Slashdot Log In
Huge Credit Fraud Ring Sends Europeans' Data To Pakistan
Posted by
timothy
on Sat Oct 11, 2008 04:32 PM
from the we-keep-our-biggest-credit-thieves-in-d.c. dept.
from the we-keep-our-biggest-credit-thieves-in-d.c. dept.
marshotel excerpts from a story at the Wall Street Journal: "European law-enforcement officials uncovered a highly sophisticated credit-card fraud ring that funnels account data to Pakistan from hundreds of grocery-store card machines across Europe, according to U.S. intelligence officials and other people familiar with the case. Specialists say the theft technology is the most advanced they have seen, and a person close to British law enforcement said it has affected big retailers including a British unit of Wal-Mart Stores Inc. and Tesco Ltd."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Wal-Mart UK? (Score:2, Informative)
big retailers including a British unit of Wal-Mart Stores Inc.
Meaning Asda, I guess?
Re: (Score:3, Informative)
Yes - TFA says as much.
Once a grocer (Score:3, Funny)
"Once a grocer, always a grocer."
Said by Penelope Keith (as Audrey fforbes-Hamilton) in "To The Manor Born" (http://en.wikipedia.org/wiki/To_the_Manor_Born) to Marjory Frobisher (played by Angela Thorne) about Richard DeVere (played by Peter Bowles) a nouveau riche millionaire supermarket owner.
How that applies here too!
Re:Once a grocer (Score:5, Insightful)
The article doesn't say where the rogue devices were installed, although they insinuated they may have been placed there in a Chinese factory. The limited number of devices containing the bug and the spread across various retailers hints that they probably weren't placed there by employees of the retailers: they may have been installed during manufacturing, packaging, or possibly during maintenance.
These retailers are big enough that they all likely contract with a third party to perform their hardware repairs. It's possible that a corrupt repair person was responsible for installation of the bugs.
Parent
Screw credit cards... (Score:5, Funny)
Re:Screw credit cards... (Score:5, Funny)
Ppppphhhhhhttttt.
I've found it's simply safer to spend it just after it hits my bank account.
Yeah, most Americans do that. It goes awful fast nowadays. Like the old Depression-era joke:
... these days it's hard to make both ends meat."
Two men are sitting next to a hot dog stand having lunch. One looks down at his meal and says, "You know, one end of this thing tastes like hot dog, and the other tastes like bread."
The other guy responds with "Yeah
Parent
Which probably explains.... (Score:5, Interesting)
... why my local Tesco changed every one of its chip-and-PIN readers to a new make and model about 2 months ago. At this point you're probably wonding which make the old devices were, and I can't for the life of me remember. Sorry.
Any chance... (Score:5, Funny)
Parent
Good quick title edit.. (Score:5, Funny)
...shame my RSS feed still has it as "European's". I was wondering who this poor unlucky chap was, why defrauding him was so huge and quite how it managed to be a ring with only one person..
Re: (Score:3, Funny)
Well, if you're a small-time fraudster, it only takes a one-man ring to rule the mall.
One-Time Passwords for Transactions (Score:5, Insightful)
I've been saying for years, since I first saw one in the 1990s here in NYC, that giving my PIN to some random ATM in some random "convenience" store to get quick cash is an unacceptable security risk. Especially some random ATM that I use at 2AM after running out of cash drinking in a bar, lost among all the ATMs in the neighborhood in my hazy hangover recollection, to be searched for months or years later when they, or someone else along the line, replay my PIN.
Every login to my account from an insecure location (which might exclude my home and office PC, if they've got certificates installed) should consume a one-time password [wikipedia.org] that cannot be replayed for some later, unauthorized transaction. In fact each OTP should be attached to a specific dollar amount and recipient, with an expiration on the transaction after which even that transaction cannot claim money, or get any access at all.
Attempts to replay the transaction should automatically notify the FBI and the bank's security. I should get a notice of any risk warning above some level that I set, and a security statement listing the notices and their resolution with each monthly bill.
Eventually, people whose ID has been pirated will routinely get that security regime alternative after finding someone liable to pay for it. We should all move to that regime ASAP, rather than wait for the damage to force our hands.
Re:One-Time Passwords for Transactions (Score:4, Interesting)
The things aren't exactly trustworthy to begin with, and given the security track record of companies like Diebold, I find ATMs a risky way to get money. I will sometimes use the one inside my bank, but it's not that hard to go the cashier or the drive-up and get cash. Forget about using the "Money Machine" at the local gas station.
Parent
fear not... (Score:4, Funny)
The banks/we are funding the terrorists. (Score:4, Insightful)
A more interesting thought (Score:3, Interesting)
In that case they had posed as repairmen and then rigged the card machines. It forced Stop & Shop to replace all their credit card readers. But then it brings up another point.
What if these rings manage to get to the card readers before they're delivered to the merchants. I bet that is what happened here.
One-factor security (Score:4, Insightful)
Something you have, something you know, and something you are. Security means using at least two out of the three security factors. ATM cards are supposed to be "something you know" (a PIN number) and "something you have" (a card), but unfortunately, the card's only purpose is to hold another number, so it's really "two things you know, one of which must be written in invisible ink". Until we replace all bank and credit cards with electronics that can do public-key cryptography, fraud will continue to rise.
By the way, there's no evidence that anyone from Pakistan has anything to do with this. Most likely, the information is being sent to a compromised server, to conceal the real perpetrators, who could be anywhere.
Re: (Score:3, Funny)
Cartman, is that you [wikipedia.org]?
Re: (Score:3, Funny)
WHY DO YOU HATE AMERICA?!
Because I'm Canadian?!
Anyhow, this was at a Toys-R-Us, not WalMart (they aren't the same company, are they?)
Re:Credit cards are evil. (Score:5, Informative)
Parent
Re:Credit cards are evil. (Score:4, Informative)
And you don't have to 'Sue', so much as prove to the CC company that you are due the cash.
Agreed though, on the Yay for the consumer protection laws. It's not just good for the consumer either- I regularly use my credit card when I don't technically need to, specifically for this guarantee. I am not alone.
Consequently, the CC companies benefit hugely from this.
Parent
Re:Credit cards are evil. (Score:5, Informative)
In America, the credit liability laws limit the consumer's exposure for fraudulent use of a card to $50. In practice, I've found most banks actually cover their customers 100%. You have to swear that it was theft, of course, and perhaps sign an affidavit, and if turns out that you were the "thief" you will be prosecuted for fraud.
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods. For the rest of them, if you are unsatisfied with a credit transaction you can withhold payment from your credit company while you dispute the transaction, but there's paperwork involved. It's not particularly easy, and it's likely to go on your credit report.
Notice that there are no liability limits on debit card fraud, however. If a thief steals your card and drains $10,000 from your account, you now have $10,000 less than you did before you were robbed. The bank does not have a statutory obligation to return your money. Debit cards are horribly risky devices.
Parent
Re:Credit cards are evil. (Score:4, Interesting)
Although they do not have a statutory obligation, many banks do offer a contractual obligation that appears at first glance to exceed the statutory one for CCs. It's been a few years and there haven't been any big exposees on debit card weaselly contracts, so I'd condsider switching from debt based plastic to debit.
Any lawyers who've examined some of the basic debit card agreements?
Parent
Re: (Score:3, Insightful)
Seriously: With credit cards when stuff goes wrong, it's not YOUR money that's gone. It's other people's money. They may try to get it from you, but it's still YOUR money till they succeed.
With debit cards, when stuff goes wrong, it's YOUR money that's gone. You may try to get it from the bank, but meanwhile you do NOT have that money till they decide t
No questions asked, but you can go too far... (Score:3, Interesting)
Some cards here do offer no-questions-asked protection plans (I know American Express does) against defective goods.
A couple of decades ago, American Express pioneered the concept of "money back, no questions asked" if a product bought with AmEx became broken for any reason during the first 30 days after purchase. They had some dumb commercial on TV featuring a kid feeding porridge into a VCR, and a refund being given for the gummed-up VCR.
A colleague of mine perpetually travelled and regularly put more than $20k per month through his AmEx, so they automatically accepted almost any charge from him. Skipping a long and to
Re:Bank insurance + separate account. (Score:5, Informative)
How kind of your bank to not debit your account for transactions you didn't authorise :) Seriously, you don't need insurance against *them* being defrauded. If someone asks your bank to give them money while pretending to be you, it is the *bank* who has been defrauded, not you. "Identify theft" is a cute term the banks invented to turn the poor security architecture in their payments network into their customers' problem
Parent