News for hackers. Stuff that matters.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by hammock on Wednesday September 14, 2022 @06:55PM (#32844583)
With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by iglio on Wednesday September 14, 2022 @09:08PM (#32845718)
Some banks even disable the mag strip by default [1], in the UK at least, allowing you to turn it back on temporarily if you need to.

[1] https://monzo.com/help/monzo-card-pin/what-is-magstripe

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by giantg2 on Wednesday September 14, 2022 @07:10PM (#32844715)
The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Macha on Wednesday September 14, 2022 @08:09PM (#32845249)
I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mindcrime on Wednesday September 14, 2022 @10:08PM (#32846163)
At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails.

As far as I'm concerned, chip cards can get stuffed. They're utter shit in my experience.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Semaphor on Wednesday September 14, 2022 @10:49PM (#32846376)
That sounds like you are somehow mistreating them, or your local merchants use "special" terminals (or maybe your bank is just using crappy materials). I can’t even remember how long ago it was that swiping worked, but chips have never broken until I cut them for the replacement card, this is over 3 different banks.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mindcrime on Thursday September 15, 2022 @07:27AM (#32850139)
That sounds like you are somehow mistreating them,

I don't think I am. All I do is take it out of my wallet, put in the reader, take it out, put it back in my wallet, lather, rinse, repeat.

or your local merchants use "special" terminals

That would make sense if we were talking about one merchant, or even just two. But I can go to Barnes & Noble, Lowes, Food Lion, the local corner gas station, Ace Hardware, it doesn't matter, I routinely find the chip readers less reliable than the magstripe reader. I can't explain it, but chips are tainted in my worldview at this point.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Reason077 on Thursday September 15, 2022 @02:45AM (#32847995)
> "At best I've found chip reading to work about 60% of the time ... Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe"

Here in the UK, many (most?) new payment terminals don't have mag-stripe readers at all. And I expect banks will start issuing new cards without a magnetic strip in the near future, if they haven't done so already.

I agree that chip & pin isn't ideal, not just because of reliability issues but also because of the security risk of PIN disclosure. But thankfully contactless (incl. Apple Pay/Android Pay) has already replaced it for 99% of daily transactions.

But if your card's chip is broken, can't you just get your bank to send out a new one?

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mindcrime on Thursday September 15, 2022 @07:30AM (#32850163)
But if your card's chip is broken, can't you just get your bank to send out a new one?

Of course I can. But that means I have to stop and take time out of my day to call my bank and dick around with them. And then if the new card comes with a new number (I don't know if it will or not), and/or expiration date (that almost certainly will change), then I have to login to EVERY SINGLE ONE of the places online where I use that card for some kind of automatic payment and change the payment details. I'm extremely loathe to do that, because it's incredibly tedious and painful, and I always miss one anyway and wind up getting scary emails about how my account is about to be closed.

Sure, my hand will probably be forced on this sooner or later. But as it stands, I just haven't cared enough to deal with all of that.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Reason077 on Thursday September 15, 2022 @11:10AM (#32853213)
It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

Your new card will have a new number and expiry date, but the old one will remain valid.

In any case, these days my web browser remembers card numbers and fills them in automatically, so it’s really not such a big deal to update card numbers online.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mindcrime on Thursday September 15, 2022 @02:19PM (#32856222)
It might depend on your bank, but if you request it, it should be possible for them to issue a new card on the same account without cancelling the old card.

That's a good point. I guess I should call them and see if that's an option. If so, that sounds like the best of both worlds.

I could also buy a phone that has NFC / tap to pay support, and link my card to Google Wallet and use that. An awful lot of the place I shop support that these days...

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ridgered4 on Thursday September 15, 2022 @08:46AM (#32850981)
I had a similar experience, but a clerk at a gas station wiped the chip edge of the card down and it worked on reinsertion. No idea how not really visible dirty (maybe from my very old wallet) was contributing to chip read failures but I have a much higher success rate after copying this fix.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by adventured on Wednesday September 14, 2022 @09:05PM (#32845697)
When it comes to dipping the chip, it can wear down after a lot of use and stop functioning. I've never run into a problem with tapping however.

Here's an example image from a NY Times story about chips wearing down:

https://i.imgur.com/XlKEBsc.jpg

The last card I replaced due to chip wear, the chip looked even worse than that.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @02:24AM (#32862769)
That is a totally acceptable amount of wear.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by giantg2 on Wednesday September 14, 2022 @08:30PM (#32845423)
I have chip malfunctions at least once per month. I assume there is dirt or debris in the terminal or on the chip.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Macha on Wednesday September 14, 2022 @08:49PM (#32845573)
I find it odd that they're so unreliable in the US given they're neither new nor complicated technology and have a decade of use in Europe before they even started gaining adoption in the US, but I'll take your word for it. I wonder what US card or terminal manufacturers are doing wrong for such a reliability difference
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Reason077 on Wednesday September 14, 2022 @09:10PM (#32845730)
Chip payments occasionally had problems in Europe too. The chips on the cards, or the contacts on the terminals would get dirty or wear out or whatever. Contactless is much more reliable.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by girvo on Wednesday September 14, 2022 @09:06PM (#32845705)
That's wild. We've had chips on our cards in Australia for gosh-knows how long at this point, and I honestly cannot remember the last time it failed.

Not that they're even used that often these days either: everything is just tap-and-go NFC payment now.

And I do mean everything!

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mrguyorama on Thursday September 15, 2022 @01:26PM (#32855431)
Remember that the US is huge, diverse, and opinionated, and really struggles to realize "My experience isn't everyone's experience"

I've had the chip struggle like once in my life. That was on a card very near it's expiration date. Most people I see in the store have no problems with their payment method, and when I was a cashier in 2012, people seemed to have significantly more problems getting their magstripes to scan.

All of this is SUPER dependent on which flavor/brand of POS is popular around you, the effort your bank put into making a good implementation, and whether your local merchants actually put effort into running their business and keeping equipment maintained. Pretty much nothing in this discussion is generalizeable to all of the US other than "We were late to the party of chip cards"

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by tzs on Wednesday September 14, 2022 @09:31PM (#32845892)
I’ve had the readers at Home Depot occasionally fail to read my chip card. The last time it happened an employee told me that the readers were designed for slightly thicker cards than some banks are using and so don’t always make contact but if you lightly press down on the exposed end after you insert it that lifts the chip end up enough to be read.

I’ve had no problems with their readers since I started doing that.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by seanmcdirmid on Thursday September 15, 2022 @12:39AM (#32847117)
Also, when you use self check in terminals at the airport, if you use your credit card for ID, it only works via swipe.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @02:25AM (#32862779)
Credit card for ID?

This explains a lot.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by seanmcdirmid on Friday September 16, 2022 @09:48PM (#32874079)
It’s easy so people go with it. Otherwise you have to type things.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by noirbot on Wednesday September 14, 2022 @07:14PM (#32844760)
If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by krzyk on Thursday September 15, 2022 @12:25AM (#32847029)
Every time I'm in the US I'm amazed that I have give my card to the waiter who gets the card to some place and gets its back after few mins.

Don't people have wireless terminals in the US like the rest of the world?

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Macha on Wednesday September 14, 2022 @08:06PM (#32845230)
Tabs work just fine in europe where mag stripe payments have been phased out. You pay at the end in the pin terminal.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by FractalParadigm on Wednesday September 14, 2022 @08:19PM (#32845338)
And in Canada. 99.9% of the time if the machine asks you to use the magstripe period there's something wrong and the payment isn't going to process regardless.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mbreese on Wednesday September 14, 2022 @07:27PM (#32844892)
Originally I was thinking they could handle an open tab like a gas station — place a hold on the card for $X for an open tab. But then, the more I thought about it, I’m not sure I want to be the bartender that has to explain why there was a hold of $100 on a college kid’s debit card.

Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok!

There’s got to be a better way…

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by 2muchcoffeeman on Wednesday September 14, 2022 @07:39PM (#32844998)
You could just prepay $X. Then extend it every so often. Any remainder gets refunded at the end. Honestly, in Australia I have not swiped my CC in over a decade.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by girvo on Wednesday September 14, 2022 @09:33PM (#32845917)
In some ways we are pretty spoiled here in Australia, with regards to fintech adoption. The local farmers markets either take cash or contactless (or both depending on the stall). Its the literal only remaining place that I visit that takes cash-only at some stalls. Everywhere else is all contactless, all the time.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by 2muchcoffeeman on Wednesday September 14, 2022 @11:03PM (#32846470)
I suppose so. But it still blows me away that doing basic everyday payments in the largest economy in the world is still so poor and their physical money is terrible.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Nextgrid on Wednesday September 14, 2022 @10:16PM (#32846206)
> Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok!

I've bought gas in France with a Monzo card and the pump was able to hold and release money immediately - ~150EUR hold initially, as soon as I put the pump down it adjusted to the real amount.

Seems like the tech to make this happen does exist, it's just a matter of not using a shitty bank.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @02:27AM (#32862788)
If the merchant is closing out the preauth correctly, the remainder of the hold is released on the spot.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by samatman on Wednesday September 14, 2022 @07:59PM (#32845164)
Do you not give them the card, then they swipe it once at the end and you get it back? How does a stripe affect that?
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Semaphor on Wednesday September 14, 2022 @10:52PM (#32846401)
The whole "giving your card away" thing is so foreign to me (German). Fuck no, I’m not giving you my card. In restaurants and bars they either come by with their handheld terminal, or you go to the machine at the register and simply pay like in any other place.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by samatman on Thursday September 15, 2022 @06:15AM (#32849630)
America having invented the dining (later credit) card, we have some customs remaining from when they worked analog.

I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @02:34AM (#32862823)
> I understand why Germany, a poorer country which was late to electronic payments, wouldn't do this; I don't understand the hostility to it. But then, I'm American, we've been doing this longer than you've been alive.

You mean payments between banks that take two to three days within the country instead of a regulated maximum of 15 seconds across borders?

It's a shame you're so salty that the rest of the world has far overtaken the US. You may have been doing it "longer", but you've absolutely failed to iterate and are still stuck with obsolete technology that's rife with fraud, for which a more appropriate feeling than saltiness is shame.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Semaphor on Thursday September 15, 2022 @06:31AM (#32849752)
Hey, if you are proud of your security issues, good for you :)
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by samatman on Thursday September 15, 2022 @09:07AM (#32851310)
The chargeback is always there, in the background, keeping people honest, broadly speaking. I generally wave my watch at something and carry on with my day, due to the innovative work of Americans. I mean probably a few Germans at Apple, but they're Americans now, and that's what matters.

But having a clunky thing at home you stick your debit card in is okay too! I guess.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by bri3d on Wednesday September 14, 2022 @08:19PM (#32845334)
There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit. You pass off your card, it is swiped and immediately returned. If you don’t settle your tab, it’s automatically settled with a pre-set tip using the stored track data. It’s convenient for bar owners and patrons as the bar doesn’t have leftover cards to deal with and the patron doesn’t have to retrace their steps to recover their forgotten card the next day.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Reason077 on Wednesday September 14, 2022 @09:06PM (#32845703)
Interesting, I haven't encountered such a system at UK bars/pubs. Either it's entirely pay-as-you-go (easy when everyone has contactless), or, at fancier places, they'll trust you to run a tab without taking a card up front.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @02:35AM (#32862831)
> There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit.

What a security nightmare.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by bri3d on Friday September 16, 2022 @11:01AM (#32866965)
More or less a security nightmare than a drawer or tray full of physical credit cards behind a busy bar at night, which is the alternative at US bars? I'd argue that time-shifting card data is actually safer, even if it is often against the merchant agreement.

I really haven't heard of much trouble caused by these systems - of course, they require magnetic stripes in general, which are a massive attack vector, but the bar use case specifically doesn't seem to cause additional issues that I'm aware of. There are so many lower-tech and easy ways to steal magnetic track data, like skimmers, that I don't think compromising bar-back point of sale systems is a particularly high priority for most criminals.

Anyway, this is probably just a small snapshot in time regardless, since once swiped-card transactions finally go away US bars will have to switch to the mobile terminal pay-as-you-go method anyway.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Friday September 16, 2022 @12:53PM (#32868866)
>Once swiped-card transactions finally go away US bars will have to switch to the mobile terminal pay-as-you-go method anyway.

Now you get it.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by justsomehnguy on Wednesday September 14, 2022 @08:40PM (#32845508)
>> It’s convenient for bar owners and patrons

LOL. It's convenient for bar owners. Patrons doesn't give a shit about that.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by pdntspa on Wednesday September 14, 2022 @11:41PM (#32846708)
Speak for yourself, I can't tell you how many times I've left my card at the bar because of an open tab. Nowadays I'll favor places that give me my card back when I open a tab.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by bri3d on Wednesday September 14, 2022 @08:54PM (#32845612)
When the alternative is “hold onto the card” and you have to track it down or order a new one, sure it’s more convenient for the customer too…
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mrguyorama on Thursday September 15, 2022 @01:29PM (#32855480)
This is incorrect. All the bars here in maine have no trouble opening a tab, no matter what payment method you have, including cash.

Some establishments take your card as collateral, some actually swipe it into their system to keep track, but that's not that common.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by astura on Wednesday September 14, 2022 @08:35PM (#32845459)
>If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip

???

Yes you can. At least the bars around me have no problem with holding a tab with chip and/or tap. Maybe they just use newer terminals.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by mrguyorama on Thursday September 15, 2022 @01:32PM (#32855532)
So many people here extrapolating a one time issue they once experienced to cover the whole 50 states of the union and all 330 million of us.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by bmitc on Wednesday September 14, 2022 @07:32PM (#32844924)
Why is that? Due to older machines used or something else?
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by krzyk on Thursday September 15, 2022 @12:22AM (#32847002)
Adding to that: do people use physical cards? (except older generation)

I don't remember when I last saw a person not taping with phone or watch.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by seanmcdirmid on Thursday September 15, 2022 @12:37AM (#32847109)
Fred Myers (a grocery store) where I live doesn’t have NFC POSes in their self checkout kiosks, so I have to whip out my card to chip there. But otherwise I don’t usually use it (though I bring it just in case).
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by JohnTHaller on Thursday September 15, 2022 @12:29AM (#32847059)
Lots of smaller stores have readers where either the tap or the chip is broken. I just went to one today and took out my card to insert the chip instead of using Google Pay.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by krzyk on Saturday September 17, 2022 @08:21AM (#32876929)
Wow it never happened to me, then the reader is broken no cards worked one time it was and by a pure chance I had cash (which I don't carry normally).
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by JohnTHaller on Saturday September 17, 2022 @04:11PM (#32881116)
One of the shops near me can only do tap reading on their reader as the chip isn't working. My debit card only has chip, no tap. But I can pay with Google Pay via my phone. The CVS near me the tap readers in the pharmacy don't work. But the chip readers do.