ATM card fraud, an answer?

enfield

Perhaps this has been suggested before but here it is anyway. ATM cards are only useable if the skimmer has the pin number, and the only way he can get it is if catches you using the card and copies it in some way. Now then if each card had two pin numbers and they can only be used in succession, i.e, use the first one first and the first one cannot be used again until the second one has been used and then it reverts to the first one again. This would mean that anyone who copied your pin number would not be able to use it unless they had the both numberd, if you get my meaning.
I know some people had a big problem remembering these numbers but with a bit of effort this could make it very very difficult for the skimmers.
I this a case of the bleeding obvious or am I missing something?
Kind regards.
Tom.

GerardKeating

enfield wrote: »

Perhaps this has been suggested before but here it is anyway. ATM cards are only useable if the skimmer has the pin number, and the only way he can get it is if catches you using the card and copies it in some way. Now then if each card had two pin numbers and they can only be used in succession, i.e, use the first one first and the first one cannot be used again until the second one has been used and then it reverts to the first one again. This would mean that anyone who copied your pin number would not be able to use it unless they had the both numberd, if you get my meaning.
I know some people had a big problem remembering these numbers but with a bit of effort this could make it very very difficult for the skimmers.
I this a case of the bleeding obvious or am I missing something?
Kind regards.
Tom.

Grand, if you can remember which number one use last, but if you cannot....

Plus, if the card holder has used the card later in the day, the skimmer can use the first pin.

finnteme

howabout a touchscreen keypad, where numbers are not in normal order, and changes for each customer.

This way if someone is watching/recording the pin, they are not able to determine the pin code, since the numbers are in different order each time.

kippy

finnteme wrote: »

howabout a touchscreen keypad, where numbers are not in normal order, and changes for each customer.

This way if someone is watching/recording the pin, they are not able to determine the pin code, since the numbers are in different order each time.

How about using one of those covers over the keypad?
Doesnt that work?

scotty_irish

finnteme wrote: »

howabout a touchscreen keypad, where numbers are not in normal order, and changes for each customer.

This way if someone is watching/recording the pin, they are not able to determine the pin code, since the numbers are in different order each time.

all these smart ideas which would work in a perfect world but guess what, people are dumb. gotta cater for the lowest common denominator.

Solair

Get rid of magnetic stripe cards entirely.

All ATM fraud is conducted by skimming the, no longer used, magnetic stripe on the back of the card and capturing the PIN number. These two bit of data are then used to clone the magnetic stripe aspect of the card and it is then used in a location where chip and pin is not used.

What we need to look at is ditching magstripe cards entirely. The smart card chip is very extremely difficult to copy and very secure. The magstripe is 1960s technology which can be read and copied with very simple hardware.

All European countries now use Chip and PIN, so does Canada and quite a lot of other nations. Only the United States drags its feet on this technology, and I suspect that it's largely due to a problem they tend to have with anything that is "not made here".

The vast majority of the time, Irish people make ATM transactions in Irish and near-by European / UK ATMS.

Cards which had no magnetic stripe could be issued for European use only.

If you are travelling to a technologically backwards destination in the developing world, or to the United States, then you could get a magstripe card sent to you for that purpose.

It would almost totally eliminate ATM fraud in Ireland, leaving only US tourists or tourists from countries that still use magnetic stripe only cards at risk of skimming.

I don't really see the point of Chip and PIN if we still keep the magstripe on the card.

It's a bit like installing a really complicated alarm system and ultra high tech windows and doors with multi-bolt deadlocking on your house, but then insisting on keeping the old bashed up farm-house half door secured by a tiny bolt on the back of the house because 'ah sure the American tourists would never be able to figure out the alarm codes"

The cost of issuing 2 cards to customers would be massively offset by the savings the banks would make in lack of ATM fraud.

While backwards compatibility is handy, chip and PIN is now fully rolled out and there should really be no need for using magstripe cards domestically or within the EU.

Jagle

so what your saying is that if my magnetic strip is disabled on my card then it cant be skimmed?
so if i cover the back of my card in some thin tape it cant be skimmed?


i presume the card cloners at ATM machines scan the card as it passes by the device, i always presumed it copped the chip

Solair

Jagle wrote: »

so what your saying is that if my magnetic strip is disabled on my card then it cant be skimmed?
so if i cover the back of my card in some thin tape it cant be skimmed?


i presume the card cloners at ATM machines scan the card as it passes by the device, i always presumed it copped the chip

Well, if the magnetic stripe were completely erased on the back of the card, yes it cannot be cloned.

However, while Irish ATM machines do all use chip and pin at this stage, I am not entirely sure if they can accept a card that does not also have a magstripe! So, you could have problems if you were to erase the strip e.g. with a magnet.

The whole thing should be chip and pin only at this stage.

There are still some shop keepers and UK chain stores who will insist on swiping cards through card readers for absolutely no logical reason too.

Magstripe technology simply should be removed entirely there's no logical reason to have it anymore and it's costing banks vast amounts of money to keep paying for ATM fraud and leaving customers at a loss too in many cases.

There really is no excuse for skimming anymore, other than the banks' inability to move forward on technological standards.

Jagle

very interesting, tho i agree with you that mag strip is redundant now that we have a much more secure way.

I work in a service industry and sometimes the machine will tell you the chip is having a problem, and so you can proceed with the transaction by using the mag strip, it is handy as a back up

yungwan

Sorry to take over your thread but you have made a point above I wanted to elaborate on!

I have just noticed today that my Laser Card has been use fraudulently to order food from an online takeaway site. Two transactions were made on Wed within 3 minutes of each other.

The Bank are saying that the Laser was used instore (which I didnt think was possible, I thought the whole point of these sites was to get food ordered to your house) and that magnistrip and pin were used.

Does this mean it is possible that it was skimmed then? And that the chip part of the card wasnt used but the strip? I ask because the Bank said they would have to have my actual card to use it, but I argue it has to have been skimmed as obviously I still have my card.

Its such a pain in the ass. I have cancelled my card but Ill be waiting a while for money. I have to speak to Guards first this evening before anything can be done

MissFlitworth

Does this mean it is possible that it was skimmed then? And that the chip part of the card wasnt used but the strip? I ask because the Bank said they would have to have my actual card to use it, but I argue it has to have been skimmed as obviously I still have my card.

Your card could have been cloned, so all the information on it copied onto a duplicate card & then used in store. I think chip + pin system was supposed to stop this working but so many shops still let you sign for a purchase if your card won't go through

Solair

Fall back to magstripe shouldn't be allowed, end of.

If your card's fault or your card reader in a shop is faulty, it should be replaced.

In general, smart cards are extremely reliable, as long as you don't bend them too much!

Magstripes are actually more likely to go wrong as they wear out with regular use and also erase if exposed to a magnet.

The banks really need to move on this or the fraud will just keep going on and on.

I suppose, the banks' usual attitude is 'sure someone'll bale us out' or they'll attempt to shift liability onto the customer.

Magstripe is obsolete and totally hacked wide open technology.

As for your Laser card being used in the shop.

Either the shop keyed the number (over the phone) and the card was used that way, or someone used a cloned card, which could only be magstripe.

Again, your bank allowed the transaction to go through that way with magstripe + signature, in which case the shop's liable for the fraud as far as I am aware because the overrode the bank's system.

If you're card's physically stolen and the PIN is used with the chip, then you can have a terrible time proving it was the bank's problem and not yours.