Crooks plant fake payment card terminals at multiple stores

Crooks planted bogus payment card processing terminals at multiple locations operated by the Hancock Fabrics chain store that allowed for the theft of sensitive financial data from customers, the company warned. The personal identification number pads were stolen in August and September and "replaced with visually identical, …

[Uk_Gadget]

They got my details....

....But as they were spending less than my wife, I never reported it..

[joe 32]

42 years to 57 years!

What! 42 years to 57 years for some fraud. Murders, Rapists and Paedophiles don't even get that long!

[kain preacher]

@42 years to 57 years!

People like you make me laugh. The reason for so much time is because the amour of victims. I dont know were you live but Paedophiles here do get long sentences . Back to my original point. Show were some has killed or raped some more than 2 people who would be facing less time then life in prison with out a plea deal . Now if he just scammed on or two people I would say that 42 - 57 be extreme , but he scammed more than just two people .

[Tom 35]

They ripped of the bank, and worse made them look like fools

If they had mugged the same number of people they would get 5-10

[Anonymous Coward]

@@42 years to 57 years! (Kain)

No, people like YOU make ME laugh. Is it more important that powerful financial organizations got defrauded - for which they have insurance - than someone got raped? REALLY?

So, you're saying that you'd prefer your significant other/wife/daughter raped rather than their credit card get ripped off? If you say so.

PS: can we get a moron symbol?

[Steve Roper]

Yes, 42 to 57 years

Now THAT'S more like it. Bung these bastards in the hole and throw away the bloody key. They're of no use to society whatsoever.

And murderers and paedophiles do get life sentences. As for rapists - well, that's an offence that's pretty hard to prove, isn't it? If it *is* proven, then in most cases the rapist will do a long stretch.

[Anonymous Coward]

`They're of no use to society whatsoever"

Moron...

Some of the finest security consultants in the world are ex hackers and crackers. You are just a silly, bitter and angry little man....

[Anonymous Coward]

couple of points...

Ah, and there is the inconvenient truth...

Paedophiles and rapists and the like don't threaten the profit margins of large powerful corporations, so whilst it's important the state makes best endeavours to appear to care, it really isn't *that* concerned -where morality is concerned they leave it to us, the knuckle dragging masses. Where there's money involved, however...

Anyway, `Paedophile` is a very vague term. Someone who likes/has a prediliction for young people. Bearing in mind the legal age of consent is completely arbitrary and varies wildly from one country/culture to the next.... Are we talking about someone who looks at pictures of naked teens (say 14-17) posing on the internet (and does not pay for it) or someone who actually physically rapes babies and or young children (or even older children)? Or someone who has sex with a person of the opposite sex with their consent? Or does it make no difference to you?

Black and white thinking...tsk tsk...

[swaygeo]

RE: Couple of points...

Now that's some powerful cynicism ;-)

The revolution will not be televised - well at least not in HD...

[Anonymous Coward]

If they know the pin it's your fault

Presumably the banks are still chanting the "if they used the pin then it must have been the fault of the customer matnra" with the regulator playing along?

[Disco-Legend-Zeke]

This Is A Failing Of...

...the authentication system. Terminals should be polled, and all downtime logged/accounted for/investigated.

You can do it while i swill my 211.

Hmmm can swill be a verb?

[Code Monkey]

Swill is a verb

But what's a 211?

[Disco-Legend-Zeke]

In The USA...

...211 is the brand mark for Steel Reserve, a very cheap high gravity (8.1% ABV) beer.

It tastes really nasty.

Another, please!

[Peter 39]

where were the skimmers?

It would have been nice if Hancock said which stores were found to have skimmers.

I would also like to know why we only hear about it now, if it happened last August/September. Did they only just find out, or did their lawyers take this long to tell management they had to disclose it? If they have known about it for some time and did not disclose it then there are some serious liability claims.

[Anonymous Coward]

where were the skimmers?

Old news... It made the papers in the SF Bay Area back in September ... At least one of the compromised stores was the Hancock Fabric store in Napa, CA. I believe there were others in parts of the Bay Area, and some in, I believe, Wisconsin.

Lock 'em up and throw away the key...

[Anonymous Coward]

The legal system?

Most likely waiting for cases to be cleared through the snail's pace legal system.

[Anonymous Coward]

Now those are what I call .....

deterrent sentences,lol, to the extreme . What they need to do is advertise this widely and also UK bring in these sentences over here;

""...Last month, three Bulgarian men were charged with defrauding banks of more than $137,000 in a scheme that attached devices to numerous automatic teller machines in Massachusetts. If they are convicted, maximum prison sentences range from 42 years to 57 years...."

2 less crims on streets,ever.

[Steve Renouf]

and cost the tax-payers a multitude more than they actually stole...

... in order to house, feed and clothe them for that period.

I think we need to find a much more cost effective method of punishment. (pointed stick, anyone?)

[Anonymous Coward]

We could...

...ship them off to some penal colony somewhere. But I think the Aussies would complain, they're not hot on immigration these days.

Cf. http://bash.org/?262417

[Fatman]

Punishment

You said: "I think we need to find a much more cost effective method of punishment. (pointed stick, anyone?)"

Pointed stick????

^ Naaaah!

|

| IMHO, a .357 (through the brains) would do nicely!!!!

|

|------------------ Or perhaps, one of these!

[Steve Evans]

How can this be...

After all we were all told the move to chip and pin would make things so much safer...

</sarcasm>

[pctechxp]

@Steve Evans

Chip and Pin isn't in operation in the States

[Wolf 1]

PIN pads are something different

A PIN pad is the keyboard unit found in an ATM, it's a self-contained computer with a huge number of safeguards that prevent exactly this sort of thing.

What Hancock Fabric is talking about is just a credit card reader--a completely different thing. Calling these things terminals is really misleading. They have few if any safeguards and are absolutely NOT PIN pads.

[Boring Bob]

It is a PINpad

A PINpad is any pad that you type a PIN into. The real ones are "highly" secure, the keyboard being itself part of a tamper proof boxes that encrypts the PIN before it can leave the box (it this is needed). The problem is the security requirements for the fake PINpads are somewhat lower than those for the real ones.

[Anonymous Coward]

Solution.

1.Walk into bank.

2. fill in paper withdrawal form

3. speak to cleark.

4. walk out with real, hard, cash

5. buy items.

6. Be content that your purchase was guaranteed hacker free.

Cash truely is the last anonymous transaction.

[Chris007]

you said...

"Cash truely is the last anonymous transaction."

Hence govt from all over the world trying to get rid of it....

[sabba]

Inside job...

I am assuming that these devices were inside the stores. In which case does this mean that store employees were culpable?

paris - cos' she'd "swipe your card" for you!!

[lukewarmdog]

how

Did they manage to remove and replace the number pad with nobody watching? Isn't there usually a CCTV camera pointing at ATMs?

As for the cost of locking them up.. maybe the answer isn't longer sentences but different ones. I'd suggest neutering as a good deterrent. Followed by a lobotomy. Then maybe chopping both hands off. Then feeding to hungry pigs. This should be the standard penalty for most crimes that get media attention.

[Cameron Colley]

But Chip 'n' Pin are infallible!!

The great crime-fighting duo were brought in by banks to wipe out credit card fraud completely! They cannot have failed!!

[Robert Carnegie]

This is in the U.S.

so presumably it is not the "Chip and PIN" used in the UK, but are we safer?

Apparently UK or international bank rules and standards require that a chip card has a magnetic stripe on it as well, which is easier to steal data from, including from compromised reading devices, even chip devices. I don't know if you're "allowed" to remove the data on the magnetic strip yourself. A wire brush or metal wire scouring pad perhaps, but probably not putting it in the microwave.

[Richard Scratcher]

Magnetic Strip

Chip and PIN is not yet available worldwide so the magnetic strip is still required. You could erase it with an AC electromagnet (such as the old tape recorder degaussers). The trouble is you probably wouldn't be able to use the cash machines in the US.

The magnetic tape strip contains all the data the crook needs except for your PIN but there are several scams going on to read the strip and then watch you type in your PIN to a chip & PIN reader. I saw a TV programme where a waiter in the UK was wearing a matchbox-sized card reader on her belt. She pretended to clean the chip of a card but was swiping it through the reader. Then she watched the punter enter his PIN into the chip & PIN terminal. Now she had the necessary data to send abroad so that a card can be made and used in cash machines there.

The other common scam is to attached a false panel containing a strip reader to the front of UK cash machines. Then by using a camera or just looking over your shoulder, the necessary data can be gathered.

The strip doesn't contain the PIN, that's kept at the bank but I was surprised to find that the PIN is stored on the chip.

[Peter 39]

advantage of no CHIP+PIN

CHIP+PIN means that the customer is liable in cases of fraud, unless he/she can prove otherwise (banks don't help a lot here).

In the U.S. the customer is liable only for $50.

Not a difficult decision, is it?

[Ginolard]

re: Solution

Huh. In my experience it would be more like

1.Walk into bank.

2. Try and find a pen still attached to its chain

3. Try and find a working pen still attached to its chain

4. Fill in withdrawal form without the pen nib tearing the form in two

5. Join interminably long queue

6. Realise you are behind the man from the penny arcade who's cashing in his yearly takings

7. Give up and risk being hacked. It's less hassle.

[Tim Jenkins]

Re: how

Rent white van

Walk into store holding clipboard

Tell mimimum wage counter clerk you are here to 'upgrade' the card readers

When manager objects, tell them 'there was a memo about it months ago'

Replace legitimate units with doctored ones

Leave with more units to gimik

Repeat

Simples

(You could even post the things in and get them to do it to themselves. Darn fleshy bio-units; always the weakest link...)

[Anonymous Coward]

Too poor to lose money

So I'm safe then!

[Anonymous Coward]

Good

So, Chip & PIN, functionally useless, as predicted. What a shock. Let's hope this kicks the banks in the direction of implementing proper security. Or better, our politicians/courts into forcing the assumption that it's the banks problem until they can _prove_ the customer was knowingly fraudulent.

Mine's the one with a chequebook in the pocket (hack that with electronics, or replicate my spiders-crawl pawprint as easily as lifting a 4 digit number, and you'll win a big prize...)

[Robert Carnegie]

THIS IS NOT CHIP & PIN.

It's a lousy, leaky, legacy American system.

Would a magnetic eraser to make the stripe unreadable affect the chip on your card as well?

[Anonymous Coward]

No, BUT

ATM's read the mag card before the chip and if the mag card is empty, the machine wont accept the card!!

[Robert Carnegie]

Are you sure?

"ATM's read the mag card before the chip and if the mag card is empty, the machine wont accept the card!!"

If correct, that's moronic. But given many chip card readers don't -touch- the magnetic strip, or most of it anyway, I'm sceptical. I think that goes for human bank teller equipment too.

Furthermore, since major UK upermarkets now let you draw cash at the checkout, you could use a magnetically defaced card for cash that way.

Both theories could be tested on a card that is about to expire and that you have a replacement for, so that you aren't wiped out - at least for your ATM: embarrassing in a shop. I suspect the microwave may fry the chip and leave the magnetic strip working, but physically destroying the strip (scrape it off and then draw one on with permanent-marker pen) seems less risky - although I am rather "good" an!t destroying electronic devices by casual handling.

[kain preacher]

over 1000 victiams

And you are surprised he got that much time. I never said that I prefer a loved one get raped and I never know were you get that impression . My point was the sheer number of victims and then you complain that he gets . Do9 you think Madoff should not of gotten the time he did .