4 ms·

Its all fun and games until some one puts skimmers / malware on the kiosks and appears on Brian Krebs site as the latest hack. I am not putting my CC or DD car

Its all fun and games until some one puts skimmers / malware on the kiosks and appears on Brian Krebs site as the latest hack. I am not putting my CC or DD card anywhere near a conatctless system - I keep a > 3£k balance on my Santander DD to get the good interest rate.

gambiting 10y ago
This guys puts a skimmer on your regular machine, no contactless needed: https://www.youtube.com/watch?v=y83ZgzuFBSE https://www.youtube.com/watch?v=y83ZgzuFBSE And the fear of contactless payments is almost funny - someone would need to go to ridiculous length to read a card via PayWave/PayPass(the card won't reply to a non-genuine key, so you would need to have an actual authorized reader or access to one), and the most you can spend is 25 pounds per transaction, and you can only do it 5 times before you have to enter the pin. In the meantime, you can anonymously buy thousands of stolen card numbers online - so why bother with contactless? I will always use it if there is an option to.
- Bromskloss 10y ago
  How do people use stolen card numbers without getting caught? Simply ordering things to be delivered to your home doesn't seem like something that you would get away with.
  - gambiting 10y ago
    You order it to Amazon drop off point? Or an address that you know no one lives at? Or buy online goods that you can re-sell later - bitcoins, steam/battle net accounts, any virtual currency. Drugs. I know people who had their stolen card used to pay for $200 Uber trips - once you leave the car good luck getting found out, and the driver doesn't know if your card got declined or not. I'm sure there's a thousand ways to get money out of stolen cards.
  - brainfire 10y ago
    Sure, but you could have it delivered sans signature to an empty house and grab it off the step. Or bounce the money through people who click on those "I made $234k last month working from home" ads. Brian Krebs has written a few things about ways they (try to) get away with it: http://krebsonsecurity.com/tag/money-mules/ http://krebsonsecurity.com/tag/money-mules/
- spacecowboy_lon 10y ago
  Not the same there are pics of scammers on a crowded tube trains (london) with a hand held contactless device harvesting.
  - gambiting 10y ago
    Source? The contactless card will not surrender its information unless you have an actual authorized terminal, it's not like you can just read it with an NFC reader, it just doesn't work that way.
oarsinsync 10y ago
You don't want to keep all your money in a single account, regardless, and if you do, you definitely don't want a card on that account that you use in the wild. Specific UK example that happened recently to a friend of mine, he had a single HSBC current account with ~£5000 in it. He had a debit card with that account, and used that in ATMs, at restaurants, etc. as his primary spending mechanism. His debit card got cloned and the account emptied. There are protections in place, one of which that he still had possession of the card, that resulted in him getting all the money refunded to his account. However, the process took six weeks. For the duration of that time, he had no money at all. Since then, he has a separate account that he uses for ATMs (never keeps more than £500 in there) and all other spending goes on a credit card, which gets paid off in full every month. If his ATM card gets cloned, he's out £500 at most for a few weeks until he gets it refunded. If his credit card gets cloned, he's not out a single penny, as disputed transactions are struck from statement balances due at the end of the month.

gambiting 10y ago

This guys puts a skimmer on your regular machine, no contactless needed: https://www.youtube.com/watch?v=y83ZgzuFBSE https://www.youtube.com/watch?v=y83ZgzuFBSE And the fear of contactless payments is almost funny - someone would need to go to ridiculous length to read a card via PayWave/PayPass(the card won't reply to a non-genuine key, so you would need to have an actual authorized reader or access to one), and the most you can spend is 25 pounds per transaction, and you can only do it 5 times before you have to enter the pin. In the meantime, you can anonymously buy thousands of stolen card numbers online - so why bother with contactless? I will always use it if there is an option to.

Bromskloss 10y ago
How do people use stolen card numbers without getting caught? Simply ordering things to be delivered to your home doesn't seem like something that you would get away with.
- gambiting 10y ago
  You order it to Amazon drop off point? Or an address that you know no one lives at? Or buy online goods that you can re-sell later - bitcoins, steam/battle net accounts, any virtual currency. Drugs. I know people who had their stolen card used to pay for $200 Uber trips - once you leave the car good luck getting found out, and the driver doesn't know if your card got declined or not. I'm sure there's a thousand ways to get money out of stolen cards.
- brainfire 10y ago
  Sure, but you could have it delivered sans signature to an empty house and grab it off the step. Or bounce the money through people who click on those "I made $234k last month working from home" ads. Brian Krebs has written a few things about ways they (try to) get away with it: http://krebsonsecurity.com/tag/money-mules/ http://krebsonsecurity.com/tag/money-mules/
spacecowboy_lon 10y ago
Not the same there are pics of scammers on a crowded tube trains (london) with a hand held contactless device harvesting.
- gambiting 10y ago
  Source? The contactless card will not surrender its information unless you have an actual authorized terminal, it's not like you can just read it with an NFC reader, it just doesn't work that way.

oarsinsync 10y ago

You don't want to keep all your money in a single account, regardless, and if you do, you definitely don't want a card on that account that you use in the wild. Specific UK example that happened recently to a friend of mine, he had a single HSBC current account with ~£5000 in it. He had a debit card with that account, and used that in ATMs, at restaurants, etc. as his primary spending mechanism. His debit card got cloned and the account emptied. There are protections in place, one of which that he still had possession of the card, that resulted in him getting all the money refunded to his account. However, the process took six weeks. For the duration of that time, he had no money at all. Since then, he has a separate account that he uses for ATMs (never keeps more than £500 in there) and all other spending goes on a credit card, which gets paid off in full every month. If his ATM card gets cloned, he's out £500 at most for a few weeks until he gets it refunded. If his credit card gets cloned, he's not out a single penny, as disputed transactions are struck from statement balances due at the end of the month.