dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
4783
share rss forum feed


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to Mele20

Re: Why Card Fraud Grows

said by Mele20:

Huh? Credit cards do NOT require pins.

Oh really? Mine does, and many do here in Canada. It's a chip card.
--
Better to have it and not need it, then need it and not have it.


Dustyn
Premium
join:2003-02-26
Ontario, CAN
kudos:11
said by Juggernaut:

said by Mele20:

Huh? Credit cards do NOT require pins.

Oh really? Mine does, and many do here in Canada. It's a chip card.

Same.
My VISA card REQUIRES a PIN code in order to process a transaction. It has the magnetic strip and the chip.
--
Remember that cool hidden "Graffiti Wall" here on BBR? After the name change I became the "owner", so to speak as it became: Dustyn's Wall »[Serious] RIP


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
Yep, unless the POS reader doesn't have the chip reader, or is not functional yet.
--
Better to have it and not need it, then need it and not have it.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to StuartMW
said by StuartMW:

said by Snowy:

said by Mele20:

What's a "stored value card"? I've never heard of it.

Any type of prepaid card.

One would've thought that was self-explanatory but apparently not.

I've never had one so why would I be familiar with that phrase? I don't get the point of those kinds of cards.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2

1 edit
Think on-line purchases to limit liability amounts, or credit-challenged folks. Or, Pay Pal and the like.

*edited to add.
--
Better to have it and not need it, then need it and not have it.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to Dustyn
said by Dustyn:

said by Juggernaut:

said by Mele20:

Huh? Credit cards do NOT require pins.

Oh really? Mine does, and many do here in Canada. It's a chip card.

Same.
My VISA card REQUIRES a PIN code in order to process a transaction. It has the magnetic strip and the chip.

In Canada? I was talking about USA. Sorry if that wasn't clear.

I have an RFID card that also has a magnetic strip. It doesn't have a pin. It is the card of the future in the USA during transition to RFID cards that do not require a pin and that will eventually not have a stripe. There are maybe 25-30 merchants in this area where you can wave it. Everywhere else you need to swipe it but no pin required either way. I haven't used it yet as it was sent when my card expired as a replacement for the Platinum card I had which was nicer looking. It's the ugliest card I have, smaller than standard size, and thinner. It would be easier to lose because of the non standard size and the dreary, dark color.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


Dustyn
Premium
join:2003-02-26
Ontario, CAN
kudos:11
said by Mele20:

In Canada? I was talking about USA. Sorry if that wasn't clear.

That's okay, I was referencing Canada not USA as was Juggernaut See Profile. So there are credit cards that DO require PINS.


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to Mele20
As has been discussed many times here, RFID cards are very insecure. My CC company sent me a chip card 6 months after sending me their new RFID card.
--
Better to have it and not need it, then need it and not have it.


Snowy
Premium
join:2003-04-05
Kailua, HI
kudos:6
Reviews:
·Time Warner Cable
·Clearwire Wireless
reply to Mele20
said by Mele20:

I don't get the point of those kinds of cards.

There are many advantages/disadvantages to using a prepaid card.
The reasons I routinely them are:
1. Online purchases.
I don't use CC's/debit card for online purchases as a mater of security.
2. To disassociate myself from certain purchases either online or bricknmortar.
The only disadvantage is the ~$5 premium to purchase the card,
I'll mitigate that by buying high value cards to reduce the cost as a percentage of the dollar amount.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to Juggernaut
Yes, I was the person who started the main threads here regarding RFID cards. I started a long thread here several years ago on them and then again when I got mine which was about a year ago. At the beginning of the last thread I started, I was very skeptical of the card and its safety. But that turned out to be because of my ignorance. I was sure I knew about RFID cards and didn't want one. However, technology changes rapidly and I was going on my knowledge from the first thread several years ago.

Luckily, I didn't let the negative comments in the more recent thread (that had nothing to back them up) make me believe these cards were still bad. Instead I researched and read a great deal. I suggest you do the same although I am referring to RFID cards in the USA not in Canada or Europe where the system is DRASTICALLY different and NOT better for USA because of the differences. OLDER RFID cards are insecure and, of course, USA banks would love for you to believe that is still the case because they want liability changed to be borne by the customer. So, if they can convince you that RFID cards TODAY THE VERY LATEST TECHNOLOGY IN THEM are unsafe then they have a sucker who is thrilled to be told that in order to get a "safe" card that the sucker has to accept liability and that is "minor" because, of course, with the vastly "safer" chip card it doesn't matter if liability is shifted to the user. Yeah, and pigs fly. Educate yourself. But then your country has already snookered everyone there as has most of Europe. So, I suppose there is no hope for you. Americans have not yet been snookered and, hopefully, we will not allow that to happen.

It sounds like I am the only one in this thread who actually went and read the link Name Game See Profile gave to that forum discussion. ( Snowy See Profile doesn't need to read it but others should). That explains some of why Europe's approach is quite different from USA and why USA does not need to nor should take Europe's approach.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7
I am assuming the info there is correct..but you never know in this changing landscape.


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7

1 edit
reply to Snowy
said by Snowy:

said by Mele20:

I don't get the point of those kinds of cards.

There are many advantages/disadvantages to using a prepaid card.
The reasons I routinely them are:
1. Online purchases.
I don't use CC's/debit card for online purchases as a mater of security.
2. To disassociate myself from certain purchases either online or bricknmortar.
The only disadvantage is the ~$5 premium to purchase the card,
I'll mitigate that by buying high value cards to reduce the cost as a percentage of the dollar amount.

And being a smart shopper..more mitigation with great deals.
»twitter.com/i/#!/search/?q=%23cheap&src=hash

--
Gladiator Security Forum
»www.gladiator-antivirus.com/


Juggernaut
Irreverent or irrelevant?
Premium
join:2006-09-05
Kelowna, BC
kudos:2
reply to Mele20
I'm glad you feel secure in your decision. Personally, I don't feel good about any card that depends on a non-physical interface to use. That's my choice, right? As it is yours.

BTW, thanks for your timely insults regarding my country, and other countries. As usual, you belittle anyone that does not agree with you.

Have a good evening.
--
Better to have it and not need it, then need it and not have it.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
I'm not sure how you equate my comment about England refusing cataract surgery to the elderly until they often are so lacking in sight that they cannot read, watch TV, and fall frequently because they cannot see, to be an insult. It is a sad fact not an insult.

It is also a fact that Europe does not have card verification set up as we do. In Europe everything is not online probably because of the cost of broadband there. Here all verification is in real time on line. It is a completely different system here and unique to the USA. Because of it we do not need chip and pin cards but no one from Canada or Europe ever mentions this. It was not meant as an insult, but as a fact that should NOT be overlooked when discussing why the USA doesn't have the system Europe has and why our system should not be considered "backward and behind the times" as it is not. It is far more advanced than Europe's partly because we enjoy much cheaper broadband.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7
reply to Juggernaut
said by Juggernaut:

I'm glad you feel secure in your decision. Personally, I don't feel good about any card that depends on a non-physical interface to use. That's my choice, right? As it is yours.

BTW, thanks for your timely insults regarding my country, and other countries. As usual, you belittle anyone that does not agree with you.

Have a good evening.

Feel like you are among the chosen..and a rare privilege..it is a common trick by many debaters as they think it makes their point stronger and factual...just don't fall for de bait.
Unless you like the Game.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to Name Game
said by Name Game:

said by Snowy:

said by Mele20:

I don't get the point of those kinds of cards.

There are many advantages/disadvantages to using a prepaid card.
The reasons I routinely them are:
1. Online purchases.
I don't use CC's/debit card for online purchases as a mater of security.
2. To disassociate myself from certain purchases either online or bricknmortar.
The only disadvantage is the ~$5 premium to purchase the card,
I'll mitigate that by buying high value cards to reduce the cost as a percentage of the dollar amount.

And being a smart shopper..more mitigation with great deals.

Are you agreeing or disagreeing with Snowy See Profile? Are you saying there are "great deals" on prepaid cards? I don't quite get your comment.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to Name Game
So, because I didn't provide the link to prove my comment about many elderly in England being denied cataract surgery until they are almost blind I am a trickster? UGH. I thought if I provided it then we might have a slew of OT comments but I can give it to you by PM if you'd like.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7
reply to Mele20
Because it was not for you..nevertheless..has to do with great deals one can find..same product lower prices and a reason to shop online..also since you do prepay them..I think people tend to be more cautious when to use them for a purchase at bricknmortar.


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7
reply to Mele20
said by Mele20:

So, because I didn't provide the link to prove my comment about many elderly in England being denied cataract surgery until they are almost blind I am a trickster? UGH. I thought if I provided it then we might have a slew of OT comments but I can give it to you by PM if you'd like.

Then why inject it at all I am not interested in it so save your PM's...this thread is about credit card fraud..
--
Gladiator Security Forum
»www.gladiator-antivirus.com/


Exidor
Premium
join:2001-05-04
Brampton, ON
reply to Name Game

MasterCard Extends U.S. EMV Migration Roadmap to ATM Channel

MasterCard Press Release:
quote:
Reinforces Commitment to Address All Channels

PURCHASE, N.Y.–(BUSINESS WIRE)–Sep. 10, 2012– MasterCard today announced the expansion of its U.S. electronic payments roadmap to include the ATM channel. Beginning in October 2016, a liability shift hierarchy will be introduced for ATM transactions in the U.S., as part of an effort to globally align the use of EMV technology to prevent and manage fraud in the payments ecosystem.

The liability shift will apply to all MasterCard-branded products across all transactions initiated at U.S. ATMs.

As part of its roadmap unveiled in January, MasterCard identified the need to further secure all channels by means of the implementation of EMV standards in the U.S. The company has taken a leadership role to foster collaboration to drive a smooth migration and advance the U.S. electronic payments system to deliver maximum benefits to consumers and the industry.

“This continues our commitment to look holistically at the next generation of U.S. payments,” said Mike Weitzman, Group Executive, U.S. Markets, MasterCard. “As other markets have migrated to EMV, we have seen fraud shift to the least secure channel. By establishing this liability shift, we’re advancing efforts to prevent and reduce fraud. At the same time, by making the announcement today, we’re providing our issuers, acquirers and ISOs flexibility and sufficient time to manage their ATM technology decisions.”

Last fall, MasterCard announced the extension of its existing EMV liability shift program for inter-regional Maestro ATM transactions effective 2013. The program announced today expands liability for U.S. ATM operators to include all EMV-enabled cards used at U.S. ATMs.

Analyst firm Aite Group estimates that fraud costs the U.S. card payments industry an estimated $8.6 billion every year. In addition, the firm’s research shows that many industry executives agree that switching to the EMV standard can greatly help to mitigate card fraud, while minimizing risk and maximizing profitability.

“An upgrade of existing U.S. ATM systems to EMV is a necessary next step in the evolution of financial institutions’ tactics to keep pace with fraudsters,” said Julie Conroy McNelley, research director with Aite Group. “The industry executives we talk to are bullish on EMV migration to reduce their potential vulnerability from mag stripe fraud and make way for future innovations that can help enhance the value of electronic payments to consumers.”

MasterCard was part of the original group that created the EMV standard and has supported the successful migration to EMV-based payments in every major market globally to date. The company’s continued investment in advancing these infrastructure standards has provided insights and expertise to guide the industry in advancing payments security and convenience.

»newsroom.mastercard.com/press-re···channel/

*****************************

THE NEXT GENERATION OF PAYMENTS COMES TO THE UNITED STATES

Payments technology is changing, transforming the consumer purchasing experience worldwide. The next generation of payment products and services build on the current safe, simple and smart ways to pay while bringing greater security and new capabilities to every transaction. This transformation is about more than just a specific device. It's about creating a holistic purchasing experience supported by greater security and control.


»www.mastercard.us/mchip-emv.html

****************************

The key word seems to be holistic.

The American Cancer Society recommends that if holistic medicine is to be used at all, it should be used only in conjunction with conventional medicine and not as a replacement.


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7

1 edit
Yes it is the buzz word out there and for good reason that might make some of this go away..

Experience Design Is The Future of Mobile Payments

A HOLISTIC CUSTOMER EXPERIENCE IS THE FUTURE OF MOBILE PAYMENTS

In order for an experience to be successful, it must meet people’s basic needs before it can attempt to satisfy higher level needs [1]

Mobile payments is the next big thing.
In the past 12 months there has been much hype around mobile payments with lots of articles espousing the “next great wave” and the promise of new revenue streams, product, and services.

And here’s why:

Handset manufacturers, such as Nokia, announcing the imminent introduction of smartphones embedded with NFC chips. Smartphones introduced by the company in 2011 will come with NFC.
Manufacturers, such as VeriFone, including NFC as standard in all their new point of sale (POS) terminals.
The announcement in late 2010 by three U.S. wireless carriers — AT&T Mobility, T-Mobile USA and Verizon Wireless — of the formation of a joint venture chartered with building “Isis,” a national mobile commerce network.
Google’s launch in May 2011 of “Google Wallet,” a mobile application for smartphones that will use NFC to enable mobile transactions, coupled with “Google Offers” — online deals that integrate into Google Wallet.
Orange and Barclaycard launching “Quick Tap” NFC mobile payments in the U.K.
PayPal’s mobile payment ambitions to offer a seamless end-to-end experience from product lookup, comparison shopping across local retailers, coupling, payment, and fulfillment.
American Express announces its SERVE digital wallet service platform in August 2011, in direct competition with PayPay.
Facebook Credits expansion announced March 2010 that will turn retailer’s FaceBook pages into commerce sites, offering limited edition product or at discounted prices, loyalty programs, and more.
Amazon announces mobile wallet initiative.
In November 2011, Visa announced its V.ME digital wallet initiative

»ideaengineers.sapient.com/strate···ayments/

see also

»ideaengineers.sapient.com/busine···preface/

I am reminded when Microsoft started to think about "holistic" approach to security..but then it was too late.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/


Name Game
Premium
join:2002-07-07
Grand Rapids, MI
kudos:7

1 edit
reply to Name Game

Re: Why Card Fraud Grows

Phonetic attack commands crash bank phone lines

A security researcher has demonstrated a series of attacks capable of disabling touch tone and voice activated phone systems or forcing them to disclose sensitive information.

In one test, a phone system run by an unnamed Indian bank had dumped customer PINs.

Attacks including blind SQL injection and buffer overflows could be served to almost any interactive voice response (IVR) phone system, according to Rahul Sasi, a security researcher with iSight Partners.

He said the attacks could take down critical phone systems, cutting off banking services or the ability of call centres to field customer inquiries.

“If someone can crash a banking app from anywhere in the world, that’s critical,” Sasi said.

“No banks or organisations are testing IVRs because they think the systems are secure, but in reality they are not. No firewall or CAPTCHAs monitor voice traffic.”

The attacks were limited to the characters available within dual-tone multi-frequency signalling (DTMF) systems, which could include numbers and letters, but not most special characters such as backslashes.

In demonstrations at the recent Hack in the Box conference to be replayed at the upcoming Ruxcon security event, Sasi ran fuzzy testing against IVR systems serving data via a keypad and by spoken commands.

»www.scmagazine.com.au/News/31584···nes.aspx

IVRS IN BANKING SECTOR

»www.ivrsdevelopment.com/ivrs_banking.htm
IVR Credit Card Payments
»www.datatel-systems.com/IVR/appl···ents.htm

Money money
--
Gladiator Security Forum
»www.gladiator-antivirus.com/


El Quintron
Resident Mouth Breather
Premium
join:2008-04-28
Etobicoke, ON
kudos:4
Reviews:
·TekSavvy Cable
·TekSavvy DSL

1 recommendation

reply to Name Game
I haven't read the whole thread, but I did work in Credit/Debit card processing for a number of years.

The chip is definitely about placing the onus for fraudulent charges on the card holder, if you look at how a chargeback works, the merchant is always holding the brunt of responsibility when s/he deals with credit cards.

When a card holder requests a chargeback, the money is immediately taken away with a service charge from the merchant, and it's up to the merchant to dispute the chargeback, or provide documentation that s/he performed their due dilligence.

The merchants in most cases provide money to Visa and their merchant banks so who do you think VISA and the merchant banks wanna protect the most card holders or Merchants?

As a card holder, I watch all of my debit/credit transactions, and use cash whenever possible.
--
Support Bacteria -- It's the Only Culture Some People Have


More Fiber
Premium,MVM
join:2005-09-26
West Chester, PA
kudos:31

1 recommendation

reply to Mele20
said by Mele20:

Credit cards do NOT require pins.

Agreed, mag stripe credit cards do not require pins, but we're talking about EMV chip (smart) cards.

A smart card can have multiple "wallets". The implementation of each wallet is up to the issuer. A wallet can be credit, debit, prepaid, private label, or even cash.

When you use a smart card, depending on the capabilities of the reader you can choose which wallet you want to use for a transaction. For example, a credit issuer may choose to go with "chip and sig", in which case the reader would not prompt the user for a PIN. Or a credit issuer may choose to go with "chip and pin", in which case the reader will prompt for a PIN.

said by Mele20:

..why would I use a debit card when I have a checkbook?

Because merchants don't like to take checks?

Maybe where you live a merchant will take a check from a local resident, but in big cities merchants are reluctant to take checks when most people have a debit or credit card.

said by Mele20:

For those with tons of money why not just pay in cash?

Who carries around large amounts of cash in a big city?

said by Mele20:

I still believe that you are talking about debit cards. EMV is NOT on table in this country. RFID is.

I am talking about EMV (smart cards) which can be multiple types of cards.

EMV most certainly is on the table. MC, Visa and Discover have MANDATED that payment networks accept EMV transactions by sometime in 2013 (actual date varies by network). This is only the first step. The next step is for merchants to update their readers to accept EMV cards. That can't happen until the networks can process EMV transactions.

said by Mele20:

So what about RFID cards ....can they be used in Europe?

Only as a mag stripe card, and acceptance of those is now spotty.

said by Mele20:

That thread was confusing about saying EMV cards will be here en mass in 2013. I thought it was RFID cards that would be here en mass in 2013 because currently there are not a lot of merchants where you can do a contactless charge but I had read this would change dramatically in 2013 but according to that thread EMV cards will be big and RFID ones will go away before even really getting started here?

I doubt EMV cards will be here en masse in 2013, although we may see them start to appear. Merchants have to update their terminals to accept EMV cards. 2014 maybe.

RFID will probably fade away. Too may problems with RFID being insecure. RFID will be replaced by Near Field Communications (NFC) on smartphones. This is farther out as NFC is present only on a couple of smartphones today. Secure transactions using a Smartphone require something called a Secure Element (SE) on the smartphone. There is going to be a battle over the who controls the SE on smartphones (smartphone vendor or issuer). I'm afraid this is going to become very fragmented for lack of standards and interoperability.
said by Snowy:

said by Mele20:

What's a "stored value card"? I've never heard of it.

Any type of prepaid card.

In the most generic sense, that's true. However, in the context of EMV, a stored value card is one where the value is stored in the chip on the smart card, rather than in a computer somewhere which is the case with prepaid cards.
Think of using a smart card at a parking meter or vending machine where the transaction is authorized completely offline. Smart cards are capable of storing cash. You load x $ onto your smart card at an ATM and then can use that cash at any online or offline terminal.
--
There are 10 kinds of people in the world; those who understand binary and those who don't.

Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
Thank you for the information. I will try to get to where I need no credit card (never debit card) except for a large purchase where I need to carry a balance, or a deposit on a hotel room, or the few times I am forced to shop on the internet. I will start writing checks again, or paying with cash for groceries, and all the small things I put on a credit card and pay off at the end of the month for cash back or mileage rewards. I will save a significant amount of money this way as I will make no impulse purchases and only purchases that are truly necessary so I see this as going backwards for banks especially if the consumer is held liable for fraud as a lot of folks will stop using credit cards if that happens.

Other than the rewards, I see no reason now with these Smart cards and moving fraud liability to the customer to use a credit card except when truly necessary (which is not for groceries, prescription medication, drug store purchases, Walmart, Target, etc). I don't live in a big city but when I visit Honolulu I have not been afraid to carry a good amount of cash or travelers checks. I don't have a cell phone but if I did it would not have internet connectivity so I wouldn't be doing this stuff on a cell phone.

I have about ten credit cards and I will hate getting rid of them all but one, but I just want a simple credit card...not all this wallet stuff. Although if the card was chip and sig that might be ok. I would not allow chip and PIN. We don't have parking meters, I don't ever buy, EVER anything from a vending machine, I can't see any reason to not carry actual cash instead of putting cash on a credit card? That is plain weird. I just want a simple credit card that earns cash back or mileage.

I suppose the main problem might be if the local banks stop issuing ATM cards that are NOT credit or debit cards. Then I would I have go back to going in the banks to get cash frequently (as I did before my bank set up tons of ATM machines all over the state). But I can do that if need be. What I really would not want to see happen would be for Macy's to do something like this with their cards. I would lose a lot if I had to pay cash at Macy's. You really must have their card.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson