Slashdot Mirror
Russian POS Pickpocket Generates New Interest In RFID-Blocking Wallets (thestack.com)
An anonymous reader writes: A Facebook post depicting a man apparently stealing from commuters by tapping a POS reader against them unobserved on public transport caused a sensation on Facebook before being removed earlier today. The provenance of the photo is uncertain, but unnamed authorities have said that it was taken in Russia. Since this type of opportunistic street theft requires a merchant business account through which any transactions would be easily traceable, the question arises as to how such acts of fraud are being made profitable. Comments on the matter have brought up anew the topic of RFID-blocking wallets as necessary everyday security.
A Russian piece of shit pickpocket? No need for attacking other countries today.... all pickpockets are pieces of shit.
who said this is a good idea the first place?
Contact-less payments are dumb, and lead to precisely this kind of abuse. I mean it could be a simple confirmation, a single swipe on the screen or something (when talking about smartphone based payments). And contact-less keys can simply have a button you have to press before unlocking.
Contactless cards: how to avoid paying twice
"Credit cards that you simply wave at a reader save time and are a boon for visitors to London. But they can also raid your bank account invisibly" (11 Nov 2014)
http://www.telegraph.co.uk/fin...
or from slashdot back in 2012 "Android App Lets You Steal Contactless Credit Card Data" (June 21, 2012 )
http://it.slashdot.org/story/1...
Whats the new news AC? The risks of some of the newer cards and bank services have been in the tech media for years and been reported by the media too.
Domestic spying is now "Benign Information Gathering"
If you have two RFID cards in your wallet the device will not be able to read them... cheaper to get extra cards than a new wallet
This attack is actually quite easy. The "Pickpocket" has one end of a transmitter not a POS system. The other end of the transmitter is waiting at cashier to make a payment. Effectively the system is fantastically dumb, just relaying the transaction requests back and fourth between the the checkout and the person's card.
The "getaway" is that they are leaving with the goods. If the store doesn't get paid, it doesn't matter.
This completely end runs the entire smart card encryption and every other security measure on the card. It is just a pair of repeaters that are extending the range of the card from 3cm to potentially miles.
I suspect that there are timeouts on the cards but if the repeaters don't induce much lag the speed of light should not add much. Still, depending on how generous these timeouts have been set, it may be possible to fire these signals through an LTE pair of phones giving the pickpockets an international range.
In theory a pickpocket could be having the signals relayed in a nice message queue fashion to a series of people waiting at automated checkouts. So the pickpocket could walk down a train while a small group of purchasers ring transaction after transaction through. Assuming a $100 limit per purchase not only could the pickpocket feed an easy 20 cards from a single train, but he could wait a few minutes before returning for a second pass down the train making it appear that the users were making a second purchase, and then a third and a fourth.
Doing the math that could net $2,000 per pass with maybe 3 possible passes before the pinless swipe limit were hit.
Then step out and do the next train car. Now we are looking at no less than $10,000 in goods per hour during rush hour.
This is assuming that it isn't one long train. If it is a train where you can walk the length of a crowded train it could potentially be 100 cards in a single run if the queuing system is properly organized.
When I first saw someone swipe a card without a pin this scheme popped into my head. I have just been waiting the years since for it to become public.
I suspect the fix won't be that easy because merely being less generous with the timeouts will probably exceed the capabilities of many cards and many machines, causing them to become unreliable.
In most cases the chip can be removed. It often bulges enough to cut it out with a razor. If not, slice into the card, find where the chip is, then call the card company to request a new card from which the chip can then be easily removed. There are also phone apps (I've used a free one on Android) that can read RFID chips, so that the card can be tested to be sure it's clean after chip removal.
I was in Australia over Christmas with my brand spanking new USA based credit cards (from major bank and CC companies) .. which have barely have chips in them. I was buying some stuff in a shop one day and handed over my credit card and the assistant took my card, looked at it, paused for a second and then finally said with an incredulous tone .. "Oh .. I have to swipe this, don't I".
Talk about an abject lesson in how backwards my CC was.
I am Slashdot. Are you Slashdot as well?
It must be good because it saves Joe Dumbfuck from having to remember his PIN and spending 5 secs entering it!
Seriously , if the banks and stores had suddenly suggested bring out a system whereby you just shove your card in the slot but don't need to bother to enter your PIN any more for the shop syphons off your cash there would have been an outcry. But because its contactless - Oooo! Magic! - no one seems to Get It.
Those tap transactions are insane, I disabled that functionality on all my cards the moment I found out that it became possible to tap my debit cars and have money taken from my debit account. Had to call the banks for that.
As to how this guy does it, I don't know for sure, if I was doing it I suppose I would use stolen merchant accounts to run purchase transactions that would end up buying bitcoins or something, cannot come up with anything better on the spot, I have to deal with merchant accounts and payment processors, it is not trivial to set everything up, in case of purchases made with stolen credit cards, merchant ends up on the hook not only for the initial amount but also for a charge back fee (25usd per incident), so it is not very easy but apparently possible after all to get away with stealing this way.
You can't handle the truth.
When I first read the headline it was "Russian Piece of Shit Pickpocket Generates Interest in RFID-Blocking Wallets"
I know it's "Point of Sale", but too many years of experience with the other version of the acronym has conditioned me to read it a certain way with often, as in this case, coming up with a different interpretation of a statement.
Mimetics Inc. Twitter
Swiping a little piece of plastic to get my big gulp and bag of funyums is just too difficult and time-consuming for me. Thank god these benevolent companies have given me a way I can save 0.8 seconds in my important, busy day. Because you know, all those little 0.8 seconds whenever I want to buy something in my day add up and drain my life away. Why, if you add up all the time I waste by having to swipe my card, it could add up to as much as maybe three or four seconds a day.
Now excuse me while I go check my Twitter account for three hours and watch The Bachelor.
You are welcome on my lawn.
I'm here to help you.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
"the question arises as to how such acts of fraud are being made profitable."
"Comments on the matter have brought up anew the topic of RFID-blocking wallets as necessary everyday security."
Seriously? You weren't able to see that relation?
Read your own text slowly. This time, try to think while you read.
Ok. I'm not sure you'll manage it. Let's try a simpler with the key words in bold:
"OMG! How will anyone make a profit out of this?!" followed by "It's time to buy an RFID-blocking wallet!"
...good criminals.
Saw these a lot since around 2009 in Japan.
easy. set up a company and a merchant account with the passport data of some homeless guy or from a stolen passport (takes only a few days), grab as much money as you can and disappear.
this is how most russian scams are operated.
"It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
I never understood the "need" for contactless payments....is it so hard to buy stuff without pressing a confirmation button? Do you buy so much stuff that the time saved not pressing a button or whatever would really benefit you?
Seriously, I never understood this...yes, I know that at its heart it's meant to make it easier to buy something in the hopes that you'll buy more useless shit, but do people really see this as some truly beneficial feature?
Just cruising through this digital world at 33 1/3 rpm...
Can one *pop* the RFID chips in ones cards with a quick trip in the microwave...10-15 seconds to blow the chip, but not harm the plastic card?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Why aren't standard wallets RFID blocking now? I got snagged on an out of state trip around 3 or 4 years ago. I don't know exactly how, but I assume it was someone with a scanner in the TSA line at the airport. Ever since I used one of those hard plastic RFID blocking wallets when I travel or go somewhere with long security lines. A few months ago I switched to an everyday leather RFID blocking wallet. I got one from Hammer Anvil on Amazon, but there's other brands out there too. The thing is smaller than my old leather wallet. The shielding adds almost nothing.
Question - does anyone know of a website that tests these wallets against all common credit card chip types? The hammer anvil one says it blocks a certain type of frequency, but not all RFID. I got the impression that it would block credit card chips, but maybe not building security RFID chips. But that leaves a question of whether or not they block all credit cards. I think most of the slim type wallets are the same - the shielding is thin, so it only blocks certain types.
Anyone have a definitive source for testing?
That should read non contactless devices!
Look, I know pickpockets are not the nicest of people--they are petty criminals, after all--but to call them a POS is a bit harsh, isn't it?
For phones, at least they require some kind of authentication first. Don't chip & PIN cards require at least the PIN?
My Global Entry card came in a foil-lined envelope (like this) that says on the outside, "Protect your card's sensitive electronics -- and your privacy. Keep the card in this sleeve when not in use." If the US Gov't thinks a Global Entry card could potentially be sniffed from a similar vector, why think this would be much different?
It's a bit naive to think "but there is an obstacle so it wouldn't work" this scam https://fakeletters.org/job-offers/excellent-job-opportunity-for-freshers-and-professionals has been used to get victims to sign up for an easily traceable merchant account in the past. Why would it not be used by a piece of shit with a POS?
It's a bit naive to think "but there is an obstacle so it wouldn't work" this scam https://fakeletters.org/job-of... has been used to get victims to sign up for an easily traceable merchant account in the past. Why would it not be used by a piece of shit with a POS?
You have to remember that fraud of this sort is something done on a cost benefit analysis basis. For single city transport and small purchase cards the limitations in geographic terms, per transaction limits, and the limited total number of sellers who can cash in the points for money, increase the costs of getting money back from fake transactions reduce the benefit per act of fraud, and increase risk. This means that it is less worthwhile to break but does not mean it can not be done. The more universal a system is the less fussy they can be with the vendors and the less conspicuous actions to cash in the fraud in other ways (eg. buy and resell expensive items) have to be, deceasing the risk. Larger limits on the new chips increase the per transaction profit, and the usage of more widely available hardware as well as greater number of victims reduces per action costs. Does not happen with current system does not mean can not happen with new systems, the economics make this sort of scam inevitable if we use more contactless cards, so long as security is not perfect.
Not only are re-writeable magnetic stripes real the hardware for at least some chip based cards can store info too, leaving you with only the slight at gate delay which is a different issue. If half a second per passenger delay breaks your station then you have other issues and will see bottlenecks elsewhere, or you don't have enough gates, for pretty much any other purchase slot in and out or swipe is to trivial a component of the time taken to even register. You seem to care far more about the trivial convince than the risks but this trade off is the real question, what is the real world cost of both systems, in convenience and money, and the less limited contactless gets the more costly they will become.
The last wallet I bought claims to block RFID. I tested it at work and found that it blocked the POS reader in the coffee bar, but not the entry card reader on the door, which doesn't exactly inspire confidence. Perhaps the sort of low-powered device 'pickpockets' are likely to use would also be blocked, but there's no way to be sure. Do the manufacturers actually test these things?
As a cash user, and a subway rider for a year, your post made me think for a while. I think subway and bus RFID is handy, because I will make multiple transactions on the go for a single trip, it will be for only a few dollars at each transaction, and I will be dressed up to handle the weather. When buying something, like food, I will be inside, waiting in a line, and the transaction amount will be ten to sixty dollars. The advantages of RFID (speed) are reduced, and the downside, (amount of money getting stolen) are greater. My transit smart card will have up to 20 or 40 dollars on it, and I can refill it at a machine at a subway stop. My ATM card will have several hundred dollars on it.
If you are a fraudster and you want a merchant bank account then you can acquire one just as easily as any other type of account... surprisingly enough by being fraudulent. As long as you pay your setup fee and whatever identity the fraudster is using passes a basic credit check then you can get a bank account like that from pretty much any bank. If you plan on using it to steal money then its not like your next months merchant fees are going to be an issue - you're going to just dump the account as soon as it's generated a profit for you..
It's easy to transfer cash from the merchant account to a pre-paid debit card or even to willing accessories to fraud and just spend it as you want. Sure, your merchant account will eventually get flagged and locked out, but by that point the fraudster could easily have emptied it and moved on to the next one.
On a related subject: I destroy the RFID features on my cards by cutting through the antennae.
I tried a few of those RFID blocking wallets, and although they block the signals and are cheap, they're still poorly made. The one I settled on has been tested by a few independent labs, and is every bit as high quality leather as my old wallet - yet has a faraday cage built into it. From the few basic tests I've been able to do on my own, it seems to do what it's marketed to do. http://silent-pocket.com/colle...
One of my banks sent me a contactless card last year. But that's OK, because that account I only ever use for online purchases, and the card never leaves the living room. I'm not even sure how you'd actually perform a contactless payment. And I don't feel any particular reason to learn.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"