7 ms·

This seems a great way to steal other people's credit cards. You can literally duplicate someone's card on your "coin". Now there's a super easy way for someon

by altoz 13y ago

This seems a great way to steal other people's credit cards. You can literally duplicate someone's card on your "coin". Now there's a super easy way for someone working in a restaurant to get your credit card information and sell it.

madsushi 13y ago
Easier than pen and paper? Or the camera on their phone?
- walshemj 13y ago
  Its a bit hard to read the mag stripe by eye - unless your a mutant in which case call in Phil Coulson's team stat
  - andrewfong 13y ago
    The majority of credit cards still have actual numbers on them.
    - q3k 13y ago
      Except that the CVV from the magstripe is missing - wich means ypu can only use the printed CNP CVV, ie. only use the card data for internet transactions.
- bnycum 13y ago
  I assume it's easier in the sense that your waiter could add your card to his Coin, then immediately go buy a TV at the store with it. Not having to make a fake card or needing the address of the card holder to use it online.
  - jerf 13y ago
    As with some other people in cousins comments to your post, I think you may not realize that that attack is already perfectly feasible today. By "feasible" I mean real criminals already do this today, not merely that some academics hypothesize that it may be possible. It's all very off-the-shelf stuff. If you're worried about this attack, the solution isn't "don't use Coin someday in the future", it's "don't use anything with a magnetic strip, today".
maxmcd 13y ago
Couldn't they just require the name/address to match for all cards? Including the one you used to pay for the device?
- berberous 13y ago
  The FAQ says that they do indeed require the names to match.
walshemj 13y ago
Yes I really want to have a reprogrammable CC that I hand to a waiter NOT - Why not just have the fed mandate Chip and Pin after a certain date like Europe did.
- andrewfong 13y ago
  Because it's not worth the cost. On the consumer side, chargebacks are easy. Credit card companies bear the brunt of the cost of fraud. They all have the incentive in the world to start rolling out chip and pin technology. The fact that they haven't probably demonstrates that the math doesn't work out.
  - fragmede 13y ago
    > Because it's not worth the cost. Neither are airbags in cars, yet the government stepped in and made them mandatory. > [Credit card companies] all have the incentive in the world to start rolling out chip and pin technology. No, their incentive is to make sure people keep using credit cards. They've done the math and concluded that the amount of user confusion resulting from chip and pin technology resulting in less credit card use is less than the cost of fraud. The fact that chip and pin works in Europe, and also that credit card processors still exist in Europe proves that implementing chip and pin isn't going to drive Visa and Mastercard out of business.
    - serf 13y ago
      >> because it's not worth the cost. > Neither are airbags in cars, yet the government stepped in and made them mandatory. that's simply untrue. http://www.riskworld.com/news/97q1/nw7aa029.htm http://www.riskworld.com/news/97q1/nw7aa029.htm this testimony is from 1997, and even with mostly first generation airbags in play at that time it's still wrong. They are even more effective at saving lives now, and many of the problems with passenger side airbags have now been alleviated. saved lives = saved money (unless you're looking at cost-to-state of an entire life rather than cost-to-state for medical/funeral costs, but that's outside the scope of this)
MichaelGG 13y ago
Pretty sure a magstripe writer isn't really that hard to get.
CoffeeDregs 13y ago
Two notes: 1) This can already be done using a simple stripe reader. 2) Coin can identify, investigate and proactively block anyone who has more than the average number of cards, so Coin actually seems well positioned to reduce fraud. Also, Coin could identify that multiple Coin cards have the same credit/whatever cards on them and, the next day, prompt you to swipe your card again to confirm. [Provided that Coin uploads suitable data to its servers...] In fact, using a Coin card could be a signal to fraudsters not to commit fraud against your card.
- fragmede 13y ago
  Additionally: simple stripe readers have been available for years now, and fit quite easily in one hand. http://www.baltimoresun.com/media/photo/2011-08/64038442.jpg http://www.baltimoresun.com/media/photo/2011-08/64038442.jpg
- vklj 13y ago
  And by using the location of your phone, and the timing of the swipes, Coin can learn a lot about your shopping habits. Not as much as the credit card company (e.g. not the amount of the purchase), but still quite a lot.
- raybeorn 13y ago
  Just because I am using coins hardware doesn't necessarily mean I need to use their software. And if it does catch on in the main stream, I doubt many people will check to see if it is your card if a check actually exists.
- praxeologist 13y ago
  You have to take pictures of the cards. I assume it would work similarly to how I can take photos of checks to deposit them where, within some tolerance, you have the check/card inside of a "frame" allowing the check to be read. Maybe they can also sort of OCR the card name and make sure it matches your own.
- joshfraser 13y ago
  Yes, credit card duplicators have been available for a long time, but the average minimum-wage worker doesn't know that. This changes the game -- kinda like how how the prevalence of high quality camera phones changed the game for sexting. You could do it before, but it happens a lot more now that it's so convenient and the technology is available to the masses.
tomasien 13y ago
It's so easy to steal someone's credit card that I can name at least 10 people off the top of my head who have had it done, and I'm not even trying. I myself have had it happen twice. The good news is, you just cancel it, there's a paper trail to track the people who did it, and you have fraud protection. All of that can be done better though when you get off the credit card rail, which is what I'm working on. tommy@thecityswig.com if you wanna talk

by altoz 13y ago

madsushi 13y ago

Easier than pen and paper? Or the camera on their phone?

walshemj 13y ago
Its a bit hard to read the mag stripe by eye - unless your a mutant in which case call in Phil Coulson's team stat
- andrewfong 13y ago
  The majority of credit cards still have actual numbers on them.
  - q3k 13y ago
    Except that the CVV from the magstripe is missing - wich means ypu can only use the printed CNP CVV, ie. only use the card data for internet transactions.
bnycum 13y ago
I assume it's easier in the sense that your waiter could add your card to his Coin, then immediately go buy a TV at the store with it. Not having to make a fake card or needing the address of the card holder to use it online.
- jerf 13y ago
  As with some other people in cousins comments to your post, I think you may not realize that that attack is already perfectly feasible today. By "feasible" I mean real criminals already do this today, not merely that some academics hypothesize that it may be possible. It's all very off-the-shelf stuff. If you're worried about this attack, the solution isn't "don't use Coin someday in the future", it's "don't use anything with a magnetic strip, today".

maxmcd 13y ago

Couldn't they just require the name/address to match for all cards? Including the one you used to pay for the device?

berberous 13y ago
The FAQ says that they do indeed require the names to match.

walshemj 13y ago

Yes I really want to have a reprogrammable CC that I hand to a waiter NOT - Why not just have the fed mandate Chip and Pin after a certain date like Europe did.

andrewfong 13y ago
Because it's not worth the cost. On the consumer side, chargebacks are easy. Credit card companies bear the brunt of the cost of fraud. They all have the incentive in the world to start rolling out chip and pin technology. The fact that they haven't probably demonstrates that the math doesn't work out.
- fragmede 13y ago
  > Because it's not worth the cost. Neither are airbags in cars, yet the government stepped in and made them mandatory. > [Credit card companies] all have the incentive in the world to start rolling out chip and pin technology. No, their incentive is to make sure people keep using credit cards. They've done the math and concluded that the amount of user confusion resulting from chip and pin technology resulting in less credit card use is less than the cost of fraud. The fact that chip and pin works in Europe, and also that credit card processors still exist in Europe proves that implementing chip and pin isn't going to drive Visa and Mastercard out of business.
  - serf 13y ago
    >> because it's not worth the cost. > Neither are airbags in cars, yet the government stepped in and made them mandatory. that's simply untrue. http://www.riskworld.com/news/97q1/nw7aa029.htm http://www.riskworld.com/news/97q1/nw7aa029.htm this testimony is from 1997, and even with mostly first generation airbags in play at that time it's still wrong. They are even more effective at saving lives now, and many of the problems with passenger side airbags have now been alleviated. saved lives = saved money (unless you're looking at cost-to-state of an entire life rather than cost-to-state for medical/funeral costs, but that's outside the scope of this)

MichaelGG 13y ago

Pretty sure a magstripe writer isn't really that hard to get.

CoffeeDregs 13y ago

Two notes: 1) This can already be done using a simple stripe reader. 2) Coin can identify, investigate and proactively block anyone who has more than the average number of cards, so Coin actually seems well positioned to reduce fraud. Also, Coin could identify that multiple Coin cards have the same credit/whatever cards on them and, the next day, prompt you to swipe your card again to confirm. [Provided that Coin uploads suitable data to its servers...] In fact, using a Coin card could be a signal to fraudsters not to commit fraud against your card.

fragmede 13y ago
Additionally: simple stripe readers have been available for years now, and fit quite easily in one hand. http://www.baltimoresun.com/media/photo/2011-08/64038442.jpg http://www.baltimoresun.com/media/photo/2011-08/64038442.jpg
vklj 13y ago
And by using the location of your phone, and the timing of the swipes, Coin can learn a lot about your shopping habits. Not as much as the credit card company (e.g. not the amount of the purchase), but still quite a lot.
raybeorn 13y ago
Just because I am using coins hardware doesn't necessarily mean I need to use their software. And if it does catch on in the main stream, I doubt many people will check to see if it is your card if a check actually exists.
praxeologist 13y ago
You have to take pictures of the cards. I assume it would work similarly to how I can take photos of checks to deposit them where, within some tolerance, you have the check/card inside of a "frame" allowing the check to be read. Maybe they can also sort of OCR the card name and make sure it matches your own.
joshfraser 13y ago
Yes, credit card duplicators have been available for a long time, but the average minimum-wage worker doesn't know that. This changes the game -- kinda like how how the prevalence of high quality camera phones changed the game for sexting. You could do it before, but it happens a lot more now that it's so convenient and the technology is available to the masses.

tomasien 13y ago

It's so easy to steal someone's credit card that I can name at least 10 people off the top of my head who have had it done, and I'm not even trying. I myself have had it happen twice. The good news is, you just cancel it, there's a paper trail to track the people who did it, and you have fraud protection. All of that can be done better though when you get off the credit card rail, which is what I'm working on. tommy@thecityswig.com if you wanna talk