Slashdot Mirror
Clueless About Card Data Hack, PF Chang's Reverts To Imprinting Devices
wiredmikey writes: After saying earlier this week that it was investigating reports of a data breach related to payment cards used at its locations, P.F. Chang's China Bistro confirmed on Thursday that credit and debit card data has been stolen from some of its restaurants. What's interesting, and somewhat humorous, is that the company said that it has switched over to manual credit card imprinting systems for all of its restaurants located in the continental United States. The popular restaurant chain said that on Tuesday, June 10, the United States Secret Services alerted the company about the incident. Admitting that it does not know the extent or current situation and impact of the attack, the company noted in a statement: "All P.F. Chang's China Bistro branded restaurants in the continental U.S. are using manual credit card imprinting devices to handle our credit and debit card transactions," the company said. "This allows you to use your credit and debit cards safely. If it's not obvious, anyone who has visited a P.F. Chang's and used a payment card in the last several months should monitor their accounts and report any suspected fraudulent activity to their card company.
Those imprint machines are far from safe. PF Changs should shutter the business until they figure this out.
Why does Slashdot randomly serve up beta when I hit the site anonymously? Close the browser and hit it again, poof, beta is (usually) gone.
I thought we put this whole beta thing to bed months ago....why this nonsense?
So now I can physically steal boxes of credit card numbers with signatures right at the bottom?
My latest discover card doesn't even have numbers to print. It is a blank card
My credit union prints their own cards... which don't have a relief on the printed data... so they can issue them directly from the branch. If you want relief on your card, you have to order it through the mail. So I guess I'm not eating at Chang's tonight
Which has more power: the hammer, or the anvil?
One of my cards was reissued without raised digits on it about 3 years ago, so this plan might not work out so well for them. Also, I wonder how many of the 19 year-olds working there's minds just got blown by the swipe machine and now know why credit cards (used to) have raised digits.
This response is not necessarily clueless. How much values does the chain derive from electronic processing? If it is less than the cost of securing their systems then going back to paper is a smart tactic.
There are lots of cases where sensitive records are needlessly computerized. For example, I just had a discussion with my local blood bank. They have federal requirements to record your identity in order to track you down if someone finds a problem with your blood. So they put it in a computer and when you ask about security they give you the same line that Target and PF Changs, and Neiman Marcus, and pretty much everybody gives you when you ask - that security is important to them and that they've taken precautions to protect it.
But the thing is, they don't need to computerize my identity. It is one of those write-once, read rarely pieces of data because the number of times they have to find someone because of bad blood is tiny compared to the number of donations they get. They could just write it down and file it in a literal filing cabinet and then give me a donor-id to use when making donations. Let the computers use the donor-id for scheduling and all the other stuff that happens frequently, but in that rare case when they have to actually find out who I really am, an extra 5 minutes to go look in the filing cabinet won't be a burden.
I'm not saying that all sensitive information should only be stored on paper, but I am saying we ought to be asking what info really benefits from being stored electronically and is the benefit really greater than the risks?
There are a lot of cards now with don't have the numbers imprinted on them. Am I going to have to manually write out my card information when I go there now because these incompetent people can't be bothered to hire a couple security people and fix the problem instead of making it inconvenient and no more secure for anybody. Also a credit card swipe is pretty much automatically processed, what kind of delay will be on the manual transactions?
I heard the USA will finally get proper Chip & Pin cards next year ?
I visited the US recently and discovered the joy of swipe & signature on paper receipts... It really feels like 3rd world technology.
A company that didn't know it was breached, doesn't know the extent of the breach, and who's answer to the breach is to revert to 40-year old tech using the phrase "If it's not obvious..."
~Knowledge is knowing that a tomato is a fruit, but Wisdom is knowing not to put it in a fruit salad.
its illegal to use those devices in California. I thought the whole reason those were phased out was because they actually facilitated card theft...
I was under the impression (no pun intended) that the old-school imprint technique was declared unacceptable (in the PCI-DSS rules) a few years back.
Perhaps the rules for securing the imprints were just so cumbersome that it made using them completely impractical. I can't imagine fast food joints maintaining the physical security required for this.
You'll see things here that look odd, even antiquated to modern eyes, like phones with cords, awkward manual valves, computers that, well, barely deserve the name. It was all designed to operate against an enemy who could infiltrate and disrupt even the most basic computer systems. Galactica is a reminder of a time when we were so frightened by our enemies that we literally looked backward for protection...
Show me on the 1st Amendment bobblehead where the moderator touched you...
Back in the 80s I worked for a company that did back office accounting systems. Then I moved to a large non-profit and was in charge of both back office and customer facing systems. This was when the Internet was for non-commercial traffic only, so "customer facing" meant a live operator at a dumb terminal hooked up to a minicomputer.
My new employer wanted me to develop a system that would among other things take credit cards from donors and volunteers. I was pretty confident on the technical end of things, but I wasn't sure about handing the financial data. So I called in a CPA friend I'd met at my prior job, and he looked over a the design documentation for the system to make sure everything was kosher.
"You can't store credit card information in the database," he said.
"Why not?"
"Because it's insecure," he said.
"But it's convenient," I said.
"That's the problem," he said. "Look, any of the operators will be able to look up credit card information on any donor. Some of these donors are rich. You'd be able to go on one hell of a shopping spree with just one of their credit cards."
"What if I make it harder to look up the data?"
"Then it's not convenient anymore," he said. "Look, you don't actually have a use for this data once you've processed the credit card transactions. And while you're keeping it around in case you might someday have a use for it, it leaves you wide open to theft. It'd be a disaster; customers won't do business with you because your reputation will be in the toilet. Get rid of it. Get it out of the database, any logs you have, and make sure it's not in any backup tapes."
And when I thought about it I realized he was right. There was no point in exposing my employer to risk for no real benefit. That's when I learned an important principle of security: don't hold onto sensitive data that you don't actually have a use for. I suppose you could generalize: don't keep sensitive data on any system where there is no compelling need to store it there.
Things have changed now; storing credit card data has come to be regarded as routine in the post-1 click, impulse buy Internet world. But even though it is the *norm*, that doesn't mean you should automatically do it. There's actually a use in a web store for storing credit card data which offsets the risk (which you should still minimize). There's no reason for a restaurant to store credit card information -- that's just blind habit. Waiter takes the customer credit card, runs the transaction, and hands the card back to the customer, and then restaurant no longer has the data. You can't lose what you don't have.
Of course in this case it's probably not P.F. Chang's fault. They bought a POS system which left them open. It probably is all slick and really very helpful at keeping things moving, like maybe taking the customers card at the table. It'd be interesting to know how the POS system vendor screwed this up, because clearly they did.
There is no encryption or security architecture that beats not having the data.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Nobody handles cards like that anymore. So. Let's put an ad on Craigslist in the "gigs" section. Then we can have some guy who says he has a work permit (honestly) drive them over to his mama's house on the East side of town. He'll scan them with her XP machine so they can get onto the network.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Credit cards are a ponzi scheme, are not backed by any hard currency, cannot be used to pay taxes and are only used by drug dealers and money launderers. Oh, wait....
Prove anything by multiplying Huge Number times Tiny Number
All these breach reports create a fascinating story to me.
It's kind of like the old Bill Gates drop test. How large an amount of money would Bill have to accidently drop to be worth his time to lean down and pick it back up?
Solutions like 3C could be rolled out very quickly and very inexpensively to eliminate credit card fraud. 3C can work with existing equipment so no new hardware is required in most cases. It would actually be easier than rolling out imprinting devices. And much more secure.
Chip-and-pin could be rolled out less quickly and at a higher cost, and not quite as secure, but could still be done relatively quickly if there was the will to do it. Again, chip-an-pin would be less work that rolling out imprinting devices, and would be much more secure.
...the clunk-a-chunk machine.
I know retro is in, but this is going too far.
systemd is Roko's Basilisk.
How the heck does old fashioned imprinting help me to use a debit card?
Do these people actually not understand any of this technology?
Lost at C:>. Found at C.
The slip's form fields align with a credit card, but that doesn't mean the waitstaff can't write it in by hand. Impressions just made it faster, and gave some limited proof of "card presence."
Also, why would you eat at PF Changs? PF Chang's is for people too afraid (to be polite) to step into the local Asian restaurants. It's overpriced low-to-mid-tier produce/meat with a sauce that came out of a can. If you're lucky, that can says "PF Changs teriyaki sauce", not "Sysco teriyaki sauce."
I once ate there and the waiter actually felt it necessary to tell us that "soy sauce is like salt for chinese food."
Stop eating at chain restaurants. They suck - the food's bad, they run the local non-chains out of business - and they prey upon people who want bland consistency. Live a little. Support the local economy. Etc.
Please help metamoderate.
Cash, when stolen, is gone. I'd rather not go back to the days of carrying a a hundred bucks or more in my wallet when going out for the night, walking back to my car in a dimly lit street surrounded by sketchy/drunk people.
Somebody steals my card - or card info - I cancel the card. It's done. I owe no debts so long as I watch my charges and report if something goes wrong
Somebody steals my wallet with my card. I cancel the card. It's done. I owe no debts so long as I report the card stolen
Somebody steal my cash.... the cash is gone, and I'm not getting it back.
Actually the swipe is used sometimes - for example, I had had a problem with my credit card where automatic security checks kicked in (I made a large purchase overseas) and so had to call the credit card company for verification, which is fair enough. Inconvenient but the service of verification was painless, quick and the person at the other end was very polite and efficient.
However the next day - back at home in the UK - when I went to the local supermarket to get a big grocery shop I put in the PIN and after the cashier looked at her register, swiped the card and then asked me to sign the resulting receipt for her to check.
It was that I had had a 'flag' on my card (from the day before) and they were doing a second verification.
Also, I believe that the swipe on those hand held verification machines can also be used when signal is out to the credit card company as a last resort.
But don't knock the manual carbon copy method. I wouldn't have my gerogeous hand mad rug from a souk in Egypt were it not for that. Of course I am not going to use my debit card in those cases and the credit card company can call me at any time (as could the store owner of that souk) if the transaction was blocked.
That actually was a glimpse of a the nicer, trusting side of humanity. Thank you Mr store owner in that Souk in Egypt.
If you've got a clean record, it's not that tough to get one & it works in situations like that like a charm.I live in a neighborhood that's starting to "downhill slide" like that - that was MY "fix", amongst other things (it works).
this is actually more insecure. having your name and credit card number on 3 pieces of paper ( the copies of imprint) floating around for years to come. whether it is in the office or the basement of the restaurant. blowing around in the wind by the dumpster when they dispose of it etc...
can you imagine how quickly a thief/employee could note your 3 digit code from the back when doing the transaction? then google your name and address.
So all you have to do is get the carbons from the trash now for those, like back in the 80s??
Washington State Minimum Wage Law applies to wait staff and the current minimum wage in Washington is $9.32 an hour.