Comments on: Skimmers Siphoning Card Data at the Pump http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/ In-depth security news and investigation Wed, 23 May 2012 21:31:36 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Jim Mathews http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-10396 Jim Mathews Mon, 20 Sep 2010 15:14:53 +0000 http://krebsonsecurity.com/?p=4068#comment-10396 As a compliance offficer for a bank i can tell you that Federal law is what is being discussed. Even credit unions have to abide by this law. However, Colorado has a separate regulation for state chartered banks. Consumers do not have to abide by the 60 day period. They can protest at any time in the future and the Bank must refund funds once they determine the transaction is not legitimate. Keep in mind that this whole law is for consumer protection. Businesses are not afforded the same protection and can be help completely liable for these transactions. As a compliance offficer for a bank i can tell you that Federal law is what is being discussed. Even credit unions have to abide by this law. However, Colorado has a separate regulation for state chartered banks. Consumers do not have to abide by the 60 day period. They can protest at any time in the future and the Bank must refund funds once they determine the transaction is not legitimate.
Keep in mind that this whole law is for consumer protection. Businesses are not afforded the same protection and can be help completely liable for these transactions.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: JTW http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-8397 JTW Sat, 21 Aug 2010 11:21:33 +0000 http://krebsonsecurity.com/?p=4068#comment-8397 These devices are likely installed inside the pumps during regular maintenance if not at the factory. This has been a problem with card readers in European stores for some time, which now come out of the factories in China complete with skimmers and transmission units built in and preprogrammed to contact specific phone numbers. The Bluetooth is a new one for me, and an interesting development. These devices are likely installed inside the pumps during regular maintenance if not at the factory.
This has been a problem with card readers in European stores for some time, which now come out of the factories in China complete with skimmers and transmission units built in and preprogrammed to contact specific phone numbers.

The Bluetooth is a new one for me, and an interesting development.

Like or Dislike: Thumb up 2 Thumb down 1
]]> By: Brad http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-8084 Brad Sun, 08 Aug 2010 21:19:32 +0000 http://krebsonsecurity.com/?p=4068#comment-8084 That would draw down on the PCI compliance aspect. Tricky subject there. Actually banks take almost 100% of the losses. We certainly do try to pass it on in terms of additional fees although it has been really subtracted from the interchange we receive from the merchants. This new interchange bill congress passed is going to be a real game changer for all consumer accounts. Consider that the interchange could drop 30-50% for bank's income. This will not lower fees for consumers at the merchant level. But it will force banks to make up that lost income somewhere else. Banks have a virtually unlimited liability for debit card losses - it is a very risky product - and when you drop that fee income without dropping the liability - that is a dangerous situation.

That would draw down on the PCI compliance aspect. Tricky subject there. Actually banks take almost 100% of the losses. We certainly do try to pass it on in terms of additional fees although it has been really subtracted from the interchange we receive from the merchants.

This new interchange bill congress passed is going to be a real game changer for all consumer accounts. Consider that the interchange could drop 30-50% for bank’s income. This will not lower fees for consumers at the merchant level. But it will force banks to make up that lost income somewhere else. Banks have a virtually unlimited liability for debit card losses – it is a very risky product – and when you drop that fee income without dropping the liability – that is a dangerous situation.

Well-loved. Like or Dislike: Thumb up 4 Thumb down 0
]]> By: Brad http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-8083 Brad Sun, 08 Aug 2010 21:14:58 +0000 http://krebsonsecurity.com/?p=4068#comment-8083 Actually - Verified by Visa is a horrible tool. It simply extends passwords, and if banks were to implement 100% of the functionality of the product with every consumer - the consumers would be a very unhappy lot. And the merchant does not have any responsibility. They simply present the box to the consumer. I have never seen a merchant require 100% participation in the product - essentially forcing the consumer to use it - they would lose to many sales and Visa allows the consumer/crook to skip past it and complete the sale.

Actually – Verified by Visa is a horrible tool.
It simply extends passwords, and if banks were to implement 100% of the functionality of the product with every consumer – the consumers would be a very unhappy lot.

And the merchant does not have any responsibility. They simply present the box to the consumer. I have never seen a merchant require 100% participation in the product – essentially forcing the consumer to use it – they would lose to many sales and Visa allows the consumer/crook to skip past it and complete the sale.

Well-loved. Like or Dislike: Thumb up 4 Thumb down 0
]]> By: Brad http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-8082 Brad Sun, 08 Aug 2010 21:10:39 +0000 http://krebsonsecurity.com/?p=4068#comment-8082 Sorry - Your thoughts on keeping your credit card separate from your debit/checking account -does not hold any merit. They are not attached to each other and are not related in the bank except by name. Sorry –
Your thoughts on keeping your credit card separate from your debit/checking account -does not hold any merit. They are not attached to each other and are not related in the bank except by name.

Like or Dislike: Thumb up 2 Thumb down 0
]]> By: Beeker http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-7778 Beeker Wed, 28 Jul 2010 17:07:46 +0000 http://krebsonsecurity.com/?p=4068#comment-7778 Actually "Verify by Visa" is just another tool to prevent unauthorized charge when you purchase things online which forced you to input the ID and the password. I have run across that on a few occasion and used it. It is within the responsibility of the merchant to implement that if they choose to do so. Just a another layer of security. Actually “Verify by Visa” is just another tool to prevent unauthorized charge when you purchase things online which forced you to input the ID and the password. I have run across that on a few occasion and used it. It is within the responsibility of the merchant to implement that if they choose to do so. Just a another layer of security.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Tim http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-7735 Tim Tue, 27 Jul 2010 11:52:39 +0000 http://krebsonsecurity.com/?p=4068#comment-7735 I would further that to say there are MANY places that still allow pumping before paying. Here in Ontario (Canada), that's the norm. I can't remember the last time I paid before I pumped, but then, I always use my card at the pump for the electronic record and instant receipt. I can't imagine paying in cash first for filling a small tank like a motorcycle. What do you choose? $10 or $15? The difference could mean not making it to the next gas station. I would further that to say there are MANY places that still allow pumping before paying. Here in Ontario (Canada), that’s the norm. I can’t remember the last time I paid before I pumped, but then, I always use my card at the pump for the electronic record and instant receipt. I can’t imagine paying in cash first for filling a small tank like a motorcycle. What do you choose? $10 or $15? The difference could mean not making it to the next gas station.

Like or Dislike: Thumb up 2 Thumb down 0
]]> By: greg http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-7679 greg Thu, 22 Jul 2010 14:56:22 +0000 http://krebsonsecurity.com/?p=4068#comment-7679 I'm wondering, once a POS is confirmed it had been skimmed, are there any financial consequences for the business who operate the POS terminal (like being sued by creditcard companies/banks who attempt to recover some of the monies from that business via a lawsuit for negligence, etc.) If banks support (most of) the loss, surelly they will pass it (via higher fees and commissions) on us, their customers. I’m wondering, once a POS is confirmed it had been skimmed, are there any financial consequences for the business who operate the POS terminal (like being sued by creditcard companies/banks who attempt to recover some of the monies from that business via a lawsuit for negligence, etc.) If banks support (most of) the loss, surelly they will pass it (via higher fees and commissions) on us, their customers.

Like or Dislike: Thumb up 1 Thumb down 0
]]> By: Jane http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-7678 Jane Thu, 22 Jul 2010 14:18:02 +0000 http://krebsonsecurity.com/?p=4068#comment-7678 It also doesn't work as advertised. We made a purchase last week online, and NoScript blocked the "Verified by Visa" part from running. Product arrived yesterday. Not sure if that's an implementation issue or a sign that the whole thing's just for show.

It also doesn’t work as advertised. We made a purchase last week online, and NoScript blocked the “Verified by Visa” part from running. Product arrived yesterday. Not sure if that’s an implementation issue or a sign that the whole thing’s just for show.

Well-loved. Like or Dislike: Thumb up 4 Thumb down 0
]]> By: Matt from CT http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/comment-page-1/#comment-7675 Matt from CT Thu, 22 Jul 2010 03:02:46 +0000 http://krebsonsecurity.com/?p=4068#comment-7675 Not all gas stations are attended to accept cash, either. Especially in rural areas, where the state laws allow it, they'll be unstaffed during the wee hours of the morning but still allow pumping fuel to support (especially) commercial and farm users. This became more common both as the technology for card reading improved, and environmental regulations made having your own fuels tanks more expensive and greater liability.

Not all gas stations are attended to accept cash, either.

Especially in rural areas, where the state laws allow it, they’ll be unstaffed during the wee hours of the morning but still allow pumping fuel to support (especially) commercial and farm users.

This became more common both as the technology for card reading improved, and environmental regulations made having your own fuels tanks more expensive and greater liability.

Well-loved. Like or Dislike: Thumb up 7 Thumb down 0
]]>