Why isn't this being reported as a UX issue? Instead it's being described as some issue with the tap functionality in the card.
> Chase did not say why multiple withdrawals did not trigger a fraud alert, or why the bank did not review surveillance video -- but each transaction requires entering a PIN -- which the thieves had apparently captured. So always, cover the keypad, and log out before you walk away.
I don't know when they started placing them high up, if it's some sort of ADA thing or what, but it's very awkward now if you drive a regular car.
https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin...
This bit is interesting though:
"So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out."
How can a customer log out in these circumstances?
I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan.
It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.
Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.
What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction.
The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators.
This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location.
No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization.
Plus it gives me, the customer, additional leverage in the case where they do screw up.
I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz.
No jury would allow these withdrawals to stick on the original account.
Having to log out for contactless but presumably not for a contactful transaction looks like a huge UI oversight.
> "There are 52,258 cash machines in the UK, of which about 8,400 – or 16% – support contactless withdrawals,"
Although I see the question "Which countries are leading the way in adopting contactless ATMs?" goes unanswered.
> The rollouts will go largely unnoticed as adding contactless capability to an ATM doesn’t really provide any additional services.
Certainly unnoticed by me!
[1] https://www.retailbankerinternational.com/analysis/david-gri...
PINs could be bluetoothed to the attacker.
The main problem here is not requiring proof of the card for each transaction.
This is mostly all on the bank.