ATM card skimming machine?

[silent ben]

Every time i use a machine, i give the card cover a good tug, never had it come away...yet.

If i went up to a machine and it had a "this is an anti-fraud device" sticker on, with a suspicious looking box, i'd pull it off. whats the worst they can do to you? tell you off (even though you were only protecting your assets).

[rajagra]

Every time i use a machine, i give the card cover a good tug, never had it come away...yet.

If i went up to a machine and it had a "this is an anti-fraud device" sticker on, with a suspicious looking box, i'd pull it off. whats the worst they can do to you? tell you off ?

The crazy thing is they know people will react that way, so the sticker warns you:

For customer protection this machine has been fitted with a device to prevent card fraud.
Tampering with this device will result in the machine going out of service.
BARCLAYS.

Not only is there an obvious insert in the card slot, to the left of that there is also a triangular projection with a small hole underneath. It's probably a socket so technicians can plug in a diagnostic tool, but it could just as easily be a camera looking down at the keypad!!!
I have some rubbish pictures taken with my phone. I'll post them later.
The whole thing just screams trouble. I reported one back in November, I was assured by Barclays Head Office Security that it was OK. Not that they could have possibly known, when you think about it.

[Oakey]

If you find a skimmer, keep it chances are you'll get a funky little digi cam out of it to mess about with.

http://atm.ev6.net/camera1

[Atomic]

http://money.guardian.co.uk/scamsand...375365,00.html

edit, heres an example of a card reader on the barclays machine:

[Rave]

I meant to use my phone to snap a pic on my way home but forgot. Anyway, they're nothing like as obvious as Atomic's skimming machine, but they do fill up the slot pretty well.

[Ferral]

Theres been loads of fraud lately on the cash machines where crooks have been putting false fronts that are exact duplicates on the machines and when you put you're card in to get money it reads all the card details, you still get the money but the crooks have all the bank details and the pin number etc

[Paul Adams]

pfft no need for a camera, your PIN is stored on the card..

if they skimmed the card then they have your pin already

PINs are NOT stored on cards, that would be a huge, huge, huge design flaw!

The PIN is one of the 2 parts of "2-factor authentication", this is something you HAVE and something you KNOW.
The card itself is something you HAVE.
The PIN is something you (and the bank) KNOW.

One without the other is no use.

Same principle for smartcards and "chip & PIN" systems.

[rajagra]

http://money.guardian.co.uk/scamsand...375365,00.html

edit, heres an example of a card reader on the barclays machine:

And here's another:


So, good old Barclays have created a variety of different add-on devices, ensuring that Joe Public doesn't have a snowball's chance in Hell of knowing what's legit.
Nice one.

Does anyone know what that thing to the left of the slot is?

[silent ben]

Personally, i'd pull it off, see what happens, but thats me

[dazedhorizon]

you should find the one fitted to the machine you saw makes it really quite hard to get your card in and out, its supposed to be there....

m@

natwest do this too, when the card is ejected it does very slowly ....

makes you think though :/

[iMc]

natwest do this too, when the card is ejected it does very slowly ....

makes you think though :/

The first time I used one of those I thought I had been done. Nasty things. Don't trust them at all. It's like the little ejecting motor is about to break or something.

[dazedhorizon]

The first time I used one of those I thought I had been done. Nasty things. Don't trust them at all. It's like the little ejecting motor is about to break or something.

yeap and it only leaves like half a cm of card left to pull out.


I like to get my card before my cash comes flying out thanks !!

[Spud1]

PINs are NOT stored on cards, that would be a huge, huge, huge design flaw!

The PIN is one of the 2 parts of "2-factor authentication", this is something you HAVE and something you KNOW.
The card itself is something you HAVE.
The PIN is something you (and the bank) KNOW.

One without the other is no use.

Same principle for smartcards and "chip & PIN" systems.

Depends entirely on the card tbh

some PINs ARE stored on cards, buy a card reader and see for yourself if you like As are as many details about you as possible to fit on the cards. The PIN can either be stored on the stripe (in older cards) or encrypted in the chip on newer cards (chip and pin or not).

This is the reason why you can only change your PIN at certain cash machines or at a bank etc with you giving them the card- where it can re-write to the chip with the new pin.

It is a major security flaw yes, but then it would be just as bad (if not worse) if you were sending the PIN over the internet/intranet (depending on the machine and its location) to authorise it - simply scanning the packets being sent too and fro would result in the pin being given away....

If you can prove me wrong then thats cool, let me know We had a uni lecturer explain it all to us last year - he could have been wrong

[Allen]

Does anyone know what that thing to the left of the slot is?

It's a hearing aid thing for those with sight problems IIRC... like a headphone socket perhaps?

That's what I heard anyway!

[Paul Adams]

Depends entirely on the card tbh

some PINs ARE stored on cards, buy a card reader and see for yourself if you like As are as many details about you as possible to fit on the cards. The PIN can either be stored on the stripe (in older cards) or encrypted in the chip on newer cards (chip and pin or not).

This is the reason why you can only change your PIN at certain cash machines or at a bank etc with you giving them the card- where it can re-write to the chip with the new pin.

It is a major security flaw yes, but then it would be just as bad (if not worse) if you were sending the PIN over the internet/intranet (depending on the machine and its location) to authorise it - simply scanning the packets being sent too and fro would result in the pin being given away....

If you can prove me wrong then thats cool, let me know We had a uni lecturer explain it all to us last year - he could have been wrong

My first job was in the tech support department of a company that provided till & back office solutions to retailers, and part of that was dealing with banks and EFT systems.
Also, we looked at providing customer loyalty cards for our EPOS system so we had a lot of experience with mag-stripe cards and readers including what information is stored on bank/ATM/debit/credit cards.
I have forgotten more than I can remember, but I seem to recall that the mag-stripe has 2 tracks to store data and it is delimited by what translates to the ASCII character for a semicolon.

In all the bank cards I ever dealt with, the only information that was readily readable was the card number, expiry date and optionally start date & issue number.
The information is CRC'd so it's not easily alterable by mistake - but the equipment and software to do this is easy to obtain.

Some bank systems allow you to change your PIN through an ATM, some don't - and if, for example, you have a Barclays card and use it to take cash out of a Natwest ATM then I would never expect the option to appear to change your PIN (but it may for Natwest customers).

My second job (for a building society) was involved with smartcard systems for VPN authentication and I had a project where I dealt with RSA to integrate smartcard chip & PIN and fingerprint authentication technologies into NetWare, Windows and our web portal.

Towards the end of my time at the building society, there was a project to integrate our core banking system with the "Link" network for having ATMs in our branches.

I would be horrified if any system as key as a financial institution stored the PIN on the card itself - the tokens should only contain enough information for the authenticating system to look up your record and present a challenge for you to prove your identity.

In the same way, Kerberos authentication means that a domain logon in Windows does NOT send your password across the network.
Ever. Not even encrypted.
The analogy used is that the authentication system builds a one-time padlock which is valid for 5 minutes and it can be unlocked using your password and returning the unlocked padlock (not the key) proves that you HAVE the key.

The information on the card/chip should only be enough for your record to be retrieved by the authentication system - not even your name should be stored electronically.


Authentication systems have been my bread & butter for a few years

[EvilMunky]

my mate has recently got stung with these scimming machines on an atm. took 3 grand out of his account cos the bank didnt cancel the card properly. Hes taken over a month to get the money back now.