Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

New Identity Theft Technology Fails to Protect 280

Posted by ScuttleMonkey from the someone-built-a-better-idiot dept.
Nuclear Elephant writes "According to BBC News, identity thieves are quickly adapting to new technologies such as chip-and-pin credit cards using human nature tactics rather than cracking the technology. At least that's what Dr. Emily Finch (UEA), who interviews career criminals about their activities, claims. Finch swapped credit cards with a male coworker and performed a number of transactions without being challenged by cashiers. Finch also believes biometric identity cards will only exacerbate the problem. Regardless of which side of the fence you sit on, could this take us closer to embedded chips under the skin?"
This discussion has been archived. No new comments can be posted.

New Identity Theft Technology Fails to Protect More

New Identity Theft Technology Fails to Protect

Comments Filter:

  • As the T-shirt says (Score:5, Insightful)

    by Emeye ( 871203 ) on Monday September 05, 2005 @02:02PM (#13484203)
    ...there is no patch for human stupidity.

    • Re:As the T-shirt says (Score:3, Funny)

      by Anonymous Coward
      Actually, yes there is a patch for human stupidity. It's called the birth control patch.
    • ...there is no patch for human stupidity.

      They're working on it. It's called Smack-Me-Smart.

      They take people who are stupid, like really stupid, can't get any dumber stupid.

      Then they hit them, until the stupid comes right out.

      This process is often implemented in 3rd World Countries and states like Texas and Florida, onto children and wives.

      The process is not yet perfected, but it is a work in progress.

  • It was said better... (Score:5, Insightful)

    by greginnj ( 891863 ) on Monday September 05, 2005 @02:03PM (#13484210) Homepage Journal

    and earlier, by Schneier:

    "If you think technology will solve your security problems, either you don't understand the technology, or you don't understand the problems."

  • Credit Card prank (Score:2, Interesting)

    by saskboy ( 600063 )
    Zug.com and slashdot has shown this gag before.

    It's very funny, until you realize the implications. I no longer make my signature on credit card reciepts anything like the one on my card. Why bother?
    • Pardon me, I left off the link to the Zug.com prank(s).

      http://www.zug.com/pranks/credit_card/ [zug.com]

    • Re:Credit Card prank (Score:2, Informative)

      by Gwyn_232 ( 585793 )
      This is slightly different from the credit card prank. In the US signatures have never been checked that thoroughly, but in the UK the majority of staff used to be quite careful about checking the card details.
       
      Since chip and pin was introduced they barely look at the card (many don't even take it from you - they just ask you to put it in the card reader).

      • Re:Credit Card prank (Score:3, Informative)

        by E8086 ( 698978 )
        "many don't even take it from you - they just ask you to put it in the card reader"

        I remember when something similar happened over here. I was working as a cashier at the local supermarket during summer and winter breaks. Up to one summer everything with credit cards was done by us at the register, there is a keypad for entering pins directly across from us. That winter there are card readers installed, the generic for credit and debit cards ones you see everywhere now and they were further away from us, so

        • Re:Credit Card prank (Score:3, Insightful)

          by arminw ( 717974 )
          .....fraud protection to cover from the time the card goes missing until it's reported lost/stolen.....

          The obvious answer is to put the chip into the person, rather than into a card the person carries. That makes it a lot harder, although I suppose not impossible to steal. Implantable chips have been in use for animals for a while already. RFID and other readout methods exist for these chips. In combination with biological data, such a system would considerably harder to circumvent.

          This sort of thing was pr
    • There was one friend of mine who simply put an X through everything instead of his name. Honestly it was probably far more secure because it at least gave the cashiers a WTF moment.

      But this all does bring me to a question I've had: what's the point of that number on the back of the card? I mean it's just one more piece of information, sure, but it's not any harder to obtain than the card number and expiration date.

      So what practical benefit does it really offer?

    • Zug.com and slashdot has shown this gag before.

      It's very funny, until you realize the implications.

      Signatures are a laughably stupid "security precaution" in the first place, that's why nobody looks at them, and you don't even need them to order online (including over the phone).

      Does that surprise anybody? Considering the would-be theif has the signature right in front of their face? It's like a password challenge in which the prompt includes the password.

      But so what? Cash never had ANY notion

  • Always a way! (Score:3, Interesting)

    by usageman ( 912573 ) on Monday September 05, 2005 @02:04PM (#13484218) Homepage Journal
    It is possible that one day the imbedded chip under the skin would become law it may even come with a gps and auto feature that disables the user installed in it as well. But taht makes me think about the Bible in the mark of the beast and son on.With all the things you can buy unchallenged with a credit card there will always be a way around any security feature period.
    • Embedded chips that act like credit cards won't ever happen because too many evangelical christians would never go for something embedded chips. This would be because they feel it is one of the signs of the "End times."

      • Re:Always a way! (Score:3, Interesting)

        by FireFury03 ( 653718 )
        Embedded chips that act like credit cards won't ever happen because too many evangelical christians would never go for something embedded chips.

        I would never go for an embedded "credit card chip" either - having your wallet stolen is one thing, but having the part of your body with the chip in it swiped is quite another (I'm being serious - there has been at least 1 case I am aware of in which a carjacker cut off the car owner's finger for the fingerprint because it had a newfangled fingerprint scanner ins
    • Law? No, I'm sorry. I came into this world without a chip, I plan on leaving that way to.

    • Re:Always a way! (Score:3, Interesting)

      by mcheu ( 646116 )
      Aside from the privacy issues of governments, spouses, criminals, corporations, etc tracking people, a GPS device will need to emit a fair bit of EM radiation. We've already got concerns about long term intermittant cel phone use being a potential health hazard.

      You're talking about a device stuck under the skin that's going to blast out EM radiation into you 24/7, continuously, or pulsed every few minutes. I can't see that as being very healthy.

    • Re:Always a way! (Score:3, Interesting)

      by E8086 ( 698978 )
      " It is possible that one day the imbedded chip under the skin would become law it may even come with a gps and auto feature that disables the user installed in it as well."

      yes, there should be a second level of security, I'm not for imbedded in my skin chips, perhaps a 2nd pword/pin or 2nd chip also carried on your person in a place other than where the card is carried. If it's small enough it could be attached to anything you have with you everyday, on a keychain, in a watch, in a piece of jewlery or cont
    • Way off topic. What if in the far future, when nanotechnology is commonplace, everyone born in "civilized" nations gets some device embedded in them that will automatically kill disease? It also has the side effect of prolonging life. This device has flashable firmware that can be constantly updated (and hackable).

      I wonder if people would go for this? Mark of the Beast indeed.

  • Credit card companies don't care (Score:5, Insightful)

    by bigtallmofo ( 695287 ) on Monday September 05, 2005 @02:05PM (#13484221)
    Why would anyone think that the credit card companies would ever care about identity theft? Sure, it does cost them some money. But by far the cost of identity theft is placed on merchants. If someone disputes a charge on the credit card bill, the credit card companies merely take the money back from the merchant.

    As a glaring demonstration of how unconcerned credit card companies are about theft, on the same credit card I had someone fraudulently use it three times. Each time I asked for a new card with a new number on it. Each time the issuing bank (Citibank) said, "Let's just wait to see if it happens again". I had to insist on the third time because I was sick of dealing with it.

    When they can just pass costs onto merchants and consumers, is it any wonder they're designing ineffective solutions?
    • Wrong. In the UK if the merchant users chip and PIN and the transaction is fraudulent, the cost is born by the card company, no the merchant.

      • Any chance you could provide a reference for that? If true, you've just made me a hell of a lot happier about chip and PIN - I'd assumed that the aim was to shift responsibility off the CCs' shoulders and onto someone else's.

        • Re:Really? Cool (Score:4, Insightful)

          by v1 ( 525388 ) on Monday September 05, 2005 @05:24PM (#13485361) Homepage Journal
          The reason merchants take your signature so casually is because they have no financial responsibility. That's part of the visa and mastercard merchant agreement. If the card is approved on the swiper, the merchant is guaranteed his 97% of the take, or whatever it is for that particular card. (visa, mc, and discover are all different %)

          The only responsibility the merchant has is that if he does too many fraudulent transactions percentage-wise, the card handling service he goes through may drop him, and he'll have to find another. I don't know if the card service eats the fraud or if the bank does in those cases. Either way, the merchant is always paid. It's this guarantee that makes a merchant willing to only get like 97% of the purchase price without the right to charge extra for credit purchases. (extra charges for credit purchases are against the credit card processing rules)

          Another somewhat unknown fact is that if someone steals your card or through any other circumstances charges to your cc #, you can be held partly liable. The banks can make you pay up to $50 of the balance of "disputed charges". From the three or four people I've seen get their cards stolen though, the bank usually eats the $50 they could otherwise push on the consumer. I find this very odd for a bank to be generous to the tune of $50, but for some reason they do it. They probably make well over $50 in interest for most card holders during any 2 year period, so for them it's probably better to roll on the $50 and keep them using their plastic.

          The first thing you need to do if your card is missing is report it lost. The $50 limit applies only to unauthorized charges made before the card is reported lost. Anything after that is entirely the responsibility of the bank.
      • Wrong. In the UK if the merchant users chip and PIN and the transaction is fraudulent, the cost is born by the card company, no the merchant.

        I could be wrong, but I thought in this case the card owner could be liable because they obviously didn't protect their PIN well enough.
    • Not so. In the UK, the merchants are now only found liable if they haven't bothered to install Chip and PIN terminals in the store.
    • Maybe you need to have switch to a more security-conscious card company? I've had fraud on my natwest and amex cards (in both cases due to cloning at restaurants), and both immediately replaced the cards. They also do callbacks for authorisation if the transaction is unusual - e.g. when buying electronics abroad.

  • embedded identity (Score:4, Interesting)

    by sedyn ( 880034 ) on Monday September 05, 2005 @02:06PM (#13484226)
    "Regardless of which side of the fence you sit on, could this take us closer to embedded chips under the skin?"

    I fail to understand how an embedded chip would make identity theft any less of a problem. While it may reduce social enginering which the article defines as a problem, how would it eliminate the technical (and in the case of securing identity information, most important) aspect.

    For example, assuming that theives can get around biometric data. What is going to stop them from removing a "read-only" chip and installing a "read/write" chip?

  • Back to basics (Score:4, Interesting)

    by macemoneta ( 154740 ) on Monday September 05, 2005 @02:08PM (#13484234) Homepage
    "Regardless of which side of the fence you sit on, could this take us closer to embedded chips under the skin?"

    If it does work outside of your body, it won't work inside your body. There is no absolute way to prove identity. It's a bummer, I know.

    You can prove (within acceptable limits) that some biometric data (like a DNA sample) comes from you, but there is a gap between that information and identity. Identity is solely a "web of trust" issue. Trying to solve identity theft with some piece of information (like a password) or biometric data (like a fingerprint) will only raise the bar for identity theft.

  • Take my cards, dont' rip my arm away !!! (Score:5, Insightful)

    by Anonymous Coward on Monday September 05, 2005 @02:12PM (#13484256)
    Considering the level of violence some criminals (drug addicts etc) are willing to use on their victims, I'd rather keep my money/cards on my wallet and don't want to have any hard-to.remove RFID chips at my arms.

    • Most chips already in existence will automatically disable themselves if it senses the host is dead (I believe by way of body temperature).


      • The absolute majority of RFID tags that could be embedded under your skin are passive devices with no power source. ie: they only respond when interogated by an external device and they really don't care whether they are alive, dead or even still attached to your body.

        Active tags which have a power cell are around the size of a 10 penny piece are wholely unsuitable for placing under the skin and, of course, would require a minor operation every time the battery needed changing. (Oh, and just *pray* the cell

      • Re:Take my cards, dont' rip my arm away !!! (Score:4, Funny)

        by Tim Browse ( 9263 ) on Monday September 05, 2005 @04:33PM (#13485082)
        I'm sure that's a great comfort when someone's cut your finger off to get past a biometric system.

        I mean, you'd be sitting there trying to staunch the flow of blood as they run off with your finger, chuckling to yourself, and muttering "Those fools. They don't even know it won't work. What a bunch of idiots. I'm way smarter than them."
    • New York Times 2010
      Eye gougings are up 20% this month since the introduction of the new Visa-Eye card, which owes its high security to the uniqueness of the user's iris pattern.
    • I'd rather keep my money/cards on my wallet and don't want to have any hard-to.remove RFID chips at my arms.

      Prior art [bbc.co.uk]

      Malaysia car thieves steal finger

      Police in Malaysia are hunting for members of a violent gang who chopped off a car owner's finger to get round the vehicle's hi-tech security system.

      The car, a Mercedes S-class, was protected by a fingerprint recognition system.

      Accountant K Kumaran's ordeal began when he was run down by four men in a small car as he was about to get into his Merc

  • Credit Cards (Score:4, Insightful)

    by flajann ( 658201 ) <fred...mitchell@@@gmx...de> on Monday September 05, 2005 @02:13PM (#13484260) Homepage Journal
    Security is an illusion; Credit Card security doubly so.

    There is no substitute for hard Commonsense. Signatures are meaningless. Retailers are interested in making the sale and not annoying the customers with suspicion.

    In my case, my signature cannot fit on that tiny space provided on the credit card, and so resembles nothing like it. Most clerks will make a perfunctory "check" of signatures, if they even bother.

    Regard your credit card like you would cash, since there is little more security involved. Though, most institutions that issue Credit Cards and increasingly Debit Cards will give you a chance to dispute charges and have them removed.

    • Re:Credit Cards (Score:5, Informative)

      by zippthorne ( 748122 ) on Monday September 05, 2005 @02:25PM (#13484334) Journal
      In the US, your liability in the event of loss/theft if your credit card is limited by law to $50 (provided you inform the bank as soon as you realize what happened). Debit cards have no such protection beyond whatever contract you and the bank agree to. Therefore, If you insist on using a debit card where you would previously have used a credit card, it behooves you to not only read the contract thoroughly, but also consult a lawyer as to the enforceability of the contract.

  • "New technology"? (Score:3, Informative)

    by hotspotbloc ( 767418 ) on Monday September 05, 2005 @02:16PM (#13484281) Homepage Journal
    So the article talks about how technology fails and social engineering [wikipedia.org] takes over but how is it new? Kevin [wikipedia.org] worked this trick like a pro twenty years ago.

    Dr Finch says criminals have told her how they now look over people's shoulders to see a person's pin being entered on a keypad and then attempt to steal the card at a later date.

    It's called shoulder surfing [wikipedia.org], hardly new.

    • It's called shoulder surfing, hardly new.

      Very true. The difference is that Chip and PIN now actively encourages shoulder surfing, as the retailer will not worry as long as the PIN is correct. Someone taking the card early on a Saturday will pretty much have all the rest of the day to make valid transactions (at other stores) before the owner notices the loss and gets the card blocked.

  • One Time and for All (Score:5, Interesting)

    by Doc Ruby ( 173196 ) on Monday September 05, 2005 @02:21PM (#13484314) Homepage Journal
    Why are credit card companies taking so long to make each transaction covered by its own one-time password? Why do I give the same CC# to a recipient, without security? The card is almost always processed by a machine now, even with a (usually minimum-wage) human handling the transaction. Why should the recipient be trusted not to rerun the charge, or increase it, or share the access info with someone else?

    I know that credit card companies cover fraud loss over $50, so they are paying some of these costs of fraud. But automation has made frauds <$50 much more profitable and common. And identity theft comes after one leak in the identity privacy chain, often without direct damage to the leaking organization. And usually in much greater amounts than the original transaction could have allowed - and usually with much further damage to future transactions than even the value of the theft.

    One-time password tech is much cheaper than the losses we're suffering. And the necessary automation overhead could make the entire transaction system safer and more efficient for legitimate transactors. Where is it? Are banks just making so much money off all their transactions that new systems like one-time passwords are just to low on their priority list? With all the ID theft running rampant, what crisis could it require to force action to protect us?

  • All the more reason to go cash (Score:5, Interesting)

    by Allnighterking ( 74212 ) on Monday September 05, 2005 @02:23PM (#13484327) Homepage
    No matter how hard you try. You can't steal my ID if I use cash. You might steal my cash. Not my ID. Do transactions indoors at the teller window. (Most banks will not ensure that any deposit made at the ATM will make it into your account.) Get to know your tellers. Facial recognition helps a lot. Saved my Grandfather (according to him) years ago when someone tried to cash a stolen payroll check. The tellers knew him. The cops where called.

    Am I alone in noticing that the more protections they build in the easier theft becomes? It would seem that the more you tell people they are too dumb to protect themselves the more they act like idiots.

    • Re:All the more reason to go cash (Score:4, Interesting)

      by Overzeetop ( 214511 ) on Monday September 05, 2005 @02:40PM (#13484431) Journal
      It's like anything else...the more safe you make it, the more complacent we will become. I'm convinced that each person has a risk tolerance band, rather than a limit. They will do foolish things to stay above the "minimum risk" line while still staying below the "maximum risk" line. They will also endeavor to raise the lower limit, proving a perceived reduction in risk. This creates a sort of risk-instability, in which the drive to maximize your "return" (aka, stay above your minimum risk)puts you perilously close to your maximum risk line and results in catastrophic failures rather than minor, progresive ones.

      I probably shouldn't have used "return" above, as you might think I'm referring to financial investing. I'm not. A return would be to reduce your commute time by 2-5 minutes, allowing you to sleep a bit later. The risk you add is driving faster and closer to the car in front of you than conditions would otherwise permit because you have ABS and air bags. Or reducing the effort required to mow the lawn by getting a self-propelled lawnmower, and then using a velcro strap to lock it in the "on" position so you can mow one-handed, closer to that steep hillside, increasing the chance that you and the (locked-on mower) will careen down the bank, cutting out chunks of your [insert appendage here] and destroying your neighbor's [insert anything valuable here].
    • > No matter how hard you try. You can't steal my ID if I use cash. You might steal my cash. Not my ID.

      If you were on your way to buy a high spec laptop, for example, I'd be just as happy with the cash, thank you.

      I'd also like you to do things like checking into a decent hotel, booking a flight, renting a car without using your credit card.....

  • It's all about liability (Score:5, Interesting)

    by slim ( 1652 ) <john@hartnupBLUE.net minus berry> on Monday September 05, 2005 @02:28PM (#13484352) Homepage
    When I was over in the States recently, quite a few cashiers would notice my chip'n'pin card, mention that the US would be moving over to them soon, and saying how nice it will be to have that extra security.

    Sometimes I would try and explain the catch.

    Since chip & pin supposedly makes fraud impossible, banks have shifted the liability for chip & pin fraud away from themselves and onto the consumer.

    That is -- is someone clones your card and forges your signature with a traditional credit card, you can call the credit card company, tell them you didn't make that purchase, and (unless they can prove you were lying) they will refund you the money. They might write the money off, or they might pursue the criminals responsible; it's not your worry. Accepting this risk is all part of their business model. That's what banks are all about.

    However, in the UK at least, this changes with chip & pin. If someone shoulder-surfs your PIN, pickpockets your card, and spends money on your card, the bank now says it's YOUR responsibility.

    In one way: fair enough, there are precautions you can take to safeguard your PIN, but on the other hand, isn't taking on that liability one of the things we're (directly or indirectly) paying our card providers for?
    • "Chip & PIN" in the UK doesn't even seem to be implemented securely. Last weekend I used it at Tesco. As I attempted to put my card in the reader on the pinpad, the checkout assistant grabbed it off me and mumbled something about it needing to go through the cash register. He then swiped the card on the old system they used when you had to sign, and asked me to enter my PIN on the pinpad.

      When I used to work for a company making magstripe & PIN systems in New Zealand 8 years ago, there was a regula

    • When I was over in the States recently, quite a few cashiers would notice my chip'n'pin card, mention that the US would be moving over to them soon, and saying how nice it will be to have that extra security.

      What? They asked you that?? And they said they were looking forward to the extra security??? Wow! The only thing cashiers in the States ever ask me is if I want a receipt, and that's the smart ones. I'm shopping at all the wrong places.
    • When I was over in the States recently, quite a few cashiers would notice my chip'n'pin card, mention that the US would be moving over to them soon, and saying how nice it will be to have that extra security.

      I disagree, I don't believe we will see chip and pin in the US.

      It's much more profitable for Visa/MC when debit card transactions are debited via Visa/MC systems. In the United States, this is done by selecting "credit" on the hypercom and signing a receipt.

      Choosing "Debit" on the hypercom and entering

  • chips won't work either. Nothing will (Score:5, Interesting)

    by pair-a-noyd ( 594371 ) on Monday September 05, 2005 @02:31PM (#13484373)
    You need to see Gattaca [wikipedia.org] and here [imdb.com]

    They were taking DNA samples in real time from people for access control.

    The guy went to extreme measures to defeat the real time DNA sampler.

    No matter what they try, no matter what measures they try to take and enforce, there will always be people that will find ways around it.

    Personally, I will tell them to stick their chips up their asses. When it gets to that point, I'm leaving civilization and heading for an island somewhere, I'll live off of coconuts and iguana stew.

  • Reminds me of "Demolition Man" (Score:3, Interesting)

    by Not_Wiggins ( 686627 ) on Monday September 05, 2005 @02:32PM (#13484376) Journal
    Regardless of which side of the fence you sit on, could this take us closer to embedded chips under the skin?

    John Spartan on Simon Phoenix being unable to buy anything because you need an implanted chip:
    It would be a waste of time to mug somebody . . . unless he rips off someone's hand, and let's hope he doesn't figure that one out.

  • reminds me of... (Score:3, Interesting)

    by amcdiarmid ( 856796 ) <amcdiarm@@@gmail...com> on Monday September 05, 2005 @02:33PM (#13484383) Journal
    The problem of this type of security is that it attempts to replace thought on the part of all involved. (see zug.com about credit card fun)

    When I and my wife got a joint account, the bank swapped our pictures on our atm cards. We look nothing alike, each being easly taken for our respective genders. I used mine (with her picture) for six months without anyone even glancing at the picture. Eventually, when I got passport photos at a local picture processing shop: the clerk looked at the card and refused to process it.

    Literally after hundreds of transactions including a good number in the $250/300 range. Unfortionatly "Security" (tm) is everyones job, but no one wants to do it.
    • The problem of this type of security is that it attempts to replace thought on the part of all involved.

      People are stupid, and security measures must take this into account:
      1. The original signature system didn't take this into account because the shop cashiers are stupid and don't check the signature.
      2. The new chip & pin system doesn't take this into account because the card holders are stupid and don't protect their pin.

      Admittedly (2) can be reduced by having well designed keypads that reduce the vi
      • not to enforce/validate who you are. I beleive that the seller is supposed to validate your identity with other documents. (not that it is done.)

      • Anyone care to explain why they opted for using pin numbers instead of electronic signature recognition - I was under the impression that signature recognition is quite reliable (it's certainly been around for a while). Signatures are much harder for someone to reproduce than a PIN and this method would remove the need for the cachier to check the signature (which they don't do anyway).

        PIN technology was probably the easiest, cheapest, fastest solution. It's merchants that get hurt the most with fraud.

  • Biometrics cellphones (Score:4, Interesting)

    by jsveiga ( 465473 ) on Monday September 05, 2005 @02:34PM (#13484388)
    A friend just came back from Japan, where his cousin was paying groceries et all with his cellphone, which had a "sweep-type" fingerprint scanner (and videophone, and fast internet, etc).

    I also heard years ago that somewhere in Scandinavia you could pay some soda vending machines just by calling the phone number on its front with your cell phone.

    It is interesting to see phone companies grabbing part of the credit card market.

    Maybe it'll converge to using your phone/phone account as an ID, driver's license, bank account, credit card, and even to call people!

    Instead of money, you'll be paid in talktime credits...

  • One possible solution (Score:2, Interesting)

    by slobber ( 685169 )
    Ok, so you make a credit card transaction and before it is approved, you get a call on your cell phone, enter a PIN and only then the transaction is approved. Yes, you need to have a signal for this to work, but I think this gets around many problems inherent to other verification methods.
  • Most retailers now use a self-swipe card reader. They don't even look at the card.

    Every once in a great while a clerk will ask to see my card at my local supermarket. But those occasions are few and far between.

    They don't even cross match the store ID card with the card you swipe. I understand that there are flaws such as a spouse having a store card with the same number on it. But there has to be a better way of checking to be sure the credit/debit card holder is who they say they are.

    This is why
    • I think these self swipe readers are a huge security hole. Anyone can spend a few hundred dollars for a magnetic card writer and change the information on the card. Getting a credit card number isn't that difficult either. It seems crazy to me that retailers AND credit card companies don't seem to care much about this. Is it really cheaper to let people scam the system than to make the system more secure?
      • Having once built POS systems using software and hardware I'm fully aware that a reader/writer is pretty short money.

        And most banks haven't yet made the transition from mag-stripe to smart-chip. The entire infrastructure would have to be changed.

        As to why there isn't any serious effort to combat fraudulent credit/debit usage that's simple. The people who suffer are the merchants and the card holders. The banks, card issuers, and card processors are competely off the hook when it comes to fraud.

        A me
    • This is why I'd be much more comforable with a card + thumb print + pin scenario.

      I'm not happy with the idea of using my thumb print / iris scan / etc as part of the transaction - seems to me it would invite the criminals to chip off my thumb or scoop out my eye at the same time as swiping my wallet. I'd be much happier with something like electronic signature recognition - much harder to forge a signature than punch in a pin number and you're nolonger relying on someone to bother to check the signature ma
      • Ah but without the pin it'd be useless. And encrypt the minutae of the thumbprint with the pin. Use challenge-response authentication on the pin.

        But most importantly make sure the thumb, iris, etc. is attached to a living, breathing being. Most of the theft of credit/debit cards is non-violent anyhow. Most of it exploits technology or processes .

        But signatures are worthless. The signature on my card and on my drivers license is far different from the way I actually sign things. It's why I always make i
        • Ah but without the pin it'd be useless.

          Ok, so after someone has looked over my shoulder and seen my pin, instead of just mugging me for my card they'll take the trouble to cut my finger off too - great.

          But signatures are worthless. The signature on my card and on my drivers license is far different from the way I actually sign things.

          Signatures are not worthless - signature analyser systems look at the _style_ and order of your pen strokes, not the exact shape of the finished signature. So it doesn't matt
      • The problem with sig recognition is that your signature not only changes over time, but changes with the document you're signing the the materials you're signing with. Try it some time. Sign an electronic pad (and try different ones noting how they aren't always good writing surfaces. Then try signing a regular sheet of paper with a ball point pen, and then try a gel ink pen. From there, try signing a form on which you need to press hard to make duplicates. Last but not least, compare the signature on your
        • The problem with sig recognition is that your signature not only changes over time, but changes with the document you're signing the the materials you're signing with.

          Signature analyser systems look at the _style_ and order of your pen strokes, not the exact shape of the finished signature. So it doesn't matter that your signature is different every time, you're still drawing it in the same way (just as handwriting analysis can match handwriting to a particular person even though the 2 samples of writing ar
  • Not only is the idea of having RFIDs embedded into people's skin scary to me, but it also promises to add a new, terrifying meaning to the term "hacking"...
    • Not only is the idea of having RFIDs embedded into people's skin scary to me, but it also promises to add a new, terrifying meaning to the term "hacking"...

      Well, the "hackers" are supposed to be the curious test-the-system type of guys. It is it the "crackers" with their "cracking tools" that you should really be worried about...

  • Easy identity theft (Score:3, Interesting)

    by tsa ( 15680 ) on Monday September 05, 2005 @02:52PM (#13484490) Homepage
    My professor recently had his identity stolen. Apparently the thieves stole some of his mail from his mailbox, and opened a new bank account in his name by his bank. Then they applied for internet banking on his `real' bank account. When they had that, they could easily steal his money. I find it amazing that it is so easy to steal someones identity with this bank.
    • I'd say it's easy to steal someone's identity, PERIOD. Why? Because thanks to various government and commercial interests, our personal information is ALL OVER THE DAMN PLACE. I cringe every time I hear someone who wants a copy of sensitive information like a driver's license, a social security card, or a passport - it's just one more access point available to thieves. They just don't seem to get it - their methods might actually contributing to a potential breach of the very security they're trying to enfo
  • I would much prefer to be able to carry on using my signature. Someone standing behind me wouldn't be able to knock me over the head, and go to a cashpoint to withdraw cash after seeing me sign my name. Sure you can forge them, but it's a bit harder than punching in 4 numbers.

  • How stupid (Score:4, Insightful)

    by AdamInParadise ( 257888 ) on Monday September 05, 2005 @03:01PM (#13484534) Homepage
    The whole point of the Chip&PIN scheme is that you're authenticated with your PIN, so you must keep this PIN secret. You can't keep your signature secret.

    This is like saying "Login & Passwords schemes are insecure! If I give my login and password to my coworker, he can impersonate me! The sky is falling!"

    Actually, the Chip&PIN scheme is better than Login/Password schemes since you need a physical device (the smart card) to perform the transaction.

    If this new scheme forces thiefs to switch to "Social Engineering", well, it's a good thing, since people can be educated about them.

    I love this quote:
    She claims this chip and pin technology, as it is called, has not reduced the problem of fraud.

    The amount of "card-present" fraud in France (where this scheme is in use for about 20 years) is severals orders of magnitude lower than in other countries with similar caracteristics. Ok, the "Problem of fraud" has not been reduced, but the "Amount of fraud" has, and that's what matters.

    • Re:How stupid (Score:3, Insightful)

      by macemoneta ( 154740 )
      If this new scheme forces thiefs to switch to "Social Engineering", well, it's a good thing, since people can be educated about them.

      Be careful what you wish for; social engineering comes in many forms.

      [Points gun at head]: Give me your card.
      What is the PIN? [Pulls trigger]

      You've just been socially engineered out of your funds, and life. Raising the bar on security doesn't always mean it's harder for a criminal, or safer for you.

  • I recently returned from a trip to the Philippines. One of the most annoying things about the shopping there is that they actually verify credit card signatures, and, if your signature is the least bit different on the receipt than on the card, a manager has to be called over.

    Even the most brain 2 dollar a day cashier chicks carefully verify credit card transaction, and, if there's a question, they'll gather another two or three cashier chicks to cluck at the card before summoning a manager, who will the

  • The reason that newer technologies fail is the ability of the criminal to adapt to all the security flaws inherant in every new technology...
    The only way to be secure is to use more than one security technology...
    For instance, you have cards that are read by proximity detectors...all I have to do, as a bad guy, is get a reader and scan people as they walt past me...store the data, and copy it into new cards...bingo!
    What we need is more security, not more technology...
    For instance, a smart card credit ca

  • Who needs eyes? (Score:2, Insightful)

    by divisivemind ( 888140 )
    While biometrics and/or embedded chips would ensure additional security for the average transaction, I'm not looking forward to purchasing additional dismemberment insurance for when some thug decides he wants to mug me. Biometrics might just make using my credit card harder to do without riping out my eyes or dismembering my fingers/hands/arms. No need to encourage that behavior. Its probably best to keep cash/cards easily accessible so you at least have a chance of surviving the encounter. After all,

    • Re:Who needs eyes? (Score:4, Interesting)

      by Detritus ( 11846 ) on Monday September 05, 2005 @06:17PM (#13485633) Homepage
      I've read about a number of local cases where the thug kidnaps his victim and takes him to a cash machine, forcing the victim to make a withdrawal or be shot. These are the same dead-enders who switched to carjacking when it became too difficult for them to steal unattended cars.

    • Re:Who needs eyes? (Score:3, Informative)

      by hlh_nospam ( 178327 )
      No need to encourage that behavior.

      No need to encourage that behaviour, indeed. I live in a state that allows me to carry a concealed handgun, and I am certified to teach the state concealed handgun course. The most effective deterrent is the occasional would-be thief that is shot by his intended victim. This encourages thieves to move to areas that require potential victims to be unarmed.

  • From the article... (Score:4, Insightful)

    by ttsalo ( 126195 ) on Monday September 05, 2005 @03:41PM (#13484771)
    "Instead of using stolen cards, criminals are now taking over people's identities and applying for cards in their name. If you think about a credit card application, it doesn't actually require much information about an individual that can't be found out with a little bit of research."

    Oh please! Because the authentication of people's credit card applications is completely broken, the problem of cloned and stolen cards shouldn't be fixed? I'm the first to admit that technology alone isn't enough, but this absolute stupidity of authenticating people by "personal" "secret" information has got to stop. (And no, trying to fix that by safeguarding the info better will never work.)

  • It will only make ID theft more gruesome.

    And as another poster has put it so clearly, why do we even NEED credit cards? At present our debit system works well enough. I have stopped using credit cards long ago. I still buy stuff (albeit less stuff I don't need since I have to think more about what I buy) and my bills are paid reliably.

    In my view, only two things require credit -- houses and cars. For some people, cars don't require credit either... lucky them. But for anything else, there's cash.

  • cashiers asking for ID (Score:4, Interesting)

    by Anonymous Coward on Monday September 05, 2005 @03:59PM (#13484887)
    The cashier didn't ask for the coworker's ID probably because he looked like a non-threatening white person.

    My experience:
    I was standing in line one time and two friendly-looking white women ahead of me used their credit card without the cashier asking for their ID. When it was my turn, the cashier asked for my drivers license to check my signature on the receipt. I guess the cashier assumed two white women are less likely to commit fraud compared to an asian guy. Acting casual and friendly is how con-artists get away with fraud.

    I don't mean to turn this into a race issue, but it cannot be ignored.
  • I'd be happy if they'd develop a single customer loyalty card. My key ring / wallet can't take much more of this.

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close