Invisible ATM Card skimming
-
@JaredBusch said:
So instead of sticking your head in the sand, use the tools that are out there.
You're equating my choice to not use that technology as the same as sticking my head in the sand?
I think sticking your head in the sand would be comparable to the people who in the article where warned that the ATM they were about to use was hacked, yet they used it anyhow.
Instead, I'm simply choosing to live a 'harder' life to try to keep myself a bit more secure.
Before that attempt to access my bank account, I did not have a password requirement on my account. In fact I had called the bank in the past for account information, providing recent payments/deposits as additional proof of ownership, and felt those safeguards where good enough. Up to that point, they appeared to be, and in reality they still were - because the bank denied them access to my information for lack of this information, but it was really no bother to add the additional password for over the phone access.
-
@Dashrender said:
Instead, I'm simply choosing to live a 'harder' life to try to keep myself a bit more secure.
That you think it makes you more secure is where he is equating it to the head in the sand. Is it more secure? Why is phone access harder to hack? Isn't it easier in most cases? That's normally the fastest path to breaking into someone's account.
You've made your life harder, by a lot, for sure. But the question is, is it to make you more secure?
-
@scottalanmiller said:
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
Nope, I haven't had an ATM card in 20 years. I don't trust that particular system - it's a me thing. CC's at least offer you a near guarantee of not paying fraudulent charges on your account, debit cards don't offer that protection in many cases, especially when the PIN is used (Though, do I recall correctly that your bank refunded your fraud?)
My bank was able to block it, so it never happened. Someone else had it refunded.
Credit cards are SO easy to skim, they have to refund you because they refuse to check if it is really you.
Chip AND Pin would definitely cut down on the amount of fraud. I believe that Europe fully implemented that, I don't understand why the US skipped the Pin portion of it? How does plugging the card into a reader help? I suppose it keeps someone from just copying the mag strip. I wonder how much fraud will be reduced by the reduced use of the mag strip alone?
The US skipped the CHIP portion of it. Can't get a chipped card anywhere. I've asked and asked. Some people lie to get you to get their card and then it has no chip. I've been trying since 2007 to get one.
In Europe it is a law to protect consumers, that's why they have it. In the US they have shown that the chip is too expensive and it is cheaper to have the fraud.
Well those things are changing. While the Chip cards aren't everywhere yet, they are coming (finally). My Amex has had one for 2 years now (all the longer I've had the card), but my Visa (local bank) does not.
Starting in Oct, the vendor will be responsible for any in person fraud if the patron presents a chip based card but the vendor doesn't process it chip based.
I'm sure there are several other things that have to be place for that as well, but it's a start.
Walmart started requiring me to use the chip portion two months ago, assuming the card had a chip. I would swipe my Amex, and it would beep at me.. the cashier would ask - do you have a chip on the card? I'd say yes, they'd say - you have to insert the card into the bottom of the reader.
-
@Dashrender said:
Before that attempt to access my bank account, I did not have a password requirement on my account. In fact I had called the bank in the past for account information, providing recent payments/deposits as additional proof of ownership, and felt those safeguards where good enough. Up to that point, they appeared to be, and in reality they still were - because the bank denied them access to my information for lack of this information, but it was really no bother to add the additional password for over the phone access.
So it sounds like you have far less security than we do with our online accounts. Why do you feel the extra effort is worth it to be less secure? What's the end goal?
It's all personal stuff, so do what makes you happy. But I think you are imagining a security that you are not achieving.
-
@scottalanmiller said:
@Dashrender said:
Instead, I'm simply choosing to live a 'harder' life to try to keep myself a bit more secure.
That you think it makes you more secure is where he is equating it to the head in the sand. Is it more secure? Why is phone access harder to hack? Isn't it easier in most cases? That's normally the fastest path to breaking into someone's account.
You've made your life harder, by a lot, for sure. But the question is, is it to make you more secure?
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
-
@Dashrender said:
I think sticking your head in the sand would be comparable to the people who in the article where warned that the ATM they were about to use was hacked, yet they used it anyhow.
Why? Cars have accidents but we still drive them. Understanding that risks exists is very important. Not panicking and treating them reasonably is a key thing that we do in IT. There are risks everywhere. Some are big, some are small. Knowing what they are and just how risky they are is very important. Extremely important.
There are tradeoffs. And often reacting too much to one threat can create another risk that we overlooked.
Knowing that I can get skimmed by an ATM is very important. Knowing which ATMS to use, where to use them, how to use them, etc. is important. Recognizing that I was skimmed and having my card shut off before it could be used was important. Having the available money in my account low was important. But I would not call that putting my head in the sand. I would call it a reasonable response to a small risk. I'm a high risk traveler and it's still a minor threat for me.
-
@scottalanmiller said:
@Dashrender said:
Before that attempt to access my bank account, I did not have a password requirement on my account. In fact I had called the bank in the past for account information, providing recent payments/deposits as additional proof of ownership, and felt those safeguards where good enough. Up to that point, they appeared to be, and in reality they still were - because the bank denied them access to my information for lack of this information, but it was really no bother to add the additional password for over the phone access.
So it sounds like you have far less security than we do with our online accounts. Why do you feel the extra effort is worth it to be less secure? What's the end goal?
It's all personal stuff, so do what makes you happy. But I think you are imagining a security that you are not achieving.
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
-
@Dashrender said:
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
Honestly, I'd think not having one before that was completely reckless. That's what's odd, to me your system is not very secure but you are going through a lot of pain based on the hope for more security.
-
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
-
@scottalanmiller said:
@Dashrender said:
You don't think adding the password makes the account more secure? I suppose perhaps not, if the password was easily guessable, and the bank didn't require any of the previous account verifications.
Honestly, I'd think not having one before that was completely reckless. That's what's odd, to me your system is not very secure but you are going through a lot of pain based on the hope for more security.
OK I'll blame that one on my bank (and myself for not correcting it sooner) - as I've never had any bank account I've setup require/request a password for phone access. But then again I opened that account in 1984 as a savings account only, then added services as I got older.
So I assume everyone here has a password/phrase on their accounts for phone access?
-
To me, phone security is like car safety. We all know that airplanes are far safer than cars, but cars feel safer so we often trust them out of an emotional response even when logically we know that they are the most dangerous form of transportation that we can take. People are emotionally terrified of airplanes, no matter how safe they are. They point to rare crashes that make the news as validation for this, but it is purely anecdotal. People die in car crashes constantly to the point that the news does not report them.
Phones are not very secure, they are extremely difficult to make secure. Yes, you can add a password, but online we don't consider just a password to be all that secure, right? And computers cannot be social engineered, but people can. Using the phone to talk to a person is the best way to be exposed.
I don't see you being extra secure here. I only see extra effort. Giving up the luxuries of modern life but not gaining anything. And is there really much to gain?
-
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
-
@scottalanmiller said:
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
I do it with my monthly statements. But really my bank account is used for three things - receiving my paycheck and paying my CC and my mortgage. There is so little traffic on the account as to not make it an issue.
Now my CC - that's a whole different story.
-
@scottalanmiller said:
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
Try calling your bank and see if you can at minimum get information about your account over the phone. If nothing else it would be an interesting test.
-
Another factor that you may not have considered, often banks block phone calls from outside of the country. Sounds good for a security standpoint, but it isn't. For someone attempting to hack an account faking an internal number is trivial. But for you as a customer when traveling outside of the country being blocked from accessing your own account could be a really big deal. You can't check your balance, you can't disable your card, you can't verify an attack, etc.
For me going internationally, giving up online access would be another total degree of risk and exposure.
-
Just so we're on the same page, I couldn't tell you the last time I called the bank for any account information. It's just not something I need, and frankly I could disable it and it would probably be just fine.
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
Is my life more difficult - absolutely. Am I less secure than you - no way! Only if you've setup your accounts to not allow phone access, and only allow in person or online would you maybe be more secure. If you have two factor authentication on your bank account and disabled phone access, then I'd say you are more secure.
But I do have two factor, that's standard even for little local banks. I don't see how you are more secure.
For example, how often do you check your statements? How do you even do that well when on the phone? You must spend a lot of time listening to statements over the phone trying to make sure that things are still secure. How many hours a month does that take?
I do it with my monthly statements. But really my bank account is used for three things - receiving my paycheck and paying my CC and my mortgage. There is so little traffic on the account as to not make it an issue.
Now my CC - that's a whole different story.
So your CC is online, just not the bank?
-
@Dashrender said:
Just so we're on the same page, I couldn't tell you the last time I called the bank for any account information. It's just not something I need, and frankly I could disable it and it would probably be just fine.
How do you verify that there are no malicious transactions? That's why I often log in.
-
-
@Dashrender said:
@scottalanmiller said:
@Dashrender said:
So I assume everyone here has a password/phrase on their accounts for phone access?
I'm not even aware of phone access options. That sounds crazy. The only thing I use the phone for is to shut off a card that is exposed.
Try calling your bank and see if you can at minimum get information about your account over the phone. If nothing else it would be an interesting test.
Without basic information, you will not be able to get it from my bank. Same as with yours. My bank will require a few pieces of information about the account and the answer to a security question (one of 3) setup. The security question is the "password" part of the puzzle and is how all banks I have used for a decade or more operate. I would suspect that almost all banks operate this way.
The point is that you did these things and someone still tried. So why make it so hard on yourself when people are still going to try and get into your account?
Make proper use of the technology at hand. Same as with anything else in IT.
