Hacker News Reader

Comment by new299 | Hacker News Reader

Nice writeup. But in the article they write:

> Are you angry that your card has been stolen, again? Contact your local congress person or senator and ask them to pass legislation that fines gas stations $100 for every card that is discovered on a skimmer in one of their pumps. It’s ultimately up to the gas stations and pump manufacturers to secure their pumps.

Suggesting a solution like it's an easy fix always bugs me a bit. Would a 100USD fine actually work here? The issue seems more with the fact that the US hasn't upgraded to a chip&pin style system. You might end up just costing the gas stations more money, when they don't actually have the power to do much about the problem.

It feels a bit like victim blaming, when in this case the victim has little choice but to work with the system as they find it.

View on HN

The deadline for retailers getting on board with chip readers was October 2015. Gas stations pushed back and got it moved to 2020 because of the high costs (according to them) associated with swapping out card readers attached to pumps.

The way I understand, after the 2020 deadline, gas stations will be liable for fraudulent charges (or at least associated fees).

Also, I've had my debit card skimmed twice in the past 3 years. A smart gas station (or chain) would pay to put chip readers in NOW and advertise that feature. I'd got there exclusively.

> I've had my debit card skimmed twice in the past 3 years.

Huh. I suppose that is the one advantage we have in Oregon where we are not allowed to pump our own gas.

Full service gas stations have a long history of "old fashioned" card skimming - at least from my experience in New Jersey. My mother uses a separate credit card explicitly for gas stations because her credit card has been skimmed at NJ gas stations a half dozen times over the years.

Full service stations don't preclude a lack of terminal tampering. If the gas station closes at some point in time anyone can tamper with it after hours when it is unstaffed. Additionally, tampering can occur by criminals paying off employees to install skimmers.

Or an employee who covertly swipes your card with a reader that fits in his pocket before putting it through the pump

Didn't that partly change recently? When we were up in Oregon for the eclipse, one of the folks told us that you can now self pump between....some hour in the evening I can't recall and closing time.

Yeah, I lived in Bend for 3 years and miss that (among other things).

>Would a 100USD fine actually work here?

Yeah. The number of cases being reported would go down when gas stations start throwing skimmers they find in the trash instead of calling the cops.

Right... this sounds like a really strong possibility. Why didn't I think of that. :)

It's not the gas stations that are committing the crime. Why should they be fined? It's the people breaking into the pumps and installing the skimmers.

Most stations do what they can with security seals, frequent inspections, I've even seen some that install hardware-store hasps and padlocks on the pumps.

I do wonder why they have not converted to chip cards though. Almost all other retailers have.

The article says that

> Essentially, the perpetrator opens a pump using one of a few master keys, unplugs the credit card reader from the main pump controller, plugs the card reader into the skimmer and plugs the skimmer back into the pump controller. This reportedly takes less than 30 seconds.

So I'd say that at least those stations whose pumps can be opened easily with a master key should be liable if their careless handling of customer data leaks credit card details to skimmers. A fine would put additional pressure on the pumps with the worst security and might eventually lead to widespread deployment of something like the alarm system proposed at the end of the article.

Right but we're working with incomplete information. Who mandates the use of those pumps? Are better, more secure pumps available? Do the gasoline suppliers mandate that certain pumps are used? etc. etc.

So it's not clear that these things are purely under the gas stations control and that a simple fine would solve the issue.

Alternative solutions might include:

1. Mandating stronger security certification of public facing card readers.

2. The police more aggressively prosecuting these offenses (raising the cost to criminals who are caught and making the offense less profitable).

I don't have complete information, so it's not clear to me which solution is best. But it doesn't seem obvious and simple.

Here in Oregon, it's state law that only gas station attendants can fill vehicles. It seems that this would prevent some of this, but of course it doesn't prevent the skimmer from being installed after hours or by the attendants themselves..

A gas station with a skimmer is like a gas station with a gas spill -- it's a hazard on their property that is open to the public. They have a responsibility to maintain a safe environment, or else close off the property.

I assume when a gas station operator becomes aware of either a skimmer or a gas spill they remove it.

I guess in both cases what they can do to prevent those things from occurring at all is limited. Is anyone arguing that they don't monitor for skimmers on a regular basis? It's just that the criminals keep putting them back.

Here is what Visa has to say about the matter: https://usa.visa.com/visa-everywhere/security/emv-at-the-pum...

Hardware changes are annoying and expensive. Here in Canada where gasoline crested over $1.00/L it took an incredible amount of time for vendors to upgrade their equipment to handle the extra digit. Many locations had numbers physically taped on to their pumps and signs.

Pretty much all US cardholders have chip+pin now. I’d say about 75% of retailers support it.

(Not sure if this is how it works outside of the US, but we currently have cards with both magstripes and chips. You use the chip where it’s supported, the stripe where it isn’t.)

I've never seen Chip+Pin on a Credit Card in the United States outside of Target Stores that uses it on their own store card.

Everywhere else is Chip+Signature.

Are you thinking of Debit Cards? (I won't use these. I got my bank, BOFA to issue me an ATM card that's not a debit card.)

Yeah, my debit is Chip+PIN. Curious, what do you have against debit cards?

Try getting your money back if it's stolen. (And try convincing the bank you didn't give someone your PIN!) With a credit card, it's the banks money.

Very few credit cards are chip and pin, they're mostly chip and sign. And I don't think I've ever seen a gas station with a chip reader, so the chip's not really doing you any good if you're just swiping anyway. I believe the gas stations were given a longer timeframe to convert.

Here in Australia its pretty much 100% chip and PIN or contactless payments (paypass). Has been for a number of years now.

I don't think anyone swipes cards unless there is something wrong with the payment terminal. Even vending machines are tap and go.

If you swipe an Australian-issued card in an Australian-issued payment terminal, it will insist that you use the chip instead. Only if there is a problem reading the chip are you permitted to use the magnetic strip. Either way, the correct PIN number is required.

I believe that the magnetic strip can still be used for certain low-value transactions by stable merchants (e.g. street parking meters) but such exceptions are rare. Certainly never the case in a normal retail situation.

https://www.cnet.com/au/news/australian-credit-cards-boost-s...

Theres a loophole in Australian regs that I recently noticed. With a foreign card on credit, you can swipe and OK past the PIN prompt with no PIN. Most merchants don't know they are supposed to sign and verify after that.

Of the dozen times i've tried it i've been prompted once to sign - and in that case the card had no signature on it and the merchant waived it away.

I'm in the process of figuring out the scope of this issue and how to fix/report it - I think the solution will be for terminals to enforce prompting for ID/signature

> I'm in the process of figuring out the scope of this issue and how to fix/report it

Don't bother, the merchants and card issues are well-aware of this. You're supposed to reconcile your card statement with your expected transactions, and dispute irregularities. If you attempt to fraudulently claim that you didn't perform a transaction, the issuer goes to the merchant to get a copy of the signature & uses it as proof you authorized the transaction.

If a fraudster forged your signature, you simply assert that the signature is not yours. If you attempt fraud here (sign in an unrecognisable hand), the fraud investigations will try to put you at the scene with CC TV recordings/handwriting matching/etc. Hopefully you have not signed any affidavits that the signature is not yours, because then you'll be up for perjury as well as fraud.

pin-bypass is pain. until people are all moved to just be chip/pin or even just pin then the only way is to add a bunch of prompts to hopefully force the staff to check for signature or to add delays/confirmations to make the process too annoying and force the customer to change.

Same here in the UK - it's ALL Chip & PIN, I can't even recall the last time I had to swipe my card[1], and I use it a LOT (yay, Airmiles!).

If the payment is <= 30 GBP, it's an offline transaction as well. Anything over that amount triggers a round trip to the backend servers.

As an aside, it's now perfectly possible to live a cashless life in the UK if you wanted to.

[1] That said, I think ATMs read the mag-stripe... but I don't really use those either these days.

> If the payment is <= 30 GBP, it's an offline transaction as well

It's still online (card-present check), but skips authorisation (no PIN needed).

> it's now perfectly possible to live a cashless life in the UK if you wanted to

Perhaps in London. Try spending a long weekend in Torquay.

I'm sure the Tesco, Sainsbury, Co-Op, and Waitrose in Torquay can handle card payments if you were really stuck.

I haven't found a single place so far that supported the chip+pin transaction. Everyone has the terminals but they are either set to not do the pin transaction or they are tapped off with a "broken" sign.

Here in Washington the chip readers are sometimes taped over... nearly always in, you guessed it, gas stations. They have the hardware but it's disabled.

Yep, also in Washington, same here.

We do? I've seen chip + signature all over the place, but I don't think I have a single chip + pin credit card.

Target cards are chip + pin, IIRC

You can thank Russian hackers for that.

The chip was to avoid skimmers like this...

When implemented there was a liability shift. But as always the US is far behind the rest of the world.

In Denmark the chip was added in 2004, and fully adopted 4-6 years later.

Reply on news.ycombinator.com