Slashdot Mirror
Huge Credit Fraud Ring Sends Europeans' Data To Pakistan
marshotel excerpts from a story at the Wall Street Journal: "European law-enforcement officials uncovered a highly sophisticated credit-card fraud ring that funnels account data to Pakistan from hundreds of grocery-store card machines across Europe, according to U.S. intelligence officials and other people familiar with the case. Specialists say the theft technology is the most advanced they have seen, and a person close to British law enforcement said it has affected big retailers including a British unit of Wal-Mart Stores Inc. and Tesco Ltd."
big retailers including a British unit of Wal-Mart Stores Inc.
Meaning Asda, I guess?
The ONLY reason you actually need one is to travel.
"Once a grocer, always a grocer."
Said by Penelope Keith (as Audrey fforbes-Hamilton) in "To The Manor Born" (http://en.wikipedia.org/wiki/To_the_Manor_Born) to Marjory Frobisher (played by Angela Thorne) about Richard DeVere (played by Peter Bowles) a nouveau riche millionaire supermarket owner.
How that applies here too!
To hell with credit cards and plastic. This kind of danger is why I only use cash and keep all my money in a Washington Mutual bank account, where it's safe...
A-Bomb
Cartman, is that you?
... why my local Tesco changed every one of its chip-and-PIN readers to a new make and model about 2 months ago. At this point you're probably wonding which make the old devices were, and I can't for the life of me remember. Sorry.
...shame my RSS feed still has it as "European's". I was wondering who this poor unlucky chap was, why defrauding him was so huge and quite how it managed to be a ring with only one person..
--- Band: Joey Ultra
I've been saying for years, since I first saw one in the 1990s here in NYC, that giving my PIN to some random ATM in some random "convenience" store to get quick cash is an unacceptable security risk. Especially some random ATM that I use at 2AM after running out of cash drinking in a bar, lost among all the ATMs in the neighborhood in my hazy hangover recollection, to be searched for months or years later when they, or someone else along the line, replay my PIN.
Every login to my account from an insecure location (which might exclude my home and office PC, if they've got certificates installed) should consume a one-time password that cannot be replayed for some later, unauthorized transaction. In fact each OTP should be attached to a specific dollar amount and recipient, with an expiration on the transaction after which even that transaction cannot claim money, or get any access at all.
Attempts to replay the transaction should automatically notify the FBI and the bank's security. I should get a notice of any risk warning above some level that I set, and a security statement listing the notices and their resolution with each monthly bill.
Eventually, people whose ID has been pirated will routinely get that security regime alternative after finding someone liable to pay for it. We should all move to that regime ASAP, rather than wait for the damage to force our hands.
--
make install -not war
In the UK. We're fine. Most of our data has already been stored in a government hard drive and left on a train seat somewhere, and it's not like we have any money in our bank accounts anyway.
WHY DO YOU HATE AMERICA?!
Because I'm Canadian?!
Anyhow, this was at a Toys-R-Us, not WalMart (they aren't the same company, are they?)
Trolling is a art,
...it was Diebold?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
How kind of your bank to not debit your account for transactions you didn't authorise :) Seriously, you don't need insurance against *them* being defrauded. If someone asks your bank to give them money while pretending to be you, it is the *bank* who has been defrauded, not you. "Identify theft" is a cute term the banks invented to turn the poor security architecture in their payments network into their customers' problem
Matthew @ Bytemark Hosting
My credit card has been ripped in the past. I lost £50 and the rest was refunded. I get the distinct impression that the banks do not care to catch the perpetrators or in fact, stop fraud. It is more cost effective to do the minimum required and get us to fund the losses. Think about it, spend wads of cash on security or just increase bank charges etc to pay for loses. Banks are not interested in fraud. They have already run the numbers.
Don't make your problems my problems!
A quote in the WSJ article says the hackers are performing at a level of sophistication that rivals foreign intelligence services. The implication: Payment card data security requires much, much more than just forcing merchants to lock down data and comply with the PCI (payment card industry data security standard). Card data security is a national security issue. It requires wholesale rethinking of the credit card system. The Federal Trade Commission misunderstands the magnitude of the problem. The FTC is locked in an old-fashioned belief that data in-security is due to stupid merchants (like TJX) treating consumers (and their privacy) "unfairly" by failing to secure their systems. We need fresh thinking and better leadership on this issue from the FTC. --Ben
Benjamin Wright, Dallas, Texas, benjaminwright.us
We had this happen here in RI about a year or so ago. Except in our case the ring was being run by Armenians.
In that case they had posed as repairmen and then rigged the card machines. It forced Stop & Shop to replace all their credit card readers. But then it brings up another point.
What if these rings manage to get to the card readers before they're delivered to the merchants. I bet that is what happened here.
Something you have, something you know, and something you are. Security means using at least two out of the three security factors. ATM cards are supposed to be "something you know" (a PIN number) and "something you have" (a card), but unfortunately, the card's only purpose is to hold another number, so it's really "two things you know, one of which must be written in invisible ink". Until we replace all bank and credit cards with electronics that can do public-key cryptography, fraud will continue to rise.
By the way, there's no evidence that anyone from Pakistan has anything to do with this. Most likely, the information is being sent to a compromised server, to conceal the real perpetrators, who could be anywhere.
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods.
A couple of decades ago, American Express pioneered the concept of "money back, no questions asked" if a product bought with AmEx became broken for any reason during the first 30 days after purchase. They had some dumb commercial on TV featuring a kid feeding porridge into a VCR, and a refund being given for the gummed-up VCR.
A colleague of mine perpetually travelled and regularly put more than $20k per month through his AmEx, so they automatically accepted almost any charge from him. Skipping a long and tortuous story, he bought a used airplane in Australia as part of some hare-brained get-rich-quick scheme (probably caused by alcohol). It was charged to his AmEx! His partner in the scheme was the pilot, who pranged the airplane on the first take-off. He survived, but the plane was a complete write-off.
Rather than accept the partial payment from their basic insurance coverage, my colleague called American Express, since the plane had been bought only a week or so previously. Contrary to their advertising, they asked a great many questions, and wriggled like mad in vain attempts to avoid the refund. Eventually, they cancelled the charge.
American Express tried to impose an inadequate monthly charge limit on him after that, but our mutual boss stood up to them, by threatening to cancel the corporate reliance on AmEx if there were any restrictions. We had almost a hundred perpetual travellers and a couple of hundred regular travellers (I occasionally exceeded US$10k on AmEx in a month). AmEx backed down.
Those who can make you believe absurdities can make you commit atrocities. - Voltaire