3 ms·

Krebs has a post on this as well: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-ta

Krebs has a post on this as well: https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip-based-cards/ https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip... “The only way for this attack to be successful is if a [bank card] issuer neglects to check the CVV when authorizing a transaction,”

Pfhreak 10y ago
I have not had the largest confidence in banks abilities to understand security. I've personally dealt with: 1) 'Two factor auth is on, you have to answer two security questions to access your account!' 2) 'Your password is limited to exactly 8 characters ... for security' 3) 'Oh, we now support SMS two factor auth' -- 4 months in, I've received 1 SMS challenge 4) 'You don't want a chip card, they are more hassle' 5) 'We allow systems like Mint to access your account when you have 2 factor auth on. No, you cannot opt out.' Yeah, don't have the highest confidence that my bank(s) actually understand how to keep things safe.
- ChrisClark 10y ago
  > 1) 'Two factor auth is on, you have to answer two security questions to access your account!' That's awful! By using the two-factor wording it's deliberately misleading people who don't know much about it.
- luck_fenovo 10y ago
  > 'You don't want a chip card, they are more hassle' I got exactly that line fairly recently. To be fair, it probably is much more of a hassle from what I've heard, so they're not wrong, exactly. It seems like the chip+pin rollout has been bungled pretty terribly.
- gregschlom 10y ago
  May I suggest switching banks? And while you're at it, you may want to look into a credit union rather than a corporate bank.
- JumpCrisscross 10y ago
  > You don't want a chip card, they are more hassle As a consumer, I am indemnified by my bank, per Regulation E, against fraud from swipes. I get no benefit from the slower chip + sig system.
- gozur88 10y ago
  Ugh! This is my pet peeve. My brokerage house will reset your password (which is fine) and convert your account back to single factor authentication (which is... WTF?!) if you answer the security questions over the phone. What was the point of getting that stupid fob when any idiot can bypass it if he knows my mother's maiden name?
mannykannot 10y ago
In which case, I hope no-one but the bank is liable for the cost of the fraud.

Pfhreak 10y ago

I have not had the largest confidence in banks abilities to understand security. I've personally dealt with: 1) 'Two factor auth is on, you have to answer two security questions to access your account!' 2) 'Your password is limited to exactly 8 characters ... for security' 3) 'Oh, we now support SMS two factor auth' -- 4 months in, I've received 1 SMS challenge 4) 'You don't want a chip card, they are more hassle' 5) 'We allow systems like Mint to access your account when you have 2 factor auth on. No, you cannot opt out.' Yeah, don't have the highest confidence that my bank(s) actually understand how to keep things safe.

ChrisClark 10y ago
> 1) 'Two factor auth is on, you have to answer two security questions to access your account!' That's awful! By using the two-factor wording it's deliberately misleading people who don't know much about it.
luck_fenovo 10y ago
> 'You don't want a chip card, they are more hassle' I got exactly that line fairly recently. To be fair, it probably is much more of a hassle from what I've heard, so they're not wrong, exactly. It seems like the chip+pin rollout has been bungled pretty terribly.
gregschlom 10y ago
May I suggest switching banks? And while you're at it, you may want to look into a credit union rather than a corporate bank.
JumpCrisscross 10y ago
> You don't want a chip card, they are more hassle As a consumer, I am indemnified by my bank, per Regulation E, against fraud from swipes. I get no benefit from the slower chip + sig system.
gozur88 10y ago
Ugh! This is my pet peeve. My brokerage house will reset your password (which is fine) and convert your account back to single factor authentication (which is... WTF?!) if you answer the security questions over the phone. What was the point of getting that stupid fob when any idiot can bypass it if he knows my mother's maiden name?

mannykannot 10y ago

In which case, I hope no-one but the bank is liable for the cost of the fraud.