4 ms·

Security in Europe? We've had groups taking over unmanned gas stations and cash machines with our 'secure' pin. Their latest method of attack: Stand in line and

Security in Europe? We've had groups taking over unmanned gas stations and cash machines with our 'secure' pin. Their latest method of attack: Stand in line and spot the pin-code (just 4 numbers). Distract the person when the machine is about to give back their card and swap it for another card (a dummy that looks like it's theirs, nobody reads the card anyway). They now have your PIN and your card. With the card and the PIN they access your bank- and savings accounts. The target doesn't know it until they check their account (usually after some days). The bank will not block large transfers of money and won't notify you. What could the bank do? Well they already have my cellphone number. A SMS with you're about to transfer XXX to bank account YYYY would be nice. Or a MAC-adress savety? Allow me to add machines the way Apple does with their iPhone. Instantly block all other machines. Edit: Solutions

darklajid 13y ago
What's your point? That someone can get his/her card stolen? And that a PIN might be seen by an observer? That's still orders of magnitude better than 'No PIN'. And frankly, if you allow others to see your PIN you are not properly educated by your bank (I sometimes see elderly people do that and they get a pass from me) or reckless/careless (in which case I have no sympathy). Of course attack vectors exist. They always do. This very site talked about card skimmers a couple of times for example, which copy the magnetic stripe and record the PIN at the same time. As soon as you mix social engineering/clever people in the mix you have boundless opportunities. But that's a different terrain, attacking the person in front of the ATM and not the technology. In reply to your potential solutions: That 'Send SMS to phone' is implemented over here - I get my transaction codes for my mobile banking site via SMS and the message specifically restates amount and target before the TAN itself.
- digitalengineer 13y ago
  They use miniature camera's in blind spots for the person using the machine, transparent foil on the numbers or even completely dummy covers on top of the real covers with prepaid phones sending the data immediately. My point is the bank can do so much more (and so easily) but they do not care. Your Credit Card act as a buffer if I understand correct. You can get the money back right? About my PIN? Yeah it doesn't work outside my country. In just 1.5 hours dive you can use that card abroad without the PIN. The banks have now blocked this by blocking the card abroad. So I need a Credit Card as well... My friend works for the biggest payment system we have around here. They do not care about these systems as they're focusing on a society without PIN/Credit Cards. Cool of course, but for now we're stuck in 1980.
  - darklajid 13y ago
    It seems (correct me if I'm wrong) you're assuming I'm not from Europe/not using DirectDebit. If that's the case: Both isn't true - I own a CC for roundabout 3 (4?) years, but don't trust it/don't use it a lot. That said: I see a weird trend over here as well - it seems stores are regularly switching between the card&pin method and the braindead 'just sign here' way of things. So my card can probably be abused, albeit not online and not at any ATM. I don't think we disagree a lot: There are still huge gaping holes that aren't hard to exploit. But that's still no reason _not_ to use the card&pin system (-> see article). We shouldn't stop there and wear a smug face, 'Europe is secure, we are done'. But in the light of this article we're still better off.
    - digitalengineer 13y ago
      You're right. But are we better off? Stolen money from Creit Cards is refunded if I'm correct. Stolen money from my Debit card is not refunded. I am to blame...
  - bowlofpetunias 13y ago
    Wait, what? What Debit Card do you use that works without PIN?
    - dagw 13y ago
      Not all places have chip+pin terminals. All debit cards I've used (in Sweden) let you swipe and sign a receipt in place of typing your PIN.
      - digitalengineer 13y ago
        Yes, that's what happened to me as well (vacation in France, some time ago). I was shocked. There was no protection if I lost my card.
    - EiZei 13y ago
      They do but usually it's the fallback option which means the merchant is more liable and is supposed to check your ID as well.

darklajid 13y ago

What's your point? That someone can get his/her card stolen? And that a PIN might be seen by an observer? That's still orders of magnitude better than 'No PIN'. And frankly, if you allow others to see your PIN you are not properly educated by your bank (I sometimes see elderly people do that and they get a pass from me) or reckless/careless (in which case I have no sympathy). Of course attack vectors exist. They always do. This very site talked about card skimmers a couple of times for example, which copy the magnetic stripe and record the PIN at the same time. As soon as you mix social engineering/clever people in the mix you have boundless opportunities. But that's a different terrain, attacking the person in front of the ATM and not the technology. In reply to your potential solutions: That 'Send SMS to phone' is implemented over here - I get my transaction codes for my mobile banking site via SMS and the message specifically restates amount and target before the TAN itself.

digitalengineer 13y ago
They use miniature camera's in blind spots for the person using the machine, transparent foil on the numbers or even completely dummy covers on top of the real covers with prepaid phones sending the data immediately. My point is the bank can do so much more (and so easily) but they do not care. Your Credit Card act as a buffer if I understand correct. You can get the money back right? About my PIN? Yeah it doesn't work outside my country. In just 1.5 hours dive you can use that card abroad without the PIN. The banks have now blocked this by blocking the card abroad. So I need a Credit Card as well... My friend works for the biggest payment system we have around here. They do not care about these systems as they're focusing on a society without PIN/Credit Cards. Cool of course, but for now we're stuck in 1980.
- darklajid 13y ago
  It seems (correct me if I'm wrong) you're assuming I'm not from Europe/not using DirectDebit. If that's the case: Both isn't true - I own a CC for roundabout 3 (4?) years, but don't trust it/don't use it a lot. That said: I see a weird trend over here as well - it seems stores are regularly switching between the card&pin method and the braindead 'just sign here' way of things. So my card can probably be abused, albeit not online and not at any ATM. I don't think we disagree a lot: There are still huge gaping holes that aren't hard to exploit. But that's still no reason _not_ to use the card&pin system (-> see article). We shouldn't stop there and wear a smug face, 'Europe is secure, we are done'. But in the light of this article we're still better off.
  - digitalengineer 13y ago
    You're right. But are we better off? Stolen money from Creit Cards is refunded if I'm correct. Stolen money from my Debit card is not refunded. I am to blame...
- bowlofpetunias 13y ago
  Wait, what? What Debit Card do you use that works without PIN?
  - dagw 13y ago
    Not all places have chip+pin terminals. All debit cards I've used (in Sweden) let you swipe and sign a receipt in place of typing your PIN.
    - digitalengineer 13y ago
      Yes, that's what happened to me as well (vacation in France, some time ago). I was shocked. There was no protection if I lost my card.
  - EiZei 13y ago
    They do but usually it's the fallback option which means the merchant is more liable and is supposed to check your ID as well.