to worry about. 5. Transaction logs via bank statement The downside that this (OP) problem illustrates does need sorting and I was very sceptical of contactless before I used it, but its quite nice.
    - superuser2 11y ago
      Most credit and debit cards are not contactless and can only be read when inserted into a reader. Why not use one of those?
      - tonylemesmer 11y ago
        These contactless cards can also be used on TFL (Transport for London) Underground entry points, directly debiting your bank account. There is no mechanical degradation associated with using a contactless card whereas in my experience swiping the mag-stripe is problematic. However as many have pointed out, there are potentially a boat load of skimming issues.
      - takluyver 11y ago
        In the UK, most new debit cards at least do have contactless payment. I'm not sure about credit cards, but it's probably the same.
  - samwillis 11y ago
    I think the "point" of contactless is to make the transactions quicker. Where it used to (in the UK) take 30 seconds to put your card in the chip and pin machine, enter your pin number and wait for the transaction to be confirmed, now its literally 3 seconds. Over the course of a year that is a massive time saving for the retailer and so a cost saving (less staff). With chip and pin the customer was liable for all transactions when their pin number was used. It was your responsibility to ensure it wasn't exposed. Now with contactless there is no risk to the customer, the bank/retailer takes on the full risk of fraud for contactless payments. You will not be out of pocket for a fraudulent contactless transaction. This is why contactless transaction are limited to £30 (initially was £20), it limits the bank/retailers potential exposure to contactless fraud, its also handily set to just about the average card transaction in the UK.
    - superuser2 11y ago
      Interesting. In the US most businesses use magnetic stripe readers which take ~1 second from swipe to approval.
      - josephmx 11y ago
        We stopped using that for lack of security, plus I think signing the receipt (and carbon copy) is time consuming, right?
        VLM 11y ago
        I don't do much legacy brick and mortar CC shopping anymore, but it seems completely random at Home Depot and Target if they want my signature or not. Maybe after X transactions in the last Y days they no longer need a sig. With a possible side dish of Z percent or lower of transactions are fraudulent from this store.
      - gambiting 11y ago
        You can use swipe in some places in the UK, but then you have to wait for the receipt to print, the cashier to find a pen, you have to sign it and the cashier has to verify it, click on the terminal that they did, and get a final receipt printed. It's even more hassle than typing in a pin.
- matthewmacleod 11y ago
  In that sense, wouldn't it be just as easy to insert the card into a POS device and supply the PIN? The point of contactless is to make it less bother to use cards. One of the tradeoffs for that is reducing the security – it's sort of a necessary condition. Losses are limited to maybe £150 in the UK (that's 5 transactions at the maximum of £30) without further authentication, and it's virtually certain that the card provider will refund these transactions too if your card is used without authorisation.
  - CydeWeys 11y ago
    It's significantly easier to simply touch the card than to have to insert it into a device that provides a keypad, and then type a PIN into said keypad. The keypad approach is safer though, and I'd prefer that for lots of situations, but there's no situation in which I'd want to be able to have money leave my card without me at least touching the damn thing to activate it.
herbst 11y ago
Contact less payments without verification is certanly not "nice stuff" but simply negligently and stupid.
- lloydsparkes 11y ago
  Its nice because it makes payments significantly faster especially for small transactions. When your in a busy shop getting lunch, or a bar, it saves a significant amount of time and effort.
  - Majestic121 11y ago
    It does save you some time, but is this time worth the security downgrade? I guess it is up to each person to answer this question. The main issue I have with this is that no one gave me a choice : I received my card with this feature turned on and absolutely no way to have a card without it (I asked at the bank).
    - herbst 11y ago
      I changed banks about things like this. My bank once thought that i have to have Online Banking with my account, while all i wanted (and still do) is absolutely no remote access except with the debit card. They also told me that their eTan is much safer than the classic Tan system via post so they stopped it. I really think less is more when it goes about the safety of my money.
  - malka 11y ago
    When it comes to my money, i want safe. not convenient.
  - herbst 11y ago
    Honestly i have the few extra seconds. My security and peace are fully worth that. Also we have fingerprint scanners on android now. So contactless plus verification is not a issue at all. Contactless without verification is just lazy. There is really nothing to argue.
  - 11y ago
mseebach 11y ago
Yes, but the reason isn't what you suggest it is. The reason is that people like the OP on Facebook, whoever posted it here, and whoever up-voting it, are happy to feed the fear of strangers by propagating these kinds of stories. This story will probably make it into the tabloids tomorrow thanks to having gone viral. A lie gets halfway around the world before the truth has a chance to get its pants on.

mjs 11y ago

If you connect your card to Apple Pay you get an immediate notification every time your card is charged (might depend on the bank), which is useful for detecting this sort of thing. Actually I'm not sure why Apple Pay should be necessary--if you have the bank's app installed that should generate notifications on "purchase" as well.

TheOtherHobbes 11y ago
I'm not sure how many UK banks send them. Mine certainly doesn't. It's also been the slowest to roll out Apple Pay support.
- soneil 11y ago
  Something I thought was interesting, I have a friend who banks with česká spořitelna, and she gets an SMS for each transaction. Nothing fancy, no app, no 'platform', just .. better banking in eastern europe than in the UK.
  - scrollaway 11y ago
    The UK has Mondo coming soon (https://getmondo.co.uk/ https://getmondo.co.uk/) which looks very promising. For the Eurozone, there's Number26 (https://number26.eu/ https://number26.eu/). I've been using them. They took a long time to send me their card but overall they're a million times better than any other bank in Europe. (If you want more info, email me)
samwillis 11y ago
I only seem to get the notification on the phone if it was a transaction initiated with Apply Pay. I don't get them when just using the contactless card. (I think 'modern banking with apps and notifications' is what new UK banks like Mondo[1] and Atom[2] are aiming to do) 1: https://getmondo.co.uk/ https://getmondo.co.uk/ 2: https://www.atombank.co.uk/ https://www.atombank.co.uk/
- underyx 11y ago

deleted 11y ago

[deleted]

deleted 11y ago
[deleted]

awjr 11y ago

I don't get this. Credit Card fraud is used to acquire goods from unsuspecting traders. This requires a trader to have a POS and money is not usually credited for 1-4 weeks, by which time his/her account will be frozen and the police on the way.

richmarr 11y ago
Misleading title. He wasn't spotted "skimming contactless cards" he was spotted holding an object and doing nothing else with it.
forgetsusername 11y ago
No kidding. If you're collecting payments through a credit card processor, this sort of scam would be shut down and reversed almost immediately, since the credit card company is directly in the middle of the transaction.
- cissou 11y ago
  While you're mostly correct, it doesn't prevent people from "trying" this sort of scam. IIRC Square had to fight many battles like this, where fake "merchants" would open a Square account, swipe stolen cards, move the money away from Square and close their account. It's many small time crooks, not one big operation (it doesn't take a genius to figure this out), so it's actually really hard to fight.
nly 11y ago
There was a presentation at 32C3 this year where it was demonstrated, live on stage, just how woefully easy it is to get an eBay bought PoS device working with someone elses merchant account. Once you've done so, all you have to do is issue a 'refund' to a card you control, perhaps already stolen itself, and then go and withraw the cash. Another method, that was actually demonstrated, was to issue a mobile phone topup, which many of these multi-function terminals can do. Like most exploits, cybercrime isn't going to be enacted through a single flaw, but through systemic failure in the industry to give a shit before rolling any of this crap out.

viggity 11y ago

wait, so there is no pin that you have to enter?

tonylemesmer 11y ago
nope, just swipe. It doesn't even verify the transaction with the bank because there is a £30 limit on transactions.
deleted 11y ago
[deleted]
yoz-y 11y ago
For contactless payment, no. But the transactions are limited in amount (according to the article in UK it is 30 GBP and here in France it is 20 EUR). You can also pay only a certain amount before having to use "standard" method with chip & pin.
- Systemic33 11y ago
  I'm fairly certain you don't need to use chip, but you do need to use the PIN.
  - manarth 11y ago
    In the UK at least, PIN-challenges for contactless payment are random. I've heard it's supposedly approx 1 in 10 payments require the PIN, but I've been using contactless payment for just over 6 months, and it hasn't asked once (I've also used it a few times in mainland Europe, again, no PIN needed).
  - yoz-y 11y ago
    Sadly in France for any transaction over 20EUR you have to use the chip. I know that in several other countries you only need the PIN. Apparently this actually depends on the terminal configuration so I hope that once Apple Pay comes here it will not suffer from the same useless limitation.

est 11y ago

Tin foil wallets is already a thing these days.

Rafert 11y ago
Or solid aluminium if you're looking for something more fancy: https://www.secrid.com/en/ https://www.secrid.com/en/

YeGoblynQueenne 11y ago

For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.

YeGoblynQueenne 11y ago

For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.

YeGoblynQueenne 11y ago

For the record device is Verifone VX 680. This must be the dumbest thief ever. They practicality signed their theft. With their real name.

belltyler 11y ago

"And I would have gotten away with it, too, if it weren't for you meddling kids!" - Guy carrying POS device

danso 11y ago

Naive person here: if this is a thing that works, how did it escape notice as an attack vector in the stages in which this technology was debated and standardized?

matthewmacleod 11y ago
It didn't. This is a known attack vector; the decision has been taken that the costs of cancelling fraudulent transactions are less than the benefits from allowing easier payment.
yoz-y 11y ago
It did not escape. That is why the contactless payment has very low limits, so the damage is not that big. Also, my card has to be really close to the terminal to work. (And I have a shielded wallet anyways)
deleted 11y ago
[deleted]

ck2 11y ago

How to disable contactless cards http://www.instructables.com/id/Disabling-Contacless-Payment-on-Debit-Cards/step2/How-to-disable-it-on-your-card/ http://www.instructables.com/id/Disabling-Contacless-Payment...

tomcart 11y ago

Maybe someone else can confirm, but that doesn't look like any TFL carriage i know. In fact, it looks a lot more like moscow: http://thumbs.dreamstime.com/z/inside-modern-subway-car-1214290.jpg http://thumbs.dreamstime.com/z/inside-modern-subway-car-1214... and was posted on EnglishRussia a week ago: https://twitter.com/EnglishRussia1/status/697017291494596608 https://twitter.com/EnglishRussia1/status/697017291494596608 It may have existed before this...

joshcrowder 11y ago
You're correct its definitely not a London Underground I dont think its a UK train either
bechampion 11y ago
yes that's not TFL by the looks of it.
Someone1234 11y ago
Agreed. That metal pole should be coloured (dark blue, dark red, or yellow) if it were a London Underground train. I even Google Image Searched it, and cannot find a train that looks like that. Plus the shape of the pole is all wrong...
s_kilk 11y ago
Definitely not a UK train.
anton_gogolev 11y ago
It is indeed a carriage from one of the Russian underground systems. I vaguely recall having seen this story sometime ago, and back then it was reported that this guy was spotted in Moscow underground, but these kinds of carriages can be seen in Moscow, St. Petersburg, Kiev and possibly other cities.
richmarr 11y ago
...and here again in Poland, also a week ago: http://paczaizm.pl/jesli-zastanawiasz-sie-gdzie-spierdzielilo-twoje-50zl-na-koncie-gosc-z-terminalem-w-metrze-komunikacji-miejskiej/ http://paczaizm.pl/jesli-zastanawiasz-sie-gdzie-spierdzielil...

happywolf 11y ago

What this guy can take advantage will be victims don't check their bank statements carefully and he can get away with the money, or else he will be in pretty bad shape to handle all the charge-backs. I will say the chance of a stolen POS is low as his goal is to get the money. If he borrows the POS from his merchant friend for this purpose, then that is not cool at all. To me this is not a serious security threat to ordinary people.

shiftpgdn 11y ago
Charge a penny and then refund it to capture the details for a recurring charge. 30 days from then you can hit the card with a $5 charge using some ambiguous merchant name like "Card validation services". 90% of people don't inspect their bank statements close enough to notice something like this. Get 1000 people and that's a healthy sum for a criminal to live off of.
- mseebach 11y ago
  > 90% of people don't inspect their bank statements close enough But 10% of people is more than enough (by a substantial margin) to get the operation shut down, the money (all of it) returned, and probably land the guy in jail.

domas 11y ago

Looks like this FB post is just a hoax. Linked FB post is not an original. There is an older story here in Russian: https://tjournal.ru/22625-staling-money-with-terminal https://tjournal.ru/22625-staling-money-with-terminal

shawabawa3 11y ago

I doubt he's actually skimming cards. The risk-reward is pretty terrible. It's hard to subtly press it up against someone's pocket, and the range is pretty bad, and the first time anyone notices your account is frozen and you'll be prosecuted

oavdeev 11y ago

Exact same photo was making rounds in Russian Facebook few weeks ago, judging by the door and the handle I bet it is indeed Moscow, not London. As in this case, no one saw the guy actually skimming cards. Also if he was doing really that, why not hide POS in a bag or his pocket?

at-fates-hands 11y ago
This was my reaction. If you're skimming cards, you probably want to make sure your target is unaware of what you're doing less someone sees you and notifies transit cops or some other authorities and you get arrested.

butler14 11y ago

For those inclined, you can get neat little leather sleeves that have two pockets, one protected, one not, here https://www.faradaystore.com/rfid-blocking/wallets/ https://www.faradaystore.com/rfid-blocking/wallets/. Helps me keep my debit/credit card safe(?), but if nothing else, stops it clashing with my Oyster, which can otherwise be a pain.

gboudrias 11y ago
At this price it might be cheaper to ship it from ThinkGeek (although they seem only only have the S.H.I.E.L.D. model nowadays...): https://www.thinkgeek.com/product/1d95/ https://www.thinkgeek.com/product/1d95/
- butler14 11y ago
  yea there is sod all choice outside of the US from what I've seen. most RFID wallets seem to be an extension of Kickstarter's obsession with them a couple of years ago, and most manufacturers and sellers seem to be North American-based.
- bryan11 11y ago
  One can make an RFID shield for a folding wallet fairly easily. Take a manila folder or something similar and cut it to tightly fit in the outside pocket. Cover that with aluminum foil, then cover that with packing tape. Place this in the outside pocket of the wallet, fold it so the RFID shield covers the contents, and cards inside are protected.

notliketherest 11y ago

Of course this is possible. Sign up for a Stripw account, feed it a PAN (credit card number), and charge it. With anti fraud mechanisms however, you're not going to get very far.

kombucha2 11y ago

this is stupid

yread 11y ago

I'm definitely NOT buying an RFID-blocking wallet if they have to do marketing with hoaxes like this

snake_plissken 11y ago

Why would anyone ever pull a scam like this? To get a POS terminal, don't you have to submit a lot of personal information? And then, how would you anonymously get the money from the bank? It's not like you could do this over a long time lime where you slowly accumulate < $30 charges and then one day withdrawal all of the money. You would surely get flagged?

Aoyagi 11y ago

This is Russia. I have no difficulties believing it's genuine.

molecule 11y ago

Other commenters have pointed out that this does not appear to be on the London Tube. The post mentions nothing saying that the poster took the photograph or that it was on the London Tube, the London-Tube association of the HN headline seems to be mis-inferred from the poster's location, Edinburgh, United Kingdom, although that's quite a ways from London...