7 ms·

Why isn't this being reported as a UX issue? Instead it's being described as some issue with the tap functionality in the card.

sohkamyung 4y ago
Not only an UI issue. Users apparently also did not do the elementary step of hiding the PIN they entered. This is only mentioned at the end of the article: > Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.
- vba616 4y ago
  If you're in a drive through, from what I've seen, you would need long arms and an SUV to cover the keypad. I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
- moremetadata 4y ago
  "easier for a criminal to snoop on ATM PINs using a thermal (infrared) camera to detect residual heat from keypresses" https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pins-with-thermal-cameras/ https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin... This bit is interesting though: "So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out." How can a customer log out in these circumstances? I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan. It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
  - WirelessGigabit 4y ago
    Like a big button that says log out. Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
    - moremetadata 4y ago
      > To her shock, Bongiorno saw three more withdrawals from her account -- $940 was gone. What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction. The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators. This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
      - salawat 4y ago
        Phones don't log that info. Cell towers do. there is no way to have a cellular phone and not be triangulable. not with a cell network with fully overlapped coverage areas.
      - WirelessGigabit 4y ago
        Because a receipt is a forcing mechanism for the system to close the transaction. No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization. Plus it gives me, the customer, additional leverage in the case where they do screw up. I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz. No jury would allow these withdrawals to stick on the original account.
  - 4y ago
- ratg13 4y ago
  They can also get the pin through fake keypads. PINs could be bluetoothed to the attacker. The main problem here is not requiring proof of the card for each transaction. This is mostly all on the bank.
  - WirelessGigabit 4y ago
    Doesn't matter as a tap cannot be replayed. The cipher changes.
deleted 4y ago
[deleted]
yieldcrv 4y ago
San Francisco isn’t a market based economy so every actors behavior here is understandable.
c22 4y ago
I've used ATMs where you slide your card (and retain possession of the card through the transaction). They always prompt at the end whether you'd like to make another transaction and if you say "yes" they require you to slide your card a second time. I haven't seen one that didn't work this way for at least a couple decades, so I'm surprised they missed this when adding tap functionality.

sohkamyung 4y ago

Not only an UI issue. Users apparently also did not do the elementary step of hiding the PIN they entered. This is only mentioned at the end of the article: > Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.

vba616 4y ago
If you're in a drive through, from what I've seen, you would need long arms and an SUV to cover the keypad. I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
moremetadata 4y ago
"easier for a criminal to snoop on ATM PINs using a thermal (infrared) camera to detect residual heat from keypresses" https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pins-with-thermal-cameras/ https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin... This bit is interesting though: "So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out." How can a customer log out in these circumstances? I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan. It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
- WirelessGigabit 4y ago
  Like a big button that says log out. Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
  - moremetadata 4y ago
    > To her shock, Bongiorno saw three more withdrawals from her account -- $940 was gone. What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction. The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators. This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location. https://en.wikipedia.org/wiki/Signalling_System_No._7 https://en.wikipedia.org/wiki/Signalling_System_No._7
    - salawat 4y ago
      Phones don't log that info. Cell towers do. there is no way to have a cellular phone and not be triangulable. not with a cell network with fully overlapped coverage areas.
    - WirelessGigabit 4y ago
      Because a receipt is a forcing mechanism for the system to close the transaction. No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization. Plus it gives me, the customer, additional leverage in the case where they do screw up. I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz. No jury would allow these withdrawals to stick on the original account.
- 4y ago
ratg13 4y ago
They can also get the pin through fake keypads. PINs could be bluetoothed to the attacker. The main problem here is not requiring proof of the card for each transaction. This is mostly all on the bank.
- WirelessGigabit 4y ago
  Doesn't matter as a tap cannot be replayed. The cipher changes.

deleted 4y ago

[deleted]

yieldcrv 4y ago

San Francisco isn’t a market based economy so every actors behavior here is understandable.

c22 4y ago

I've used ATMs where you slide your card (and retain possession of the card through the transaction). They always prompt at the end whether you'd like to make another transaction and if you say "yes" they require you to slide your card a second time. I haven't seen one that didn't work this way for at least a couple decades, so I'm surprised they missed this when adding tap functionality.