Discussion:
Credit card fraud , dont fall for it
(too old to reply)
h***@anony.net
2013-07-30 22:41:01 UTC
Permalink
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html

: How the conmen tricked their victim

1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.

2 On Sunday he gets call from “Mark at Visa Card Services”. Mark
confirms his last transaction, tells Mr Welch that since then his card
has been cloned and a further £1,100 has been taken from his account
and gives him a reference number. He calls the bank number on the back
of his card, not realising that the person on the other end of the
line has not hung up.

3 Over a series of calls with “Rajesh”, Mr Welch reveals his full name
and date of birth. Mr Welch is told a courier is coming to pick up his
card.

4 Rajesh calls back to say a car is on its way. Mr Welch is told that
his card has been used to for a series of transactions, including at
an Apple store. Rajesh says that as there are now two cards in
existence, he needs to perform a PIN block. Mr Welch is suspicious and
refuses, but is told to enter the number on his keypad – that way it
will go into the system but not be seen by call centre staff. He does,
and the number tone reveals his PIN.

5 A “courier” comes 90 minutes later and the card is handed over. The
fraudsters now have everything they need to take money from Mr Welch’s
current account.

6 The next day Rajesh calls back to say that Mr Welch’s credit card
has now been cloned. He hands over the PIN in the same way.
AlanG
2013-07-31 06:56:07 UTC
Permalink
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Post by h***@anony.net
Mark
confirms his last transaction, tells Mr Welch that since then his card
has been cloned and a further £1,100 has been taken from his account
and gives him a reference number. He calls the bank number on the back
of his card, not realising that the person on the other end of the
line has not hung up.
3 Over a series of calls with “Rajesh”, Mr Welch reveals his full name
and date of birth. Mr Welch is told a courier is coming to pick up his
card.
4 Rajesh calls back to say a car is on its way. Mr Welch is told that
his card has been used to for a series of transactions, including at
an Apple store. Rajesh says that as there are now two cards in
existence, he needs to perform a PIN block. Mr Welch is suspicious and
refuses, but is told to enter the number on his keypad – that way it
will go into the system but not be seen by call centre staff. He does,
and the number tone reveals his PIN.
5 A “courier” comes 90 minutes later and the card is handed over. The
fraudsters now have everything they need to take money from Mr Welch’s
current account.
6 The next day Rajesh calls back to say that Mr Welch’s credit card
has now been cloned. He hands over the PIN in the same way.
tim.....
2013-07-31 07:32:29 UTC
Permalink
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from "Mark at Visa Card Services".
How do they get his phone number?
I was wondering that.

Though there is evidence that people do fall for (a modified version of)
this scam

tim
Cynic
2013-08-02 13:32:29 UTC
Permalink
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
--
Cynic
AlanG
2013-08-02 14:10:03 UTC
Permalink
Post by Cynic
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.

AFAIAA the only people to have my landline number are BE, my family
and the Doctor we are registered with. The latter means the NHS will
have it too I'd guess. BT who run the exchange may know that number is
connected to my address but that is not certain
Jethro_uk
2013-08-02 14:19:08 UTC
Permalink
Post by Cynic
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory enquiries
will not tell you and 192 would be acting illegally if the phone number
was ex directory and they passed it out.
AFAIAA the only people to have my landline number are BE, my family and
the Doctor we are registered with. The latter means the NHS will have it
too I'd guess. BT who run the exchange may know that number is connected
to my address but that is not certain
The important question though, is as a result of your statement above,
are you more likely to trust a caller who knows your name, address, and
maybe some more details ?
AlanG
2013-08-02 14:47:41 UTC
Permalink
Post by Jethro_uk
Post by Cynic
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory enquiries
will not tell you and 192 would be acting illegally if the phone number
was ex directory and they passed it out.
AFAIAA the only people to have my landline number are BE, my family and
the Doctor we are registered with. The latter means the NHS will have it
too I'd guess. BT who run the exchange may know that number is connected
to my address but that is not certain
The important question though, is as a result of your statement above,
are you more likely to trust a caller who knows your name, address, and
maybe some more details ?
No.
I've had calls from organisations I've dealt with on my previous phone
line. I absolutely refuse to divulge information over the phone to any
unsolicited callers. The sole exception being the doctors surgery and
they only ask health questions about current conditions.

Last time I got an unsolicited call it was from my ISP/phone provider.
I told them to write to me. Then I went on the forums and sent out a
warning about a possible scam. BE no longer contacts people by phone
at home.
Cynic
2013-08-02 15:57:10 UTC
Permalink
Post by AlanG
Post by Cynic
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.

Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
--
Cynic
AlanG
2013-08-02 16:00:58 UTC
Permalink
Post by Cynic
Post by AlanG
Post by Cynic
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.
Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
So they get their targets bank account number, address and phone
number. ISTM they would need to target a hell of a lot of people to
get all those details
Cynic
2013-08-02 16:38:20 UTC
Permalink
Post by AlanG
Post by Cynic
Post by AlanG
Post by Cynic
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.
Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
So they get their targets bank account number, address and phone
number. ISTM they would need to target a hell of a lot of people to
get all those details
They do not need his bank account number.
They get his address by following him home
They get his telephone number by looking up the address on a phone
listing site

Sure, the last will fail if he is ex-directory, but that gives them at
least a 50% success rate, I rekon.
--
Cynic
AlanG
2013-08-02 17:52:24 UTC
Permalink
Post by Cynic
Post by AlanG
Post by Cynic
Post by AlanG
Post by Cynic
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.
Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
So they get their targets bank account number, address and phone
number. ISTM they would need to target a hell of a lot of people to
get all those details
They do not need his bank account number.
They get his address by following him home
They would have to follow a hell of a lot of people home given the
numbers who don't have land lines these days. AFAIAA there is no
directory for mobiles
Post by Cynic
They get his telephone number by looking up the address on a phone
listing site
Sure, the last will fail if he is ex-directory, but that gives them at
least a 50% success rate, I rekon.
tim.....
2013-08-02 18:09:25 UTC
Permalink
Post by Cynic
Post by AlanG
Post by Cynic
Post by AlanG
Post by Cynic
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.
Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
So they get their targets bank account number, address and phone
number. ISTM they would need to target a hell of a lot of people to
get all those details
They do not need his bank account number.
They get his address by following him home
They get his telephone number by looking up the address on a phone
listing site
Sure, the last will fail if he is ex-directory, but that gives them at
least a 50% success rate, I rekon.
Are there websites that look-up number from addresses.

It used to be illegal to provide telephone search facilities this way
(though obviously you could search the phone book manually)

tim
Big Les Wade
2013-08-05 12:31:44 UTC
Permalink
Post by Cynic
They do not need his bank account number.
They get his address by following him home
They get his telephone number by looking up the address on a phone
listing site
But you cannot do that (IME) without knowing his name as well. How do
they get his name? Martin suggests they got it by buying some marketing
databases, but that would also tell them his address, from which they
could get his phone number without going to the trouble of following him
home from the bank. It really doesn't make sense.
--
Les
tim.....
2013-08-02 18:06:52 UTC
Permalink
Post by AlanG
Post by Cynic
Post by AlanG
Post by Cynic
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
He may not be in the book. If he is not in the book directory
enquiries will not tell you and 192 would be acting illegally if the
phone number was ex directory and they passed it out.
Yes, he might not be, in which case the scammer would not get his
number and would not be able to scam him.
Next you'll be asking how muggers manage to get any money because
their victim might not be carrying any money.
So they get their targets bank account number, address and phone
number. ISTM they would need to target a hell of a lot of people to
get all those details
I agree. From a crim's pov they would be better of just mugging people as
the money comes out of the machine.

tim
tim.....
2013-08-02 17:55:01 UTC
Permalink
Post by Cynic
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
In the context of the discussion you need the guy's name first (and you
don't have that either)

tim
Martin Brown
2013-08-05 07:21:36 UTC
Permalink
Post by tim.....
Post by Cynic
On Wed, 31 Jul 2013 08:32:29 +0100, "tim....."
Post by tim.....
Post by AlanG
How do they get his phone number?
I was wondering that.
Phone book? Directory enquiries? 192.co.uk?
In the context of the discussion you need the guy's name first (and you
don't have that either)
tim
Yes they probably did. That was what made him worth following.

The marks details were almost certainly seen by the next in line in the
queue and they got exactly the details needed to find his phone number.

(assuming that the hole in the wall machine hadn't been tampered with)

Then they follow him home. Given a name and address it isn't hard to
find a phone number unless they are ex-directory.
--
Regards,
Martin Brown
Jethro_uk
2013-07-31 09:35:16 UTC
Permalink
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on
a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over. If only banks
made a point of telling customers never to give their PIN to anyone ...
R. Mark Clayton
2013-07-31 12:00:16 UTC
Permalink
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on
a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over. If only banks
made a point of telling customers never to give their PIN to anyone ...
Er they do, and request [old] cards are cut in two if replaced.
Jethro_uk
2013-07-31 13:01:03 UTC
Permalink
Post by R. Mark Clayton
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by R. Mark Clayton
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over. If only banks
made a point of telling customers never to give their PIN to anyone ...
Er they do, and request [old] cards are cut in two if replaced.
Every bank I have used has always informed customers they would never ask
for their PIN - either by phone, or in writing.

Which bank asks customers for their PINs? so people can make their own
choices.

Destroying cards has been SOP for over 3 decades ... I recall being
allowed to cut my Mums Barclaycard in half in the 70s.
AlanG
2013-07-31 13:02:22 UTC
Permalink
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on
a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
Post by h***@anony.net
If only banks
made a point of telling customers never to give their PIN to anyone ...
Martin Brown
2013-07-31 13:53:09 UTC
Permalink
Post by AlanG
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on
a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.

When a real bank or credit card fraud operator rings you they basically
ask if you recognise any of the following "out of character"
transactions and then if your answer is no inform you that your card has
been cancelled with immediate effect. A new card is then sent
immediately to your home address or to somewhere else if you beg them.

If they cannot contact you they zap the card first and send you a letter
to that effect asking you to ring them urgently. They always advise you
to destroy even an invalidated or time expired card.
Post by AlanG
Post by h***@anony.net
If only banks
made a point of telling customers never to give their PIN to anyone ...
They do but some people fall for this sort of social engineering trick.

One thing I have noticed is that there can be a mismatch between the
badged third party card insurance that Barclaycard provide and your
physical address if you move house. I was notified of a credit card
fraud against a card belonging to a previous tenant who had not lived at
my address for over 10 years. Bills went to his new address but the
fraud action address had not been updated. This can also mean that they
send a list of all your credit cards annually to your former address!

It rang alarm bells because it was addressed to another Mr G Brown at my
address but it turned out to be innocent and a real previous Mr Brown
whose card really had been compromised. The bank apologised.

They claim that they cannot sort this mismatched address problem out due
to data protection laws... Ho hum :(
--
Regards,
Martin Brown
Cynic
2013-08-02 13:34:25 UTC
Permalink
On Wed, 31 Jul 2013 14:53:09 +0100, Martin Brown
Post by Martin Brown
Post by AlanG
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
--
Cynic
Martin Brown
2013-08-02 14:35:51 UTC
Permalink
Post by Cynic
On Wed, 31 Jul 2013 14:53:09 +0100, Martin Brown
Post by Martin Brown
Post by AlanG
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.

Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN. Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".

I prefer HSBCs Vasco login security dongle - much less faffing about.
--
Regards,
Martin Brown
Cynic
2013-08-02 16:03:11 UTC
Permalink
On Fri, 02 Aug 2013 15:35:51 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is
quicker & easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
--
Cynic
Jethro_uk
2013-08-02 16:16:38 UTC
Permalink
Post by Cynic
On Fri, 02 Aug 2013 15:35:51 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is quicker
& easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
Presumably it generates a unique one-time key linked to the account
holders details. Similar to the RSA key I have used in the past, and the
Aladdin safeword system I use now.
Cynic
2013-08-02 16:40:19 UTC
Permalink
Post by Jethro_uk
Post by Cynic
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is quicker
& easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
Presumably it generates a unique one-time key linked to the account
holders details. Similar to the RSA key I have used in the past, and the
Aladdin safeword system I use now.
What is it - a calculator type of device? How does it get the account
holder's details to generate the key?
--
Cynic
tim.....
2013-08-02 18:04:57 UTC
Permalink
Post by Cynic
Post by Jethro_uk
Post by Cynic
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is quicker
& easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
Presumably it generates a unique one-time key linked to the account
holders details. Similar to the RSA key I have used in the past, and the
Aladdin safeword system I use now.
What is it - a calculator type of device? How does it get the account
holder's details to generate the key?
It generates numbers in a known (to the bank) random sequence and each
account holder started from a different point.

The bank know where the machine that they gave you started from and hence
know what the next "random" number should be. (Presumably the verification
algorithm allows a bit of leeway in case you accidently skip one).

However, it proves nothing to the bank except that you are the person
holding it in your hand - if you know the account number of the person whose
machine you have "found" it is useless security on its own

tim
Michael Swift
2013-08-02 18:38:04 UTC
Permalink
Post by tim.....
However, it proves nothing to the bank except that you are the person
holding it in your hand - if you know the account number of the person
whose machine you have "found" it is useless security on its own
Isn't this true of all security measures, if you password, number, magic
spell is known by someone else they can use it as if it were you.

Mike
--
Michael Swift We do not regard Englishmen as foreigners.
Kirkheaton We look on them only as rather mad Norwegians.
Yorkshire Halvard Lange
tim.....
2013-08-03 07:36:39 UTC
Permalink
Post by Michael Swift
Post by tim.....
However, it proves nothing to the bank except that you are the person
holding it in your hand - if you know the account number of the person
whose machine you have "found" it is useless security on its own
Isn't this true of all security measures, if you password, number, magic
spell is known by someone else they can use it as if it were you.
which is why banks have introduced home terminals.

you need my terminal [1], card and PIN to pretend to be me.

tim

[1] At least I think you need *my* terminal
Cynic
2013-08-05 12:18:08 UTC
Permalink
On Fri, 2 Aug 2013 19:38:04 +0100, Michael Swift
Post by Michael Swift
Post by tim.....
However, it proves nothing to the bank except that you are the person
holding it in your hand - if you know the account number of the person
whose machine you have "found" it is useless security on its own
Isn't this true of all security measures, if you password, number, magic
spell is known by someone else they can use it as if it were you.
Unless it also involves a physical object, such as a card. Then the
thief will have to have both the information *and* the physical
object. At the extreme end is biometric identification, where the
physical object is part of your body.
--
Cynic
AlanG
2013-08-03 08:34:51 UTC
Permalink
On Fri, 2 Aug 2013 19:04:57 +0100, "tim....."
Post by tim.....
Post by Cynic
Post by Jethro_uk
Post by Cynic
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is quicker
& easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
Presumably it generates a unique one-time key linked to the account
holders details. Similar to the RSA key I have used in the past, and the
Aladdin safeword system I use now.
What is it - a calculator type of device? How does it get the account
holder's details to generate the key?
It generates numbers in a known (to the bank) random sequence and each
account holder started from a different point.
The bank know where the machine that they gave you started from and hence
know what the next "random" number should be. (Presumably the verification
algorithm allows a bit of leeway in case you accidently skip one).
However, it proves nothing to the bank except that you are the person
holding it in your hand - if you know the account number of the person whose
machine you have "found" it is useless security on its own
You need the log on details for the account. In all my web bank
accounts there are a minimum of 3 separate passwords. One has 7. Plus
you need the device and the debit card and PIN for that card. It is
unlikely a criminal would have all of those unless he is holding the
victim hostage in his own home and is torturing the details out of him
Michael Swift
2013-08-02 18:39:06 UTC
Permalink
In article <***@127.0.0.1>, Cynic <***@yahoo.co.uk>
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.

You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.

It's a bit of a faff but if it keeps me safe it's worth it.

Mike
--
Michael Swift We do not regard Englishmen as foreigners.
Kirkheaton We look on them only as rather mad Norwegians.
Yorkshire Halvard Lange
Max Demian
2013-08-02 22:03:19 UTC
Permalink
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things
so far. They asked me to check my contact details and I found that one
of the phone numbers is wrong, but they won't let me correct it
without the gadget so it can jolly well stay wrong. Bankers.
--
Max Demian
Michael Swift
2013-08-02 23:14:40 UTC
Permalink
Post by Michael Swift
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things so far.
They asked me to check my contact details and I found that one of the
phone numbers is wrong, but they won't let me correct it without the gadget
so it can jolly well stay wrong. Bankers.
That's the one, touch wood I've never had a problem, tomorrow my account
will suddenly be empty :-)

Mike
--
Michael Swift We do not regard Englishmen as foreigners.
Kirkheaton We look on them only as rather mad Norwegians.
Yorkshire Halvard Lange
tim.....
2013-08-03 07:40:16 UTC
Permalink
Post by Max Demian
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things
so far. They asked me to check my contact details and I found that one
of the phone numbers is wrong, but they won't let me correct it
without the gadget so it can jolly well stay wrong. Bankers.
I'm sure that you can change it using an "offline" method :-(

tim
Max Demian
2013-08-03 10:52:33 UTC
Permalink
On Sat, 3 Aug 2013 08:40:16 +0100, "tim....."
Post by tim.....
Post by Max Demian
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things
so far. They asked me to check my contact details and I found that one
of the phone numbers is wrong, but they won't let me correct it
without the gadget so it can jolly well stay wrong. Bankers.
I'm sure that you can change it using an "offline" method :-(
Why should I bother? If they ring me up, I'll have to verify it's
really them.
--
Max Demian
Martin Brown
2013-08-03 08:09:03 UTC
Permalink
Post by Max Demian
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things
so far. They asked me to check my contact details and I found that one
of the phone numbers is wrong, but they won't let me correct it
without the gadget so it can jolly well stay wrong. Bankers.
You should be able to do it by writing to the bank manager in the old
traditional style using signed paper instructions in an envelope.

The dangerous one is when your card fraud security ends up pointing to a
previous address due to "data protection issues". Their badged card
insurance is from a third party and they don't share your details with
them or make it clear that you have to notify the (unknown) third party.
--
Regards,
Martin Brown
Max Demian
2013-08-03 10:55:24 UTC
Permalink
On Sat, 03 Aug 2013 09:09:03 +0100, Martin Brown
Post by Martin Brown
Post by Max Demian
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
You log onto your Barclays account, enter your Name as on the card,
enter a long unique number you were given when you set up online
banking, click a button and then enter the two sets of numbers.
It's a bit of a faff but if it keeps me safe it's worth it.
Is that PINsentry? I've avoided being issued with one of those things
so far. They asked me to check my contact details and I found that one
of the phone numbers is wrong, but they won't let me correct it
without the gadget so it can jolly well stay wrong. Bankers.
You should be able to do it by writing to the bank manager in the old
traditional style using signed paper instructions in an envelope.
The dangerous one is when your card fraud security ends up pointing to a
previous address due to "data protection issues". Their badged card
insurance is from a third party and they don't share your details with
them or make it clear that you have to notify the (unknown) third party.
WTF is "badged card insurance"? Is it when you pay them
(unnecessarily) to protect yourself against fraud?
--
Max Demian
Martin Brown
2013-08-05 07:47:03 UTC
Permalink
Post by Max Demian
On Sat, 03 Aug 2013 09:09:03 +0100, Martin Brown
Post by Martin Brown
The dangerous one is when your card fraud security ends up pointing to a
previous address due to "data protection issues". Their badged card
insurance is from a third party and they don't share your details with
them or make it clear that you have to notify the (unknown) third party.
WTF is "badged card insurance"? Is it when you pay them
(unnecessarily) to protect yourself against fraud?
Credit card theft insurance from way back when cards were less common.

ISTR They called it "Barclaycard Secure" but it was actually implemented
by a third party company Sentinel. When I moved house and notified
Barclaycard they dutifully sent a complete list of all my insured cards
to my former address every year until I finally noticed the recurring
small annual charge on my statement and queried it.

Exactly the same had happened to the guy who lived in my house a decade
previously which resulted in notification of a fraudulent transaction
being sent to his former address (despite the fact that his card issuer
had the correct correspondence address for him!!!). I kid you not!

When challenged about this crazy state of affairs they cite data
protection as the reason why their fraud database of card theft
insurance that appears on the bill as "Barclaycard Secure" has to be
altered by sending a letter to a third party. When I fell for this it
was by Sentinel. These days it is by Affinion or CPP. You have to look
carefully on the website to find it. It is no longer offered for sale:

http://www.barclaycard.co.uk/personal/insurance-customer-service/sentinel-gold-card-protection

http://www.barclaycard.co.uk/personal/insurance-customer-service/card-protection

Knowing the right keywords to find it in a Google search is the key.
It was impossible to discover in the old days of reams of small print!
--
Regards,
Martin Brown
Cynic
2013-08-05 12:21:15 UTC
Permalink
On Fri, 02 Aug 2013 23:03:19 +0100, Max Demian
Post by Max Demian
Is that PINsentry? I've avoided being issued with one of those things
so far.
Why? Don't you want to use online banking, or would you like to make
it easier to be defrauded?

I think it is an excellent system.
--
Cynic
Max Demian
2013-08-05 13:05:10 UTC
Permalink
Post by Cynic
On Fri, 02 Aug 2013 23:03:19 +0100, Max Demian
Post by Max Demian
Is that PINsentry? I've avoided being issued with one of those things
so far.
Why? Don't you want to use online banking, or would you like to make
it easier to be defrauded?
I might want to access online banking away from home, and forget/not
want to carry this object. The 5 digit passcode and 'memorable word'
of which you are asked two letters via dropdowns seems adequate to me.
Post by Cynic
I think it is an excellent system.
I'm sure they could devise a better system, or have a device the size
and thickness of a credit card so I could carry it in my wallet.
--
Max Demian
Cynic
2013-08-05 15:06:20 UTC
Permalink
On Mon, 05 Aug 2013 14:05:10 +0100, Max Demian
Post by Max Demian
Post by Cynic
Why? Don't you want to use online banking, or would you like to make
it easier to be defrauded?
I might want to access online banking away from home, and forget/not
want to carry this object. The 5 digit passcode and 'memorable word'
of which you are asked two letters via dropdowns seems adequate to me.
Until someone sitting in a free WiFi zone sets up a MitM attack to
glean exactly that sort of information.
Post by Max Demian
Post by Cynic
I think it is an excellent system.
I'm sure they could devise a better system, or have a device the size
and thickness of a credit card so I could carry it in my wallet.
So far I have never had a problem finding someone with a device I can
borrow at any place I have needed to. Not that it is often that I
need to access online banking away from office or home unexpectedly.
--
Cynic
Jethro_uk
2013-08-05 15:32:38 UTC
Permalink
[quoted text muted]
[quoted text muted]
Until someone sitting in a free WiFi zone sets up a MitM attack to glean
exactly that sort of information.
Surely HTTPS would foil that ?
Cynic
2013-08-05 16:04:44 UTC
Permalink
Post by Jethro_uk
[quoted text muted]
[quoted text muted]
Until someone sitting in a free WiFi zone sets up a MitM attack to glean
exactly that sort of information.
Surely HTTPS would foil that ?
*If* the user takes any notice of the "invalid certificate" popup from
their browser. Unfortunately ther are so many legitimate sites with
invalid certificates that that is unlikely.
--
Cynic
Jethro_uk
2013-08-05 16:23:48 UTC
Permalink
Post by Cynic
Post by Jethro_uk
Post by Cynic
[quoted text muted]
[quoted text muted]
Until someone sitting in a free WiFi zone sets up a MitM attack to
glean exactly that sort of information.
Surely HTTPS would foil that ?
*If* the user takes any notice of the "invalid certificate" popup from
their browser. Unfortunately ther are so many legitimate sites with
invalid certificates that that is unlikely.
Fair point. Not helped by some numbskull banks telling their customers to
ignore such warnings.
tim.....
2013-08-03 07:38:50 UTC
Permalink
Post by Michael Swift
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
They were on mine

I had to may two consecutive payments (for the same amount) to the same
payee as the amount that I need to transfer was above the "faster payments"
limit

and the authorisation code was the same for both

tim
Curlytop
2013-08-04 10:23:08 UTC
Permalink
tim..... set the following eddies spiralling through the space-time
Post by tim.....
I had to may two consecutive payments (for the same amount) to the same
payee as the amount that I need to transfer was above the "faster
payments" limit
and the authorisation code was the same for both
tim
All that means is that the auth code is derived from the destination account
and the amount, as well as your own account details, Possibly the date is
included but certainly not the time. Thus two identical transactions (same
destination, same amount) on the same day will generate the same code. I
wouldn't worry about that as long as it continues to be different for
anybody else or any other amount.
--
ξ: ) Proud to be curly

Interchange the alphabetic letter groups to reply
Cynic
2013-08-05 12:19:47 UTC
Permalink
On Fri, 2 Aug 2013 19:39:06 +0100, Michael Swift
Post by Michael Swift
writes
What is it - a calculator type of device? How does it get the account holder's
details to generate the key?
Its like a calculator, you put your debit card in one end and enter the
last four characters of the long number, press a button, enter your PIN,
press a button and it gives you two sets of four numbers which are never
the same twice.
That's the same as my Barclays system in that case. I thought the PP
was describing something different.
--
Cynic
Martin Brown
2013-08-05 07:28:47 UTC
Permalink
Post by Cynic
On Fri, 02 Aug 2013 15:35:51 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
Post by Cynic
Post by Martin Brown
Or do you mean when phoning up and the toy card reader gives a one time
secure code that confirms you are in possession of the reader, card and
PIN.
That's the one, yes.
Post by Martin Brown
Note that the code it gives is longer than your PIN and related to
it only in the sense that it is a cryptographic answer of "YES".
Exactly. It proves to the teller (to the required standard) that I am
the account holder of the account associated with that debit card, and
thus authorised to deal with that account. Alternatively he could ask
for two forms of photo ID, but entering a card and PIN number is
quicker & easier.
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
A 6 digit cryptographic pseudorandom magic number that changes every 30s
and binds to you and your account with the bank able to predict what it
will show. They calibrate it for drift and it seems to be good even when
not used for over a year. I am guessing that a part of the data sent is
an encryption of a time stamp - requires 11 bits to encode which 30s of
the day and they may get away with much less. The only time I have had a
problem is when I make a typo and the system correctly says not right. I
have also tried entering the previous code just after my device shows a
new number and it is accepted. YMMV
--
Regards,
Martin Brown
tim.....
2013-08-05 09:58:39 UTC
Permalink
Post by Martin Brown
Post by Cynic
On Fri, 02 Aug 2013 15:35:51 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
It is equivalent to giving them the PIN and he gave them the original
physical bank card as well which is much more stupid.
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
This is new technology that not everyone has yet

I have only seen it in one bank that I use.

tim
Cynic
2013-08-05 12:29:58 UTC
Permalink
On Mon, 05 Aug 2013 08:28:47 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
Post by Cynic
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
I possibly misled you. The tellers have the same card readers as they
issue to their customers - they do not expect you to be carrying your
own.
Post by Martin Brown
Post by Cynic
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
A 6 digit cryptographic pseudorandom magic number that changes every 30s
and binds to you and your account with the bank able to predict what it
will show. They calibrate it for drift and it seems to be good even when
not used for over a year. I am guessing that a part of the data sent is
an encryption of a time stamp - requires 11 bits to encode which 30s of
the day and they may get away with much less. The only time I have had a
problem is when I make a typo and the system correctly says not right. I
have also tried entering the previous code just after my device shows a
new number and it is accepted. YMMV
Seems to be a very similar system except it uses an individual reader
rather than your card.

The advantage for me is that while I do not carry the device with me
at all times, I usually have my debit card in my wallet. If I need to
carry out an online banking transaction somewhere but do not have my
device, I can usually find someone who banks with Barclays and borrow
their device to get a login code.
--
Cynic
Martin Brown
2013-08-05 13:00:53 UTC
Permalink
Post by Cynic
On Mon, 05 Aug 2013 08:28:47 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
Post by Martin Brown
Post by Cynic
The tellers at Barclays bank will often ask you to enter your card and
PIN into the small portable card reader that customers are given for
online banking.
Why? If you are at the bank then they already have secure terminals.
Outside the bank on the ATMs.
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
I possibly misled you. The tellers have the same card readers as they
issue to their customers - they do not expect you to be carrying your
own.
I am still a bit mystified as all the banks I use regularly have a
variant of the standard point of sale terminal on each teller position
and they will allow you to do a give me cash transaction at the window.

I don't bank with Barclays...
Post by Cynic
Post by Martin Brown
Post by Cynic
Post by Martin Brown
I prefer HSBCs Vasco login security dongle - much less faffing about.
I am not familiar with that - how does it work?
A 6 digit cryptographic pseudorandom magic number that changes every 30s
and binds to you and your account with the bank able to predict what it
will show. They calibrate it for drift and it seems to be good even when
not used for over a year. I am guessing that a part of the data sent is
an encryption of a time stamp - requires 11 bits to encode which 30s of
the day and they may get away with much less. The only time I have had a
problem is when I make a typo and the system correctly says not right. I
have also tried entering the previous code just after my device shows a
new number and it is accepted. YMMV
Seems to be a very similar system except it uses an individual reader
rather than your card.
The Vasco token is about the right size to use as a keyfob. A problem
only arises if you have multiple ones for different accounts/work
related usage. Then you have to keep track of which is which.
Post by Cynic
The advantage for me is that while I do not carry the device with me
at all times, I usually have my debit card in my wallet. If I need to
carry out an online banking transaction somewhere but do not have my
device, I can usually find someone who banks with Barclays and borrow
their device to get a login code.
I have seen the Natwest home unit. It seems tremendously clunky to me.
--
Regards,
Martin Brown
Max Demian
2013-08-05 17:17:54 UTC
Permalink
On Mon, 05 Aug 2013 14:00:53 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
On Mon, 05 Aug 2013 08:28:47 +0100, Martin Brown
Post by Martin Brown
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
I possibly misled you. The tellers have the same card readers as they
issue to their customers - they do not expect you to be carrying your
own.
I am still a bit mystified as all the banks I use regularly have a
variant of the standard point of sale terminal on each teller position
and they will allow you to do a give me cash transaction at the window.
I don't bank with Barclays...
I don't see anything wrong with the Barclays card verification device
(about the size of a pocket calculator that the teller inserts your
debit card into and hands to you to enter your PIN). The verification
of your account balance is then done by the teller at his/her
terminal.
--
Max Demian
Martin Brown
2013-08-06 07:52:51 UTC
Permalink
Post by Max Demian
On Mon, 05 Aug 2013 14:00:53 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
On Mon, 05 Aug 2013 08:28:47 +0100, Martin Brown
Post by Martin Brown
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
I possibly misled you. The tellers have the same card readers as they
issue to their customers - they do not expect you to be carrying your
own.
I am still a bit mystified as all the banks I use regularly have a
variant of the standard point of sale terminal on each teller position
and they will allow you to do a give me cash transaction at the window.
I don't bank with Barclays...
I don't see anything wrong with the Barclays card verification device
(about the size of a pocket calculator that the teller inserts your
debit card into and hands to you to enter your PIN). The verification
of your account balance is then done by the teller at his/her
terminal.
So they *are* cheapskates. Almost every other bank has point of sale
type supermarket pay terminals on the customer side - you put your card
in they set up the transaction amount from their terminal and you input
the PIN to execute whatever transaction you have asked them to do.

I do most of my transactions online now apart from physically paying
cheques in from time to time and even that is getting rarer.
--
Regards,
Martin Brown
tim.....
2013-08-06 08:05:44 UTC
Permalink
Post by Max Demian
On Mon, 05 Aug 2013 14:00:53 +0100, Martin Brown
Post by Martin Brown
Post by Cynic
On Mon, 05 Aug 2013 08:28:47 +0100, Martin Brown
Post by Martin Brown
Are Barclays such cheapskates that they don't have a reader and PIN
terminal on every teller position inside the bank as well?
I possibly misled you. The tellers have the same card readers as they
issue to their customers - they do not expect you to be carrying your
own.
I am still a bit mystified as all the banks I use regularly have a
variant of the standard point of sale terminal on each teller position
and they will allow you to do a give me cash transaction at the window.
I don't bank with Barclays...
I don't see anything wrong with the Barclays card verification device
(about the size of a pocket calculator that the teller inserts your
debit card into and hands to you to enter your PIN). The verification
of your account balance is then done by the teller at his/her
terminal.
So they *are* cheapskates. Almost every other bank has point of sale type
supermarket pay terminals on the customer side
No they don't

I can only repeat my previous comment

of the 4 banks that I have used in the past month, only one had this feature

tim

Boutros Boutros-PMD
2013-07-31 14:02:14 UTC
Permalink
On Wed, 31 Jul 2013 09:35:16 GMT, Jethro_uk
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint
late on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a
victim of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
Jethro_uk
2013-07-31 14:21:13 UTC
Permalink
Post by Boutros Boutros-PMD
Post by AlanG
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by Boutros Boutros-PMD
Post by AlanG
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
If I had done that, I would have broken my banks instruction that I never
reveal my PIN - even (and *especially*) to them.

"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."

All I know is I am fairly alert to scams, and never answer any questions
when someone calls me. Personally I have opted to communicated via the
secure messaging facility, so no phone calls, and no emails.
AlanG
2013-07-31 14:28:47 UTC
Permalink
Post by Jethro_uk
Post by Boutros Boutros-PMD
Post by AlanG
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by Boutros Boutros-PMD
Post by AlanG
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a victim
of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
If I had done that, I would have broken my banks instruction that I never
reveal my PIN - even (and *especially*) to them.
In that case you reveal your PIN every time you enter it via the
keypad. You have no idea whether the number is being stored
Post by Jethro_uk
"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."
except when you enter it onto a keypad
Post by Jethro_uk
All I know is I am fairly alert to scams, and never answer any questions
when someone calls me. Personally I have opted to communicated via the
secure messaging facility, so no phone calls, and no emails.
I'm the same. I always ask them to write to me then put the phone down
Jethro_uk
2013-07-31 14:44:13 UTC
Permalink
Post by Jethro_uk
Post by Boutros Boutros-PMD
On Wed, 31 Jul 2013 09:35:16 GMT, Jethro_uk
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-
phone-
Post by Jethro_uk
call-
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-
theft-8738646.html
Post by Jethro_uk
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint
late on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a
victim of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
If I had done that, I would have broken my banks instruction that I
never reveal my PIN - even (and *especially*) to them.
In that case you reveal your PIN every time you enter it via the keypad.
what keypad ? On the ATM/C&P reader that isn't mentioned ?
You have no idea whether the number is being stored
Post by Jethro_uk
"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."
except when you enter it onto a keypad
What keypad ?
Post by Jethro_uk
All I know is I am fairly alert to scams, and never answer any questions
when someone calls me. Personally I have opted to communicated via the
secure messaging facility, so no phone calls, and no emails.
I'm the same. I always ask them to write to me then put the phone down
AlanG
2013-07-31 14:58:54 UTC
Permalink
Post by h***@anony.net
Post by Jethro_uk
Post by Boutros Boutros-PMD
On Wed, 31 Jul 2013 09:35:16 GMT, Jethro_uk
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-
phone-
Post by Jethro_uk
call-
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-
theft-8738646.html
Post by Jethro_uk
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint
late on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a
victim of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
If I had done that, I would have broken my banks instruction that I
never reveal my PIN - even (and *especially*) to them.
In that case you reveal your PIN every time you enter it via the keypad.
what keypad ? On the ATM/C&P reader that isn't mentioned ?
A phone keypad was mentioned
Post by h***@anony.net
You have no idea whether the number is being stored
Post by Jethro_uk
"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."
except when you enter it onto a keypad
What keypad ?
In this case a telephone keypad.
Post by h***@anony.net
Post by Jethro_uk
All I know is I am fairly alert to scams, and never answer any questions
when someone calls me. Personally I have opted to communicated via the
secure messaging facility, so no phone calls, and no emails.
I'm the same. I always ask them to write to me then put the phone down
Jethro_uk
2013-07-31 15:28:00 UTC
Permalink
Post by AlanG
Post by h***@anony.net
Post by Jethro_uk
Post by Boutros Boutros-PMD
On Wed, 31 Jul 2013 09:35:16 GMT, Jethro_uk
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-
phone-
Post by Jethro_uk
call-
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-
theft-8738646.html
Post by Jethro_uk
Post by Boutros Boutros-PMD
Post by Jethro_uk
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint
late on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
He did not give them his pin. He entered it onto a key pad as a
victim of a scam. I doubt the courts would side with the banks there
The touch tones of the keypad would have revealed his PIN to the
scammers.
If I had done that, I would have broken my banks instruction that I
never reveal my PIN - even (and *especially*) to them.
In that case you reveal your PIN every time you enter it via the keypad.
what keypad ? On the ATM/C&P reader that isn't mentioned ?
A phone keypad was mentioned
Post by h***@anony.net
You have no idea whether the number is being stored
Post by Jethro_uk
"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."
except when you enter it onto a keypad
What keypad ?
In this case a telephone keypad.
Post by h***@anony.net
Post by Jethro_uk
All I know is I am fairly alert to scams, and never answer any
questions when someone calls me. Personally I have opted to
communicated via the secure messaging facility, so no phone calls, and
no emails.
I'm the same. I always ask them to write to me then put the phone down
"We will NEVER ask you to divulge your PIN, either by telephone, in
writing, or by email ..."

so he used the *telephone* keypad ?
Big Les Wade
2013-07-31 16:54:50 UTC
Permalink
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late on
a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
I think you misunderstand. What Alan meant, I think, was "They couldn't
have known his phone number, therefore this story is yet another of
those mythical scams ... "
--
Les
Jethro_uk
2013-07-31 17:07:52 UTC
Permalink
Post by Big Les Wade
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by Big Les Wade
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
I think you misunderstand. What Alan meant, I think, was "They couldn't
have known his phone number, therefore this story is yet another of
those mythical scams ... "
No. I was saying it was *immaterial* how they got his phone number. There
are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address. Personally just because
someone calls me up and asks for "Mr. X" doesn't mean squat. Certainly
doesn't imbue me with a mystical belief that they are who they say they
are because they have my phone number.
Martin Brown
2013-08-01 07:11:21 UTC
Permalink
Post by Jethro_uk
Post by Big Les Wade
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by Big Les Wade
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
I think you misunderstand. What Alan meant, I think, was "They couldn't
have known his phone number, therefore this story is yet another of
those mythical scams ... "
No. I was saying it was *immaterial* how they got his phone number. There
are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address. Personally just because
someone calls me up and asks for "Mr. X" doesn't mean squat. Certainly
doesn't imbue me with a mystical belief that they are who they say they
are because they have my phone number.
I generally assume all unsolicited calls about finance are hostile and
treat them as such. It particularly annoys me when *my* bank ring me up
out of the blue and demands that I prove to them who *I* am.

I insist on them telling me the first line of my address and postcode as
proof that they are my bank and they go off script at that point -
refusing to do so on the grounds of "data protection".

The call ends there in deadlock with their script exhausted. If it is
important they can put it in writing but they seldom bother to do so.
--
Regards,
Martin Brown
Ophelia
2013-08-01 10:27:16 UTC
Permalink
Post by Martin Brown
Post by Jethro_uk
Post by Big Les Wade
Post by h***@anony.net
Post by AlanG
Post by h***@anony.net
excerpt
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-
call-
Post by Big Les Wade
Post by h***@anony.net
before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
Post by AlanG
Post by h***@anony.net
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from “Mark at Visa Card Services”.
How do they get his phone number?
Who cares ? He gave them his PIN, and it was game over.
I think you misunderstand. What Alan meant, I think, was "They couldn't
have known his phone number, therefore this story is yet another of
those mythical scams ... "
No. I was saying it was *immaterial* how they got his phone number. There
are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address. Personally just because
someone calls me up and asks for "Mr. X" doesn't mean squat. Certainly
doesn't imbue me with a mystical belief that they are who they say they
are because they have my phone number.
I generally assume all unsolicited calls about finance are hostile and
treat them as such. It particularly annoys me when *my* bank ring me up
out of the blue and demands that I prove to them who *I* am.
I insist on them telling me the first line of my address and postcode as
proof that they are my bank and they go off script at that point -
refusing to do so on the grounds of "data protection".
The call ends there in deadlock with their script exhausted. If it is
important they can put it in writing but they seldom bother to do so.
The last time this happened to us, they asked for our password. DH gave
them a telling off and suggested they ask for letters within that password.
--
--
http://www.helpforheroes.org.uk/shop/
Gordon Burditt
2013-08-01 07:20:54 UTC
Permalink
Post by Jethro_uk
No. I was saying it was *immaterial* how they got his phone number. There
are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address.
Some of them are even free over the Internet.
Post by Jethro_uk
Personally just because
someone calls me up and asks for "Mr. X" doesn't mean squat.
If someone calls and gets your name *WRONG*, or asks you for your
name, or doesn't ask for someone specific by name, that's a red
flag that it's a scam (or marketing, which is not much different).
Post by Jethro_uk
Certainly
doesn't imbue me with a mystical belief that they are who they say they
are because they have my phone number.
Big Les Wade
2013-08-01 16:37:39 UTC
Permalink
There are plenty of ways to find a phone number (landline) if you want
- especially if you already know the address.
How?
--
Les
Martin Brown
2013-08-02 07:56:04 UTC
Permalink
There are plenty of ways to find a phone number (landline) if you want
- especially if you already know the address.
How?
It is a lot easier if you already know the name of your target which
seems the most likely way it was done in this particular case.

If he was ex-directory then there *is* a bit more to it.
--
Regards,
Martin Brown
Jethro_uk
2013-08-02 10:16:14 UTC
Permalink
There are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address.
How?
There are various lookup services for a start (192.com ?). This was
clearly an organised scam, so possibly they bought (access to) a few
marketing databases, which happened to combine the address, the name and
the phone number.

As I stated, just because someone calls me up, and knows my name, doesn't
mean a thing to me. That is the point at which the story posted by the OP
and myself depart company. He believed it was his bank, because they
happened to know his name.

Sadly this sort of scam is just not going to go away. We are being
required to throw around so much personal data, that is being stored all
over the place, it should come as no surprise people can have so much
information on us. Photocopied driving licenses, passports, birth
certificates, utility bills, council tax bills, tax forms ... I have been
required to provide all of this over the years. It only takes sloppy
security in one location for someone to be able to see my bank details,
my passport, and my council tax - more than enough to put together a
convincing scam. However, in the original story, then no matter how
convincing, I would not have typed my PIN in, regardless of what the man
on the phone said. That is because my bank has repeated told me they will
never ask for my PIN, and anyone who does ask for it is not working for
them. They have it in big bold letters when they issue a card. And when
you register for online banking, it's printed on the letter they send you
with some of the details you need.

Yes, the original story does sound scary .... but the whole scam hinged
on getting the PIN. Without that, it would have failed.

Just as an aside (although a few sites do just ask for a "memorable
word") it's never a good idea to *actually* use your mothers maiden name
as the answer you give, when a site suggests it as a secondary challenge.
Because that's just too easy. Just use a word you can remember.
Martin Brown
2013-08-02 11:35:01 UTC
Permalink
Post by Jethro_uk
There are plenty of ways to find a phone number (landline) if you want -
especially if you already know the address.
How?
There are various lookup services for a start (192.com ?). This was
clearly an organised scam, so possibly they bought (access to) a few
marketing databases, which happened to combine the address, the name and
the phone number.
As I stated, just because someone calls me up, and knows my name, doesn't
mean a thing to me. That is the point at which the story posted by the OP
and myself depart company. He believed it was his bank, because they
happened to know his name.
Sadly this sort of scam is just not going to go away. We are being
required to throw around so much personal data, that is being stored all
over the place, it should come as no surprise people can have so much
information on us. Photocopied driving licenses, passports, birth
certificates, utility bills, council tax bills, tax forms ... I have been
required to provide all of this over the years. It only takes sloppy
security in one location for someone to be able to see my bank details,
my passport, and my council tax - more than enough to put together a
convincing scam. However, in the original story, then no matter how
convincing, I would not have typed my PIN in, regardless of what the man
on the phone said. That is because my bank has repeated told me they will
never ask for my PIN, and anyone who does ask for it is not working for
them. They have it in big bold letters when they issue a card. And when
you register for online banking, it's printed on the letter they send you
with some of the details you need.
Yes, the original story does sound scary .... but the whole scam hinged
on getting the PIN. Without that, it would have failed.
Actually not quite. There are various sophisticated technical attacks
against Chip & PIN that were demonstrated by Cambridge University
computer laboratory that trick a terminal into accepting cloned card.

http://www.theregister.co.uk/Print/2012/09/13/chip_and_pin_security_flaw_research/

Or the more detailed paper on the cryptographic weaknesses of *EMV.

http://www.cl.cam.ac.uk/~rja14/Papers/unattack.pdf

Someone is on trial in France for exploiting the no PIN attack (or
rather was when the paper was written last year).

Maybe the banks should be *MUCH* clearer to their customers about what
they actually do when a card is compromised so that people don't fall
for the "we are sending a courier round to collect it" scam.

The PIN isn't quite as secure as the banks would have you believe but it
is still a lot better than a signature at point of sale.
--
Regards,
Martin Brown
Jethro_uk
2013-08-02 11:50:36 UTC
Permalink
Post by Martin Brown
[quoted text muted]
Actually not quite. There are various sophisticated technical attacks
against Chip & PIN that were demonstrated by Cambridge University
computer laboratory that trick a terminal into accepting cloned card.
http://www.theregister.co.uk/Print/2012/09/13/
chip_and_pin_security_flaw_research/
Post by Martin Brown
Or the more detailed paper on the cryptographic weaknesses of *EMV.
http://www.cl.cam.ac.uk/~rja14/Papers/unattack.pdf
Of course you can use a cloned card in the UK, without a PIN. Don't
forget the terminals allow you to swipe a card and take a signature. I
have had to do this on a couple of occasions in supermarkets, where the
reader refused to accept the chip method.
Gordon Burditt
2013-08-01 07:02:16 UTC
Permalink
Post by AlanG
Post by h***@anony.net
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Phone number lookup by address is commonly available over the
Internet, at least for USA addresses. For free, even. I think
similar information is available for the UK. I type in an address
and get names and phone numbers for that address and a bunch of
neighbors (among other places you can do this is www.anywho.com).

Some sites give other information like number of bedrooms, square
feet, when the house was built, and sex offenders living in the
area. I suspect a lot of these sites are all run by the same
organization.

How can you tell it's a scam? Your phone is ringing.
Martin Brown
2013-08-01 07:18:51 UTC
Permalink
Post by Gordon Burditt
Post by AlanG
Post by h***@anony.net
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Phone number lookup by address is commonly available over the
Internet, at least for USA addresses. For free, even. I think
similar information is available for the UK. I type in an address
and get names and phone numbers for that address and a bunch of
neighbors (among other places you can do this is www.anywho.com).
Not seen one that will allow you to wildcard the name in the UK although
there did use to be a reverse lookup phone directory CD indexed on all
content once upon a time. Ex directory numbers are also more resistant
to searching although SOCA's mates can do it with ease.

Interesting how SOCA is more concerned with preserving the "good name"
of blue chip institutions than actually investigating widespread illegal
use of private investigators to blag for personal data. It speaks
volumes that they embargoed release of the names which they were
eventually forced to disclose in camera to the select committee.
Post by Gordon Burditt
How can you tell it's a scam? Your phone is ringing.
When they ask for details that the bank says they will never ask for.
(The banks fib about this as their telephone security is sloppy)

I also tell my bank to get lost when they cold call me.
--
Regards,
Martin Brown
AlanG
2013-08-01 07:57:31 UTC
Permalink
Post by Gordon Burditt
Post by AlanG
Post by h***@anony.net
http://www.independent.co.uk/news/uk/crime/it-started-with-a-phone-call-before-i-knew-it-i-was-another-victim-of-identity-theft-8738646.html
: How the conmen tricked their victim
1 Fraudsters spot Andy Welch withdrawing money from a cashpoint late
on a Saturday night and tail him to his house.
2 On Sunday he gets call from ?Mark at Visa Card Services?.
How do they get his phone number?
Phone number lookup by address is commonly available over the
Internet, at least for USA addresses. For free, even. I think
similar information is available for the UK. I type in an address
and get names and phone numbers for that address and a bunch of
neighbors (among other places you can do this is www.anywho.com).
If you are ex directory not BT your phone number will only be
available to the service provider or who you gave it to. The only
organisations that have my landline number are the doctor and the
phone provider. I use 3 disposable mobile phone numbers for those
people demanding a number
Post by Gordon Burditt
Some sites give other information like number of bedrooms, square
feet, when the house was built, and sex offenders living in the
area. I suspect a lot of these sites are all run by the same
organization.
How can you tell it's a scam? Your phone is ringing.
Loading...