Hacker News Reader

Comment by outworlder | Hacker News Reader

> "With five account numbers in hand, the hackers distributed the information to individuals in 20 countries who then encoded the information on magnetic-stripe cards. On Dec. 21, the cashing crews made 4,500 A.T.M. transactions worldwide, stealing $5 million, according to the indictment."

If true, that's hilarious. Seriously, ATM reading magnetic stripes? What century are we, again? It seems I've traveled backwards in time. Either that, or it's a new Terminator movie plot.

I haven't seen a credit or debit card without a smartcard (which requires a PIN) in Brazil in more than a decade now. Not sure if it would have stopped this particular attack, as the magstripe readers are still there because of foreign credit cards. However, there are stricter restrictions on foreign money withdrawals which are enforced regardless of the originating bank.

View on HN

US debit cards just require magnetic strip and pin to withdraw from ATMs.

That's the biggest problem.

If the US would switch to chip and pin then all those countries that already use chip and pin can turn off the magnetic strip by default. Right now they need to leave it on as the US is common travel destination.

Chip and pin isn't 100% secure either but it would stop a large number of skimmers.

If you don't travel and you live in a country with chip and pin have your bank disable your magnetic stripe. Even if someone were to skim your card the bank will not authorize a transaction via magnetic stripe.

Chip and pin pushes more burden onto the consumer. I am well protected now with mag stripe - why would I want to place more of a burden on myself to keep a PIN safe when the law currently protects me for unauthorized charges?

Indeed. As a US resident I have never had a chip and pin style card. Every merchant around fully accepts magstripe only, and PIN needed for cash withdrawals.

I've tried pretty hard to get one. None of the banks I've found would provide me with one.

You have to get a specialized "foreign traveler" credit card. My coworker got one from BoA since we work for a Montreal based company and travel up a few times a year.

Here in Jamaica, it's stripe and PIN for debit cards at ATMs and POSs, and stripe and signature for credit cards at POSs.

The card doesn't matter: if the bank can afford to mass produce it, the cost to duplicate it will be small change in a $45 million heist.

Not quite. Chip and PIN adds an additional layer of security (PIN verification upon payment, verified against a secure chip) that is much, much more difficult to duplicate because the internals aren't known. Magnetic stripes are open to everyone.

Actually, the internals are known, it would be security through obscurity otherwise (cough GSM cough)

The mag stripe is as safe as giving everybody your CC number (with CVV code)

Which chip-and-pin two things happen:

- the chip won't work without the pin number being input

- only one transaction is authorized at a time

- the chip is not duplicable (the information needed to duplicate it can't be read from the card)

It's not just the cost of the new cards -- all the payment terminals would have to be upgraded as well. AFAIK, unless you're in a major international city (NYC, Washington DC, SF) the terminals in the stores & restaurants don't know what to do with a chip-only card.

some older ATMs in pacific using only magnetic stripes (e.g. New Zealand). I am from europe and my bank calls me each time when i use ATM because they have to follow security rules - cash withdrawal in low-level security ATM in exotic location)

What? I live in NZ and I've never heard of an ATM that gives you money without a pin.

I think he means magnetic strip + PIN, not just the magnetic strip. Still weaker than chip + PIN.

That wouldn't have prevented this attack since it depended on compromising the payment processing company.

Reply on news.ycombinator.com