Card Skimmers at Costco

[Ben]

I thought this was surprising, because Costco has a ton of people working all the time and they are pretty on the ball keeping an eye on stuff, but this article says somebody installed a skimmer at a Costco that got some customers.

All I can figure is it might have been one of the self-checkout lanes, or maybe their gas pumps. I can't see any way for a thief to attach one at the regular registers. I always tap my credit card when I use the card readers there, but I don't know if that bypasses modern skimmers or not.

https://www.foxbusiness.com/retail/costco-card-skimmer-data-breach

[MillCreek]

^^^When I read about card skimmers in this area, they are almost always attached to gas pumps or ATM machines.

[Ben]

^^^When I read about card skimmers in this area, they are almost always attached to gas pumps or ATM machines.

That's where I have generally read about them (and been jacked a couple of times at the gas pumps). I would have figured Costco would say it was at the pumps or the one ATM machine most of them have, but it was curious that they didn't. That would have alleviated some worry for customers.

[Bogie]

Basically, they are overlays... And they can be on your basic point-of-purchase gizmo.
 
Vigilance is about all that works.

[230RN]

Kinda makes sense that they'd rig ATMs and gas pumps since they're accessible for tampering rain or shine, light or dark.

I know, "Captain Obvious."

[Kingcreek]

Our Costco gas pumps have signs on them saying please use tap feature.

[Ben]

Our Costco gas pumps have signs on them saying please use tap feature.

Mine too, but I think they may have started that for the covids rather than card security.

[K Frame]

Whenever I get gas the first thing I do before inserting my card in to the reader is actually grab the reader and try to move it/pull it off the pump.

If it comes off... that's a skimmer.

Or you've broken a very expensive gas pump. 

[230RN]

Pardon my iggerance, but what's the tapping technique and what's it do for you?  I rarely use my credit cards.

[K Frame]

A tap reader means that you don't insert your card into the reader. You hold it next to an area on the machine and a near field communications chip in the card communicates your information with a near field receiver in the machine.

Here's a good article that discusses them.

https://www.forbes.com/advisor/credit-cards/contactless-credit-cards/

If you look at your cards and there's a series of four closing parenthesis -- )))) -- that means that your card is set up for contactless payment.

Ah, here we go...



Generally only cards that have the gold chips in them are contactless.

As for what it does for you... makes payments a bit quicker, especially over having to insert your chip card. Those take forever to read.

And, it's a bit more secure because the chip creates a special one-time use code for each transaction.

Generally, I just leave my card in my wallet (and often my wallet at home) and use my phone. I have my primary CC set up in Samsung pay on my phone, and that is really convenient.

[230RN]

Ah, OK, thanks.  Wallet's in another room, but I doubt I have one.  "Four parentheses" looks like a symbol for radio waves.

     

The full image tells me more.  I do not recall seeing any symbols on the gas pumps at King Soopers, but my usual interaction with the pumps themselves is just to punch the 87 octane button.

[Viking]

Are there actually any legitimate, non-criminal uses for card skimmers? I mean, slim jims are used to get into cars with the keys locked inside, likewise, lockpicks are used to get into homes that the owner locked themselves out of. But I cannot think of a single legitimate, non-criminal purpose for card skimmers. Anyone who can think of anything at all?

[K Frame]

"Are there actually any legitimate, non-criminal uses for card skimmers? "

I sincerely doubt it.

"I do not recall seeing any symbols on the gas pumps at King Soopers, but my usual interaction with the pumps themselves is just to punch the 87 octane button."

About 20 years go Exxon Mobil came out with a dongle for your key chain that was an early version of the contactless payment system. You held it up against an area on the gas pump and it would authorize the pump transaction.

Speedpass! That's what it was.

It was really convenient. I had one for a number of years.

[cordex]

Are there actually any legitimate, non-criminal uses for card skimmers?

Aren't card skimmers essentially just credit card readers reconfigured to a smaller form factor and put to a nefarious purpose?

[230RN]

I just checked my cards, no radio symbols at all.

I haven't seen anything on any pumps regarding this function, but then again, I haven't been looking.  I wonder if they're in some areas and not in others.  Or maybe I'm just too poor to deserve one.

In the balance between security and convenience, I personally prefer more security.  I liken it to checking around your house for "soft points" for uninvited entry.

[K Frame]

Apparently the tap to pay (TTP) cards have really just started rolling out in a bigger way.

I got my first TTP card from Navy Federal earlier this year, IIRC.

My other primary card, from the Pennsylvania State Employees CU, isn't TTP, but it's an older card. I suspect the next one will be TTP.


Whoa... I've done a little digging and TTP cards have been around a lot longer than I thought -- MasterCard apparently introduced the first one in the US in 2003.

[Ben]

Whoa... I've done a little digging and TTP cards have been around a lot longer than I thought -- MasterCard apparently introduced the first one in the US in 2003.

I had no idea they were out that long. My last non-TTP card just switched a year ago when it hit it's expiration date.

[WLJ]

Yep, and a lot of people are highly suspicious of them fearing that people can scan them just by walking by. Noticed a bunch of wallets being sold now that supposedly block the chips being read.

[K Frame]

I've seen those, too. But, if the cards generate a one-time code each time its used, I'd think those types of skimmers would be useless because you'd only get that code, and that code along, and once it's generated it's not valid again.

[WLJ]

I never dug into this stuff, I probably should, but the code doesn't doesn't come into play with online purchases right?

[K Frame]

I don't know the answer to that.

I did goggle a bit more on the security of these cards and I'm not really seeing anything about one-time codes, which I swear I saw on a different site this morning.

So I'm just not sure how these devices are secured.

I do know, however, that the range is VERY short, only a few inches, so someone would have to be very close to you with an electronic skimmer to have any realistic chance of getting a code from your TTP card.

[cordex]

There have been at least a couple of generations of contactless payment.  Some more secure than others.

The version used in the early 2000s was vulnerable to having the CCN, cardholder's name, and expiration date in the clear and could even clone the card.
https://web.eecs.umich.edu/~kevinfu/papers/RFID-CC-manuscript.pdf

I saw a proof-of-concept device in use around 2008ish hidden in a laptop case that could steal credit card data from people just by walking past them.  I think the range was a foot or two with the big antenna loops they used, but there are a lot of cases where someone could easily pass a bag within a foot of your wallet without being noticeable.  The cards I had with RFID around that time were then replaced with cards that didn't have it, but more recently it was added back in.  I'm assuming (and hoping) that the newer ones use a better technology, but I haven't followed it.

[K Frame]

'I saw a proof-of-concept device in use around 2008ish hidden in a laptop case that could steal credit card data from people just by walking past them."

That figured into an episode of NCIS some years ago.

I forget the particulars, but someone used something like that to clone a card.

[230RN]

I've seen ads for those radio-proof wallets where someone passes a skimmer near one's wallet in one's back pocket.  Kinda scary. 

What bothers me about the "few feet" or "inches" range is that the range depends on the receiver sensitivity and triggering tranmitter power.

Theoretically, radio waves go out to infinity and with a highly sensitive receiver, could (again, theoretically) be picked up on Mars*.  So the "few feet" or "within inches" is meaningless.  If someone is sophisticated enough, one could build a triggering transmitter powerful enough to reach out, say six feet, and a receiver sensitive enough to receive a return signal from your purse or pocket.

In this respect, remember that you can lock and unlock your car with your electronic "key" from many feet away.

It basically depends on the equipment.

There's an old saying in amateur radio with respect to quality of receiving equipment:  "You can't work 'em if you can't hear 'em."

The reverse of that is you can work 'em if you can hear 'em.

Terry, 230RN

* I'm ignoring signal-to-noise ratio throughout this for illustrative purposes.  i'm also skimming over the fact that the return signal strength depends on the strength of the triggering signal, since that's what powers the circuitry in the card.

[MechAg94]

My Tacoma has the auto-unlock feature.  If you touch the inside of the door handle, the door unlocks (if you have the key fob).  I have not tried to see how far away the key fob can be for that to work.