It’s Cyber Monday, Y'all!

Cyber Monday credit card security

It’s Cyber Monday, Y'all! Do you know where your credit card is? Of course, you do. It’s in your wallet, or purse, or poised on your keyboard, ready to be put into service. I should have asked do you know where your credit card number is? 

In 2017, according to the National Retail Federation, 81 million people in the U.S. shopped online on Cyber Monday.  About 15 million more than on Black Friday. The only way to snatch up on those cyber deals is to pay with a credit card. And pay we did. Business Insider reported that we spent six and a half billion dollars in 2017. Over $1.5 billion than on Black Friday that same year.

We’ve become trained to look for https or the little padlock to indicate we are dealing with a secure site. And that is true for the transaction. E-commerce is mostly protected by encrypted communications. The security issue here is saving your personal and financial data on the company’s website. Creditcards.com posted a story in 2017 in which they conducted a poll of credit card users. The poll found that 94 million Americans store their card information online

There may be encryption for the transaction but when you store your data you’re giving the site all the information a cyber thief needs. That data sits in a database on the company’s servers for who knows how long. See a previous post on this blog about Cleaning Up Your Online Presence. 

Storing your card information makes it much easier to check out but also exposes your data to hacking. Think about all the stories in the news this year alone about companies getting hacked. And if not directly then through third party vendors. It’s so common that we almost stop paying attention to the reports. If we do feel we’ve been affected, we change our password and move on. It’s become so a part of our lives we’ve become complacent about e-commerce and our privacy.

Tips

·     You have to use plastic to shop online. When you do use credit instead of debit. 

·     Best not to store your information, especially if it’s a little used site or one-time purchase. Type your card in each time. Don’t create accounts. Check out as a guest.

·     Research with whom you’re shopping. The bigger the company the better, to some extent. As opposed to smaller businesses that have less traffic and do not have the resources to support update to date and effective security. 

·     Considering having a card you use specifically for online shopping with a low limit

·     Monitor your accounts. Especially after a shopping spree or big shopping day like Cyber Monday.

Not trying to be Chicken Little. Just trying to remind people to take a beat and check their online shopping practices. Coming back from identity theft or online fraud is not an easy path.

Even though it’s not credit card related here’s another tip that could help protect your card. If you‘re shopping Amazon or looking at reviews on Yelp or TripAdvisor, run the link to the product through a review analytics site like Fakespot. 

The results will give you an idea about how reliable the seller is and if it a reliable company. If using Fakespot, after you find a product on Amazon copy the link from the search bar and past into Fakespot. The results will be a grade regarding the site and advisement on whether you should proceed or not.

Please feel free to share. Visit the blog archive for more posts about Privacy. https://mazzellainvestigations.blogspot.com/search/label/privacy

No autographs, please

Beginning April 14, 2018, some of the major credit card companies eliminated the need to sign receipts, for any amount. American Express, Mastercard, Visa, and Discover had a previous signature requirement for any purchase over $50. The major card companies ended the requirement hoping to expedite customer experience at checkout. Since the announcement, it seems as if every store now has a different requirement at checkout. Some checkouts are as simple as tap and go-some still require a signature.

Signing

Signing the keypads was a holdover from the credit receipt days when your signature acknowledged that you were responsible for the charge. This carried over to the electronic signature pads, which really just became an acknowledgment of the purchase. Even if someone did steal your card they could sign any name. Credit card companies and merchants would use the signature to settle sale disputes, but with advancement, in fraud detection technology they say signatures are no longer necessary. Over the years the need for a signature had become a joke to some. People scribble on signature pads, sometimes with their fingers, illegible signatures or actually write, “This is not my card”, to test cashiers. The truth is, cashiers would rarely look at the back of the cards. With the advent of the keypads, the cards rarely exchanged hands so cashiers could not compare the signatures. Some retailers would ask for ID to compare the customer with the name on the card. This is becoming even rarer.

Why sign the back?

Most cards require a signature on the card to “validate” the card. In an attempt at fraud protection, some customers refuse to sign the card or write, “Ask for ID”.  Sometimes this works, but most of the feedback I’ve heard is the cashier refusing to accept the card. If the card is not signed and is stolen then the thief could use his or her own signature. 

Card signatures are probably moot because the card rarely exchanges hands. Except in the restaurant industry. With all of the fraud protection and level of security awareness, we assume we achieve, a restaurant is still one of the very few places we had our cards to strangers and allows them to walk out of our view.

As fraud detection technology advanced the need for signatures has decreased in the last several years. The implementation of the EMV (Europay, Mastercard, Visa-Which are the companies that developed the technology) chip and contactless readers has eliminated the need for the signature as these advancements have decreased the use of fraudulent cards. Unlike the magnetic strips, chips protect against hacking as the chips produce a one-time password or token to exchange the card data. Hackers may be able to obtain the information through breaches but it is unlikely they would be able to use the data or it would be too costly to decipher. This is the same technology used when using a Smartphone to pay at a contactless reader.  

Speed speed speed

In reading all the news releases regarding the removal of the signature requirement, the constant theme was speed at the checkout. Banks and merchants want to get customers through the checkout as quickly as possible. This also removes the cashier’s interaction with the customer’s card. The onus is on the “system”, not the cashier to verify the card. What it doesn’t do is verify the identity of the possessor.

Chip technology only proves that the card is real. It does not provide security as to the identity of the possessor. Therefore, if your card is stolen it can still be used until canceled. That is why it is extremely important to report your cards as lost or stolen immediately after discovering such. Some banks offer a mobile feature that allows you to remotely freeze your card until it can be found or verified that it has been lost or stolen.

Banks are experimenting with biometric identification methods to further verify the card’s user. Similar to your Smartphone, fingerprint verification would be needed to approve the transaction. Europeans have been using chip-embedded cards, since 1994. The next step in European credit security will be chip and PIN, which will require users to enter a PIN to verify identity. The same as using a debit card. America had been slow to adopt chip-embedded cards due to the millions of magnetic strips already in use. With the push for speed at checkout, Americans will get use to not having a signature pause and may balk at having to add a PIN to the process.

Retailers will have the decision whether or not to require the signature. Some have already become removing the requirement. Some may be restricted by the hardware used to complete the credit transactions. As point of sale equipment is updated even more merchants will not require signatures.

Until then don’t be shocked if the clerk just smiles and hands you the receipt. Or would you like it emailed?

Refer to the blog archive and categories for more posts about identity theft and fraud.

Time expired on parking meters

You approach the parking meter. It is a standalone machine in the parking lot; not connected to a building or a visible wired connection. While the meter does accept cash, it also has a credit card slot. You unsheathe your card and slide into the slot as instructed by the screen instructions. The meter reads your card and communicates, wirelessly, with the bank. If the card is authenticated, the transaction is approved and the meter distributes a receipt. Transaction complete. So what just happened? 

In the digital communication-everything is hackable world we live in how are parking meters safe? Research on this topic seems to indicate a risk reward scenario or more likely a Not worth the effort scenario. As we have seen in recent years, any system of any entity is subject to hacking. No matter the type of hardware or the owner. This article continues the discussion regarding the security of parking meters raised in the post Skimmers, August 2017.

The parking meter

Before we get into the security of the parking meter, first a little history.

According to Wikipedia, Massachusetts entrepreneur Roger Babson filed the first patent for a parking meter in 1928. The electric meter was meant to be powered from the battery of the parked car. Either due to design or necessity at the time the Babson meter never caught on. In 1935, Oklahoma City newspaper publisher Carl C. Magee had identified parking issues in the business district and was asked to find a solution. His idea was to regulate parking through coin operated meters associated with spaces determined by lines painted perpendicular to the curb. Magee asked Oklahoma State University engineering professors Holger Thuesen and Gerald Hale to develop a machine. The result was the Park-O-Meter, which Magee received a patent in 1938. The first Park-O-Meter was installed in downtown Oklahoma City in July 1935. Retailers loved the meters as they encouraged a quick turnover of cars and potential customers. Drivers, initially opposed, were forced to accept them. The cost for that first hour was five-cents.

The first meters accepted coins and had a dial to engage the timing mechanism with a red flag to indicate expiration of time. Those meters required a service person to keep the mechanism wound. Later iterations by other companies provided a system that remained wound by the action of the user setting the time, eliminating the need for service personnel. Since the parking meter made its debut there have been many styles and mechanisms deployed. All of which have completed the same task, measuring an amount of time for a price. Manual mechanisms remained in service for fifty some years until advancement in technology allowed for digital operations in the 1980’s.

At this point in our history lesson drivers looking to park their cars still had to use coins. Some machines only accepted one kind of coin. Different variations of the parking meter existed depending on the maintenance and replacement by local governments.  

Again Wikipedia tells us that in 2007 the IPS Group from San Diego, California introduced the solar powered credit card accepting parking meter. (Wikipedia is used as a source because there isn’t much out there in the way of the history of the parking meter)  The so called smart parking meter was born.

Smart parking meters

Advances in wireless technology have been applied to parking meter design to develop the “smart meter”. These meters are solar powered with wireless connectivity. This gives the meters the capability to talk to maintenance crews and banks, allowing for service calls and electronic transactions. This type of technology also allows drivers to pay through the use of phone apps and single machines to regulate multiple spaces. They also can be designed to alert enforcement personnel when cars are over parked.

The market is flooded with types and styles from a variety of vendors. Some municipalities use single pole meters per space and others use machines that regulate multiple spaces. All use wireless connectivity. Which brings up the question-Can they be hacked?

Are smart parking meters secure?

Shortly after the introduction of the smart parking meter three hackers revealed at the Black Hat conference in Las Vegas in 2009 that they had hacked meters in San Francisco. In an attempt to prove the security flaws of the new technology, the hackers’ reverse engineered the technology and found that the machines had little in the way of protection or encryption. They were able to “trick” a variety of meters into providing free parking. This infiltration manipulated the meters but did not attempt to intercept or steal credit card transactions.

Since this report was made public parking meter manufacturers have worked to improve the technology to protect electronic data transfer. Even the FTC issued a report in 2015 encouraging all manufacturers of smart devices (Appliances, thermostats, etc.) to invest more into securing the “Internet of things”

The International Parking Institute released a report titled, "What's What in parking Technology" in 2016. The report describes a point-to-point credit card encryption method, which delivers end-to-end encryption. The method instantaneously converts credit card data into an indecipherable code at the time the card is swiped to prevent hacking. Similar to how Apple Pay creates a token that has no exploitable meaning or value except to the key holders at either end of the transaction. This allows the meters to communicate directly to the banks.

This also means that any credit card data stored on the meter is encrypted as well so that it cannot be read by anyone, including maintenance personnel. As with any electronic transaction it is recommended that you keep your receipt as it contains a bank authorization number on your receipt to reference your transaction with your credit card company.

Hacking the wireless connection to obtain credit data may not be fruitful but there have been a few instances reported regarding skimming. This is when a thief attaches a device over or into the manufacturers credit card slot. The device collects credit card data as they are swiped. The problem is that parking meters are smaller than ATMs and gas pumps. So it is harder to hide the skimming devices. Not that it cannot be done or tried. On ANY type of machine that accepts credit cards you should check for evidence of tampering before swiping your card.  

So, our journey brings us back to the question, is it safe to use your credit card in a smart parking meter? For the most part, yes. The meters themselves either do not store data or the data is encrypted. The transactions also are encrypted. The machines themselves offer little space for skimming devices. Can they be hacked? More than likely a resounding yes as anything can be. Is it worth the criminals’ effort? Other than bragging rights probably not. The pay off is not worth the effort.

Another source of curiosity are vending machines that accept credit cards. There have been no indications that they’ve been targeted. But with what we’ve learned about parking meters, we’ll chalk those up to the pay off is not worth the effort as well.

Please feel free to share any and all posts. See the blog archive for more posts about wireless and personal security

Skimmers August 2017

Public Wi-Fi for dummies July 2017

Pain at the pump October 2016

Taking your identity on vacation June 2013