5 ms·

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodicall

Could payment terminals be made with built-in physical countermeasures for detection? Ideas: (1) Terminal has a scale built into its feet/mount. It periodically weighs itself, and if (ignoring fluctuations) it weighs too much, it shuts down. It's hard to build a skimmer that weighs 0 grams. (2) Proximity sensors in key locations on the housing. My smartphone can disable its touchscreen when I hold it against my face, so a payment terminal should be able to detect when something is covering a part that isn't supposed to be covered. (3) Light sensors. Put some in an area where skimmers need to cover (near card slot) and other where skimmers probably can't cover (the display), and detect whether they get roughly the same amount of light. (4) Microphones. Same idea as light sensors but with sound.

briffle 3y ago
Of course they can be made that way. The countermeasure built into gambling equipment like slot machines is incredible. But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..
- LorenPechtel 3y ago
  If someone comes up with an anti-skimmer terminal the payment processors would benefit from having a lower transaction fee for transactions posted from such a terminal. That would in time push the market to use such terminals.
- jalk 3y ago
  So the reason that gas, in LA area at least, have different prices for cash and card (typically ~$0.25/gal more for card) is not because of additional risk for the gas station, but just classic US exorbitant fees?
  - despideme 3y ago
    The price difference is a way to pass along credit card fees that otherwise would have to be paid by the station operator. It used to be against the credit card networks’ merchant agreements to have separate cash and credit prices — but a good number of LA gas stations rolled the dice and did it anyway. That rule changed a few years ago, and now most stations split their pricing. (I believe that’s also why ARCO gas now takes credit cards, after holding out for decades — they are now allowed to pass along the cost to the customer.)
gorkish 3y ago
Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.
- MBCook 3y ago
  They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think a rule requiring them to have chips was just passed. I know other countries are ahead of us, and that major banks have been issuing chip cards for a while. But there are still a lot of people that leaves out. And target wants to sell to them.
  - gorkish 3y ago
    I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already. The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.
    - MBCook 3y ago
      “Sorry. I know you’re on assistance because you can’t afford food, but for your security we’re not going to let you buy food with your government benefits as you may become a scam victim. Come back when your state government decides to pay to re-issue every card with better technology.” That’s cruel. The move to EMV was only recently mandated for EBT (if I remember correctly and it was done at all) because so many people were having their benefits stolen by mag stripe skimmers. You can’t use a stick against powerless people to affect change. It just makes them suffer. Even if Target did mandate contactless, the stock would plummet on news of all the lost sales and the CEO would be out. The new one would reverse it immediately.
crote 3y ago
Skimming is pretty much a solved problem in Europe already. We got rid of the mag stripe, so trivially cloning a card is no longer possible. Furthermore we don't allow offline transactions, so a skimmer must somehow get in between the connection from the terminal to the card and execute a separate transaction right before or after the genuine one. It is still not 100% impossible, but the "overlay" type of skimmer this protects against has been eliminated for a few years now.
- sangnoir 3y ago
  You are correct: but I think all these measures are in place because liability is placed on financial institutions rather than individual victims. The owners of the payment infrastructure are correctly motivated to holistically solve the problem, unlike in the US were the person woth the least power and control is burdened with having to contend with "Identity theft" and losing money by default to make up for the fraud.
  - tyoma 3y ago
    This is plainly untrue. The US has an absurdly consumer friendly legal environment; you simply say you didn’t do the transaction and your money is immediately refunded; it is up to the payment infra to eat the losses. The reason mag stripe and associated technologies stuck around is precisely because US banks were good enough at real-time fraud detection that the cost of fraud was << cost of replacing every card and strongaming every merchant into buying new payment terminals. Eventually they relented since the US became the place to cash out non-US cards. And identity theft is absolutely a thing in Europe. As a random example, here is Sweden: https://globalinitiative.net/analysis/21752-2/ https://globalinitiative.net/analysis/21752-2/
    - sangnoir 3y ago
      > The US has an absurdly consumer friendly legal environment; you simply say you didn’t do the transaction and your money is immediately refunded; US consumer laws don't hold a candle to European ones - it's not even close. Have you ever gone through this process yourself, or are you stating the idealized version of what should happen? I'd like to hear the bank you were dealing with, because mine tried to give me the run around ("It's not fraudulent because your PIN was used"), and I had to fight them over many calls to get a "temporary refund" by threatening to involve a state ombudsman. Later on, I got a letter in the mail that said the investigation was complete, and the refund was now permanent, only to have the refund yanked again months later. Caping for American banks in this day and age is weird. They are mostly terrible and will rather have their clients take the financial hit before they do - even if they have to lie or frustrated you with long holds & multiple calls unless you show them you mean business.

briffle 3y ago

Of course they can be made that way. The countermeasure built into gambling equipment like slot machines is incredible. But then it would cost more than their competitors. With much more maintenance for false positives, etc. And the vendor doesn't really pay the price for skimmer fraud..

LorenPechtel 3y ago
If someone comes up with an anti-skimmer terminal the payment processors would benefit from having a lower transaction fee for transactions posted from such a terminal. That would in time push the market to use such terminals.
jalk 3y ago
So the reason that gas, in LA area at least, have different prices for cash and card (typically ~$0.25/gal more for card) is not because of additional risk for the gas station, but just classic US exorbitant fees?
- despideme 3y ago
  The price difference is a way to pass along credit card fees that otherwise would have to be paid by the station operator. It used to be against the credit card networks’ merchant agreements to have separate cash and credit prices — but a good number of LA gas stations rolled the dice and did it anyway. That rule changed a few years ago, and now most stations split their pricing. (I believe that’s also why ARCO gas now takes credit cards, after holding out for decades — they are now allowed to pass along the cost to the customer.)

gorkish 3y ago

Alternatively they could just remove the slot and require self-pay terminals to be contactless. It really makes no sense to me why merchants don't already do this proactively; they are well incentivized: 1) Contactless merchant fees are lower than dip or swipe 2) Payment terminals are cheaper 3) Less fraud/shrink This hunk of plastic from Target is a solution looking for a problem.

MBCook 3y ago
They’re not looking for a problem. The problem exists. “Just use contactless” doesn’t work in the US. Just yesterday a friend was commenting that he got a new credit card (old card expired) and the new one still doesn’t have contactless. Seems his bank decided it wasn’t worth it. But that’s not all. Target gift cards don’t have contactless. Don’t think Visa/MC/AmEx gift cards do either. I bet EBT cards don’t, I think a rule requiring them to have chips was just passed. I know other countries are ahead of us, and that major banks have been issuing chip cards for a while. But there are still a lot of people that leaves out. And target wants to sell to them.
- gorkish 3y ago
  I was suggesting "Just use contactless" for customer accessible payment terminals. Want to use something less secure and more likely to result in fraud? You can hand your card to the cashier or walk inside instead of paying at the pump, just like you do with any non-card payment already. The EBT, gift card, and lazy small banks would get their act together pretty damn quick, I'd wager.
  - MBCook 3y ago
    “Sorry. I know you’re on assistance because you can’t afford food, but for your security we’re not going to let you buy food with your government benefits as you may become a scam victim. Come back when your state government decides to pay to re-issue every card with better technology.” That’s cruel. The move to EMV was only recently mandated for EBT (if I remember correctly and it was done at all) because so many people were having their benefits stolen by mag stripe skimmers. You can’t use a stick against powerless people to affect change. It just makes them suffer. Even if Target did mandate contactless, the stock would plummet on news of all the lost sales and the CEO would be out. The new one would reverse it immediately.

crote 3y ago

Skimming is pretty much a solved problem in Europe already. We got rid of the mag stripe, so trivially cloning a card is no longer possible. Furthermore we don't allow offline transactions, so a skimmer must somehow get in between the connection from the terminal to the card and execute a separate transaction right before or after the genuine one. It is still not 100% impossible, but the "overlay" type of skimmer this protects against has been eliminated for a few years now.

sangnoir 3y ago
You are correct: but I think all these measures are in place because liability is placed on financial institutions rather than individual victims. The owners of the payment infrastructure are correctly motivated to holistically solve the problem, unlike in the US were the person woth the least power and control is burdened with having to contend with "Identity theft" and losing money by default to make up for the fraud.
- tyoma 3y ago
  This is plainly untrue. The US has an absurdly consumer friendly legal environment; you simply say you didn’t do the transaction and your money is immediately refunded; it is up to the payment infra to eat the losses. The reason mag stripe and associated technologies stuck around is precisely because US banks were good enough at real-time fraud detection that the cost of fraud was << cost of replacing every card and strongaming every merchant into buying new payment terminals. Eventually they relented since the US became the place to cash out non-US cards. And identity theft is absolutely a thing in Europe. As a random example, here is Sweden: https://globalinitiative.net/analysis/21752-2/ https://globalinitiative.net/analysis/21752-2/
  - sangnoir 3y ago
    > The US has an absurdly consumer friendly legal environment; you simply say you didn’t do the transaction and your money is immediately refunded; US consumer laws don't hold a candle to European ones - it's not even close. Have you ever gone through this process yourself, or are you stating the idealized version of what should happen? I'd like to hear the bank you were dealing with, because mine tried to give me the run around ("It's not fraudulent because your PIN was used"), and I had to fight them over many calls to get a "temporary refund" by threatening to involve a state ombudsman. Later on, I got a letter in the mail that said the investigation was complete, and the refund was now permanent, only to have the refund yanked again months later. Caping for American banks in this day and age is weird. They are mostly terrible and will rather have their clients take the financial hit before they do - even if they have to lie or frustrated you with long holds & multiple calls unless you show them you mean business.