5 ms·

ATM thieves use glue and 'tap' function to drain accounts at Chase Bank

28 points by crcastle 4y ago

crcastle 4y ago
Why isn't this being reported as a UX issue? Instead it's being described as some issue with the tap functionality in the card.
- sohkamyung 4y ago
  Not only an UI issue. Users apparently also did not do the elementary step of hiding the PIN they entered. This is only mentioned at the end of the article: > Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.
  - vba616 4y ago
    If you're in a drive through, from what I've seen, you would need long arms and an SUV to cover the keypad. I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
  - moremetadata 4y ago
    "easier for a criminal to snoop on ATM PINs using a thermal (infrared) camera to detect residual heat from keypresses" https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pins-with-thermal-cameras/ https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin... This bit is interesting though: "So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out." How can a customer log out in these circumstances? I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan. It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
    - WirelessGigabit 4y ago
      Like a big button that says log out. Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
      - moremetadata 4y ago
        > To her shock, Bongiorno saw three more withdrawals from her account -- $940 was gone. What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction. The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators. This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
        salawat 4y ago
        Phones don't log that info. Cell towers do. there is no way to have a cellular phone and not be triangulable. not with a cell network with fully overlapped coverage areas.
        WirelessGigabit 4y ago
        Because a receipt is a forcing mechanism for the system to close the transaction. No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization. Plus it gives me, the customer, additional leverage in the case where they do screw up. I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz. No jury would allow these withdrawals to stick on the original account.
    - 4y ago
  - ratg13 4y ago
    They can also get the pin through fake keypads. PINs could be bluetoothed to the attacker. The main problem here is not requiring proof of the card for each transaction. This is mostly all on the bank.
    - WirelessGigabit 4y ago
      Doesn't matter as a tap cannot be replayed. The cipher changes.
- deleted 4y ago
  [deleted]
- yieldcrv 4y ago
  San Francisco isn’t a market based economy so every actors behavior here is understandable.
- c22 4y ago
  I've used ATMs where you slide your card (and retain possession of the card through the transaction). They always prompt at the end whether you'd like to make another transaction and if you say "yes" they require you to slide your card a second time. I haven't seen one that didn't work this way for at least a couple decades, so I'm surprised they missed this when adding tap functionality.
bdcravens 4y ago
Chase is terrible. For over a year I tried to get back $900+ dollars they stole from me (they closed an account with no notice or explanation, in the middle of the pandemic no less), to no avail (just endless run-around in overseas call centers, with no direct mechanism to talk to anyone with authority).
- dkjaudyeqooe 4y ago
  Small claims court is your friend.
  - effingwewt 4y ago
    Not in this case, Chase years ago started requiring you to waive them in favor of arbitration.
    - dkjaudyeqooe 4y ago
      Maybe not: "If you are in a contract containing an arbitration clause naming the AAA Rules, you may still be able to bring your dispute in small claims court instead of arbitration, as long as the claim falls within the jurisdiction requirements of the small claims court" < https://www.google.com/search?q=do+abitration+clauses+cover+small+claims+court https://www.google.com/search?q=do+abitration+clauses+cover+... > But arbitration is also your friend, probably even easier than small claims.
- bjacobt 4y ago
  File a complaint at CFPB [1]. Long story short, I deposited a valid check, but chase fraud dept closed my account with close to 13k in it. I made a lot of trips to the bank, countless hours on the phone and what I found is different departments don’t communicate or share data. Every time I call or go to the bank the first agent would say a check was mailed, after I insist they never mailed anything, I get transferred to someone else that says they have not received the requested document - which I had submitted in person at a local branch. This process repeated few time and got escalated to their “executive office” twice - which restarted the process. It felt like I would never get my money and after two months I filed a complaint at CFPB. About 3 weeks later chase magically found all the documents and issued a check for the balance. I’m not sure what is going on at this bank but they should not be allowed to treat customers like this. Just read this from the linked news article > Victims said Chase would not review surveillance video because the amounts were below $5,000. Why wouldn’t chase review videos if amount is less that $5000? 1. https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/
deleted 4y ago
[deleted]
tehwebguy 4y ago
Report it to your bank, get an immediate reimbursement and smile knowing your evil bank lost a few bucks.
SturgeonsLaw 4y ago
That article managed to use both "PIN number" and "ATM machine", impressive. Granted, they were quoting people, but one of them was a bank manager
- 1letterunixname 4y ago
  Homologicity is often used as an English phonetic crutch where a particular syllable would be awkward and/or for exposition that may not be tautological to all observers. Maybe get over it and bikeshed about something else?

28 points by crcastle 4y ago

Why isn't this being reported as a UX issue? Instead it's being described as some issue with the tap functionality in the card.

sohkamyung 4y ago
Not only an UI issue. Users apparently also did not do the elementary step of hiding the PIN they entered. This is only mentioned at the end of the article: > Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.
- vba616 4y ago
  If you're in a drive through, from what I've seen, you would need long arms and an SUV to cover the keypad. I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
- moremetadata 4y ago
  "easier for a criminal to snoop on ATM PINs using a thermal (infrared) camera to detect residual heat from keypresses" https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pins-with-thermal-cameras/ https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin... This bit is interesting though: "So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out." How can a customer log out in these circumstances? I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan. It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
  - WirelessGigabit 4y ago
    Like a big button that says log out. Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
    - moremetadata 4y ago
      > To her shock, Bongiorno saw three more withdrawals from her account -- $940 was gone. What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction. The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators. This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
      - salawat 4y ago
        Phones don't log that info. Cell towers do. there is no way to have a cellular phone and not be triangulable. not with a cell network with fully overlapped coverage areas.
      - WirelessGigabit 4y ago
        Because a receipt is a forcing mechanism for the system to close the transaction. No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization. Plus it gives me, the customer, additional leverage in the case where they do screw up. I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz. No jury would allow these withdrawals to stick on the original account.
  - 4y ago
- ratg13 4y ago
  They can also get the pin through fake keypads. PINs could be bluetoothed to the attacker. The main problem here is not requiring proof of the card for each transaction. This is mostly all on the bank.
  - WirelessGigabit 4y ago
    Doesn't matter as a tap cannot be replayed. The cipher changes.
deleted 4y ago
[deleted]
yieldcrv 4y ago
San Francisco isn’t a market based economy so every actors behavior here is understandable.
c22 4y ago
I've used ATMs where you slide your card (and retain possession of the card through the transaction). They always prompt at the end whether you'd like to make another transaction and if you say "yes" they require you to slide your card a second time. I haven't seen one that didn't work this way for at least a couple decades, so I'm surprised they missed this when adding tap functionality.

bdcravens 4y ago

Chase is terrible. For over a year I tried to get back $900+ dollars they stole from me (they closed an account with no notice or explanation, in the middle of the pandemic no less), to no avail (just endless run-around in overseas call centers, with no direct mechanism to talk to anyone with authority).

dkjaudyeqooe 4y ago
Small claims court is your friend.
- effingwewt 4y ago
  Not in this case, Chase years ago started requiring you to waive them in favor of arbitration.
  - dkjaudyeqooe 4y ago
    Maybe not: "If you are in a contract containing an arbitration clause naming the AAA Rules, you may still be able to bring your dispute in small claims court instead of arbitration, as long as the claim falls within the jurisdiction requirements of the small claims court" < https://www.google.com/search?q=do+abitration+clauses+cover+small+claims+court https://www.google.com/search?q=do+abitration+clauses+cover+... > But arbitration is also your friend, probably even easier than small claims.
bjacobt 4y ago
File a complaint at CFPB [1]. Long story short, I deposited a valid check, but chase fraud dept closed my account with close to 13k in it. I made a lot of trips to the bank, countless hours on the phone and what I found is different departments don’t communicate or share data. Every time I call or go to the bank the first agent would say a check was mailed, after I insist they never mailed anything, I get transferred to someone else that says they have not received the requested document - which I had submitted in person at a local branch. This process repeated few time and got escalated to their “executive office” twice - which restarted the process. It felt like I would never get my money and after two months I filed a complaint at CFPB. About 3 weeks later chase magically found all the documents and issued a check for the balance. I’m not sure what is going on at this bank but they should not be allowed to treat customers like this. Just read this from the linked news article > Victims said Chase would not review surveillance video because the amounts were below $5,000. Why wouldn’t chase review videos if amount is less that $5000? 1. https://www.consumerfinance.gov/complaint/ https://www.consumerfinance.gov/complaint/

deleted 4y ago

[deleted]

tehwebguy 4y ago

Report it to your bank, get an immediate reimbursement and smile knowing your evil bank lost a few bucks.

SturgeonsLaw 4y ago

That article managed to use both "PIN number" and "ATM machine", impressive. Granted, they were quoting people, but one of them was a bank manager

1letterunixname 4y ago
Homologicity is often used as an English phonetic crutch where a particular syllable would be awkward and/or for exposition that may not be tautological to all observers. Maybe get over it and bikeshed about something else?