Slashdot Log In
Huge Credit Fraud Ring Sends Europeans' Data To Pakistan
Posted by
timothy
on Sat Oct 11, 2008 03:32 PM
from the we-keep-our-biggest-credit-thieves-in-d.c. dept.
from the we-keep-our-biggest-credit-thieves-in-d.c. dept.
marshotel excerpts from a story at the Wall Street Journal: "European law-enforcement officials uncovered a highly sophisticated credit-card fraud ring that funnels account data to Pakistan from hundreds of grocery-store card machines across Europe, according to U.S. intelligence officials and other people familiar with the case. Specialists say the theft technology is the most advanced they have seen, and a person close to British law enforcement said it has affected big retailers including a British unit of Wal-Mart Stores Inc. and Tesco Ltd."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Wal-Mart UK? (Score:2, Informative)
big retailers including a British unit of Wal-Mart Stores Inc.
Meaning Asda, I guess?
Re: (Score:3, Informative)
Yes - TFA says as much.
Credit cards are evil. (Score:2, Insightful)
The ONLY reason you actually need one is to travel.
Re:Credit cards are evil. (Score:5, Informative)
Parent
Re:Credit cards are evil. (Score:4, Informative)
And you don't have to 'Sue', so much as prove to the CC company that you are due the cash.
Agreed though, on the Yay for the consumer protection laws. It's not just good for the consumer either- I regularly use my credit card when I don't technically need to, specifically for this guarantee. I am not alone.
Consequently, the CC companies benefit hugely from this.
Parent
Re: (Score:2)
And you don't have to 'Sue', so much as prove to the CC company that you are due the cash.
Isn't there a similar system in the US? To where you can dispute charges? I assumed this to work for any instance in which the seller was at fault. Although I am not well versed in US credit, I tend to buy locally, with cash, and get those preloaded MasterCard/Visa's for internet purchases.
Re:Credit cards are evil. (Score:5, Informative)
In America, the credit liability laws limit the consumer's exposure for fraudulent use of a card to $50. In practice, I've found most banks actually cover their customers 100%. You have to swear that it was theft, of course, and perhaps sign an affidavit, and if turns out that you were the "thief" you will be prosecuted for fraud.
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods. For the rest of them, if you are unsatisfied with a credit transaction you can withhold payment from your credit company while you dispute the transaction, but there's paperwork involved. It's not particularly easy, and it's likely to go on your credit report.
Notice that there are no liability limits on debit card fraud, however. If a thief steals your card and drains $10,000 from your account, you now have $10,000 less than you did before you were robbed. The bank does not have a statutory obligation to return your money. Debit cards are horribly risky devices.
Parent
Re:Credit cards are evil. (Score:4, Interesting)
Although they do not have a statutory obligation, many banks do offer a contractual obligation that appears at first glance to exceed the statutory one for CCs. It's been a few years and there haven't been any big exposees on debit card weaselly contracts, so I'd condsider switching from debt based plastic to debit.
Any lawyers who've examined some of the basic debit card agreements?
Parent
Re: (Score:3, Insightful)
Seriously: With credit cards when stuff goes wrong, it's not YOUR money that's gone. It's other people's money. They may try to get it from you, but it's still YOUR money till they succeed.
With debit cards, when stuff goes wrong, it's YOUR money that's gone. You may try to get it from the bank, but meanwhile you do NOT have that money till they decide t
No questions asked, but you can go too far... (Score:3, Interesting)
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods.
A couple of decades ago, American Express pioneered the concept of "money back, no questions asked" if a product bought with AmEx became broken for any reason during the first 30 days after purchase. They had some dumb commercial on TV featuring a kid feeding porridge into a VCR, and a refund being given for the gummed-up VCR.
A colleague of mine perpetually travelled and regularly put more than $20k per month through his AmEx, so they automatically accepted almost any charge from him. Skipping a long and to
Re: (Score:2)
Re: (Score:2, Funny)
So you're the asshat that's making everything I purchase cost two percent more. I'll get you! I'm going to make stupid and risky investments and make you bail me out! Hahahahahah!
Re: (Score:2, Interesting)
I get 10% on my gasoline purchases from our friendly local Co-op.
Once a grocer (Score:3, Funny)
"Once a grocer, always a grocer."
Said by Penelope Keith (as Audrey fforbes-Hamilton) in "To The Manor Born" (http://en.wikipedia.org/wiki/To_the_Manor_Born) to Marjory Frobisher (played by Angela Thorne) about Richard DeVere (played by Peter Bowles) a nouveau riche millionaire supermarket owner.
How that applies here too!
Re:Once a grocer (Score:5, Insightful)
The article doesn't say where the rogue devices were installed, although they insinuated they may have been placed there in a Chinese factory. The limited number of devices containing the bug and the spread across various retailers hints that they probably weren't placed there by employees of the retailers: they may have been installed during manufacturing, packaging, or possibly during maintenance.
These retailers are big enough that they all likely contract with a third party to perform their hardware repairs. It's possible that a corrupt repair person was responsible for installation of the bugs.
Parent
Bank insurance + separate account. (Score:2)
Well, I'm just glad that my current bank provides free insurance up to 50k EUR (while maximum I had on my account is 10 times less than that ;). This insurance works in a very nice way - I can come at a maximum a week later and tell them that some transaction was bogus (means that I discovered that some money disappeared from my account without my authorization). And they will revert that transaction if it's below 50k EUR. I don't know how it works - never tried. Probably I will need to prove it somehow, ot
Y'know what... (Score:2)
Cash is easier and anonymous too.
Re: (Score:2)
Re: (Score:2)
Well, you know....cash worked pretty darned well for a few thousand years before the advent of credit cards. We didn't have so many people living beyond their means back then as we do now.
And at the very least...I prefer to pay in cash as much as possible because it really sets in my head how much I am spending. A credit card, much like chips in a casino, abstracts from how much you ar
Re:Bank insurance + separate account. (Score:5, Informative)
How kind of your bank to not debit your account for transactions you didn't authorise :) Seriously, you don't need insurance against *them* being defrauded. If someone asks your bank to give them money while pretending to be you, it is the *bank* who has been defrauded, not you. "Identify theft" is a cute term the banks invented to turn the poor security architecture in their payments network into their customers' problem
Parent
Screw credit cards... (Score:5, Funny)
Re: (Score:2)
Ppppphhhhhhttttt.
I've found it's simply safer to spend it just after it hits my bank account. Then I don't have to worry about having it stolen. ;oD
Re:Screw credit cards... (Score:5, Funny)
Ppppphhhhhhttttt.
I've found it's simply safer to spend it just after it hits my bank account.
Yeah, most Americans do that. It goes awful fast nowadays. Like the old Depression-era joke:
... these days it's hard to make both ends meat."
Two men are sitting next to a hot dog stand having lunch. One looks down at his meal and says, "You know, one end of this thing tastes like hot dog, and the other tastes like bread."
The other guy responds with "Yeah
Parent
Re: (Score:2)
Sir? I'm sorry sir, but there was a call. Your house has burned down.
Re: (Score:2)
Yes! And isn't it nice to know that your WaMu bank account* is safe? Unlike, say, your WaMu stock.
(*Now a JPMorgan Chase bank account. Safe up to $100,000 - er, I mean, $250,000.)
Which probably explains.... (Score:5, Interesting)
... why my local Tesco changed every one of its chip-and-PIN readers to a new make and model about 2 months ago. At this point you're probably wonding which make the old devices were, and I can't for the life of me remember. Sorry.
Any chance... (Score:5, Funny)
Parent
Good quick title edit.. (Score:5, Funny)
...shame my RSS feed still has it as "European's". I was wondering who this poor unlucky chap was, why defrauding him was so huge and quite how it managed to be a ring with only one person..
Re: (Score:3, Funny)
Well, if you're a small-time fraudster, it only takes a one-man ring to rule the mall.
One-Time Passwords for Transactions (Score:5, Insightful)
I've been saying for years, since I first saw one in the 1990s here in NYC, that giving my PIN to some random ATM in some random "convenience" store to get quick cash is an unacceptable security risk. Especially some random ATM that I use at 2AM after running out of cash drinking in a bar, lost among all the ATMs in the neighborhood in my hazy hangover recollection, to be searched for months or years later when they, or someone else along the line, replay my PIN.
Every login to my account from an insecure location (which might exclude my home and office PC, if they've got certificates installed) should consume a one-time password [wikipedia.org] that cannot be replayed for some later, unauthorized transaction. In fact each OTP should be attached to a specific dollar amount and recipient, with an expiration on the transaction after which even that transaction cannot claim money, or get any access at all.
Attempts to replay the transaction should automatically notify the FBI and the bank's security. I should get a notice of any risk warning above some level that I set, and a security statement listing the notices and their resolution with each monthly bill.
Eventually, people whose ID has been pirated will routinely get that security regime alternative after finding someone liable to pay for it. We should all move to that regime ASAP, rather than wait for the damage to force our hands.
Re:One-Time Passwords for Transactions (Score:4, Interesting)
The things aren't exactly trustworthy to begin with, and given the security track record of companies like Diebold, I find ATMs a risky way to get money. I will sometimes use the one inside my bank, but it's not that hard to go the cashier or the drive-up and get cash. Forget about using the "Money Machine" at the local gas station.
Parent
Re: (Score:2)
Yeah, there's any number of better approaches to financial security than are being used now, none of which are free, and none of which banks really see a reason to spend money on. It's pr
Re: (Score:2, Insightful)
I've been saying for years, since I first saw one in the 1990s here in NYC, that giving my PIN to some random ATM in some random "convenience" store to get quick cash is an unacceptable security risk. Especially some random ATM that I use at 2AM after running out of cash drinking in a bar, lost among all the ATMs in the neighborhood in my hazy hangover recollection, to be searched for months or years later when they, or someone else along the line, replay my PIN.
No need for that. What would be nice is a sma
Re: (Score:2)
Re: (Score:2)
The point is ... the vendor that uses tech to eliminate fraud will have more money, so they can pay *better* interest or rewards or whatever.
Public key crypto is, what, 15 years old now? I a little baffled that credit cards and atm cards remain so primitive.
OTP not the solution. (Score:2)
There are trojans in the wild, that hijack the HTML renderer component. The certificate matches, the secure connection matches, the OTP code matches, it's just the amount entered and the target account number that differs between what is displayed on the confirmation screen and what is being sent over the net. You think you're signing a $10 ebay transaction, while what you just signed is $10k for an account in Philippines.
In other words: computer display and keyboard are not trusted devices anymore. You typ
Re: (Score:2, Funny)
This is the TLA police; we're doing the WWW rounds tonight and you're SOL.
outwitted? (Score:2)
So, it's better that the technology they have in place?
Re: (Score:2)
fear not... (Score:4, Funny)
Re: (Score:2)
In the UK. We're fine. Most of our data has already been stored in a government hard drive and left on a train seat somewhere, and it's not like we have any money in our bank accounts anyway.
You mean, you had 10000 in your bank account before the government decided to "insure" it at a cost to each tapayer of 10000?
well it should prove *very* easy for them to insure the remainder....
Re: (Score:2)
The banks/we are funding the terrorists. (Score:4, Insightful)
PCI Law (Score:2, Interesting)
How did they get in there? At the factory? (Score:2)
To be on such a large scale they must have been inserted by someone closely involved - perhaps a distributor but more likely the factory? They are supposed to be tamper resistant.
Of course this is one reason that chip-and-pin is coming, because smartcard data can't be intercepted so easily. OTOH, as they say: if you have physical access other security is irrelevant...
A more interesting thought (Score:3, Interesting)
In that case they had posed as repairmen and then rigged the card machines. It forced Stop & Shop to replace all their credit card readers. But then it brings up another point.
What if these rings manage to get to the card readers before they're delivered to the merchants. I bet that is what happened here.
At what point... (Score:2)
At what point will the card issuers finally go to 2-factor authentication? The fact that credit cards still "mean" something in 2008 is a joke. It could be fixed, it would be expensive, but it's going to be less expensive than these multi-billion dollar losses.
There's no excuse for this lack of sophitication today. We could do so much better.
One-factor security (Score:4, Insightful)
Something you have, something you know, and something you are. Security means using at least two out of the three security factors. ATM cards are supposed to be "something you know" (a PIN number) and "something you have" (a card), but unfortunately, the card's only purpose is to hold another number, so it's really "two things you know, one of which must be written in invisible ink". Until we replace all bank and credit cards with electronics that can do public-key cryptography, fraud will continue to rise.
By the way, there's no evidence that anyone from Pakistan has anything to do with this. Most likely, the information is being sent to a compromised server, to conceal the real perpetrators, who could be anywhere.
Re: (Score:3, Funny)
Cartman, is that you [wikipedia.org]?
Re: (Score:3, Funny)
WHY DO YOU HATE AMERICA?!
Because I'm Canadian?!
Anyhow, this was at a Toys-R-Us, not WalMart (they aren't the same company, are they?)