A Burger, an Order of Fries, and Your Credit Card Number

From what I know about them when helping install them in a new retail store where i was working a few years ago, there's quite a few of them that act like nothing more than a keyboard. the fancier ones with a display still hook up over usb and i don't think they use a challenge response (I honestly don't know there, i don't know the software for them). Even once I got them in if i was skimming I wouldn't even bother removing them ever. Instead I'd use something like the little XBee modules or some other wireless device to read them and just walk in and act like a regular shopper leaving the retrieval thing in my pocket the whole time.

Having done my time in the independent computer repair trenches with more than one restaurant as a customer, I can tell you that while secure, sophisticated card scanning equipment exists, much of the stuff used at mom & pop stores is rudimentary at best. Basic USB card swipers can be swapped out with zero change required in the software.

None of this really matters though. What are the consequences of having your card skimmed?

For the card holder, it's a mere inconvenience. The banks don't hold you accountable for the breech, because they know you'd never do business with them again.

For the bank, it's only a small loss. They chargeback the transactions amounts to the vendor that took the card.

The "victim" in this scenario is the merchant who accepted the stolen card.

The risk associated with stolen credit card data is diffused this way. Merchants who don't want to assume the risk of accepting stolen credit cards can opt-in to far more stringent CC security practices like CVV2 codes and AVS (address verification). If you've ever had your CC number stolen, you know that the purchases are made overseas, or with shady merchants that don't opt-in for better security.

That's theoretically.

Practically though you first have to dispute fraudulent transactions and file chargebacks. For the most part it's easy, but for certain online transactions the bank will tell you to go and talk to the merchant directly. I had my credit card used to subscribe to the adult dating site. When I called the bank (Royal Bank of Canada, a very large, if not largest bank in Canada), they simply transferred my call to that company and I had to prove them that it wasn't me who subscribed with my credit card. They kept asking for my email address and the phone number "to compare to those on file", and the only thing that helped was actually yelling and swearing at them.

YMMV, but $50 in damages is only a part of the package.

> It's checks I worry about,

I've heard this repeated so many times it is almost becoming an internet meme. I suspect because most younger people have never seen a cheque, they think it is somehow "risky" to show the account number and BSB number.

It's not true. All cheques have them printed on them and have done for decades. The payments clearing system worked fine for all that time, and it still does.

Debit cards are particularly dangerous, as they are as vulnerable as credit cards but do not offer the same protections.

Unless the person stealing the credit card uses it to access a child porn site and you are in the UK.

Then you are on a child abuse register - your life is over. There is no trial because the data just goes straight to a police database and since computers are never wrong how can the police be wrong?

Of course you could try suing the police and insisting on a trial to prove your innocence ;-) If you knew you were on the secret registry, but you would only discover this when you apply to coach your kid's school soccer team and find a SWAT unit turn up at your house.

http://en.wikipedia.org/wiki/Operation_Ore

Possibly not if they're in a country with a weaker economy, lower cost (and/or standard) of living, and no way to get a work visa someplace else?