Slashdot Mirror
Fake ATM Fraud Expose
santos_douglas writes "Forget ATMs coming under attack by worms, MSNBC has this article about Dateline NBC's investigative report into fake ATMs and other ATM related scams. ATM frauds are a clever combination of social engineering and hardware hacking. The most sophisticated thefts involve the purchase and setup of real ATMs that actually do dispense cash to avoid suspicion, but are altered to save both the card's magnetic signature and the customers PIN, which are later added to false cards and used to empty bank accounts at real ATMS. The 'ATM gang' profiled managed to purchase and setup 50+ machines and steal over $4 million from over 21,000 customers. The machines can be purchased legitimately and hooked into the banking network with no more than a regular bank account. Less sophisticated attacks include building and attaching false fronts to existing ATMs to collect info, and using covert cameras to collect PINs from afar. The articles has some handy tips for avoiding scams."
Use banks you trust and use ATMs [or ABMs as they are called in Canada] at banks you know and trust . I'd never use a whitelabel ABM since not only do you get a surcharge but it's very easy for it to be a fake.
This isn't foolproof but much safer than using random whitelabels you find in Apu's Mealbar.
Tom
Someday, I'll have a real sig.
If they integrated some other forms of identification that couldn't be forged, such as biometrics or retinal scans, perhaps I'd be a bit less worried. But as things stand now credit cards are a better way to go if you're worried about recovering losses from fraud.
Perhaps I should just go to the barter system. "I'll give you this cow for that rack mounted server."
*
troll blacklist. Please mo
As fraud has increased, I've resorted to using only ATMs at the various branches of the bank I'm with, and I've switched (back) to using credit cards instead of debit cards for point-of-service purchases, so that if I get defrauded, I end up with a huge CC bill (relatively) instead of an empty bank account.
The Doormat
If you're not outraged, then you're not paying attention.
- Your bank publishes the charges for using an ATM outside their network, and
- an ATM you use will tell you the fee for using that ATM
I don't know why people are so pissed off about ATM fees. What, do you think the ATM fairy just drops them off all over the place for free? The machine costs money. The network costs money. Service costs money. TANSTAAFL. If you don't want to pay the fees, don't use an ATM. Like you said, there are plenty of other methods.We don't have a state-run media we have a media-run state.
The problem arises when people have created false Interac machines, or scam your bank cards information from it. I use Interac probably 3-4 times a day, and each time, do my best to ensue I can see the interac terminal, which my card is being scanned through, to allow my self a *little* piece of mind.
0110100100100000011000010110110100100000011000100
I would prefer to use an electronic key that when interfaced with an ATM will happily raise any given number to my secret exponent modulo my public key.
For each transaction, my bank will send a random challenge to the ATM that only my electronic key can solve.
But, when you lose your wallet, you are likely to report the card as missing/stolen a lot quicker. With magnetic stripe theft, most people won't notice money missing until their next statement.
You cant copy a chipcard like you can a simple magnetic strip ... but as long as the interface is not on your own hardware, the card, they can still hijack the session and rip you off.
They need to start using cards with their own crypto yes, but they also need to put a LCD on the card so you can see the amount you are transferring (with some basic safeguards to ensure that the amount shown has to have been shown for X seconds before you can confirm, so they cant just flash a new amount on there just as you press the button).
Clearly what's necessary is to have a small keypad on the card itself, as well as a small CPU, a private key that is encrypted by the user's PIN, and the public key of the bank. That way, all communication between the card and the bank can be encrypted, and no unencrypted information is ever sent through the ATM.
Such a card would not be much larger than current ATM cards.
The worst fraud that could then be perpetrated is to have a fake ATM that deducts $20 from your account but without dispensing the $20. But that scheme would be very quickly identified.
I don't know why people are so pissed off about ATM fees. What, do you think the ATM fairy just drops them off all over the place for free?
No, I think the HR fairy drops them off all over the place. She says "Here you go! Tons cheaper than a real person. Enjoy!" and wanders off to do another good deed.
High-speed Road Trip (18.000KPH)
Here in New Zealand we have major bank monopoly which results in 4 banks owning the market, with very excessive charges. But as a result ATM fraud is virtualy non-existant.
:)
Sounds like the bank monopoly is ripping you off, though. Technically I suppose it's not fraud, but you're still getting scammed, right. It's just a scam that the law smiles upon
As long as credit cards exist, I'm not going to complain about the insecurity of ATM's.
RogerWilco the Adventurous Janitor
I think that if they're set up to record the data on the magnetic stripe as well as your PIN, they can just reproduce your card -- there's no need to physically steal it. Reassuring, eh?
ATM machines are certainly not free, but they are a damned sight less expensive than the human-operated branches that banks used to provide for their customers (at no charge). In fact, cost-cutting is one of the reasons banks have consistently offered when replacing branches with ATMs. What any consumer with a brain should notice is that over the past decade or two, banks have continuously reduced their operating costs thanks to ATMs, and yet the amount of money customers tend to shell out for banking services has not decreased-- it has consistently risen. ATM fees are a big part of that.
The existence of ATM fees is due to the lack of reciprocal agreements among different banks. If bank A has thousands of machines, and wishes to provide better service for its customers, it stands to reason that it would try to enter into an agreement with another large bank B, in order to guarantee that neither banks' customers have to pay fees at ATMs belonging to either bank.
Unfortunately, experience has indicated that banks don't feel any desire to do this. In the real world, it is far more profitable for large banks to collude against their own customers through inaction-- by not creating reciprocal agreements, and collecting vast amounts of additional money through fees. This pads their bottom lines, and hey, what are customers going to do about it? There are only a few banks large enough to make such collaboration practical, and they don't seem too concerned about how much customers are paying (fees continue to rise, way ahead of inflation, despite the fact that the tech is getting cheaper.)
A similar situation exists in the world of wireless communications, where international phone companies ruthlessly assess other companies' customers absurd international roaming fees, even when the caller is only a few hundred miles from his home country. The income these corporations derive from fleecing their customers is far greater than what they would make if they chose to collaborate; since only a few companies are large enough to make this sort of agreement, and those companies make too much money off of the current arrangement, customers have nowhere to go.
The point is there are many examples of business providing services for "free", usually because they think they'll get more customers as an indirect consequence, or they fear getting a bad reputation and losing customers if they don't provide a service that their competitors provide. Of course businesses must recover their costs, but a per-use fee is not the best or only way to do so.
So just because someone suggests that ATM fees piss them off, this doesn't mean they're oblivious to the fact that ATMs cost money to buy and operate. Instead, they're suggesting that they'd like it better if businesses recovered their costs in some other way -- for example -- the same way that they recover the costs of using credit cards.
This thread started with credit cards, and guess what -- it's not free for a business to accept credit cards either. They have to pay the credit card company every time someone makes a purchase. So when credit cards first came out, businesses would tack on a 5% fee if you wanted to pay with a card. Someone like you might have made a comment like yours defending this "credit-card-use" fee. "Nobody puts a gun to your head and makes you pay with a credit card. The credit card network and database cost money." Yada yada..
But people did complain -- and today those fees are largely gone. If you go to a convenience store, the prices listed on the shelves are the same prices you pay whether you use cash or credit. Of course, this just means that stores have absorbed the costs of dealing with the credit-card companies into their prices, so today someone paying cash is paying "more than they should" to subsidize customers who pay with credit cards. Do you think this was a good change? Do you approve of this?
Whether or not you do, there's no reason this can't or won't happen to ATMs. A convenience store owner might buy and install an ATM that charges no fee, just because he's expects customers who come in to use the ATM might buy something on the way out -- or because all the other convenience stores around already have free ATMs and his store would get a bad reputation if he didn't have one too. In a world like this, the convenience store owner would just have to raise all his prices a little to compensate.
If you approve of ATM fees, would you like to see credit-card-use fees come back too? How about fees for using the convenience-store bathroom? Is there such a thing as being "nickle-and-dimed" to death? Personally I like that credit-card fees have gone away, and I would like ATM fees to go too, even if prices rose overall a little to compensate.
Just my opinion...
Hmm.. The problem is that ATM cards can be so easily forged.
Banks should switch to contactless cards with a tiny processor and display that (a) stays in control of the user at all times, and (b) allows the user to authorise *individual* cash/ATM transactions. It would be akin to a small palm-pilot with public-key cryotography and an IRDA link, but credit card sized, so it fit in your wallet... or is built into your wallet. The only way this could be defeated is by breaking the crypto, or by capturing the device itself and obtaining it's password.
Without an interface on a device in your control, even smart-cards can be defeated by the "false-front" ATMs mentioned in this article (you withdraw $20, the "false-front" ATM actually withdraws $1000, dispenses $20, and pockets the $980 difference).
> It takes less than a dollar worth of materials and a matter of
....... bing! thief takes sample from ATM cards' surface.
> seconds to capture a fingerprint off of... pretty much anything.
Yes! And I care to add for the sake of completeness, because this is
just too often (deliberately?) ignored:
1. fingerprint-protected ATM card gets stolen
2. thief needs sample of owners' fingerprint to produce copy
3. ??????????
4. profit! (well, or go to jail immediately)