Slashdot Mirror
US Banks To Test ATMs Which Accept Your Smartphone Instead Of Cards (ibtimes.co.uk)
Dozens of banks in the US are updating their ATMs, or installing new ones, in order to allow customers to withdraw cash without using bank cards. A new cardless system will be rolled out at around 2,000 cash machines across the US, operated by at least 28 banks, including giants like Wells Fargo, Bank of America and Chase. Under the new system, people can order cash on an app on their phone, and then scan a code at the ATM to receive their money, all without inserting a card or entering a PIN. The developers of the system insist that smartphone technology makes for faster and more secure transactions. More banks are expected to adopt the technology soon.
I'm not really technically competent to make a valid argument against this, but my "gut" says... No! Maybe I'm just an ignorant Luddite that longs for my black rotary phone, but my uneducated imagination flows over with ideas and visions of how wrong this could go. My new ATM card has a chip, I'll stick with that for the time being.
If you want news from today, you have to come back tomorrow.
Hmm, this might solve any FBI funding problems...
Choosing 'that' vs. 'which': http://www.dailywritingtips.co...
maybe THAT will stop my wife.
Not only do I potentially get assaulted, and all my stuff stolen, but they can drain my bank account too? Doesn't this just paint a big target on the back of anyone who carries a smart phone?
I like pay-pass, the way it works in aus is there's a maximum amount per transaction where you can use contactless without a pin. Hopefully it will be the same for this?
A version of this is already widely in use in Australia. Log into bank via smartphone, request amount of cash, receive code. Go to that bank's ATM, request cardless cash, enter code, ???, cash! I no longer carry a wallet, just my smartphone with 3-card slimline case containing my ID/drivers licence, public transport RFID card, and credit card. I'm able to slip a $20 in there too for the few remaining places who either don't take credit or charge a fee to do so.
It's interesting that every vendor tries a slightly different approach to give or get money, it's probably going to take 5-10 yrs for a standard to prevail.
By the time this new standard prevails there will be an approach using quantum encryption using Personal IDs.
Combine it with the war on cash. Up next: Anyone not wearing a trackable GPS chip at all times is forbidden from using money.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
Leave the cardreader in it for those of us who prefer to not waste time with data-leaking, security-hole-ridden so-called 'smartphones'.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
It's annoying the article doesn't list the banks.
Several banks here in Australia (the Commonwealth for one and I think also Westpac) have had the "get cash via a phone app" option for a while now (where you log onto the online banking app on your phone and get a code that you key into the ATM which will then give you cash without a card). Other banks (like the ANZ) are trialing a NFC solution where you can tap with your compatible NFC phone on a reader on the ATM instead of using your card.
There is no increase security issue with the cash-via-phone-app option as implemented by the Australian banks that have done it since the thief needs to steal your online banking password (and if they have that, they can transfer money via direct transfer to another account they control rather than risk being caught by an ATM camera withdrawing cash using this technology)
In fact the technology makes things more secure in that your account details cant be stolen by a card skimmer attached to the ATM.
I think when they say "faster", they mean less time spent using the ATM, since a large part of the process can be done before you get there, or while queuing. Of course in reality, what will happen is people will queue up for the machine, then pull out their phone once they get to the front of the queue and start with their transaction, holding the queue up even more.
I don't think I've pulled cash from a cash machine in at least five years. I hardly use cash, although I do tend to keep an "emergency" $20 in my wallet. But pretty much every store I frequent asks me if I want cash back whenever I shop anyway - no extra trip to the ATM needed.
#DeleteChrome
If they're using SQRL, then I don't have any new security concerns.
https://en.wikipedia.org/wiki/...
https://www.grc.com/sqrl/sqrl....
Keep your phone secure, and the authentication scheme is really hard to break.
Now it won't be their system which is insecure, it'll be your phone. This gives them another layer of defense against their often laughably bad security.
BeauHD. Worst editor since kdawson.
They'll require a PIN still, you'll just need to enter it on your phone. So even if the attacker has access to the software, they'll still have to figure out the PIN which will likely lock the account after too many tries.
BeauHD. Worst editor since kdawson.
In fact the technology makes things more secure in that your account details cant be stolen by a card skimmer attached to the ATM.
Impossible, and a BS justification. Okay, a card skimmer is not a problem, but a MITM attack and screen scraper app are possible on your phone and not on a credit/atm card. You are trading risks, and not in favor of the phone. Safer? Not a chance.
Kind of like everything else that goes 100% on line, it's more risk and prone to problems. But, we all get to pay for increased premiums to pay for damages so who cares right?
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Your phone is your hardware key. With your phone in hand, they can assume (or ensure) that your authorization and identity are mostly guaranteed.
This is essentially what Apple did with ITunes and iPods; the iPod is a hardware key for access to DRM content. I assume it's the same with the iPhone/FairPlay video.
TouchID works on different principles, but the idea is the same: security is (mostly) guaranteed with hardware. Apple can guarantee authorization and identity with TouchID. That makes it a bit more dangerous, because you can accidentally grant authorization to someone. But at least Apple can argue that it was you who did the grant and not person Z.
Seriously, stop and use your brain for a while. If the Phone is subject to a screen scraper, and the reader is subject to a similar app (think skimmer) then you have just doubled your points of entry for a bad guy. It does not matter how long the code is good for, because telecommunications is fast for bad guys too. Code must be used in X radius is not a huge restriction in a city. Maybe out in the sticks.
I can't stop the ignorant from thinking that on-line is secure, but I'm not going to fall for the gag and lie to people. Want secure? Use CASH! I do this all the time, and it's amazing how little risk I face for card skimmers. You can use on-line all you want, but I want you to pay for the insurance. Want to pay with your phone, go right ahead. Pay the insurance and be responsible for that too.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
seriously, phone calls is like 1% of what people use these things for.
in addition to being a portable gaming system, email device, messaging tool, web browser, photo/video camera, walkman, television, alarm clock, weather forecaster, pinball leveler, and about a million other things, the future of this device is clearly moving in the direction of replacing things like photo ID and credit card. the term "smartphone" does not fit. it's like calling a car a "smart chair".
i could live a little longer in this prison
At least almost everyone uses their smartphone to make phone calls, among other things.
But when is the last time you've actually seen gloves in a glove box?
2) You are less likely to misplace your phone - and you will personally pay to replace it.
3) You can begin the transaction before you get to the machine, so if there is a line, in effect, it is faster.
4) I can enter the code on my phone, take a snapshot and email it to you, then you can go to my bank and take the money out of my account. I just made a no fee way to email cash, as long as I have it in the account.
5) If you don't have a debit card, you can't mistakenly use it instead of a credit card, nor will you be tempted to do so on purpose. This negates the vicious attempt by the banks to charge you fees for overdrafting.
excitingthingstodo.blogspot.com
I would accept the phone as an *additional* authentication method, but certainly not as the only one. It shouldn't be hard to tie large purchases to a banking app for authentication. Heck, in a lot of places groundwork for this is partially in-place already:
* Various banks including my own allow you to increase your daily debit/transaction limit to nearly $10k if you call in to pre-authorize it for a set period. You still need the debit card and PIN of course
* My credit card company has periodically put a brief hold on an unusual large transaction, which was followed by a verification phone-call. The last time it happened I had bought gum, gas, and then a big-screen TV (apparently a common pattern for those testing a recently-stolen card). The TV purchase was initially denied, but I got a call then-and-there on my mobile from Visa asking if it was me making the purchase for $X at location Y, then it was approved.
So tie the above into a mobile app. If spending exceeds a daily, hourly, or per-transaction limit, require that it be authorized on the mobile app (with password) before processing further transactions. Your card/PIN would still be required to complete the transaction as well, but this helps prevent somebody from stealing your card and making a bunch of withdrawals/purchases if they stole the card and shoulder-surfed (or had a camera on) your PIN.
Ever walk up to a store where there's an armored truck idling outside? The crew is armed, and that's because the trucks are targets, with an attempt against them every so often. You don't see remotely that level of physical security involved with credit card transactions. Look at the marijuana stores in Colorado and Washington that have trouble getting bank accounts and consider the risks involved with all-cash transactions.
Your compromises almost exactly match mine (I wasn't lucky enough to be part of the Target breach, but it did happen with a small restaurant), and my wife was affected by the OPM breach. You can get your money back from credit card fraud, and for most people, the OPM hack was an inconvenience and some free credit monitoring. Security in general does have to get better, but it's still a far cry from the risks associated with carrying cash. Once cash is gone, it's gone. Maybe you get something back if you have insurance, but you're paying for that along the way.
You can never go home again... but I guess you can shop there.
...another vector for someone to steal my money, meddle with my finances, or break into my bank account.
Nothing could possibly go wrong with this idea. Because, you know, smartphones are SO secure and everything.
DO. NOT. WANT.
Just cruising through this digital world at 33 1/3 rpm...
Very good! Finally! It's probably the most discussed topic for any business :) Thank you for the advice. I used to build long-standing relationships with my partners and customers, so money is a crucial point here. My experience shows, that company is doing well being secure with its funds. That's why I cooperate with https://worldcore.eu/Public/Fo... to make money transfers. The system provides p2p no-fees transfers, so it was a great solution for my business. And I can keep the track of all money flows easily, as transfers are accomplished with same day approval. Perfect for enterprenuers!