6 ms·

Nice writeup. But in the article they write: > Are you angry that your card has been stolen, again? Contact your local congress person or senator and ask them

by new299 9y ago

Nice writeup. But in the article they write: > Are you angry that your card has been stolen, again? Contact your local congress person or senator and ask them to pass legislation that fines gas stations $100 for every card that is discovered on a skimmer in one of their pumps. It’s ultimately up to the gas stations and pump manufacturers to secure their pumps. Suggesting a solution like it's an easy fix always bugs me a bit. Would a 100USD fine actually work here? The issue seems more with the fact that the US hasn't upgraded to a chip&pin style system. You might end up just costing the gas stations more money, when they don't actually have the power to do much about the problem. It feels a bit like victim blaming, when in this case the victim has little choice but to work with the system as they find it.

ams6110 9y ago
It's not the gas stations that are committing the crime. Why should they be fined? It's the people breaking into the pumps and installing the skimmers. Most stations do what they can with security seals, frequent inspections, I've even seen some that install hardware-store hasps and padlocks on the pumps. I do wonder why they have not converted to chip cards though. Almost all other retailers have.
- goialoq 9y ago
  A gas station with a skimmer is like a gas station with a gas spill -- it's a hazard on their property that is open to the public. They have a responsibility to maintain a safe environment, or else close off the property.
  - new299 9y ago
    I assume when a gas station operator becomes aware of either a skimmer or a gas spill they remove it. I guess in both cases what they can do to prevent those things from occurring at all is limited. Is anyone arguing that they don't monitor for skimmers on a regular basis? It's just that the criminals keep putting them back.
- yorwba 9y ago
  The article says that > Essentially, the perpetrator opens a pump using one of a few master keys, unplugs the credit card reader from the main pump controller, plugs the card reader into the skimmer and plugs the skimmer back into the pump controller. This reportedly takes less than 30 seconds. So I'd say that at least those stations whose pumps can be opened easily with a master key should be liable if their careless handling of customer data leaks credit card details to skimmers. A fine would put additional pressure on the pumps with the worst security and might eventually lead to widespread deployment of something like the alarm system proposed at the end of the article.
  - new299 9y ago
    Right but we're working with incomplete information. Who mandates the use of those pumps? Are better, more secure pumps available? Do the gasoline suppliers mandate that certain pumps are used? etc. etc. So it's not clear that these things are purely under the gas stations control and that a simple fine would solve the issue. Alternative solutions might include: 1. Mandating stronger security certification of public facing card readers. 2. The police more aggressively prosecuting these offenses (raising the cost to criminals who are caught and making the offense less profitable). I don't have complete information, so it's not clear to me which solution is best. But it doesn't seem obvious and simple.
    - craftyguy 9y ago
      Here in Oregon, it's state law that only gas station attendants can fill vehicles. It seems that this would prevent some of this, but of course it doesn't prevent the skimmer from being installed after hours or by the attendants themselves..
- astrodust 9y ago
  Hardware changes are annoying and expensive. Here in Canada where gasoline crested over $1.00/L it took an incredible amount of time for vendors to upgrade their equipment to handle the extra digit. Many locations had numbers physically taped on to their pumps and signs.
- loosescrews 9y ago
  Here is what Visa has to say about the matter: https://usa.visa.com/visa-everywhere/security/emv-at-the-pump.html https://usa.visa.com/visa-everywhere/security/emv-at-the-pum...
qbrass 9y ago
>Would a 100USD fine actually work here? Yeah. The number of cases being reported would go down when gas stations start throwing skimmers they find in the trash instead of calling the cops.
- new299 9y ago
  Right... this sounds like a really strong possibility. Why didn't I think of that. :)
Gaelan 9y ago
Pretty much all US cardholders have chip+pin now. I’d say about 75% of retailers support it. (Not sure if this is how it works outside of the US, but we currently have cards with both magstripes and chips. You use the chip where it’s supported, the stripe where it isn’t.)
- zerocrates 9y ago
  Very few credit cards are chip and pin, they're mostly chip and sign. And I don't think I've ever seen a gas station with a chip reader, so the chip's not really doing you any good if you're just swiping anyway. I believe the gas stations were given a longer timeframe to convert.
- cstrat 9y ago
  Here in Australia its pretty much 100% chip and PIN or contactless payments (paypass). Has been for a number of years now. I don't think anyone swipes cards unless there is something wrong with the payment terminal. Even vending machines are tap and go.
  - Jaruzel 9y ago
    Same here in the UK - it's ALL Chip & PIN, I can't even recall the last time I had to swipe my card[1], and I use it a LOT (yay, Airmiles!). If the payment is <= 30 GBP, it's an offline transaction as well. Anything over that amount triggers a round trip to the backend servers. As an aside, it's now perfectly possible to live a cashless life in the UK if you wanted to. -- [1] That said, I think ATMs read the mag-stripe... but I don't really use those either these days.
    - falsedan 9y ago
      > If the payment is <= 30 GBP, it's an offline transaction as well It's still online (card-present check), but skips authorisation (no PIN needed).
    - reaperducer 9y ago
      > it's now perfectly possible to live a cashless life in the UK if you wanted to Perhaps in London. Try spending a long weekend in Torquay.
callmeed 9y ago
The deadline for retailers getting on board with chip readers was October 2015. Gas stations pushed back and got it moved to 2020 because of the high costs (according to them) associated with swapping out card readers attached to pumps. The way I understand, after the 2020 deadline, gas stations will be liable for fraudulent charges (or at least associated fees). Also, I've had my debit card skimmed twice in the past 3 years. A smart gas station (or chain) would pay to put chip readers in NOW and advertise that feature. I'd got there exclusively.
- hasbot 9y ago
  > I've had my debit card skimmed twice in the past 3 years. Huh. I suppose that is the one advantage we have in Oregon where we are not allowed to pump our own gas.
  - eric_h 9y ago
    Full service gas stations have a long history of "old fashioned" card skimming - at least from my experience in New Jersey. My mother uses a separate credit card explicitly for gas stations because her credit card has been skimmed at NJ gas stations a half dozen times over the years.
  - callmeed 9y ago
    Yeah, I lived in Bend for 3 years and miss that (among other things).
  - astura 9y ago
    Full service stations don't preclude a lack of terminal tampering. If the gas station closes at some point in time anyone can tamper with it after hours when it is unstaffed. Additionally, tampering can occur by criminals paying off employees to install skimmers.
    - colejohnson66 9y ago
      Or an employee who covertly swipes your card with a reader that fits in his pocket before putting it through the pump

by new299 9y ago

ams6110 9y ago

It's not the gas stations that are committing the crime. Why should they be fined? It's the people breaking into the pumps and installing the skimmers. Most stations do what they can with security seals, frequent inspections, I've even seen some that install hardware-store hasps and padlocks on the pumps. I do wonder why they have not converted to chip cards though. Almost all other retailers have.

goialoq 9y ago
A gas station with a skimmer is like a gas station with a gas spill -- it's a hazard on their property that is open to the public. They have a responsibility to maintain a safe environment, or else close off the property.
- new299 9y ago
  I assume when a gas station operator becomes aware of either a skimmer or a gas spill they remove it. I guess in both cases what they can do to prevent those things from occurring at all is limited. Is anyone arguing that they don't monitor for skimmers on a regular basis? It's just that the criminals keep putting them back.
yorwba 9y ago
The article says that > Essentially, the perpetrator opens a pump using one of a few master keys, unplugs the credit card reader from the main pump controller, plugs the card reader into the skimmer and plugs the skimmer back into the pump controller. This reportedly takes less than 30 seconds. So I'd say that at least those stations whose pumps can be opened easily with a master key should be liable if their careless handling of customer data leaks credit card details to skimmers. A fine would put additional pressure on the pumps with the worst security and might eventually lead to widespread deployment of something like the alarm system proposed at the end of the article.
- new299 9y ago
  Right but we're working with incomplete information. Who mandates the use of those pumps? Are better, more secure pumps available? Do the gasoline suppliers mandate that certain pumps are used? etc. etc. So it's not clear that these things are purely under the gas stations control and that a simple fine would solve the issue. Alternative solutions might include: 1. Mandating stronger security certification of public facing card readers. 2. The police more aggressively prosecuting these offenses (raising the cost to criminals who are caught and making the offense less profitable). I don't have complete information, so it's not clear to me which solution is best. But it doesn't seem obvious and simple.
  - craftyguy 9y ago
    Here in Oregon, it's state law that only gas station attendants can fill vehicles. It seems that this would prevent some of this, but of course it doesn't prevent the skimmer from being installed after hours or by the attendants themselves..
astrodust 9y ago
Hardware changes are annoying and expensive. Here in Canada where gasoline crested over $1.00/L it took an incredible amount of time for vendors to upgrade their equipment to handle the extra digit. Many locations had numbers physically taped on to their pumps and signs.
loosescrews 9y ago
Here is what Visa has to say about the matter: https://usa.visa.com/visa-everywhere/security/emv-at-the-pump.html https://usa.visa.com/visa-everywhere/security/emv-at-the-pum...

qbrass 9y ago

>Would a 100USD fine actually work here? Yeah. The number of cases being reported would go down when gas stations start throwing skimmers they find in the trash instead of calling the cops.

new299 9y ago
Right... this sounds like a really strong possibility. Why didn't I think of that. :)

Gaelan 9y ago

Pretty much all US cardholders have chip+pin now. I’d say about 75% of retailers support it. (Not sure if this is how it works outside of the US, but we currently have cards with both magstripes and chips. You use the chip where it’s supported, the stripe where it isn’t.)

zerocrates 9y ago
Very few credit cards are chip and pin, they're mostly chip and sign. And I don't think I've ever seen a gas station with a chip reader, so the chip's not really doing you any good if you're just swiping anyway. I believe the gas stations were given a longer timeframe to convert.
cstrat 9y ago
Here in Australia its pretty much 100% chip and PIN or contactless payments (paypass). Has been for a number of years now. I don't think anyone swipes cards unless there is something wrong with the payment terminal. Even vending machines are tap and go.
- Jaruzel 9y ago
  Same here in the UK - it's ALL Chip & PIN, I can't even recall the last time I had to swipe my card[1], and I use it a LOT (yay, Airmiles!). If the payment is <= 30 GBP, it's an offline transaction as well. Anything over that amount triggers a round trip to the backend servers. As an aside, it's now perfectly possible to live a cashless life in the UK if you wanted to. -- [1] That said, I think ATMs read the mag-stripe... but I don't really use those either these days.
  - falsedan 9y ago
    > If the payment is <= 30 GBP, it's an offline transaction as well It's still online (card-present check), but skips authorisation (no PIN needed).
  - reaperducer 9y ago
    > it's now perfectly possible to live a cashless life in the UK if you wanted to Perhaps in London. Try spending a long weekend in Torquay.

callmeed 9y ago

The deadline for retailers getting on board with chip readers was October 2015. Gas stations pushed back and got it moved to 2020 because of the high costs (according to them) associated with swapping out card readers attached to pumps. The way I understand, after the 2020 deadline, gas stations will be liable for fraudulent charges (or at least associated fees). Also, I've had my debit card skimmed twice in the past 3 years. A smart gas station (or chain) would pay to put chip readers in NOW and advertise that feature. I'd got there exclusively.

hasbot 9y ago
> I've had my debit card skimmed twice in the past 3 years. Huh. I suppose that is the one advantage we have in Oregon where we are not allowed to pump our own gas.
- eric_h 9y ago
  Full service gas stations have a long history of "old fashioned" card skimming - at least from my experience in New Jersey. My mother uses a separate credit card explicitly for gas stations because her credit card has been skimmed at NJ gas stations a half dozen times over the years.
- callmeed 9y ago
  Yeah, I lived in Bend for 3 years and miss that (among other things).
- astura 9y ago
  Full service stations don't preclude a lack of terminal tampering. If the gas station closes at some point in time anyone can tamper with it after hours when it is unstaffed. Additionally, tampering can occur by criminals paying off employees to install skimmers.
  - colejohnson66 9y ago
    Or an employee who covertly swipes your card with a reader that fits in his pocket before putting it through the pump