4 ms·

A Burger, an Order of Fries, and Your Credit Card Number

32 points by ojbyrne 15y ago

onemoreact 15y ago
Having someone steal a Credit Card number is vary safe at worst your out 50$ and need to wait a few days to get another one in the mail. It's checks I worry about, you can easily drain a bank account with the 2 numbers on the bottom of them and you don't get your money back when that happens.
- Zikes 15y ago
  Debit cards are particularly dangerous, as they are as vulnerable as credit cards but do not offer the same protections.
  - corin_ 15y ago
    Depends what country you're in and who you bank with. If I lose my debit card I'm not responsible for anything spent with it afterwards.
    - simcop2387 15y ago
      I'm like that too, but only if i report it in a timely manner. I think it's something like 72 hours, otherwise there's an amount of about $50 or $100 that I'm liable for.
      - corin_ 15y ago
        I'm not sure if it's official policy or not, but in my experience at least it's 72 hours after you realise. In the past I reported payments from my card that I hadn't made dating back several months and I got them all refunded without it costing me a penny.
  - rbehrends 15y ago
    This depends on your country. For example, in the UK, the Payment Services Regulation 2009 makes no difference between credit and debit cards with respect to a payer's liability. In either case, your liability is limited to 50 pounds (unless you acted grossly negligent, intentionally, or fraudulently), regardless of the type of card used. This is largely a consequence of article 60 and 61 of EU directive 2007/64/EC [1] (some countries have been lagging behind in implementing the directive, though, so don't expect it to be the law everywhere in Europe). [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2007:319:0001:01:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...
    - edj 15y ago
      I think the parent was talking about the US, where liability depends on how fast you report the theft of your card or notice fraudulent transactions in your statement. If you don't catch these quick enough then your liability is unlimited. http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm
  - devmach 15y ago
    It depends : I lost my card and someone found it, went to biggest/main branch of the bank in nuremberg and draw 100€ from cash desk ( this all happened in 3 hours and yes, bank personal doesnt asked/checked identity ). When i found out i lost my card, i called the service line and blocked my card ( though confirmation, my card wasn't blocked ). After two week rush and paperwork i get my money back ( i know i lost my time but it was never about money ). There is always some chance to get your money back but the real problem is you're loosing your liquid that's why debit cards has daily/weekly limits.
- huhtenberg 15y ago
  That's theoretically. Practically though you first have to dispute fraudulent transactions and file chargebacks. For the most part it's easy, but for certain online transactions the bank will tell you to go and talk to the merchant directly. I had my credit card used to subscribe to the adult dating site. When I called the bank (Royal Bank of Canada, a very large, if not largest bank in Canada), they simply transferred my call to that company and I had to prove them that it wasn't me who subscribed with my credit card. They kept asking for my email address and the phone number "to compare to those on file", and the only thing that helped was actually yelling and swearing at them. YMMV, but $50 in damages is only a part of the package.
- excuse-me 15y ago
  Unless the person stealing the credit card uses it to access a child porn site and you are in the UK. Then you are on a child abuse register - your life is over. There is no trial because the data just goes straight to a police database and since computers are never wrong how can the police be wrong? Of course you could try suing the police and insisting on a trial to prove your innocence ;-) If you knew you were on the secret registry, but you would only discover this when you apply to coach your kid's school soccer team and find a SWAT unit turn up at your house. http://en.wikipedia.org/wiki/Operation_Ore http://en.wikipedia.org/wiki/Operation_Ore
- Nick_C 15y ago
  > It's checks I worry about, I've heard this repeated so many times it is almost becoming an internet meme. I suspect because most younger people have never seen a cheque, they think it is somehow "risky" to show the account number and BSB number. It's not true. All cheques have them printed on them and have done for decades. The payments clearing system worked fine for all that time, and it still does.
ayuvar 15y ago
We had a rash of credit/debit card skimming locally as a result of crooks coming into stores in the mall and replacing the store's point-of-sale card reader terminal with one of their own which was rigged to skim before passing on the information to the register, according to the local news. Normally, I'd distrust the news when it comes to anything vaguely technical but it got me wondering if the POS terminal does anything to guarantee that its credit card reader is still "authentic" (hopefully, it at least used some kind of good faith challenge-response mechanism, even if it could be easily spoofed by a potential attacker). Physically swapping them out - both to put the rigged reader in, and to remove it once it's "full" - also seems pretty risky. It was probably something like this story instead where the register itself was targeted remotely.
- simcop2387 15y ago
  From what I know about them when helping install them in a new retail store where i was working a few years ago, there's quite a few of them that act like nothing more than a keyboard. the fancier ones with a display still hook up over usb and i don't think they use a challenge response (I honestly don't know there, i don't know the software for them). Even once I got them in if i was skimming I wouldn't even bother removing them ever. Instead I'd use something like the little XBee modules or some other wireless device to read them and just walk in and act like a regular shopper leaving the retrieval thing in my pocket the whole time.
- bradleyland 15y ago
  Having done my time in the independent computer repair trenches with more than one restaurant as a customer, I can tell you that while secure, sophisticated card scanning equipment exists, much of the stuff used at mom & pop stores is rudimentary at best. Basic USB card swipers can be swapped out with zero change required in the software. None of this really matters though. What are the consequences of having your card skimmed? For the card holder, it's a mere inconvenience. The banks don't hold you accountable for the breech, because they know you'd never do business with them again. For the bank, it's only a small loss. They chargeback the transactions amounts to the vendor that took the card. The "victim" in this scenario is the merchant who accepted the stolen card. The risk associated with stolen credit card data is diffused this way. Merchants who don't want to assume the risk of accepting stolen credit cards can opt-in to far more stringent CC security practices like CVV2 codes and AVS (address verification). If you've ever had your CC number stolen, you know that the purchases are made overseas, or with shady merchants that don't opt-in for better security.
rokhayakebe 15y ago
Honest question: if a hacker is talented enough to create software to steal thousands of dollars, are they not talented enough to make multiples more legally?
- blahedo 15y ago
  Possibly not if they're in a country with a weaker economy, lower cost (and/or standard) of living, and no way to get a work visa someplace else?
brudgers 15y ago
Related All about Skimmers from Krebs on security: http://krebsonsecurity.com/all-about-skimmers/ http://krebsonsecurity.com/all-about-skimmers/

32 points by ojbyrne 15y ago

Having someone steal a Credit Card number is vary safe at worst your out 50$ and need to wait a few days to get another one in the mail. It's checks I worry about, you can easily drain a bank account with the 2 numbers on the bottom of them and you don't get your money back when that happens.

Zikes 15y ago
Debit cards are particularly dangerous, as they are as vulnerable as credit cards but do not offer the same protections.
- corin_ 15y ago
  Depends what country you're in and who you bank with. If I lose my debit card I'm not responsible for anything spent with it afterwards.
  - simcop2387 15y ago
    I'm like that too, but only if i report it in a timely manner. I think it's something like 72 hours, otherwise there's an amount of about $50 or $100 that I'm liable for.
    - corin_ 15y ago
      I'm not sure if it's official policy or not, but in my experience at least it's 72 hours after you realise. In the past I reported payments from my card that I hadn't made dating back several months and I got them all refunded without it costing me a penny.
- rbehrends 15y ago
  This depends on your country. For example, in the UK, the Payment Services Regulation 2009 makes no difference between credit and debit cards with respect to a payer's liability. In either case, your liability is limited to 50 pounds (unless you acted grossly negligent, intentionally, or fraudulently), regardless of the type of card used. This is largely a consequence of article 60 and 61 of EU directive 2007/64/EC [1] (some countries have been lagging behind in implementing the directive, though, so don't expect it to be the law everywhere in Europe). [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2007:319:0001:01:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...
  - edj 15y ago
    I think the parent was talking about the US, where liability depends on how fast you report the theft of your card or notice fraudulent transactions in your statement. If you don't catch these quick enough then your liability is unlimited. http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm http://www.ftc.gov/bcp/edu/pubs/consumer/credit/cre04.shtm
- devmach 15y ago
  It depends : I lost my card and someone found it, went to biggest/main branch of the bank in nuremberg and draw 100€ from cash desk ( this all happened in 3 hours and yes, bank personal doesnt asked/checked identity ). When i found out i lost my card, i called the service line and blocked my card ( though confirmation, my card wasn't blocked ). After two week rush and paperwork i get my money back ( i know i lost my time but it was never about money ). There is always some chance to get your money back but the real problem is you're loosing your liquid that's why debit cards has daily/weekly limits.
huhtenberg 15y ago
That's theoretically. Practically though you first have to dispute fraudulent transactions and file chargebacks. For the most part it's easy, but for certain online transactions the bank will tell you to go and talk to the merchant directly. I had my credit card used to subscribe to the adult dating site. When I called the bank (Royal Bank of Canada, a very large, if not largest bank in Canada), they simply transferred my call to that company and I had to prove them that it wasn't me who subscribed with my credit card. They kept asking for my email address and the phone number "to compare to those on file", and the only thing that helped was actually yelling and swearing at them. YMMV, but $50 in damages is only a part of the package.
excuse-me 15y ago
Unless the person stealing the credit card uses it to access a child porn site and you are in the UK. Then you are on a child abuse register - your life is over. There is no trial because the data just goes straight to a police database and since computers are never wrong how can the police be wrong? Of course you could try suing the police and insisting on a trial to prove your innocence ;-) If you knew you were on the secret registry, but you would only discover this when you apply to coach your kid's school soccer team and find a SWAT unit turn up at your house. http://en.wikipedia.org/wiki/Operation_Ore http://en.wikipedia.org/wiki/Operation_Ore
Nick_C 15y ago
> It's checks I worry about, I've heard this repeated so many times it is almost becoming an internet meme. I suspect because most younger people have never seen a cheque, they think it is somehow "risky" to show the account number and BSB number. It's not true. All cheques have them printed on them and have done for decades. The payments clearing system worked fine for all that time, and it still does.

ayuvar 15y ago

We had a rash of credit/debit card skimming locally as a result of crooks coming into stores in the mall and replacing the store's point-of-sale card reader terminal with one of their own which was rigged to skim before passing on the information to the register, according to the local news. Normally, I'd distrust the news when it comes to anything vaguely technical but it got me wondering if the POS terminal does anything to guarantee that its credit card reader is still "authentic" (hopefully, it at least used some kind of good faith challenge-response mechanism, even if it could be easily spoofed by a potential attacker). Physically swapping them out - both to put the rigged reader in, and to remove it once it's "full" - also seems pretty risky. It was probably something like this story instead where the register itself was targeted remotely.

simcop2387 15y ago
From what I know about them when helping install them in a new retail store where i was working a few years ago, there's quite a few of them that act like nothing more than a keyboard. the fancier ones with a display still hook up over usb and i don't think they use a challenge response (I honestly don't know there, i don't know the software for them). Even once I got them in if i was skimming I wouldn't even bother removing them ever. Instead I'd use something like the little XBee modules or some other wireless device to read them and just walk in and act like a regular shopper leaving the retrieval thing in my pocket the whole time.
bradleyland 15y ago
Having done my time in the independent computer repair trenches with more than one restaurant as a customer, I can tell you that while secure, sophisticated card scanning equipment exists, much of the stuff used at mom & pop stores is rudimentary at best. Basic USB card swipers can be swapped out with zero change required in the software. None of this really matters though. What are the consequences of having your card skimmed? For the card holder, it's a mere inconvenience. The banks don't hold you accountable for the breech, because they know you'd never do business with them again. For the bank, it's only a small loss. They chargeback the transactions amounts to the vendor that took the card. The "victim" in this scenario is the merchant who accepted the stolen card. The risk associated with stolen credit card data is diffused this way. Merchants who don't want to assume the risk of accepting stolen credit cards can opt-in to far more stringent CC security practices like CVV2 codes and AVS (address verification). If you've ever had your CC number stolen, you know that the purchases are made overseas, or with shady merchants that don't opt-in for better security.

rokhayakebe 15y ago

Honest question: if a hacker is talented enough to create software to steal thousands of dollars, are they not talented enough to make multiples more legally?

blahedo 15y ago
Possibly not if they're in a country with a weaker economy, lower cost (and/or standard) of living, and no way to get a work visa someplace else?

brudgers 15y ago

Related All about Skimmers from Krebs on security: http://krebsonsecurity.com/all-about-skimmers/ http://krebsonsecurity.com/all-about-skimmers/