Self-Service Checkouts: Dangerous For Your Credit Card...

Self-checkout systems in UK supermarkets are being targeted by hi-tech criminals with stolen credit card details.

A BBC investigation has unearthed a plan hatching online to loot US bank accounts via the checkout systems.

Fake credit cards loaded with details from the accounts will be used to get cash or buy high value goods.

With the help of computer security experts the BBC found a discussion on a card fraud website in which hi-tech thieves debated the best way to strip money from the US accounts.

The thieves claim to have comprehensive details of US credit and debit cards passed to them from an American gang who tapped phone lines between cash machines and banks.

In the forum they are asking for information about Asda and Tesco stores in which it is possible to use self-service systems that mules could visit with the fake cards to get at the cash.

The fraudsters are looking for self-service systems to avoid contact with store staff who may spot the fake cards.

Representatives from both Tesco and Asda argue that payment systems automatically contact the banks when a card is swiped instead of using chip-and-pin. The banks must authorise the acceptance of a signature.

"If the card has not been reported as having been cloned, yes, it can go through," said a spokeswoman for Tesco. However, she pointed out that swipe and sign transactions represent a tiny fraction of the supermarket chain's trade.

http://news.bbc.co.uk/1/hi/technology/7584258.stm

Not a problem for me, though. I only use cash. I quite like the self-service checkouts, but this kind of story must have the big supermarkets rattled. Most customers, as a rule, are not so keen on the self-service checkouts - perhaps they seem a bit too intimidating.

This kind of scare story hardly helps customer 'take-up' as the supermarkets continue their Self-Service roll-out... :lol:

I once got politely told off for having a heated argument with one of these in Tescos.

Devil spawn.

I hate those things, I much prefer going to a manned (wommaned?) till and having at least some chance of interaction.

Or just eyeing the name badges, I got served in a Tesco's the other the week by a woman whose name looked as though it had simply been pulled out of a scarbble bag.

I like using the Self Service checkouts because they are usually not busy. And it also means I don't have to make inane small talk with the checkout operative. I do usually use card, but after reading this story, you can consider my monger to have been scared.

There's no difference between you using the self service, or having a cashier swipe your card. If the criminals have cloned your card and know the pin, they'd be able to fraud you either way.

Let's face it, if the criminals are technically proficient enough to clone cards and bypass the whole chip and pin security gubbins, they'd be proficient enough to make convincing cards.
Besides, why go to a strawberry floating supermarket? The internet would be the best place to commit fraud.

The ATMs at the Morrisons I work at have all recently been used by criminals to nick money from people's accounts. Someone even got a fake £20 note out of one the other week.

They're gooseberry fool.

"Please place the item in the bagging area"

*Places item*

"Unexpected item in the bagging area, needs approval"

*Waits for staff to enter their code*

*Scans next item*

"Item needs approval"

*Waits for staff to enter their code*

Drunken_Master wrote:There's no difference between you using the self service, or having a cashier swipe your card. If the criminals have cloned your card and know the pin, they'd be able to fraud you either way.

Let's face it, if the criminals are technically proficient enough to clone cards and bypass the whole chip and pin security gubbins, they'd be proficient enough to make convincing cards.
Besides, why go to a strawberry floating supermarket? The internet would be the best place to commit fraud.

The internet isn't the best place purely because it requires an address to be entered in order for you to receive your goods whereas Tesco's or any high street store wouldn't need your address.

If you know what you're doing they are simple. But you need to understand what it is that makes them play up.... which is a lot of things.

Last edited by HrC on Fri Aug 29, 2008 11:38 am, edited 1 time in total.

Hmm, I like the self-serve checkouts but rarely use a card with them. From experience however, the system normally tells the till assistant that the card is being swiped and signed for. So hopefully they would go over and "help". If the card is being verified for these transactions, then it would be safer to do it the good old way over the phone than automating it with the system (even though telephone verification is a pain in the ****).

on a side note:
I still think that alot of the problems with self-service tills is that they have terrible instructions on what to do. I think the biggest problem is the bloody annoying "skip bagging" command, which people insist on pressing on the premise that it will speed up the process, only to realise that they now cant put the item in the bag because they have told the system that they arent putting it in. Talk about ambiguous commands!

Edit:

Shadow wrote:They're ****.

"Please place the item in the bagging area"

*Places item*

"Unexpected item in the bagging area, needs approval"

*Waits for staff to enter their code*

*Scans next item*

"Item needs approval"

*Waits for staff to enter their code*

bigcheez2k3 wrote:
Drunken_Master wrote:There's no difference between you using the self service, or having a cashier swipe your card. If the criminals have cloned your card and know the pin, they'd be able to fraud you either way.

Let's face it, if the criminals are technically proficient enough to clone cards and bypass the whole chip and pin security gubbins, they'd be proficient enough to make convincing cards.
Besides, why go to a strawberry floating supermarket? The internet would be the best place to commit fraud.

The internet isn't the best place purely because it requires an address to be entered in order for you to receive your goods whereas Tesco's or any high street store wouldn't need your address.

How hard is it, to temporarily rent a place and have all your goods turn up there? A warehouse perhaps?

Last edited by Cal on Fri Aug 29, 2008 11:40 am, edited 1 time in total.

Drunken_Master wrote:There's no difference between you using the self service, or having a cashier swipe your card. If the criminals have cloned your card and know the pin, they'd be able to fraud you either way.

Let's face it, if the criminals are technically proficient enough to clone cards and bypass the whole chip and pin security gubbins, they'd be proficient enough to make convincing cards.
Besides, why go to a ******* supermarket? The internet would be the best place to commit fraud.

The opening post actually refers to fraudsters using stolen US credit card details, copied onto fake cards, to steal from US accounts through UK supermarkets. A bit complicated, but that's the gist.

Self Service checkouts are ideal as there is no 'third-party' - i.e. a human checkout operator - between the fake card user (known as the 'mule') and the card swipe machine. As Tescos admit, if the number the fake card uses has not been reported stolen, the Self Service checkout swipe, despite seeking automatic authorisation from the bank concerned, would not see anything amiss.

Having said all that, it's doubtful whether a real 'Sharon' at the checkout would, either. :lol:

bigcheez2k3 wrote:The internet isn't the best place purely because it requires an address to be entered in order for you to receive your goods whereas Tesco's or any high street store wouldn't need your address.

That's not to say the supermarkets don't know the address of their shoppers. They practically know most of their customer base through reward cards & schemes. They know exactly what you're buying, how you're buying it & when.

KKLEIN wrote:
bigcheez2k3 wrote:The internet isn't the best place purely because it requires an address to be entered in order for you to receive your goods whereas Tesco's or any high street store wouldn't need your address.

That's not to say the supermarkets don't know the address of their shoppers. They practically know most of their customer base through reward cards & schemes. They know exactly what you're buying, how you're buying it & when.

Don't use a reward card?

bigcheez2k3 wrote:Don't use a reward card?

But I want my 1 Nectar point for reusing my bags.

bigcheez2k3 wrote:
KKLEIN wrote:
bigcheez2k3 wrote:The internet isn't the best place purely because it requires an address to be entered in order for you to receive your goods whereas Tesco's or any high street store wouldn't need your address.

That's not to say the supermarkets don't know the address of their shoppers. They practically know most of their customer base through reward cards & schemes. They know exactly what you're buying, how you're buying it & when.

Don't use a reward card?

Exactly. I never use 'em. Never will. Supermarkets use them as a profit centre, they exploit your details by selling them on - and they do very nicely out of it, too. Think about it. They have amassed millions of names, shopping habits, customer profiles - how valuable is that sort of information to countless PR, advertising and government agencies up and down the country?

I won't even go into the more shady uses of the data... save to say

Might as well get in first with it! :lol:

Mockmaster wrote:And it also means I don't have to make inane small talk with the checkout operative.

Just glare at them and say nothing. They'll soon learn to ignore you completely and focus on tilling duties.

I've used them when I get lunch at the Tesco near my Uni. I normally use my debit card because I can't be bothered getting money from the bank whenever I run out of change.

Maybe I should following the scare-mongering and not use my debit card in future.

The fake cards that are used look nothing like cards you or I use. Why bother manufacturing a convincing replica, when a phone top-up card works just as well? Or any other type of card with a magnetic strip? Look through your wallet; any card with a black stripe on the back could be used as a counterfeit card.

The story, as Cal said, explains that cards in the USA are cloned (no chip & pin over there) when a cashier either double swipes the card or swipes the card through a separate machine (under the counter for example). Cashier then sells these details to gangs who distribute the numbers around the world where the counterfeit cards are then made.

The self-service checkouts do not read the little gold chip on the front of you card, but the magnetic strip. That is why the counterfeit cards work.

And it is much easier for this type of fraud to occur, than on the internet.

Trust me, I'm a Fraud Analyst. 8-)

Igor wrote:The fake cards that are used look nothing like cards you or I use. Why bother manufacturing a convincing replica, when a phone top-up card works just as well? Or any other type of card with a magnetic strip? Look through your wallet; any card with a black stripe on the back could be used as a counterfeit card.

The story, as Cal said, explains that cards in the USA are cloned (no chip & pin over there) when a cashier either double swipes the card or swipes the card through a separate machine (under the counter for example). Cashier then sells these details to gangs who distribute the numbers around the world where the counterfeit cards are then made.

The self-service checkouts do not read the little gold chip on the front of you card, but the magnetic strip. That is why the counterfeit cards work.

And it is much easier for this type of fraud to occur, than on the internet.

Trust me, I'm a Fraud Analyst.

Stupid backwards yanks ruining everything again I see.

Self-Service Checkouts: Dangerous For Your Credit Card...

Who is online

Affiliates