Card Fraud

IceCreamMan

hey ppl , i am the most careful of ppl with my cards..when paying by card i insist the machien is brought to me or the transaction is conducted under my watchful eye. I am always careful at ATM's , making sure all is cool yet somehow someone managed to clone my bank card an has been withdrawing the daily limit for the last 3 days , luckily i do not have a large daily limit.

So moral of hte story is be damn careful with yr cards. My CC and bank card have now been stopped .. ... but ja its school fees as i guess the bank aint going to reimburse me ,i dont know. not really their fault either i spose.

anyway be vigilant , learn from my school fees an dont pay yr own.

Tonedef

Which bank are you with? From my days at ABSA, I recall that Card fraud is an operational risk that banks are required by Basel 2 legislation to be insured against. Not sure of the details any longer, Ill find out for you.

IceCreamMan

Tonedef wrote Which bank are you with? From my days at ABSA, I recall that Card fraud is an operational risk that banks are required by Basel 2 legislation to be insured against. Not sure of the details any longer, Ill find out for you.

i am standard bank..would be cool if they do refund me but damn i would love to know how it was done ... i am super observant with my cards

Tonedef

Probably a slot scanner. Those fuckers are getting sophisticated.

I personally cringe every time I'm forced to draw from those toy atms you find at graatsjes.

its times like these that I wish I had a thirty aught six and a handy time machine.

I'd call myself "JusticeBliksem".

[deleted]

I personally cringe every time I'm forced to draw from those toy atms you find at graatsjes.

Absolutely! I had quite a scary experience on Friday night, I was at a garage and the guy in the ATM was taking forever. After 5 min. I knocked on the little glass room door to see what the hold up was. Besides the man being super DUPER aggressive (I had to suggest I'll call to the cops), I found out the ATM was broken any way. Still got me worried about my bank account being drained (although the thieves would be a little disappointed), but all is good so far.

---mario---

I always scratch around the machines when I withdraw, people get frustrated of the waiting and this awkward looking bloke inspecting the machine but being a student I really love my pennies and would rather not loose them to some other idiot that goes home with a bread and pint of glue.
Also watch peoples hands, if they swipe the card and then do the savings/check account selections and what not else they drop their hands below the counter and who knows what they have under there.

deefstes

It's a good habit to learn not to let your card out of your sight but the simple truth is that there are so many easy ways in which to skim a card. It requires one swipe and it's done. Toll booth, restaurant, the possibilities are endless. The thing that is easier to protect and infinitely more important is your PIN. If I were you I'd be less concerned with the question of how your card got skimmed but rather how your PIN got out.

The only way your PIN can get out is if you tell someone (heaven forbid!) or someone looks over your shoulder or have attached a camera in a convenient spot near the ATM. For this reason I try to always cover up my hand (with my wallet) when entering the pin. My theory is that, if I can't see my fingers, then no-one else can.

Just make sure you get the pin right but hey, if you can play a pentatonic minor with your eyes closed, surely you can enter a 4 digit pin with your fingers obscured ?

singemonkey

Hear hear. I have SB chip cards so I need to enter for every transaction. I started covering my hand when entering my pin when I noticed the Spar has cameras above the tills to protect against armed robbery (of which they've had a few) and I realised that a thief with access to that video could compile a list of card numbers and then steal the cards.

Now it's entirely routine. Every time I enter, I just position my hand and then cover with the other hand and enter. Not saying I'm entirely safe but I'm confident that it makes things a little harder for card snatchers.

---mario---

singemonkey wrote Hear hear. I have SB chip cards so I need to enter for every transaction. I started covering my hand when entering my pin when I noticed the Spar has cameras above the tills to protect against armed robbery (of which they've had a few) and I realised that a thief with access to that video could compile a list of card numbers and then steal the cards.

Now it's entirely routine. Every time I enter, I just position my hand and then cover with the other hand and enter. Not saying I'm entirely safe but I'm confident that it makes things a little harder for card snatchers.

I also cover my hand with the other hand, those cameras looking over your shoulder creeps me out, I always smile at them when I walk away, bad habit. But yeah, keeping your pin safe is the best, luckily I've never had any card probs so I must be doing it right.

StephenG

if the card skimmers have the techincal equipment to clone the details from a magnetic strip off the back of your card - how difficult do you think it would be to run a simple software program to work out the order of the 4 or 5 numbers of your pin??

deefstes

...mario... wrote...luckily I've never had any card probs so I must be ~~doing it right~~ lucky.

There, fixed it for ya. ?

Bob-Dubery

StephenG wrote if the card skimmers have the techincal equipment to clone the details from a magnetic strip off the back of your card - how difficult do you think it would be to run a simple software program to work out the order of the 4 or 5 numbers of your pin??

Typically somebody using an ATM card gets a small fixed number of tries to get the PIN entered correctly.

My ATM card has a 5 digit PIN. Assuming that some combinations are disallowed I there are over 99000 possible combinations. There's a probability in the order of 0.003% of somebody being able to guess my PIN if Standard Bank allow you 3 chances to get it right.

deefstes

StephenG wrote if the card skimmers have the techincal equipment to clone the details from a magnetic strip off the back of your card - how difficult do you think it would be to run a simple software program to work out the order of the 4 or 5 numbers of your pin??

There are two types of cards, the older magnetic stripe cards and the new smartcards (chip cards). The magnetic strip is fully readable without any encryption. It means that anyone with a card reader can read the card, and that is in fact how it gets cloned. Obviously this means that the PIN can not be stored on the card.

For this reason, magstrip cards can only be used in online systems that is connected to the bank where the actualy authentication of the PIN takes place. Like XRBob points out, ATM's (and this is required by law) will offer you only a limited number of attempts (usually three) after which the card will be blocked and swallowed by the ATM.

With smartcards the memory space on the card is encrypted and so the PIN can be stored on the card. The card actually has some processing capabilities (hence the name "smart"card) so authentication of the PIN happens on the card and consequently it can be used in offline systems as well as online systems. You can never read the PIN from the card, you can only submit a PIN to the card after which the card will tell you "yes, that's correct" or "no, that's incorrect". If you provide the wrong PIN three times, the card will go into lockdown mode and become unusable.

In both instances the valid card holder is reasonably safe.

---mario---

deefstes wrote
...mario... wrote...luckily I've never had any card probs so I must be ~~doing it right~~ lucky.
There, fixed it for ya. ?

haha, thanx! haha

Bob-Dubery

deefstes wrote There are two types of cards, the older magnetic stripe cards and the new smartcards (chip cards). The magnetic strip is fully readable without any encryption. It means that anyone with a card reader can read the card, and that is in fact how it gets cloned. Obviously this means that the PIN can not be stored on the card.

For this reason, magstrip cards can only be used in online systems that is connected to the bank where the actualy authentication of the PIN takes place. Like XRBob points out, ATM's (and this is required by law) will offer you only a limited number of attempts (usually three) after which the card will be blocked and swallowed by the ATM.

With smartcards the memory space on the card is encrypted and so the PIN can be stored on the card. The card actually has some processing capabilities (hence the name "smart"card) so authentication of the PIN happens on the card and consequently it can be used in offline systems as well as online systems. You can never read the PIN from the card, you can only submit a PIN to the card after which the card will tell you "yes, that's correct" or "no, that's incorrect". If you provide the wrong PIN three times, the card will go into lockdown mode and become unusable.

In both instances the valid card holder is reasonably safe.

Executive summary: They have to have your PIN. Even if they clone a large number of cards their chances per card remain very low.

So they'd have to have access to a device where you swipe your card and key in the PIN, or they'd have to find some other way of conning you out of your PIN.

Say they set up a bogus web-site or an email scam that gives them account numbers and PINs. Could they then clone lots of cards and match the clones to the account numbers and thus to a PIN? I would think that with the chipped cards they couldn't, but with the mag stripe cards?

lindsmuse

A relative of mine had someone else's prepaid recharges going thro her card over New Year! Luckily I had just told her about topping up on the internet - she has a cellphone contract and would not have known what these amounts were. She's with FNB and it seems someone was doing this unawares (because of the small amounts) It turns out they were using an old cellphone number of hers (how they got it is another mystery) to access the account! They refunded her.

deefstes

X-rated Bob wroteSay they set up a bogus web-site or an email scam that gives them account numbers and PINs. Could they then clone lots of cards and match the clones to the account numbers and thus to a PIN? I would think that with the chipped cards they couldn't, but with the mag stripe cards?

Exactly, with chip cards it is near impossible save for the most sophisticated of cryptographic attacks. With magstrip cards it is possible in principle but still fairly tricky. The Track 1 and Track 2 data on the magstrip contains more than just account numbers and PINs. It also contains card holder name, expiry date and some discretionary data which is proprietary to the issuing bank.

The scamster will need to know all of those in order to clone a card without having access the original card. It's still possible though as all of the data on a magstrip card is unencrypted.

The bottom line is, your PIN is only piece of security that you have ultimate control of. If someone knows your PIN and steals your money, you have no leg to stand on. If someone steals your credit card and processes a few transactions with a fake signature, the bank (actually VISA or MasterCard) is ultimately responsible but if your PIN was provided in the transaction, you are responsible.

Bob-Dubery

deefstes wrote
X-rated Bob wroteSay they set up a bogus web-site or an email scam that gives them account numbers and PINs. Could they then clone lots of cards and match the clones to the account numbers and thus to a PIN? I would think that with the chipped cards they couldn't, but with the mag stripe cards?
Exactly, with chip cards it is near impossible save for the most sophisticated of cryptographic attacks. With magstrip cards it is possible in principle but still fairly tricky. The Track 1 and Track 2 data on the magstrip contains more than just account numbers and PINs.

What are we saying? The PIN is stored on the mag strip?

Then it's easy to programmatically find the PIN.

Tonedef

X-rated Bob wrote
deefstes wrote
X-rated Bob wroteSay they set up a bogus web-site or an email scam that gives them account numbers and PINs. Could they then clone lots of cards and match the clones to the account numbers and thus to a PIN? I would think that with the chipped cards they couldn't, but with the mag stripe cards?
Exactly, with chip cards it is near impossible save for the most sophisticated of cryptographic attacks. With magstrip cards it is possible in principle but still fairly tricky. The Track 1 and Track 2 data on the magstrip contains more than just account numbers and PINs.
What are we saying? The PIN is stored on the mag strip?

Then it's easy to programmatically find the PIN.

Pin is NOT stored on the magstripe at all.

SmartCards ("Chip and Pin") do not store the pin either, but an encrypted hash instead (at least the EMV standard does iirc), which means it can be authenticated without being online. The SmartCard itself contains additional circuitry to defeat hillclimbing and brute force attacks, although there have been reports that it's not as secure as initially thought.

21Fretter

I need to get a "enter your PIN" every time card. They gave me my new card right before they came out and I don't even have to enter my PIN with mine, just swipe ? (cheque card)