This lady simply swapped bar codes on expensive items for bar codes of inexpensive items. Got away with it for over a year and made as much as $30,000 per month in some months:
http://miami.cbslocal.com/latest-videos/?autoStart=true&topV...
http://www.paloaltoonline.com/news/2012/05/21/sap-palo-alto-...
I started doing this after I watched a whole tray of pink lady apples go in a skip because they brought new produce out.
The same is true of a lt of retail establishments. Old stock is destroyed to keep prices up.
On learning of such a trait in someone I ask 'what if you get caught?', but actually it is not them getting caught that matters. Think of the people that work in that shop and the position they get put in having to deal with petty cheats. Also, would you really want to be banned from the store you get your groceries from? That would be a big inconvenience.
I did see a talk where the folks noted (but did not remove) such devices and then began tracking every account that went through the modified device. This was to figure out who the bad guys were. By watching the fraudulent transactions that happened later they were able to roll up a carding group in the Baltics. But it does take a more proactive approach.
From a future products prospective the use of cards with embedded processors seems better and better.
Btw, if anyone wants to buy one, you can here: http://www.keelog.com/wifi_hardware_keylogger.html
A skimmer and a keylogger are two very distinct things. When I read the title I was interested to find out how the skimmers were placed, placing a keylogger takes much less skill and craft, it's a piece you can buy in bulk, whereas placing a skimmer usually requires a different class of criminal, skimmers often have to be fabricated for each location.
[1] http://support.quickbooks.intuit.com/opencms/sites/default/I...
[2] http://www.ebay.com/itm/CHERRY-MY8000-BEIGE-PS-2-KEYBOARD-CR...
Card got skimmed a few years ago somehow, Amex called, asked if I was in Nicaragua (I wasn't) they apologized, removed the $200 or so in charges and next-day aired me a new card. Almost zero hassle.
I'd hate to have my debit card skimmed but as far as a credit card... I'm not too worried. The risk isn't mine.
It's much better for the banks to carry the can here, so they implement more secure devices.
The rollout date is supposed to be Oct 2013.
As an end user, you are not able to protect from this type of fraud. That's why the liability doesn't reside with you.
The U.S. method, where the low-security retailer is liable, is the most fair. The current charge back system works. Retailers that use inventory control, secure systems, and require ID with large purchases receive few legitimate charge backs. [4]
[1] http://www.cl.cam.ac.uk/~rja14/Papers/unattack.pdf
[2] http://www.telegraph.co.uk/news/uknews/law-and-order/3173346...
[3] http://www.techrepublic.com/blog/it-security/chip-and-pin-th...
[4] http://www.internetretailer.com/2012/10/31/how-karmaloop-cle...
Very interesting subject.
The real security would come with a second factor that the user controls, either by approving on your phone or by using one-time-numbers for each transaction. The reason why these do not exist yet is because they would impede transaction flow, and the basic math with these companies is if fraud rate > rate loss of transaction volume from security feature then use security feature. Otherwise, don't.
"you also type the pin into the same machine... so adding a skimmer..."
There's no copying of SIM Cards.
Yes, you can still copy the magnetic stripe that's there for backwards compatibility. So, yes, it's not going to be safer while there's support for old technology.
My (European) bank issued me a chip-and-pin card without the mag stripe, good for travels, where I won't risk getting my card skimmed again.
It is the second factor in a two-factor authentication scheme.
I seem to recall reading a while back that the overall credit card fraud rate is at the level of single-digit basis points. Is that really true? (I can't seem to find a good link.)
As another poster pointed out, chip and pin is not foolproof and may present a nasty liability shift to consumers when it comes to fraud.
There are also more practical issues with chip cards. First, merchants will be requires to buy new chip capable card readers. They will not be happy about it, but they'll be forced into it by their merchant agreements. Second, chip transactions take noticeably longer to process. From my casual observation a swipe takes 1-3 seconds, but chip readers took at least twice as long. Sounds silly, but it can really add up if there is a long line.
[0] http://www.transactionworld.net/articles/2011/november/innov...
Unfortunately, at least in Canada, it seems like merchants were only obligated to buy the chip terminal so a lot of smaller businesses didn't bother with the wireless payments and force you to type in your pin for a $7 pita.
For real security, you'd need to do something like have the reader internally encrypt the data with the card processor's public key and only send an encrypted blob out of the device. If you're doing that, then anything's secure against this kind of attack. But the readers would have to cost like 10x more, and it probably isn't enough of a problem to bother replacing them all.
It's ridiculous how such an important infrastructure is so vulnerable. Magnetic stripes are easily copiable and without any other "authentication method" it's a done deal.
Now that this is happening in other types of retail stores, maybe it will spur the use of more secure options (chip and pin?).
The entire US still is, and that represents more transactions per day than happen in all of Europe.
These fools are getting caught doing elaborate plants. That's not how real criminals key log (btw, this is not a skimmer, but is a 'keylogger' as joenathan points out). Real criminals sit in the comfort of their car or nearby coffee shop and scan for open connections and insecure use of credentials.
http://www.cherrycorp.com/english/keyboards/pos/8000/
This explains the 'attack vector'. Presumably the scammers have USB dongles too.
You save some $$ in hardware but take on risk.
