8 ms·

Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

129 points by error54 12y ago

aioprisan 12y ago
This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.
- aianus 12y ago
  I wish they would deny merchant accounts to merchants too cheap/lazy to roll out contactless payments alongside chip and pin. There's nothing more stupid and frustrating than holding up the line doing chip and pin to buy a $5 meal at Subway.
  - arrrg 12y ago
    Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)
    - btbuilder 12y ago
      Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.
      - jacquesm 12y ago
        The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.
        arrrg 12y ago
        Yeah, right, there is lots that can be done. Sadly, also Germany is still somewhat backward in that regard. Every reader seems to work differently, so I’m always a bit hesitant to just stick in my card unprompted (and maybe prematurely), lest I get yelled at or something. There is lots to optimise, but chip and PIN is not inherently slow. In fact, for me it’s already as fast as cash in most cases.
        aianus 12y ago
        The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's going on and make you sign two receipts in addition to entering your pin after trying and failing to swipe it twice. - You have to type your pin in with your bare hands in -40C weather at the gas station. - You have to tip waiters with them standing right there and judging you. - It breaks square and the like IMO it's an unnecessary mess for anything under ~$50.
        jacquesm 12y ago
        I make several payments per day using chip&pin, according to my bank last month more than 300 pin transactions. That's 10 per day (travelling I do this a lot more than when I'm at home). Online it's not a problem either (fairly easy integration here with a system called 'iDeal'), typing in your pin at -40C at the gas station is still a requirement with the current prices of gas and I'm not one bit bothered by 'waiters judging me', that's a self esteem issue, not a technical one. As for international merchants who have no idea what is going on: I spend more time abroad than I do in my home country and chip-and-pin have made my life a lot easier than it ever was before in this respect. Something like 7 countries in the last 3 weeks and I have yet to use my 'cash backup' or my 'credit card backup'. Contactless is a nice technology but it is as far as I'm concerned a step backwards, I can see the advantages only for bars and festivals where the risk of contaminating your card with fluids is significant and purchases are very small (<$10).
      - jahewson 12y ago
        That's the case for chip and pin too, low-cost transactions can be authorised with just a swipe.
        aianus 12y ago
        In Canada, swipe doesn't work anywhere that has the chip-and-pin reader. No matter the amount, if you try swiping it says 'Use Chip'.
        jahewson 12y ago
        Correction: I meant "insert your card", not "swipe". Though low-cost transactions can still be authorised without having to enter a PIN, at least in the UK.
      - deleted 12y ago
        [deleted]
    - aianus 12y ago
      Before Canada implemented Chip and PIN, you usually didn't have to sign the receipt for those kind of small purchases. It takes at least 10x longer now to do the insert, type PIN, remove than just a swipe.
      - kubiiii 12y ago
        Contactless payment is more and more widespread in france for purchases < € 20.
        tonyedgecombe 12y ago
        We are starting to see it in the UK as well, it is very fast.
        icebraining 12y ago
        Our cards here in Portugal already support it as well, but the payment readers seem to be lagging behind.
        furyg3 12y ago
        This. In Holland we have chip and pin, which I've got to say goes much faster than someone can fish out cash from their wallet, certainly faster than someone can make change. Recently many places also support RFID with no pin required for small purchases (I think it's €25). Goes much faster than the employee can bag your order up.
  - doctorpangloss 12y ago
    To be fair to Home Depot, its self checkout systems have the most payment options of any system I've ever seen. They include feeding the machine a check, paying with PayPal, writing in a bank transfer, among something like a dozen payment mechanisms.
  - __david__ 12y ago
    Where are you from? Around here (Southern California) every card reading machine defaults to debit transactions, where you have to enter your PIN anyway. At least when you do credit cards you don't have to sign them for small purchases any more (less than $50 at Home Depot, for instance). I really can't say I've ever felt frustrated waiting for the person ahead of me to pay (except for maybe old people hand writing checks at the grocery store—and even then it's kind of interesting to see such old-school payments in action).
    - aianus 12y ago
      Toronto, Canada
      - __david__ 12y ago
        I've never used a contactless method. Is it NFC (or something similar)? Is it really faster than swiping your card? I had the impression you still had to do something on your phone to authorize it...
        aianus 12y ago
        Yes it's NFC. No, you don't have to do anything at all except tap your card/wallet against the reader and wait for the beep. Here's a 1:47m video from MasterCard explaining it: https://www.youtube.com/watch?v=DkxxhvVJjuM https://www.youtube.com/watch?v=DkxxhvVJjuM
        MichaelGG 12y ago
        Even in 2007 in Denver, Amex issued me a credit (not charge) card with a little RFID chip. Worked at a fair number of places. Just get the card near and it beeps and you go on your way.
    - snarfy 12y ago
      This is something that needs regulation, IMO. Debit or credit? Debit is the default everywhere. Why? Because credit has a surcharge for the merchant. It is complete bullshit that the merchants put the onus on their customers and then shrug their shoulders when fraud happens. At least with credit you are insured. They get your pin and you are screwed.
  - stef25 12y ago
    Here in Europe everything's been chip & pin for longer than I can remember, lines are not held up. Takes seconds.
    - deleted 12y ago
      [deleted]
- mzuvella 12y ago
  Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.
  - jacquesm 12y ago
    Even online I have to authorize transactions using my token and the chip on the card. So that definitely would make a difference.
  - __david__ 12y ago
    I hear this a lot and I don't really know how EU's chip and pin works, but wouldn't it be best for the the card to spit out an encrypted blob that only the originating bank can decrypt? IE, no number that's useful to anyone in the middle at all? That seems like a better design to me.
    - lucaspiller 12y ago
      A lot of places where I pay by PIN they still swipe it afterwards so that they have a record on their own system (not sure why they need this though) - I think this is what OP refers to. The difference between US banks and mine though is that if I try to pay by signing my bank won't authorise it - I have to enter my PIN (and sometimes sign too) to make a payment. Payments online is more of the retailers fault though. They shouldn't accept payments where the CVV check or address check fails. Here in the UK most retailers won't accept payments unless it all matches up, but as I understand this isn't as common in the US.
    - icebraining 12y ago
      Yes, and the infrastructure is there for chip&pin cards, you just need an ISO7816 USB reader, which are cheap nowadays (<$20). Browsers already support it as well; in fact, our national ID cards follow the same standard and you can login to governmental websites with the card. The problem is inertia, nothing else.
  - kaared 12y ago
    In Norway, the most common type of card is a debit card that can also be used as a Visa or MasterCard credit card. The card has a smart chip on the front, and on the back you have your national id number/date of birth, photo and signature, etc. The card is frequently used as an id card. When you pay using the debit card, you have to insert the part of the card with the chip into a reader and enter your pin. Typically you can not do this until the cash register has transferred the amount to pay to the terminal. You can also use it as a credit card when abroad or even in Norway. However, I'm not sure if the card will actually allow you credit (i.e. borrow money) per se -- I believe the account must have a sufficient positive balance, and I believe the domestic terminals are able to check that in real time (i.e. in a few seconds) and decline the sale if not funded. As for online purchases, every time I use it as a credit card, I get re-routed to a card verification process. This means I get taken to some third party site (typically Visa or MasterCard) where I have to authenticate using my password and generate a one-time password (pin) on my phone. You can also use a FOB, but I find a phone more practical. After the verification is done, you get taken back to the merchant site. This is the same verification process that is used for online banking. After living 15 years in the states I found this to be a bit annoying at first, but that had more to do with the speed of the implementation and the fact that it's applet-based (Java and Chrome -- have to switch browsers and hope that you don't lose your session). If I had to authenticate every time I bought something on Amazon it would get old pretty fast. However, one could simply authenticate once to indicate that this merchant is trusted. A new merchant would trigger the authentication before the transaction can be accepted.
- InclinedPlane 12y ago
  Chip and pin is already being planned for the US over the next 2 years or so. I'm honestly quite surprised the news hasn't gotten more attention.
GabrielF00 12y ago
I was at a home depot on September 1st and my credit card was declined for security reasons. I just moved to a different state, but I had no problem using the card at other stores that same day, including to make a larger purchase at the same mall as the home depot.
- willvarfar 12y ago
  So you may have been lucky and avoided your card getting breached, if that's the only time you went to home depot that is.
  - ceejayoz 12y ago
    To get a decline the POS would have had to take the card number, so probably not.
nodesocket 12y ago
How is http://rescator.cc/ http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps, and proactively blacklisted cards before the issuing banks notice and decline.
- jacquesm 12y ago
  > Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).
  - deleted 12y ago
    [deleted]
  - diafygi 12y ago
    > If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s
awjr 12y ago
I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.
- nodata 12y ago
  Lack of chip and pin, or use of magnetic stripes instead of ICs?
- jvm 12y ago
  Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml http://www.forbes.com/fdc/welcome_mjx.shtml
  - dghughes 12y ago
    http://m.youtube.com/watch?v=B80SyRmtbdI http://m.youtube.com/watch?v=B80SyRmtbdI
  - celticninja 12y ago
    cool, so only about 5 years after it was widespread/standard in Europe
  - js2 12y ago
    My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-usa-emv-cards-available-today-chip-pin-chip-signature.html http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRvcE1ELVg5UmlGZk01SHZvTUMxdUE https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I was looking into the CC issues, and as a US traveler not being able to get an EMV card with pin priority is annoying. Edit 2: jvm, not sure what you meant to link to, but that link just goes to the Forbes splash advert.
TallGuyShort 12y ago
99% correlation sounds high, but I wonder what the correlation is with other stores, and with what statistical confidence you can actually conclude that Home Depot was the victim here...
- dfc 12y ago
  It was a 99.4% overlap in zip codes listed for sale and zip codes listed as having a HD storefront. I think you might want to reread that section.
  - TallGuyShort 12y ago
    Yes but what's the correlation like for other common stores? I've lived in a lot of different towns in the US and every single on of them has had a Home Depot in town. They've also all had a Target. I'd be curious to know what that correlation looked like.
    - deleted 12y ago
      [deleted]
- driverdan 12y ago
  Exactly, correlation is not causation. I bet they have an even higher correlation with Walmart.
kazinator 12y ago
You should be able to easily dispute charges at a "big box store" that were not chip-and-pin transactions, and that did not use the three-digit security extension to the number. I've had a chip card for, what, some seven or eight years in Canada. Here is a July 2007 story about how RBC (Royal Bank of Canada) logged 10 million chip transactions: http://www.newswire.ca/en/story/14243/rbc-marks-10-million-world-wide-chip-card-transactions-with-rbc-platinum-avion-visa-card http://www.newswire.ca/en/story/14243/rbc-marks-10-million-w... "RBC today announced it recently surpassed over 10 million successful chip transactions at compatible merchant locations in Canada and worldwide. This milestone comes four years after RBC became the first Canadian financial institution to begin issuing chip cards nationally to its Platinum Avion Visa cardholders in 2003."
bluedino 12y ago
Aren't debit cards part of the problem? I only use my credit card and then just pay that as I go. Much easier to dispute charges on a credit card. Also, if the card is stolen and my bank account is emptied, with a credit card all that would happen is that my credit limit on one of my cards is temporarily reduced.
- crpatino 12y ago
  The card attached to my main account (where my employer sends my salary) is private. My main credit card is from the same bank and I pay it directly from there. Credit card gets used at places that I trust. Dispute charges can be a time consuming process, and you have to pay some token amount to avoid punitive rates anyways. I have another account in a different bank, were I send small electronic deposits periodically. I retire about 1/2 of that in cash at ATM, to pay either at places that do not accept cards or I do not trust (i.e. gas stations). I have to keep a small balance in the account, and it is not always practical to use cash, so I use the corresponding debit card at places I neither trust or distrust.

129 points by error54 12y ago

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

aianus 12y ago
I wish they would deny merchant accounts to merchants too cheap/lazy to roll out contactless payments alongside chip and pin. There's nothing more stupid and frustrating than holding up the line doing chip and pin to buy a $5 meal at Subway.
- arrrg 12y ago
  Does the US use some byzantine tech for chip and PIN? Entering the PIN is about as fast as signing the receipt, at least where I’m from. I doubt it’s much slower than paying cash. (I hand over my card. Card is inserted in reader. I enter my PIN and confirm. Transaction is confirmed after a couple seconds. That can’t be more than ten seconds or so.)
  - btbuilder 12y ago
    Most low-cost transaction don't require any signature - swipe and go. I was surprised to find in Safeway recently that a < ~$20 transaction required no signature either.
    - jacquesm 12y ago
      The chip-and-pin mechanism when optimized is very low overhead, probably faster than using cash and not nearly as slow as signing a physical receipt. For instance, one oft used optimization is that you can insert the card in the reader prior to the register sending the amount to the chip&pin terminal.
      - arrrg 12y ago
        Yeah, right, there is lots that can be done. Sadly, also Germany is still somewhat backward in that regard. Every reader seems to work differently, so I’m always a bit hesitant to just stick in my card unprompted (and maybe prematurely), lest I get yelled at or something. There is lots to optimise, but chip and PIN is not inherently slow. In fact, for me it’s already as fast as cash in most cases.
      - aianus 12y ago
        The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's going on and make you sign two receipts in addition to entering your pin after trying and failing to swipe it twice. - You have to type your pin in with your bare hands in -40C weather at the gas station. - You have to tip waiters with them standing right there and judging you. - It breaks square and the like IMO it's an unnecessary mess for anything under ~$50.
        jacquesm 12y ago
        I make several payments per day using chip&pin, according to my bank last month more than 300 pin transactions. That's 10 per day (travelling I do this a lot more than when I'm at home). Online it's not a problem either (fairly easy integration here with a system called 'iDeal'), typing in your pin at -40C at the gas station is still a requirement with the current prices of gas and I'm not one bit bothered by 'waiters judging me', that's a self esteem issue, not a technical one. As for international merchants who have no idea what is going on: I spend more time abroad than I do in my home country and chip-and-pin have made my life a lot easier than it ever was before in this respect. Something like 7 countries in the last 3 weeks and I have yet to use my 'cash backup' or my 'credit card backup'. Contactless is a nice technology but it is as far as I'm concerned a step backwards, I can see the advantages only for bars and festivals where the risk of contaminating your card with fluids is significant and purchases are very small (<$10).
    - jahewson 12y ago
      That's the case for chip and pin too, low-cost transactions can be authorised with just a swipe.
      - aianus 12y ago
        In Canada, swipe doesn't work anywhere that has the chip-and-pin reader. No matter the amount, if you try swiping it says 'Use Chip'.
      - jahewson 12y ago
        Correction: I meant "insert your card", not "swipe". Though low-cost transactions can still be authorised without having to enter a PIN, at least in the UK.
    - deleted 12y ago
      [deleted]
  - aianus 12y ago
    Before Canada implemented Chip and PIN, you usually didn't have to sign the receipt for those kind of small purchases. It takes at least 10x longer now to do the insert, type PIN, remove than just a swipe.
    - kubiiii 12y ago
      Contactless payment is more and more widespread in france for purchases < € 20.
      - tonyedgecombe 12y ago
        We are starting to see it in the UK as well, it is very fast.
        icebraining 12y ago
        Our cards here in Portugal already support it as well, but the payment readers seem to be lagging behind.
      - furyg3 12y ago
        This. In Holland we have chip and pin, which I've got to say goes much faster than someone can fish out cash from their wallet, certainly faster than someone can make change. Recently many places also support RFID with no pin required for small purchases (I think it's €25). Goes much faster than the employee can bag your order up.
- doctorpangloss 12y ago
  To be fair to Home Depot, its self checkout systems have the most payment options of any system I've ever seen. They include feeding the machine a check, paying with PayPal, writing in a bank transfer, among something like a dozen payment mechanisms.
- __david__ 12y ago
  Where are you from? Around here (Southern California) every card reading machine defaults to debit transactions, where you have to enter your PIN anyway. At least when you do credit cards you don't have to sign them for small purchases any more (less than $50 at Home Depot, for instance). I really can't say I've ever felt frustrated waiting for the person ahead of me to pay (except for maybe old people hand writing checks at the grocery store—and even then it's kind of interesting to see such old-school payments in action).
  - aianus 12y ago
    Toronto, Canada
    - __david__ 12y ago
      I've never used a contactless method. Is it NFC (or something similar)? Is it really faster than swiping your card? I had the impression you still had to do something on your phone to authorize it...
      - aianus 12y ago
        Yes it's NFC. No, you don't have to do anything at all except tap your card/wallet against the reader and wait for the beep. Here's a 1:47m video from MasterCard explaining it: https://www.youtube.com/watch?v=DkxxhvVJjuM https://www.youtube.com/watch?v=DkxxhvVJjuM
      - MichaelGG 12y ago
        Even in 2007 in Denver, Amex issued me a credit (not charge) card with a little RFID chip. Worked at a fair number of places. Just get the card near and it beeps and you go on your way.
  - snarfy 12y ago
    This is something that needs regulation, IMO. Debit or credit? Debit is the default everywhere. Why? Because credit has a surcharge for the merchant. It is complete bullshit that the merchants put the onus on their customers and then shrug their shoulders when fraud happens. At least with credit you are insured. They get your pin and you are screwed.
- stef25 12y ago
  Here in Europe everything's been chip & pin for longer than I can remember, lines are not held up. Takes seconds.
  - deleted 12y ago
    [deleted]
mzuvella 12y ago
Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.
- jacquesm 12y ago
  Even online I have to authorize transactions using my token and the chip on the card. So that definitely would make a difference.
- __david__ 12y ago
  I hear this a lot and I don't really know how EU's chip and pin works, but wouldn't it be best for the the card to spit out an encrypted blob that only the originating bank can decrypt? IE, no number that's useful to anyone in the middle at all? That seems like a better design to me.
  - lucaspiller 12y ago
    A lot of places where I pay by PIN they still swipe it afterwards so that they have a record on their own system (not sure why they need this though) - I think this is what OP refers to. The difference between US banks and mine though is that if I try to pay by signing my bank won't authorise it - I have to enter my PIN (and sometimes sign too) to make a payment. Payments online is more of the retailers fault though. They shouldn't accept payments where the CVV check or address check fails. Here in the UK most retailers won't accept payments unless it all matches up, but as I understand this isn't as common in the US.
  - icebraining 12y ago
    Yes, and the infrastructure is there for chip&pin cards, you just need an ISO7816 USB reader, which are cheap nowadays (<$20). Browsers already support it as well; in fact, our national ID cards follow the same standard and you can login to governmental websites with the card. The problem is inertia, nothing else.
- kaared 12y ago
  In Norway, the most common type of card is a debit card that can also be used as a Visa or MasterCard credit card. The card has a smart chip on the front, and on the back you have your national id number/date of birth, photo and signature, etc. The card is frequently used as an id card. When you pay using the debit card, you have to insert the part of the card with the chip into a reader and enter your pin. Typically you can not do this until the cash register has transferred the amount to pay to the terminal. You can also use it as a credit card when abroad or even in Norway. However, I'm not sure if the card will actually allow you credit (i.e. borrow money) per se -- I believe the account must have a sufficient positive balance, and I believe the domestic terminals are able to check that in real time (i.e. in a few seconds) and decline the sale if not funded. As for online purchases, every time I use it as a credit card, I get re-routed to a card verification process. This means I get taken to some third party site (typically Visa or MasterCard) where I have to authenticate using my password and generate a one-time password (pin) on my phone. You can also use a FOB, but I find a phone more practical. After the verification is done, you get taken back to the merchant site. This is the same verification process that is used for online banking. After living 15 years in the states I found this to be a bit annoying at first, but that had more to do with the speed of the implementation and the fact that it's applet-based (Java and Chrome -- have to switch browsers and hope that you don't lose your session). If I had to authenticate every time I bought something on Amazon it would get old pretty fast. However, one could simply authenticate once to indicate that this merchant is trusted. A new merchant would trigger the authentication before the transaction can be accepted.
InclinedPlane 12y ago
Chip and pin is already being planned for the US over the next 2 years or so. I'm honestly quite surprised the news hasn't gotten more attention.

GabrielF00 12y ago

I was at a home depot on September 1st and my credit card was declined for security reasons. I just moved to a different state, but I had no problem using the card at other stores that same day, including to make a larger purchase at the same mall as the home depot.

willvarfar 12y ago
So you may have been lucky and avoided your card getting breached, if that's the only time you went to home depot that is.
- ceejayoz 12y ago
  To get a decline the POS would have had to take the card number, so probably not.

nodesocket 12y ago

How is http://rescator.cc/ http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps, and proactively blacklisted cards before the issuing banks notice and decline.

jacquesm 12y ago
> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).
- deleted 12y ago
  [deleted]
- diafygi 12y ago
  > If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: http://geer.tinho.net/geer.blackhat.6viii14.txt http://geer.tinho.net/geer.blackhat.6viii14.txt Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s

awjr 12y ago

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

nodata 12y ago
Lack of chip and pin, or use of magnetic stripes instead of ICs?
jvm 12y ago
Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml http://www.forbes.com/fdc/welcome_mjx.shtml
- dghughes 12y ago
  http://m.youtube.com/watch?v=B80SyRmtbdI http://m.youtube.com/watch?v=B80SyRmtbdI
- celticninja 12y ago
  cool, so only about 5 years after it was widespread/standard in Europe
- js2 12y ago
  My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-usa-emv-cards-available-today-chip-pin-chip-signature.html http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRvcE1ELVg5UmlGZk01SHZvTUMxdUE https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I was looking into the CC issues, and as a US traveler not being able to get an EMV card with pin priority is annoying. Edit 2: jvm, not sure what you meant to link to, but that link just goes to the Forbes splash advert.

TallGuyShort 12y ago

99% correlation sounds high, but I wonder what the correlation is with other stores, and with what statistical confidence you can actually conclude that Home Depot was the victim here...

dfc 12y ago
It was a 99.4% overlap in zip codes listed for sale and zip codes listed as having a HD storefront. I think you might want to reread that section.
- TallGuyShort 12y ago
  Yes but what's the correlation like for other common stores? I've lived in a lot of different towns in the US and every single on of them has had a Home Depot in town. They've also all had a Target. I'd be curious to know what that correlation looked like.
  - deleted 12y ago
    [deleted]
driverdan 12y ago
Exactly, correlation is not causation. I bet they have an even higher correlation with Walmart.

kazinator 12y ago

You should be able to easily dispute charges at a "big box store" that were not chip-and-pin transactions, and that did not use the three-digit security extension to the number. I've had a chip card for, what, some seven or eight years in Canada. Here is a July 2007 story about how RBC (Royal Bank of Canada) logged 10 million chip transactions: http://www.newswire.ca/en/story/14243/rbc-marks-10-million-world-wide-chip-card-transactions-with-rbc-platinum-avion-visa-card http://www.newswire.ca/en/story/14243/rbc-marks-10-million-w... "RBC today announced it recently surpassed over 10 million successful chip transactions at compatible merchant locations in Canada and worldwide. This milestone comes four years after RBC became the first Canadian financial institution to begin issuing chip cards nationally to its Platinum Avion Visa cardholders in 2003."

bluedino 12y ago

Aren't debit cards part of the problem? I only use my credit card and then just pay that as I go. Much easier to dispute charges on a credit card. Also, if the card is stolen and my bank account is emptied, with a credit card all that would happen is that my credit limit on one of my cards is temporarily reduced.

crpatino 12y ago
The card attached to my main account (where my employer sends my salary) is private. My main credit card is from the same bank and I pay it directly from there. Credit card gets used at places that I trust. Dispute charges can be a time consuming process, and you have to pay some token amount to avoid punitive rates anyways. I have another account in a different bank, were I send small electronic deposits periodically. I retire about 1/2 of that in cash at ATM, to pay either at places that do not accept cards or I do not trust (i.e. gas stations). I have to keep a small balance in the account, and it is not always practical to use cash, so I use the corresponding debit card at places I neither trust or distrust.