the easy way to use a stolen credit card

My girlfriend bought a couple of rail tickets yesterday from one of
the vending machines in Waverley Station, Edinburgh. An extremely
simple procedu select where you want to go, what sort of ticket
you want, insert card, tickets dispensed.

No you didn't miss a step. It *didn't* ask for a PIN.

How the hell can that be legal?

How the hell is it even *possible*?

You could clean out somebody's account at the rate of a few hundred
pounds a minute that way.

============== j-c ====== @ ====== purr . demon . co . uk ==============
Jack Campin: 11 Third St, Newtongrange EH22 4PU, Scotland | tel 0131 660 4760
http://www.purr.demon.co.uk/jack/ for CD-ROMs and free | fax 0870 0554 975
stuff: Scottish music, food intolerance, & Mac logic fonts | mob 07800 739 557

(Jack Campin - bogus address) wrote in
:

You could clean out somebody's account at the rate of a few hundred
pounds a minute that way.

First, you don't "clean out" a credit card account, you merely apply
charges which can be disputed. If the card's already been reported
stolen, you don't even have to do that.

And in your scenario, all the thief gets is a basket full of train
tickets.

--
Bert Hyman | St. Paul, MN |

"Jack Campin - bogus address" wrote in message
...
My girlfriend bought a couple of rail tickets yesterday from one of
the vending machines in Waverley Station, Edinburgh. An extremely
simple procedu select where you want to go, what sort of ticket
you want, insert card, tickets dispensed.

No you didn't miss a step. It *didn't* ask for a PIN.

How the hell can that be legal?

How the hell is it even *possible*?

You could clean out somebody's account at the rate of a few hundred
pounds a minute that way.

One presumes the vendor would be liable for the losses this way.

But the thing is as tickets are not transferable and the tickets are not
very easily disposable I suspect this fraud is quite rare.

Its not like it is dispensing cash. I also suspect the machines are on cctv,
but as I have said many times cctv is only any use if somebody recognises
the perpetrator.


Tom

Tom Burton wrote:

But the thing is as tickets are not transferable and the tickets are not
very easily disposable I suspect this fraud is quite rare.

I am not sure that someone who has nicked a credit card will be
terribly bothered by the niceties of non-transferability rules from
NCoC.

Incidentally, I had the same experience buying a ticket in Paddinton
last week - no PIN required. Maybe it's a First thing?

Ian

On Mon, 18 Dec 2006 17:37:31 +0000, Jack Campin - bogus address
wrote:

My girlfriend bought a couple of rail tickets yesterday from one of
the vending machines in Waverley Station, Edinburgh. An extremely
simple procedu select where you want to go, what sort of ticket
you want, insert card, tickets dispensed.

No you didn't miss a step. It *didn't* ask for a PIN.

How the hell can that be legal?

How the hell is it even *possible*?


Noticed similar prodedure when paying for parking in Stockholm and
crossing the bridge from Sweden to Denmark. No PIN code entered, and
toll was nearly 50 euros, if I remember correctly.

I was also kind of worried what someone could do with a stolen card...

Mika



--
----------------------------------------------------
Haluatko lähettää postia? Vaihda osoitteen
eka (vai oliko se toka?) numero vitonen numeroksi
kahdeksan...
----------------------------------------------------

Jack Campin - bogus address wrote:

My girlfriend bought a couple of rail tickets yesterday from one of
the vending machines in Waverley Station, Edinburgh. An extremely
simple procedu select where you want to go, what sort of ticket
you want, insert card, tickets dispensed.

No you didn't miss a step. It *didn't* ask for a PIN.

How the hell can that be legal?

How the hell is it even *possible*?

You could clean out somebody's account at the rate of a few hundred
pounds a minute that way.

Same thing happens at the gas pump, here in the U.S.! It's
true some "pay at the pump" facilities DO ask for the
cardholder's zip code, but by no means all of them. (Even
with all the gas-guzzling SUV's here, it would take a lot of
tankfuls of gas to equal the cost of a few European railway
journeys, but the principle's the same.)



============== j-c ====== @ ====== purr . demon . co . uk ==============
Jack Campin: 11 Third St, Newtongrange EH22 4PU, Scotland | tel 0131 660 4760
http://www.purr.demon.co.uk/jack/ for CD-ROMs and free | fax 0870 0554 975
stuff: Scottish music, food intolerance, & Mac logic fonts | mob 07800 739 557

But the thing is as tickets are not transferable and the tickets are not
very easily disposable I suspect this fraud is quite rare.

I am not sure that someone who has nicked a credit card will be
terribly bothered by the niceties of non-transferability rules from
NCoC.

True but someone buying the ticket from said criminal may be.

A friend of mine will happily buy copied DVDs and CDs but will not copy his
own.

Mika wrote:

Noticed similar prodedure when paying for parking in Stockholm and
crossing the bridge from Sweden to Denmark. No PIN code entered, and
toll was nearly 50 euros, if I remember correctly.

I was also kind of worried what someone could do with a stolen card...

I have heard (but, not being interested in committing fraud, I don't
know if it is true) that even when a card has been cancelled it can be
used for such transactions. The vendor bears the risk, and it probably
makes commercial sense to live with some losses to fraud than to take
on the cost of a verification system (the main cost being time,
reducing the throughput on machines).

--
PB
The return address has been MUNGED
My travel writing: http://www.iol.ie/~draoi/

My girlfriend bought a couple of rail tickets yesterday from one of
the vending machines in Waverley Station, Edinburgh. An extremely
simple procedu select where you want to go, what sort of ticket
you want, insert card, tickets dispensed.


Noticed similar prodedure when paying for parking in Stockholm and
crossing the bridge from Sweden to Denmark. No PIN code entered, and
toll was nearly 50 euros, if I remember correctly.

I was also kind of worried what someone could do with a stolen card...


I guess what the two have in common is that neither of the companies have
much to lose by simply refunding fraudulent transactions.

The bridge still costs the same to maintain [1] and the train still runs. So
neither companies incurr any loss other than the revenue, it would be
different in a shop where the store not only loses the sale, but has to pay
for the stock taken aswell.

***SOME*** of Tesco's (as opposed to Asda's) self-service tills simply are
scan---swipe---and go which worries me more after all cheap bottles of
whiskey are much easier to shift no-questions asked, drink the evidence,
sir, hic. That said even from a cardholders point of view it makes little
difference, as the money will be refunded by the bank and claimed back from
Tesco - provided the cardholder was not negligent with their card.

[1] - Very minor costs will be incurred of course but I would suggest they
are negligible.

Tom Burton

I have heard (but, not being interested in committing fraud, I don't
know if it is true) that even when a card has been cancelled it can be
used for such transactions. The vendor bears the risk, and it probably
makes commercial sense to live with some losses to fraud than to take
on the cost of a verification system (the main cost being time,
reducing the throughput on machines).

And possibly a reduction in costs through processing and communications
fees. Probably just checks the checksum of the card and alike.

Not so common now but a few years ago not every single card transaction was
verified online, stores had a 'floor limit' which was never to be disclosed,
under this limit transactions could take place without verification by the
bank. Certain cards such as Electron and Solo IIRC always have had £0 floor
limits. At the store which I currently work ALL cards now have a £0 limit.
Don't think I can get in too much trouble by saying that :-)

Slightly aside, I was bored the otherday and ran my swipable cinema card (no
chip) through the reader at the till point, to my surprise it began a
transaction with a valid 16 digit number (that is my cinema number) and an
expiry date (which my cinema card does not have). I bottled it and cancelled
the transaction. All slightly odd though. I wonder what those ticket
machines would make of that?

Tom