Slashdot Mirror
What Can Be Done About Security of Debit Cards?
JumpDrive writes "I have been the victim of (Visa) debit card theft. I do not know where they stole or got the number, but it was used one day on the other side of the country and the next day it was used in Europe until they cleaned out my account. I had been monitoring my account online and immediately went to the bank and filed a claim. I was told at that time it would be 3 to 5 weeks for them to investigate the claim before they could return my money. Recently I tried to make a purchase with a debit card and was told that they couldn't use the card since it wasn't a Visa or MasterCard check card; this led to a discussion of why I no longer have a Visa or MasterCard check card. Which then led to the question of 'What can be done about it?' Currently I have a separate account for debit usage for my personal safety. But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards (not in small print and maybe required in advertisement of these cards, similar to what is required with pharmaceutical drugs on television) and/or that if a debit or check card is issued a separate account should be required for its use, and users informed of the issues of placing all of their money in the same account that their debit card has access to. What other precautionary measures should be required or taken?"
If it gets stolen, it's not your money. Also, you got skimmed.
How the banks advertise it: "Use your own money to shop online!"
What it actually means: "Expose the cash you need to live on to fraud."
The banks like it because you're putting your money at risk, not theirs.
How we know is more important than what we know.
Step 1: Cut DEBIT "check" card in half
Step 2: Just use a CREDIT card. You're protected. Problem solved.
In Canada you need an ATM PIN to use a debit card linked to a bank account, but the PINs can still be skimmed by compromised payment terminals. I only pay by credit card.
But I also think that those producing these check cards should be required to advertise the hazards of having one of these cards
NO, NO, NO. No stupid, pointless warnings. Make the financial institutions solely liable for all identity theft. They're the only ones with the ability to stop it, and they should be the ones that bear the full economic incentive for managing fraud.
But I didn't say it first, Bruce Schneier did:
The actual problem to be solved is that of fraudulent transactions. Financial institutions make it too easy for a criminal to commit fraudulent transactions, and too difficult for the victims to clear their names.
[...]
It's not that financial institutions suffer no losses. Because of something called Regulation E, they already pay most of the direct costs of identity theft. But the costs in time, stress and hassle are entirely borne by the victims.
The whole article is +5 Insightful, well worth reading.
I hate to say this, but use cash. I have several credit cards, and I use some of them daily. But unless the interest rates are lower than what I can make by not paying them (seldom if ever) they get paid off monthly. I do not have a debit card. I have a paypal account tied to a bank account I use strictly for buying and selling on ebay(lego if you are interested). My bills I pay with check or cash, and sent via mail or delivered by hand (the HVAC/R supply houses, as it credits immediately to my accounts when paying at the store). If I want something off the internet, I get a buddy of mine to order it using his data, not mine. Plus with cash, there is never a question of bouncing a check or overdraft fees or charges. Will probably get modded down for suggesting such an anti-tech idea as using cash, but oh well. Karma is overrated anyway.
Debit cards are functionally useless, since they give you nothing that using credit card which you pay off every month wouldn't while costing you quite a bit.
If you have a credit card you pay off every month, you get an interest free loan for a month. You earn points for rewards. You get protection against fraud. You often get warranties on things you wouldn't normally get.
You get NONE of this with a debit card. The only reason a debit card is preferable is if you don't have the self control to spend an amount you can pay off every month, or you have such a bad credit rating you can't get a credit card with a grace period.
In this day and age, with online banking so prevalent, checking your account every few days is only prudent. It's not unreasonable for the consumer to have some burden of identifying the loss, since each of us are the best and most efficient judge as to whether or not the transactions on our accounts are in fact ones we performed. Millions of dollars in software development and analyst training have been spent on helping banks to detect fraud, but those systems aren't fail proof.
In the end, there's no substitute for each of us keeping an eye on our own accounts' transactions.
If we don't take responsibility for our own financial affairs, should we really expect the banks to carry the whole burden on our behalf? No matter how good it is, any security measure can (and likely will, sooner or later) be defeated. (and let's not forget good old fashioned social engineering...)
In the end, the best protection against a breach is constant vigilance. (Or, said another way, prevention only goes so far, detection is still requried ;-)
Did I say RF? No, I said "chipped", although once the security is done correctly RF might not matter as much as you might think.
The correct protocol is for the merchant to tally the merchandise, and present the customer's card with their merchant ID and the transaction amount. The cardholder then has to see and approve that amount by entering a PIN in order to generate an authorization. (The cardholder needs to enter that PIN into a trusted device, which is best met by a smart card with a built-in keyboard and tiny display, or alternately by a trusted keycard device issued by the bank.) The card uses the PIN to generate a one-time approval code, which is forwarded by any means to the bank, along with the card data (account number or whatever), the amount, and the merchant ID. The bank returns an approval code to the merchant, who gives the merchandise to the customer. All this is digitally signed, of course, and the protocols need to be well laid out to avoid potential problems with respect to money laundering, man in the middle attacks, etc.
Note that the customer's account number is only usable for identification. It's only the chip-generated authorization combined with the user entered PIN that carries the value. Something you have plus something you know.
The authorization data is carried by the merchant and delivered by whatever means to the bank. The Internet would work fine. The merchant can see your account number, but they cannot charge you anything other than the value included in your approval. The authorization code is accepted by the bank for one time only use, and they will pay only the merchant ID indicated in the transaction.
Note that in this case, the card is issued by the bank. The certificates and keys are created and injected in the card by the bank. That means it's 100% bank-owned-and-provided hardware from customer to bank and back again. The bank is 100% in charge of security. All you have to do as a customer is not to lose your chipped card AND keep your PIN secret.
An RF based card would make only a minor difference in security. Sure, someone could ping it, but they couldn't get it to emit an authorization token unless they had it in their hands and pushed the tiny buttons. Protections would have to be taken to prevent RF based man-in-the-middle attacks between the merchant and the customer's card, otherwise the merchant might not get paid. But the customer's money is never at risk except when they are entering their PIN, and are staring at the tiny screen that says "PAY WALMART AMT=$34.56".
John
GGP is on the mark, when he says "Use cash". But, in today's world, it seems a necessity that we are able to make purchases online. So, I have exactly what Recovery1 has - a plain debit card. I put money on the card, make my purchase, the card is dry, and no one can make any more withdrawals. Doesn't much matter if someone around the world gets my number, they can ONLY steal the money that I have put on the card that day, and if I've already made my purchases, the balance is zero, they can't steal anything at all.
But, their attempts to do so will trigger alarms, and the bank knows that security has been compromised!! In theory, the bank will contact me, and ask about those attempted purchases.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Once you have made the formal claim for a stop payment it should be resolved in a couple of days, if your bank does not support you in this, it is time to change banks.
This is the most sensible advice I've seen on this thread. When my Commerce Bank debit card details were compromised, and several unauthorized charges started appearing on my bill, I called the number of the back of my debit card to report the losses. The bank immediately reversed all the charges and offered to send me a new card through overnight delivery.
I told them to cancel my compromised card, and to send me a new one. They told me I would be without access to my funds via debit card until I activated the new one, but that it should be here within 24 hours (it was at my house in less than 12 hours). I was responsible for $0 of the unauthorized amount, and life went on normally.
Bottom line: the debit card is only as risky as the bank with which you choose to do business. Get a bank that doesn't suck, and your debit card is a safe financial instrument.