A Burger, an Order of Fries, and Your Credit Card Number

http://www.slate.com/articles/technology/technology/2012/03/verizon_s_data_breach_investigations_report_reveals_that_restaurants_are_the_easiest_target_for_hackers_.html

by ojbyrne • 14 years ago

32 17 14 years ago

slate.com

onemoreact• 14 years ago

Having someone steal a Credit Card number is vary safe at worst your out 50$ and need to wait a few days to get another one in the mail. It's checks I worry about, you can easily drain a bank account with the 2 numbers on the bottom of them and you don't get your money back when that happens.

Zikes• 14 years ago

Debit cards are particularly dangerous, as they are as vulnerable as credit cards but do not offer the same protections.

corin_2• 14 years ago

Depends what country you're in and who you bank with. If I lose my debit card I'm not responsible for anything spent with it afterwards.

rbehrends• 14 years ago

This depends on your country. For example, in the UK, the Payment Services Regulation 2009 makes no difference between credit and debit cards with respect to a payer's liability. In either case, your liability is limited to 50 pounds (unless you acted grossly negligent, intentionally, or fraudulently), regardless of the type of card used.

This is largely a consequence of article 60 and 61 of EU directive 2007/64/EC [1] (some countries have been lagging behind in implementing the directive, though, so don't expect it to be the law everywhere in Europe).

[1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...

devmach• 14 years ago

It depends :

I lost my card and someone found it, went to biggest/main branch of the bank in nuremberg and draw 100€ from cash desk ( this all happened in 3 hours and yes, bank personal doesnt asked/checked identity ). When i found out i lost my card, i called the service line and blocked my card ( though confirmation, my card wasn't blocked ).

After two week rush and paperwork i get my money back ( i know i lost my time but it was never about money ).

There is always some chance to get your money back but the real problem is you're loosing your liquid that's why debit cards has daily/weekly limits.

huhtenberg• 14 years ago

That's theoretically.

Practically though you first have to dispute fraudulent transactions and file chargebacks. For the most part it's easy, but for certain online transactions the bank will tell you to go and talk to the merchant directly. I had my credit card used to subscribe to the adult dating site. When I called the bank (Royal Bank of Canada, a very large, if not largest bank in Canada), they simply transferred my call to that company and I had to prove them that it wasn't me who subscribed with my credit card. They kept asking for my email address and the phone number "to compare to those on file", and the only thing that helped was actually yelling and swearing at them.

YMMV, but $50 in damages is only a part of the package.

excuse-me• 14 years ago

Unless the person stealing the credit card uses it to access a child porn site and you are in the UK.

Then you are on a child abuse register - your life is over. There is no trial because the data just goes straight to a police database and since computers are never wrong how can the police be wrong?

Of course you could try suing the police and insisting on a trial to prove your innocence ;-) If you knew you were on the secret registry, but you would only discover this when you apply to coach your kid's school soccer team and find a SWAT unit turn up at your house.

http://en.wikipedia.org/wiki/Operation_Ore

Nick_C• 14 years ago

> It's checks I worry about,

I've heard this repeated so many times it is almost becoming an internet meme. I suspect because most younger people have never seen a cheque, they think it is somehow "risky" to show the account number and BSB number.

It's not true. All cheques have them printed on them and have done for decades. The payments clearing system worked fine for all that time, and it still does.

ayuvar• 14 years ago

We had a rash of credit/debit card skimming locally as a result of crooks coming into stores in the mall and replacing the store's point-of-sale card reader terminal with one of their own which was rigged to skim before passing on the information to the register, according to the local news.

Normally, I'd distrust the news when it comes to anything vaguely technical but it got me wondering if the POS terminal does anything to guarantee that its credit card reader is still "authentic" (hopefully, it at least used some kind of good faith challenge-response mechanism, even if it could be easily spoofed by a potential attacker).

Physically swapping them out - both to put the rigged reader in, and to remove it once it's "full" - also seems pretty risky. It was probably something like this story instead where the register itself was targeted remotely.

simcop23872• 14 years ago

From what I know about them when helping install them in a new retail store where i was working a few years ago, there's quite a few of them that act like nothing more than a keyboard. the fancier ones with a display still hook up over usb and i don't think they use a challenge response (I honestly don't know there, i don't know the software for them). Even once I got them in if i was skimming I wouldn't even bother removing them ever. Instead I'd use something like the little XBee modules or some other wireless device to read them and just walk in and act like a regular shopper leaving the retrieval thing in my pocket the whole time.

bradleyland• 14 years ago

Having done my time in the independent computer repair trenches with more than one restaurant as a customer, I can tell you that while secure, sophisticated card scanning equipment exists, much of the stuff used at mom & pop stores is rudimentary at best. Basic USB card swipers can be swapped out with zero change required in the software.

None of this really matters though. What are the consequences of having your card skimmed?

For the card holder, it's a mere inconvenience. The banks don't hold you accountable for the breech, because they know you'd never do business with them again.

For the bank, it's only a small loss. They chargeback the transactions amounts to the vendor that took the card.

The "victim" in this scenario is the merchant who accepted the stolen card.

The risk associated with stolen credit card data is diffused this way. Merchants who don't want to assume the risk of accepting stolen credit cards can opt-in to far more stringent CC security practices like CVV2 codes and AVS (address verification). If you've ever had your CC number stolen, you know that the purchases are made overseas, or with shady merchants that don't opt-in for better security.

rokhayakebe• 14 years ago

Honest question: if a hacker is talented enough to create software to steal thousands of dollars, are they not talented enough to make multiples more legally?

blahedo• 14 years ago

Possibly not if they're in a country with a weaker economy, lower cost (and/or standard) of living, and no way to get a work visa someplace else?

brudgers• 14 years ago

Related All about Skimmers from Krebs on security:

http://krebsonsecurity.com/all-about-skimmers/

A Burger, an Order of Fries, and Your Credit Card Number

Related Stories