Hacker News Reader

Comment by moremetadata | Hacker News Reader

"easier for a criminal to snoop on ATM PINs using a thermal (infrared) camera to detect residual heat from keypresses"

https://nakedsecurity.sophos.com/2011/08/17/stealing-atm-pin...

This bit is interesting though:

"So customers tap their card instead -- and here's the trick. When you tap, the account remains open for more transactions, unless the customer proactively logs out."

How can a customer log out in these circumstances?

I wonder if this is a US thing, because contactless payments are different around the world, in Japan they have have higher limits, but are still limited, where as in the UK its lower limits than Japan.

It indicates a number of things, the trust and oversight within the financial system, but also a reflection of the society in general.

View on HN

Like a big button that says log out.

Never leave an ATM without getting a receipt. Never leave a gas station without getting a receipt. That is the one thing that means that your session is terminated.

> To her shock, Bongiorno saw three more withdrawals from her account -- $940 was gone.

What does a receipt prove? That you have a document for one withdrawal, and most people could be forgiven for assuming a withdrawal is a single transaction.

The ATM operator could see if subsequent transactions took place, but Chase probably cant, unless it forcibly introduces a time limit of 5 to 10 mins on each withdrawal from the same machine. In part this is a data sharing contract with ATM operators.

This is where mobile phones in particular SS7 can be used to place your mobile phone and apple watch next to the ATM in order to prevent fraud, but then also highlights who is data sharing with who, especially if your phone doesnt log the cell tower traffic management pinball wizard in order to triangulate the phone's location.

https://en.wikipedia.org/wiki/Signalling_System_No._7

Because a receipt is a forcing mechanism for the system to close the transaction.

No sane system allows for continued charges on a card when a receipt has been generated without re-authentication & re-authorization.

Plus it gives me, the customer, additional leverage in the case where they do screw up.

I printed the receipt at 0944am. At 0945am someone withdrew $100. No new authn/authz.

No jury would allow these withdrawals to stick on the original account.

Phones don't log that info. Cell towers do. there is no way to have a cellular phone and not be triangulable. not with a cell network with fully overlapped coverage areas.

I've never seen a contactless card reader on an ATM in Europe.

Having to log out for contactless but presumably not for a contactful transaction looks like a huge UI oversight.

They're plentiful here in Bulgaria. Man, do I need to get out of the country more often. Fucking covid

I've seen several of them in the EU, but never used one.

According to the industry, they're "already popular" in the EU [1], and

> "There are 52,258 cash machines in the UK, of which about 8,400 – or 16% – support contactless withdrawals,"

Although I see the question "Which countries are leading the way in adopting contactless ATMs?" goes unanswered.

> The rollouts will go largely unnoticed as adding contactless capability to an ATM doesn’t really provide any additional services.

Certainly unnoticed by me!

[1] https://www.retailbankerinternational.com/analysis/david-gri...

Reply on news.ycombinator.com