4 ms·

I don't know how debit cards work in the US, but I need a PIN to use my debit card, so short of being forced to withdraw money at gunpoint, you won't get any ac

by soult 14y ago

I don't know how debit cards work in the US, but I need a PIN to use my debit card, so short of being forced to withdraw money at gunpoint, you won't get any access to my bank account.

lbotos 14y ago
In the US you can swipe debit cards as "credit" and you don't have to pin/sign most of the time under $20.
- deleted 14y ago
  [deleted]
estel 14y ago
Unless they're using the card online, when they only need my address (which isn't the hardest information to uncover).
- notatoad 14y ago
  In canada, if i want to use my debit card online i have to log in to my online banking after i make the purchase to confirm the transaction.
  - danneu 14y ago
    (American) I experienced something like this the first time in my life yesterday when buying Skype credit. After entering my info at Skype, I was redirected to a "Verified by Visa"[0] page that made me type in my bank credentials. I wish this sort of thing was universal. [0]: https://usa.visa.com/personal/security/vbv/index.jsp https://usa.visa.com/personal/security/vbv/index.jsp
    - chrisbolt 14y ago
      Verified by Visa has a pretty bad design flaw: the recommended implementation uses an iframe to load the page that prompts for your password, so it's not obvious if that iframe is legitimate or a phishing attack.
      - ljoshua 14y ago
        Also, VbV unloads a lot of the security burden to the consumer: http://news.ycombinator.com/item?id=1909862 http://news.ycombinator.com/item?id=1909862
    - CaptainZapp 14y ago
      Here's a scenario: I'm in a dodgy internet cafe with a key logger somewhere in Thailand. I need to book a flight and the airline insists on my "Verified By Visa" credentials. Who do you think my bank blames (even though they state that they won't) when somebody goes on a shopping spree with not only my CC # and my security code, but also my VbV password? As another poster mentioned: It's offloading the risk to the card holder. Something like a token, or two factor authentication would be a lot better.
    - semanticist 14y ago
      Verified by Visa (AKA '3D Secure') is a huge pain, and in all bank implementations that I've used in the UK it's trivial to reset the password. My current account is with LloydsTSB and they now don't bother asking for your 3D Secure credentials and just go straight to the 'accepted' callback, because it pissed off so many of their customers.
  - estel 14y ago
    I usually have to do the Verified by Visa stuff too, but my understanding is that it's almost entirely optional for a merchant to require the extra information. Payment can still be made even without a CVV. And even if verified by visa were compulsory, it would still be possible to create a Direct Debit payment using the account details, which are frequently written on the card, and the address.
- kalleboo 14y ago
  At least in Sweden, most debit cards now require Verified By Visa/MasterCard SecureCode for online purchases, which means the theif would need either my bank RSA fob or a password.
PakG1 14y ago
I had a co-worker once who used his debit card at an ATM at a coffee shop nearby our office. Somehow, some genius had installed a mechanism in the ATM to read the stripe and the PIN. So they were able to take that info and create a fake debit card that replicated my co-worker's debit card. The next week, his bank account got cleaned out. He was absolutely broke and went through a few weeks of hell trying to get it all sorted out. Fortunately, the bank was able to help him out. I don't know what happened with the police investigation, but basically none of us used cards at that coffee shop again. The coffee shop was still operational, and I think the police were somehow able to determine that it wasn't the coffee shop at fault (maybe only a single employee or an ATM maintenance guy, not sure). I think this is why a lot of debit cards have chips nowadays. The chips are harder to counterfeit (I think). But I think we still have to grandfather all the old debit cards without chips. :(
- idonthack 14y ago
  The chips actually make the entire card easier to counterfeit. Someone just has to walk by you with the proper radio and your card will speak up and give out all the information necessary to make charges.
- alanfalcon 14y ago
  Interesting information (with pictures) about ATM skimmers here: http://m.krebsonsecurity.com/tag/atm-skimmer/ http://m.krebsonsecurity.com/tag/atm-skimmer/ Doesn't take a genius, just some capital and a willingness to break the law and risk getting caught.
- megablast 14y ago
  Wow, I thought everybody had heard of ATM card skinners by now. Be very careful at any ATM you use, don't think you are safe because you avoid that cafe's. And cover your hand when you enter a pin.
  - PakG1 14y ago
    That was in 2010, hadn't heard of them back then. Not sure if they were actually common back then, although I'm sure they're certainly more common now. Yes, careful, careful. :(
deleted 14y ago
[deleted]

by soult 14y ago

I don't know how debit cards work in the US, but I need a PIN to use my debit card, so short of being forced to withdraw money at gunpoint, you won't get any access to my bank account.

lbotos 14y ago

In the US you can swipe debit cards as "credit" and you don't have to pin/sign most of the time under $20.

deleted 14y ago
[deleted]

estel 14y ago

Unless they're using the card online, when they only need my address (which isn't the hardest information to uncover).

notatoad 14y ago
In canada, if i want to use my debit card online i have to log in to my online banking after i make the purchase to confirm the transaction.
- danneu 14y ago
  (American) I experienced something like this the first time in my life yesterday when buying Skype credit. After entering my info at Skype, I was redirected to a "Verified by Visa"[0] page that made me type in my bank credentials. I wish this sort of thing was universal. [0]: https://usa.visa.com/personal/security/vbv/index.jsp https://usa.visa.com/personal/security/vbv/index.jsp
  - chrisbolt 14y ago
    Verified by Visa has a pretty bad design flaw: the recommended implementation uses an iframe to load the page that prompts for your password, so it's not obvious if that iframe is legitimate or a phishing attack.
    - ljoshua 14y ago
      Also, VbV unloads a lot of the security burden to the consumer: http://news.ycombinator.com/item?id=1909862 http://news.ycombinator.com/item?id=1909862
  - CaptainZapp 14y ago
    Here's a scenario: I'm in a dodgy internet cafe with a key logger somewhere in Thailand. I need to book a flight and the airline insists on my "Verified By Visa" credentials. Who do you think my bank blames (even though they state that they won't) when somebody goes on a shopping spree with not only my CC # and my security code, but also my VbV password? As another poster mentioned: It's offloading the risk to the card holder. Something like a token, or two factor authentication would be a lot better.
  - semanticist 14y ago
    Verified by Visa (AKA '3D Secure') is a huge pain, and in all bank implementations that I've used in the UK it's trivial to reset the password. My current account is with LloydsTSB and they now don't bother asking for your 3D Secure credentials and just go straight to the 'accepted' callback, because it pissed off so many of their customers.
- estel 14y ago
  I usually have to do the Verified by Visa stuff too, but my understanding is that it's almost entirely optional for a merchant to require the extra information. Payment can still be made even without a CVV. And even if verified by visa were compulsory, it would still be possible to create a Direct Debit payment using the account details, which are frequently written on the card, and the address.
kalleboo 14y ago
At least in Sweden, most debit cards now require Verified By Visa/MasterCard SecureCode for online purchases, which means the theif would need either my bank RSA fob or a password.

PakG1 14y ago

I had a co-worker once who used his debit card at an ATM at a coffee shop nearby our office. Somehow, some genius had installed a mechanism in the ATM to read the stripe and the PIN. So they were able to take that info and create a fake debit card that replicated my co-worker's debit card. The next week, his bank account got cleaned out. He was absolutely broke and went through a few weeks of hell trying to get it all sorted out. Fortunately, the bank was able to help him out. I don't know what happened with the police investigation, but basically none of us used cards at that coffee shop again. The coffee shop was still operational, and I think the police were somehow able to determine that it wasn't the coffee shop at fault (maybe only a single employee or an ATM maintenance guy, not sure). I think this is why a lot of debit cards have chips nowadays. The chips are harder to counterfeit (I think). But I think we still have to grandfather all the old debit cards without chips. :(

idonthack 14y ago
The chips actually make the entire card easier to counterfeit. Someone just has to walk by you with the proper radio and your card will speak up and give out all the information necessary to make charges.
alanfalcon 14y ago
Interesting information (with pictures) about ATM skimmers here: http://m.krebsonsecurity.com/tag/atm-skimmer/ http://m.krebsonsecurity.com/tag/atm-skimmer/ Doesn't take a genius, just some capital and a willingness to break the law and risk getting caught.
megablast 14y ago
Wow, I thought everybody had heard of ATM card skinners by now. Be very careful at any ATM you use, don't think you are safe because you avoid that cafe's. And cover your hand when you enter a pin.
- PakG1 14y ago
  That was in 2010, hadn't heard of them back then. Not sure if they were actually common back then, although I'm sure they're certainly more common now. Yes, careful, careful. :(

deleted 14y ago

[deleted]