Card skimmers on TVMs

[maniacmartin]

Hi,

BBC have a brief article today on Ticket machine card fraud. What's a little worrying is the caption image showing a skimmer on an S&B Ticket machine.

Five out of 23 European countries reported an increase in card-skimming devices attached to transport ticket machines, according to new research.

A report published by the European ATM Security Team (East) in March also found a rise in skimmers found on parking ticket meters in two countries.

Card skimmers, which steal bank card data, are more commonly attached to cash machines by criminals.

Unstaffed pay-at-pump petrol stations were also targeted in six countries.

The report did not identify individual countries but France, Germany, Russia and the UK were among those which supplied information about card fraud activity to East.

British Transport Police told the BBC that while it is was aware of the issue on rail ticket machines it was "not a major problem" in the UK.

According to the UK Cards Association, fraud losses on cards in the UK alone totalled £185m in the first six months of last year.

Once the card data has been copied, fraudsters can then get a cloned card made containing the information of the original account holder.

Chip-and-pin
While many European countries have adopted EMV (Europay, MasterCard and Visa) card security - known as chip-and-pin - America has not.

Cash machines in the US still read data from the magnetic stripe on the back of an inserted card, so even those with a chip-and-pin have a stripe as well.

"Because chip-and-pin is not yet widely supported in the United States, skimmer scammers who steal card data from European ATM users tend to ship the stolen card data to buyers or co-conspirators in the United States, where the data is encoded onto fabricated cards and used to pull cash out of US ATMs," security expert Brian Krebbs wrote in a blog post.

"The latest report from East continues to emphasise that most card fraud, stemming from skimming incidents in Europe, is in fact perpetrated outside of Europe."

 

[Tomonthetrain]

Hi,

BBC have a brief article today on Ticket machine card fraud. What's a little worrying is the caption image showing a skimmer on an S&B Ticket machine.

That's why I prefer to use a ticket office window or a guard to buy tickets. Less chance of it happening then!

 

[trainophile]

Ah! I was trying to remember something that occurred to me that I meant to post on here, and you've jogged my memory...

I was wondering whether there is any way a crook could extract enough personal information from a discarded ticket that has been collected from a TVM to access someone's online account and identity, subsequently using this information for fraudulent purposes.

There are various sets of numbers printed very small at the bottom of collected tickets, also the account holder's surname. I'm assuming these numbers are just internal codes identifying the ticket type or something, but would like to be reassured that there is no backward traceability. I never think to shred them if they haven't been retained in a ticket barrier, I just throw them in a bin. Same question as regards the 'collection receipt' - presumably this too is secure?

 

[Sir_Clagalot]

Easiest way to destroy info on a ticket stripe is to have it near a magnet, say on a smartphone case or handbag clasp... Tis the reason most tickets dont work in barriers etc is beacuse they have had it unwittingly near a magnet

 

[Clip]

There was an alert from TfL last week about this happening on a few machines. Worse than that is that its a plate over keypad too so it records your pin without use of the old camera.

 

[Bungle73]

That's why I prefer to use a ticket office window or a guard to buy tickets. Less chance of it happening then!

But then you miss out on all the online offers available. Anyway it also says its not a major problem. I'm quite sure the main risk atm is at ATMs.

 

[IanXC]

But then you miss out on all the online offers available. Anyway it also says its not a major problem. I'm quite sure the main risk atm is at ATMs.

I think you're probably right that currently the main risk is at ATMs, but as security upgrades are added to those, the criminals will move on when its too difficult. I think the industry as a whole needs to take this issue very seriously and get ahead with making the machines more secure, before customer acceptance of TVMs starts to decline with all the associated consequences.

 

[island]

Easiest way to destroy info on a ticket stripe is to have it near a magnet, say on a smartphone case or handbag clasp... Tis the reason most tickets dont work in barriers etc is beacuse they have had it unwittingly near a magnet

Mythbusters showed that normal magnets have no appreciable effect on a magnetic stripe.

 

[ainsworth74]

Mythbusters showed that normal magnets have no appreciable effect on a magnetic stripe.

Those were credit card magnetic stripes though weren't they? I can easily imagine that the stripe found on ticket stock is not as robust as those!

 

[cjmillsnun]

Good on the BBC for highlighting this...

Some of the equipment used can be very convincing..

Have a look at http://krebsonsecurity.com/all-about-skimmers/

Brian Krebs is a security researcher in the US and probably has more info on this kind of scam than any other non criminal or police source.

 

[Tomonthetrain]

But then you miss out on all the online offers available. Anyway it also says its not a major problem. I'm quite sure the main risk atm is at ATMs.

Unless you ask kindly if a booking office could print out from their machines instead of printing from a TVM

 

[Starmill]

Unless you ask kindly if a booking office could print out from their machines instead of printing from a TVM

I almost always end up doing this anyway because there is a certain type of TVM that just will not read my card!

 

[Mojo]

Those were credit card magnetic stripes though weren't they? I can easily imagine that the stripe found on ticket stock is not as robust as those!

Yes. I have rendered useless the data stored on my train tickets with a fridge magnet on several occasions.

 

[jon0844]

The best scams are ones that evolve and catch even those who think they're wise to being scammed.

People are probably now careful at an ATM but at a train station TVM? Same thing for both - inserting card and entering a PIN. Both just as useful for the thief but quite possibly it's easier to tamper with the TVM at night without CCTV. Much safer for them and you still get someone cloning your card and using the PIN to empty your account.

 

[Gemz91]

The best scams are ones that evolve and catch even those who think they're wise to being scammed.

People are probably now careful at an ATM but at a train station TVM? Same thing for both - inserting card and entering a PIN. Both just as useful for the thief but quite possibly it's easier to tamper with the TVM at night without CCTV. Much safer for them and you still get someone cloning your card and using the PIN to empty your account.

Wonder if this will see an increase in passengers boarding the train without buying tickets before they board, saying they don't want to risk their cards being cloned at the ticket machines.

 

[leshuttle]

In my experience you bypass the PIN entry stage for collecting online purchased tickets from TVMs as the purchase has already been verified. This is generally how I make most ticket purchases so safer. Even for walk-on fares I do this through RSH's phone app as it gets me loyalty points and can be collected seconds from purchase.

 

[bicbasher]

I noticed recently that London Overground has recently replaced the chip and pin readers from the type with the large screen and big black keys to the more fiddly but I'm sure safer Atos readers at all their TVM's.

 

[cjmillsnun]

In my experience you bypass the PIN entry stage for collecting online purchased tickets from TVMs as the purchase has already been verified. This is generally how I make most ticket purchases so safer. Even for walk-on fares I do this through RSH's phone app as it gets me loyalty points and can be collected seconds from purchase.

Not as safe as you think. A skim without a pin can be sent to the US and made into a fake card for paying in shops etc.

 

[jon0844]

My dad had his card cloned (at a Tesco petrol station) and had it used in the US. This was long before C&P though. The bank picked up on it before he did, fortunately.

 

[LE Greys]

Sounds like yet another good reason for using cash wherever you can. The bank knows nothing about what you spend your money on, and there's nothing to clone. Although there's always a risk involved in anything involving money.

Oh yes, and going to the booking office window keeps somebody in a job.

 

[rebmcr]

It's not worth being paranoid about, the bank will always pick up the damage from a skim.

As long as you carry more than one card, the maximum detriment is a bit of inconvenience — one-off, potential inconvenience at that — that is not worth regular deliberate inconvenience to avoid.

 

[jon0844]

I have to say that using cash all the time, and of course being able to get access to said cash if not using an ATM, would be FAR more hassle every day than using a card as carefully as possible.

 

[maniacmartin]

I have to say that using cash all the time, and of course being able to get access to said cash if not using an ATM, would be FAR more hassle every day than using a card as carefully as possible.

I agree. Think of all the heavy coinage you'd accumulate, the lack of a statement of what you spent where each month, loss of airmiles, lack of protection under S75 of the Consumer Credit Act and potential losses from theft of your cash.

Saying that, cash can be easier, for example when paying your way at a restaurant or paying a guard with a fiddly slow Avantix.

 

[jon0844]

Cash has its uses, and sometimes it's essential, so I try and carry some at all times - but I also try never to use the cash. At least when I pay on a debit card, I spend exactly what I need to spend - rather than breaking a note and then (as I often did before) spending the loose change on rubbish.

I doubt we'll ever do away with cash entirely, certainly not as long as there are criminals, business leaders and the like that rely on it to avoid detection, but it's far easier to use a debit/credit card, make payments electronically and do as much as you can online. And for that, there are now a series of new risks to be aware of.

 

[Clip]

I generally do all my monthly spending apart from going out, on a credit card and pay it off at the end of the month now. Far easier. Though I do still carry around £40 - 50 in me wallet just in case and for some cigs at a corner shop

 

[LE Greys]

I have to say that using cash all the time, and of course being able to get access to said cash if not using an ATM, would be FAR more hassle every day than using a card as carefully as possible.

Actually it isn't. If you work out in advance how much money you have available for the next month, withdraw it all on the first working day and then spend it over that month with any excess 'rolling over' to the next month, it works out very well. Sometimes, big purchases require breaking out the cheque book, but that only happens about half a dozen times a year.

Of course, it does help that I only leave the village (where there is no shop) about once a week, and then generally don't do very much spending. I don't do the household food shopping either, so that helps as well.

 

[jon0844]

What's a 'cheque book'?

I have tried the above idea once, but it didn't end well. I expect I'd do better now I'm a bit older, but at the time having cash 'on tap' was a big mistake!

 

[Bungle73]

But then you end up carrying round a large wad of cash. Sounds like a bad idea to me. Besides, I do most of my spending on line.

I do have a cheque book, but hardly ever use it.

 

[LE Greys]

But then you end up carrying round a large wad of cash. Sounds like a bad idea to me. Besides, I do most of my spending on line.

I do have a cheque book, but hardly ever use it.

That depends on how you carry it, where you go, how much it is and what security measures you take. I'm not going to comment on any of those, except to say that I believe that is a risk worth taking.

 

[jon0844]

As you've stated a series of obvious risks just there, surely you can see that it isn't a risk worth taking for many people who would be far safer using plastic.

How much you carry isn't so much of a risk if nobody knows what you've got. I've walked around with well over £1k in my pocket to pay a deposit, and figured that I was at no extra risk because nobody knew.

Where you go IS a potential risk for many people who live in areas where there's always going to be a risk and so you (sort of) prepare for the inevitable, and carrying as few valuables and cash is a pretty good start.

Security measures - well, I am not sure what these might be. Arming yourself in some way, going with a bodyguard, having a briefcase handcuffed to your wrist? Or does that mean changing the way you travel and where you go because of the fact you've got a lot of money on you?

If the latter, that's even more reason not to do it as I don't want to change the way I live my life because of the fact I've got a lot of money on me.