<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p> Well,</p>
<p><br>
</p>
<p> Older Pump station installation (and maybe new ones) use
RS-232/442 to communicate in clear text with their controller into
the building.</p>
<p> Easy to tap to skim Track 1/Track2 of the CHD which is good
to dups cards.</p>
<p><br>
</p>
<p> Now to get the physical CVV you need a physical skimmer
installed on top the pump which is where your Bluetooth come in
action.</p>
<p> With those you can dups and make "Card No Present"
transaction (aka Internet).</p>
<p><br>
</p>
<p> It is a risk/reward thing.</p>
<p><br>
</p>
<p> PS: Lazyness is pretty much the greatest threat. EU/CAN/etc
are all CHIP while some other economy still refuse to spend that
extra $1 per card :(<br>
</p>
<pre class="moz-signature" cols="72">-----
Alain Hebert <a class="moz-txt-link-abbreviated" href="mailto:ahebert@pubnix.net">ahebert@pubnix.net</a>
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 <a class="moz-txt-link-freetext" href="http://www.pubnix.net">http://www.pubnix.net</a> Fax: 514-990-9443
</pre>
<div class="moz-cite-prefix">On 11/08/18 22:50, Chris Adams wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20181109035023.GA21189@cmadams.net">
<pre wrap="">Once upon a time, Scott Christopher <a class="moz-txt-link-rfc2396E" href="mailto:sc@ottie.org"><sc@ottie.org></a> said:
</pre>
<blockquote type="cite">
<pre wrap="">Swipe-and-sign (and now just swipe for small amounts) is for Visa, Mastercard, Discover transactions (called credit)
</pre>
</blockquote>
<pre wrap="">
Signatures are no longer required for chip card transactions in the US,
except I think for transactions where the auth is done on the amount
before an added tip (restaurants).
</pre>
<blockquote type="cite">
<pre wrap="">Skimming and card fraud is actually uncommon in the U.S. these days, and the police are very effective at combating it. It's just cheaper for the industry to eat fraud losses than to "upgrade" systems. The transition to chip-based cards was a debacle.
</pre>
</blockquote>
<pre wrap="">
Skimming is still highly active at gas pumps, where chip support was
pushed off (current requirement I believe is late 2020, but may be
delayed again).
The skimmers get more creative all the time; they're getting inside
pumps (possibly with help of low-paid station attendants, but also
because of poor physical security) and installing the skimmer hardware
out of sight. The hardware has Bluetooth, so the bad guys just pull up
and get gas and someone in the car can retrieve the data (from multiple
pumps even).
</pre>
</blockquote>
<br>
</body>
</html>