Park Slope Credit Card/Bank Card Fraud!

this scam about credit card fraud sounds interesting. sorry that it happen to you.

its probably a portable scanner someone working in one of the stores where you hand off your card to. it takes just a swipe to copy and clone your card. anyway that totally sucks.

i like the meth heads ways. they go and steal info from wallets to garbage to mail to get the id and steal tons of money.

Actually, I am just going to throw this out there. I haven't been privvy to the conversations on the park slope parents board, but what I can gather off Gowanus Lounge and here is that the majority of people bank with Citi and there is at least one mention of HSBC.

There is an alarming trend these days (at least to those of us data security practitioners) towards RFID-enabled "smart cards" for banking. Citi pioneered this in NYC and eventually HSBC and Morgan, I think, joined ranks. Deal is either a keyfob (at first) or eventually an embedded chip in the actual card itself that enables someone to just "tap" those POS terminals. Visa recently ran an ad about it and it made me really concerned about how close to fruition this was.

RFID chips, for those who aren't as knee-deep in it as I am, emit an all the time radio signal. It enables that "proximity purchase" that the tapping crap is all about. The problem is you can't shut the radio frequency off. This thing is always beaming its lil signal out there. People purport that its range is all of inches, but you spend any length of time playing with RFID and you know its more like feet. These days there hasnt been nearly enough talk about encrypting the data on those little chips because its expensive and all those companies would have to agree on how to make that work (geek speak-- the key exhange).

End result... anyone with about a hundred dollars can purchase an RFID reader. Which means in a physical location (let's say... the subway) I can sit and "pick your pocket" for that signal. No touching required.

People have been calling me paranoid about this for years. Its what makes me good at what I do. I felt a little vindicated when even MSN started to carry the story only a month or so ago. So if you want to think I am paranoid, join the club, but read this:
http://articles.moneycentral.msn.com/Banking/CreditCardSmarts/NewCreditCardsAllowHandsFreeTheft.aspx

I can't help but note that its Citi. I can't help but note that people are loathe to come up with a source but it seems like a large group of people in a generally geographically centralized area.

My gut tells me this may be a part of it and its going to be a while before people start piecing it together. Cept maybe Citi who probably won't want to admit that some of the security researchers were right all along.

Two cents contributed.

armchair_warrior wrote:
also there has been a fraud going around the where you use the locale bodega atms where they clone your card too. they would put in a machine with real money etc.. but when you use it. they get all your debt card info and pin number etc....

god that is so 2004

i just found out this morning that my citibank credit card was hit also.

i rarely make online purchases, and my last few charges were indeed at park slope establishments (i live here). i have a suspicion about what business it might be, but i would also not be surprised to find out it's a citibank issue. they told me they couldn't release any info, because it was currently under investigation.

makes sense.

first chance i get, i suppose i should hit up the police station.

i was just bitching saturday night at song about all these damn cash only restaurants, and now this. guess i'll be all cash, all the time for a while now till the whole thing is sorted out.

love song btw...food's great.

well, I feel a bit constricted. While my card hasn't been hit, I recently started using my debit card at a local establishment where I wonder if they do any kind of security to prevent card fraud. Since we are being discouraged to talk about the places where people suspect it happened, and I understand that it's speculation, I prefer to be armed with *some* info.

It's helpful to know that people are being hit with charges, but without knowing if there's any connection to local businesses that I frequent, the info isn't as helpful. It's like stating there's a rash of muggings in PS, but not stating the location.

jayce wrote: Actually, I am just going to throw this out there. I haven't been privvy to the conversations on the park slope parents board, but what I can gather off Gowanus Lounge and here is that the majority of people bank with Citi and there is at least one mention of HSBC.

There is an alarming trend these days (at least to those of us data security practitioners) towards RFID-enabled "smart cards" for banking. Citi pioneered this in NYC and eventually HSBC and Morgan, I think, joined ranks. Deal is either a keyfob (at first) or eventually an embedded chip in the actual card itself that enables someone to just "tap" those POS terminals. Visa recently ran an ad about it and it made me really concerned about how close to fruition this was.

RFID chips, for those who aren't as knee-deep in it as I am, emit an all the time radio signal. It enables that "proximity purchase" that the tapping crap is all about. The problem is you can't shut the radio frequency off. This thing is always beaming its lil signal out there. People purport that its range is all of inches, but you spend any length of time playing with RFID and you know its more like feet. These days there hasnt been nearly enough talk about encrypting the data on those little chips because its expensive and all those companies would have to agree on how to make that work (geek speak-- the key exhange).

End result... anyone with about a hundred dollars can purchase an RFID reader. Which means in a physical location (let's say... the subway) I can sit and "pick your pocket" for that signal. No touching required.

People have been calling me paranoid about this for years. Its what makes me good at what I do. I felt a little vindicated when even MSN started to carry the story only a month or so ago. So if you want to think I am paranoid, join the club, but read this:
http://articles.moneycentral.msn.com/Banking/CreditCardSmarts/NewCreditCardsAllowHandsFreeTheft.aspx

I can't help but note that its Citi. I can't help but note that people are loathe to come up with a source but it seems like a large group of people in a generally geographically centralized area.

My gut tells me this may be a part of it and its going to be a while before people start piecing it together. Cept maybe Citi who probably won't want to admit that some of the security researchers were right all along.

Two cents contributed.

Thx for bringing that up! I rejected a card from my bank that included a "SmartChip", but then as time went on . . . well, you don't always stop the tide of privacy invasion. This is as big a possibility as a card cloning evil waiter . . .

Subject: Card numbers stolen

Hi,
My husband had his bank card (it is a debit but has a MC logo on it) on him during the holidays(which we spent here in Park Slope), yet someone charged hundreds of dollars worth of gas and oil in Florida WITH HIS CARD (obviously a dupe). Three months ago (right before our wedding) the same thing happened to me. I used my bank card (MC logo but debit) and someone (who deserves to rot in you know where..) cleaned out ALL of my checking account money, almost $2k at a Walmart in Florida - using in theory, a dupe card of mine.

We only use our cards (well, used too) when we have too - short of cash namely at a grocery store in the neighborhood. I would NEVER want to name locations but I do think it would be nice to figure out what the deal is about these crimes. I'm still furious about what happened to me and then for it to happen to my husband three months later...wow, we were pissed. And now we only have debit cards, not debit/anything that could be mistaken for a credit card.

Whoever did this (and continues doing this) belongs in behind bars. When they cleaned my account out, I almost bounced checks because of them, and my husband ONLY noticed the charge because we do all of our banking online.

Anyway, sorry for the rant. I'm so sorry for anyone this has happened too. I wish we could stop it from happening again.

Cheers.

RockerGirl77 wrote: This is really interesting, jayce - I think we could narrow it down to the possibility of that being the case. We need to find out if these other people have cards with that technology. Mine did.
Anyone else?

I think the question is, do any of the major bank cards NOT have that technology at this point.
bummer.

I don't think my bank card has that technology in it-but, i bank with a smaller , local bank. Not one of the biggies.

There are still banks that don't use rfid. But like I said, you can still protect what you have and shield it. At which case the danger is only when you pull it from its shielding for a few seconds. and I am not 100% sure thats what this is, but its a good bet that shouldn't be ruled out. At which point it may be a moving target. IE someone with a RFID reader.

LTS, your issue may be one of the one-offs. Yours may be unrelated but timed well. Still too early to say. But I think its a theory worth chasing down cause its been plausible for a while now.

Wow. Y'know after watching too much Law & Order, I'd think they'd solved it by now. The 78 must have a list of merchants that you have in common. Would it be wrong for the victims to email each other privately and figure out who they have in common? If it's not the merchant's fault, I'm sure they'd want to know who the guilty empoyee is!
I understand it's not ethical to bounce names around here, but this is serious and so widespread...
Is it wrong to share info privately?

of course it's not unethical to trade information privately, but keep in mind it might not actually be a business with a card swipe fraud operation -- it could be the RFID technology being accessed and misused.

Innocent X wrote: [quote=The Chipster]
I understand it's not ethical to bounce names around here, but this is serious and so widespread...
Is it wrong to share info privately?

So you don't stop shopping at a local business for no reason? Cause that could be the result even self-consciously.

Just what the economy needs, this scandal.

I don't think that if a "common denominator" is found (in private messaging, of course!) that people will necessarily stop shopping there -- I think what would happen is that most people would be a little more careful and use cash in that establishment.