3 ms·
> Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance. Not supposed to be possible o
by lelanthran 1y ago
> Kind of, but if you control the card reader you could charge more for the transaction without showing the amount, for instance.
Not supposed to be possible on a certified terminal. The certification tests this particular case (the transaction is a hash of the keys, amount and a few other things. The display of the swipe/tap/insert screen and the pin-entry are under control of the certified kernel, so the userspacve application has no control of the amount that is displayed).
> And maybe even send the money to a different account.
Not from the card reader.
- cesarb 1y agoI've heard of it happening here in Brazil. In the simplest variant, something is glued on top of the screen to hide the higher digits, making the value appear to be lower; supposedly, some more advanced variants of the scam have a damaged or tampered screen.
- clait 1y agoI was victim on this attack in Argentina. Paid a taxi with my card, and got charged 50x the amount shown on the display.