5 ms·

What I don't understand about this is... why don't ATMs just put a damn motorized door in front of the card reader slot, or alternatively stick out a tray that

by pwang 12y ago

What I don't understand about this is... why don't ATMs just put a damn motorized door in front of the card reader slot, or alternatively stick out a tray that you put the card in. The door approach makes it so that the thief has very small time window in which to install the skimmer. The tray approach can make it so that a simple internal image of the empty tray can determine if anything is ever left on it which is out of whack. Yes it costs a little bit more, but CD-ROM drives have been doing both of these approaches for ages, and it would make the installation of a skimmer reader much, much harder.

MichaelApproved 12y ago
It costs more but it's also likely to break often and would be a liability. The tray could snap off or a finger could get stuck in it. How annoying would it be if the machine is constantly out of order? A machine that deals with the general public on a scale of tens of millions has to be rock solid. People can behave really strangely (think drunk people) and all kinds of ridiculous outcomes can happen.
terminado 12y ago
In NYC, there seem to be crews that scout out unmanned subway turnstiles, and in the event of a fairly lonely one (I'm looking at you, 116th St. stop on the Bronx-bound B/C), the vending machines (which are built like tanks) somehow inevitably fail to accept bills, coins, credit cards, or any kind of money at all, actually. And guess what; In these situations, if you're caught without a Metrocard, there's usually a helpful street urchin on site, ready to swipe you through the turnstile for a reasonable fee. I'm not saying this is what will happen to a CD-ROM-style tray approach, I'm just trying to add some context to the idea. Machines exposed to enclosed, semi-public areas have to withstand a lot of deliberate, brutal sabotage, that'll make you scratch your head, and ask why on earth? With that in mind, protruding parts and orifices generally don't fare well with machines subjected to the abuses of the general public. I think it'd probably cost more that a little bit extra...
- hellweaver666 12y ago
  I recently had a similar situation at the Gare du Nord station in Paris. We were trying to purchase tickets for the train when this guy comes along and forcefully takes over the machine saying it doesn't take credit cards (which we knew it did because we've used them before). He changed the language back to French and proceeded to buy the cheapest metro ticket available then asked us to give him cash based on the more expensive distance we actually wanted to go. Luckily, we didn't have any cash, he even offered to accept pounds or dollars! Eventually after skulking off we went back to the machine and worked it out. If we had taken his tickets we likely would have been picked up by one of the frequent ticket inspections and given a hefty fine.
xnull2guest 12y ago
Designing a skimmer-proof ATM is much like designing a squirrel-proof birdfeeder. It looks good on paper but you never know what these guys are going to do. Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable.
- ZoFreX 12y ago
  > Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable. It's been done. As has creating an entire fake facade and putting in front of the real ATM.
coreymgilmore 12y ago
Adding any deterrent (more, better, larger, etc.) seems to me like a "chicken or the egg" game. ATMs get stronger security, scammers develop better methods to skim. Skimmers improve, ATMs get better security. It becomes a viscous circle of who can outwit the other for a longer time and prove more successful. Personally, I am more interested in improving security via credit card chips or contactless payment (cards or phones). Chips alone would heavily improve security due to the inherent cost (hopefully) of cracking the chip's data.
- m-app 12y ago
  Don't want to come over as a nitpicker, but the correct term here would probably be a 'cat-and-mouse game'.
  - mikeash 12y ago
    Although "chicken and egg" is an excellent description for the process of getting chips deployed.
  - coreymgilmore 12y ago
    Yup, I agree. Had a brain-fart trying to think of the right term last night.
Sanddancer 12y ago
Too many moving parts that can break, pinch and mutilate. Plus, given previous attempts, it would only block crooks for a fairly small amount of time before they figured out how to counteract it. The best course of action here is to get rid of the sixty year old tech and finish moving to chip and pin, where there is no magstrip to skim.
- zephjc 12y ago
  According to http://www.tomsguide.com/us/chip-and-pin-credit-cards,review-2013.html http://www.tomsguide.com/us/chip-and-pin-credit-cards,review... "U.S. retailers have until Oct. 1, 2015, to install chip-and-PIN compatible card readers at stores. After that date, merchants will be held liable for any fraudulent charges resulting from misuse of magnetic-stripe cards."
  - freeasinfree 12y ago
    Merchants are already de facto liable for fraudulent charges.
jkimmel 12y ago
At least in Orlando, the new Bank of America ATMs have a slot loading mechanism that takes your card in automatically (as in, you gently place the card in the slot and a motorized mechanism pulls it in). I wasn't sure of the reasoning for this initially, but my assumption is that it makes it more difficult to skim. The actual 'swipe' in which the mag strip is read seems to occur inside the machine, so a skimmer would need to be mounted with the machine opened up.
- function_seven 12y ago
  Couldn't the skimmer be mounted externally and read the stripe as the motor pulls it in?
  - deleted 12y ago
    [deleted]
  - murrayh 12y ago
    My understanding is that the motor pulls the card in using random speeds which vary as the card is getting sucked in (start sucking, slow, fast, slow, fast, etc, fully sucked in). The machine knows how to account for the variance, but the skimmer doesn't (in general skimmer's assume a constant swipe speed). You can kind of see it cause the machine does the same thing when spitting out your card. It would be more convenient to spit your card out fast like a transport ticket, but then your card could be skimmed on the way out.
    - ansgri 12y ago
      If variable speed would prevent the reader from working, how do the manual swipe readers work?
      - zenojevski 12y ago
        Cards are usually swiped in a somewhat smooth motion. Even then, it's easy to fail the motion, and you often need to swipe again. The anti-skimmer moves the card very fast in short bursts, so while it may seem just a bit jittery (averaged out), the skimmer will end skipping whole pieces of band or losing sync. Maybe they could use small rubber rollers to detect velocity and sync appropriately, like in a mouse.
jzzskijj 12y ago
Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense. My European credit card still has a magnetic stripe just because I might go to USA. In this side of Atlantic Ocean many stores, bars, gas stations etc. have a card reader in which the card goes only a few centimeters in to read the chip.
- mikeash 12y ago
  They are going to chips now. (But not pin, so it's chip-and-signature. Not quite as secure, but still much better than a magnetic stripe.) I have two credit cards with chips already, and expect all of them to switch within a year as changes to fraud liability rules coming into effect late 2015 essentially force everything to change over.
- deathanatos 12y ago
  > Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense. What about a chip-and-pin card prevents a skimmer from either monitoring or emulating the radio conversation between the card and the terminal (and thus capturing the card number) and another keypad skimmer from capturing the PIN? It seems to me that the problem is that everything required to conduct a transaction is handed to every merchant and/or untrusted machine of the merchant. (Compare to public key cryptography, where I remain in possession of a private key.) What about chip-and-pin changes that situation?
  - sargun 12y ago
    Chip and pin cards use public key cryptography. From my understanding, you would have to provide the PIN code to the device to first unlock it, and then you could verify the authenticity of the card by reading a public key, which identifies the card (and is used in transactions), and providing some nonce for it to sign for offline verification. They also require the pin code to start the process, so you would have to skim that as well. In addition to this, in the online scenario it can interact with the payment provider's servers to provide security. The combination of these methods make rapid stealing of EMV cards difficult. More info here: http://www.emvco.com/download_agreement.aspx?id=653 http://www.emvco.com/download_agreement.aspx?id=653
bobbles 12y ago
Alternatively they could take the approach of some ATMs in Australia and let you authorise the payment from your phone (using the banks app), not requiring the card at all.
jacquesm 12y ago
Because an ATM has to be proof against many things, not just skimmers! For instance, there are jerks who would simply wreck them. In fact, the skimmers could simply wreck them until the non-asshole proof version was brought back and then happily continue to ply their trade. It's like designing a vault, only it has to open up to total strangers who happen to have digital keys, and to complicate manners stuff has to go in as well as out and there is a whole bunch of user interface components strapped onto it. Designing an ATM that satisfies all criteria is very much non-trivial and any 'why don't they 'x'' should be followed by a short period of thinking about what other boundary conditions need to be satisfied.
yoodenvranx 12y ago
In Germany the part where you put in your card is made of green transparent plastic which is illuminated from the inside. Inbaddition if is shaped in a way which makes it really hard to add some skimming mechanism in there.

by pwang 12y ago

MichaelApproved 12y ago

It costs more but it's also likely to break often and would be a liability. The tray could snap off or a finger could get stuck in it. How annoying would it be if the machine is constantly out of order? A machine that deals with the general public on a scale of tens of millions has to be rock solid. People can behave really strangely (think drunk people) and all kinds of ridiculous outcomes can happen.

terminado 12y ago

In NYC, there seem to be crews that scout out unmanned subway turnstiles, and in the event of a fairly lonely one (I'm looking at you, 116th St. stop on the Bronx-bound B/C), the vending machines (which are built like tanks) somehow inevitably fail to accept bills, coins, credit cards, or any kind of money at all, actually. And guess what; In these situations, if you're caught without a Metrocard, there's usually a helpful street urchin on site, ready to swipe you through the turnstile for a reasonable fee. I'm not saying this is what will happen to a CD-ROM-style tray approach, I'm just trying to add some context to the idea. Machines exposed to enclosed, semi-public areas have to withstand a lot of deliberate, brutal sabotage, that'll make you scratch your head, and ask why on earth? With that in mind, protruding parts and orifices generally don't fare well with machines subjected to the abuses of the general public. I think it'd probably cost more that a little bit extra...

hellweaver666 12y ago
I recently had a similar situation at the Gare du Nord station in Paris. We were trying to purchase tickets for the train when this guy comes along and forcefully takes over the machine saying it doesn't take credit cards (which we knew it did because we've used them before). He changed the language back to French and proceeded to buy the cheapest metro ticket available then asked us to give him cash based on the more expensive distance we actually wanted to go. Luckily, we didn't have any cash, he even offered to accept pounds or dollars! Eventually after skulking off we went back to the machine and worked it out. If we had taken his tickets we likely would have been picked up by one of the frequent ticket inspections and given a hefty fine.

xnull2guest 12y ago

Designing a skimmer-proof ATM is much like designing a squirrel-proof birdfeeder. It looks good on paper but you never know what these guys are going to do. Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable.

ZoFreX 12y ago
> Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a technician' and place it somewhere reasonable. It's been done. As has creating an entire fake facade and putting in front of the real ATM.

coreymgilmore 12y ago

Adding any deterrent (more, better, larger, etc.) seems to me like a "chicken or the egg" game. ATMs get stronger security, scammers develop better methods to skim. Skimmers improve, ATMs get better security. It becomes a viscous circle of who can outwit the other for a longer time and prove more successful. Personally, I am more interested in improving security via credit card chips or contactless payment (cards or phones). Chips alone would heavily improve security due to the inherent cost (hopefully) of cracking the chip's data.

m-app 12y ago
Don't want to come over as a nitpicker, but the correct term here would probably be a 'cat-and-mouse game'.
- mikeash 12y ago
  Although "chicken and egg" is an excellent description for the process of getting chips deployed.
- coreymgilmore 12y ago
  Yup, I agree. Had a brain-fart trying to think of the right term last night.

Sanddancer 12y ago

Too many moving parts that can break, pinch and mutilate. Plus, given previous attempts, it would only block crooks for a fairly small amount of time before they figured out how to counteract it. The best course of action here is to get rid of the sixty year old tech and finish moving to chip and pin, where there is no magstrip to skim.

zephjc 12y ago
According to http://www.tomsguide.com/us/chip-and-pin-credit-cards,review-2013.html http://www.tomsguide.com/us/chip-and-pin-credit-cards,review... "U.S. retailers have until Oct. 1, 2015, to install chip-and-PIN compatible card readers at stores. After that date, merchants will be held liable for any fraudulent charges resulting from misuse of magnetic-stripe cards."
- freeasinfree 12y ago
  Merchants are already de facto liable for fraudulent charges.

jkimmel 12y ago

At least in Orlando, the new Bank of America ATMs have a slot loading mechanism that takes your card in automatically (as in, you gently place the card in the slot and a motorized mechanism pulls it in). I wasn't sure of the reasoning for this initially, but my assumption is that it makes it more difficult to skim. The actual 'swipe' in which the mag strip is read seems to occur inside the machine, so a skimmer would need to be mounted with the machine opened up.

function_seven 12y ago
Couldn't the skimmer be mounted externally and read the stripe as the motor pulls it in?
- deleted 12y ago
  [deleted]
- murrayh 12y ago
  My understanding is that the motor pulls the card in using random speeds which vary as the card is getting sucked in (start sucking, slow, fast, slow, fast, etc, fully sucked in). The machine knows how to account for the variance, but the skimmer doesn't (in general skimmer's assume a constant swipe speed). You can kind of see it cause the machine does the same thing when spitting out your card. It would be more convenient to spit your card out fast like a transport ticket, but then your card could be skimmed on the way out.
  - ansgri 12y ago
    If variable speed would prevent the reader from working, how do the manual swipe readers work?
    - zenojevski 12y ago
      Cards are usually swiped in a somewhat smooth motion. Even then, it's easy to fail the motion, and you often need to swipe again. The anti-skimmer moves the card very fast in short bursts, so while it may seem just a bit jittery (averaged out), the skimmer will end skipping whole pieces of band or losing sync. Maybe they could use small rubber rollers to detect velocity and sync appropriately, like in a mouse.

jzzskijj 12y ago

Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense. My European credit card still has a magnetic stripe just because I might go to USA. In this side of Atlantic Ocean many stores, bars, gas stations etc. have a card reader in which the card goes only a few centimeters in to read the chip.

mikeash 12y ago
They are going to chips now. (But not pin, so it's chip-and-signature. Not quite as secure, but still much better than a magnetic stripe.) I have two credit cards with chips already, and expect all of them to switch within a year as changes to fraud liability rules coming into effect late 2015 essentially force everything to change over.
deathanatos 12y ago
> Better yet, if only the USA banks would finally get to this millennium and start using chip-and-pin cards. Then there would be no need for this nonsense. What about a chip-and-pin card prevents a skimmer from either monitoring or emulating the radio conversation between the card and the terminal (and thus capturing the card number) and another keypad skimmer from capturing the PIN? It seems to me that the problem is that everything required to conduct a transaction is handed to every merchant and/or untrusted machine of the merchant. (Compare to public key cryptography, where I remain in possession of a private key.) What about chip-and-pin changes that situation?
- sargun 12y ago
  Chip and pin cards use public key cryptography. From my understanding, you would have to provide the PIN code to the device to first unlock it, and then you could verify the authenticity of the card by reading a public key, which identifies the card (and is used in transactions), and providing some nonce for it to sign for offline verification. They also require the pin code to start the process, so you would have to skim that as well. In addition to this, in the online scenario it can interact with the payment provider's servers to provide security. The combination of these methods make rapid stealing of EMV cards difficult. More info here: http://www.emvco.com/download_agreement.aspx?id=653 http://www.emvco.com/download_agreement.aspx?id=653

bobbles 12y ago

Alternatively they could take the approach of some ATMs in Australia and let you authorise the payment from your phone (using the banks app), not requiring the card at all.

jacquesm 12y ago

Because an ATM has to be proof against many things, not just skimmers! For instance, there are jerks who would simply wreck them. In fact, the skimmers could simply wreck them until the non-asshole proof version was brought back and then happily continue to ply their trade. It's like designing a vault, only it has to open up to total strangers who happen to have digital keys, and to complicate manners stuff has to go in as well as out and there is a whole bunch of user interface components strapped onto it. Designing an ATM that satisfies all criteria is very much non-trivial and any 'why don't they 'x'' should be followed by a short period of thinking about what other boundary conditions need to be satisfied.

yoodenvranx 12y ago

In Germany the part where you put in your card is made of green transparent plastic which is illuminated from the inside. Inbaddition if is shaped in a way which makes it really hard to add some skimming mechanism in there.