Merchants not vigilant about wiping point-of-sale machines clean - Friday, March 12, 2010 | - CBC News
Point-of-sale terminals can hold hundreds of credit and debit card numbers. Thieves are accessing personal financial information using the old-fashioned smash-and-grab method, but what they're grabbing are point-of-sale terminals, not merchandise.
CBC-TV's Marketplace has learned that many retailers are not helping the situation because they leave valuable information on the terminals where customers swipe their debit and credit cards when paying for purchases instead of wiping the data each night as they're supposed to.
"It's the equivalent of leaving the store vault open and full of cash, except the cash is credit and debit card data," said RCMP Det. John Koppes of Abbotsford, BC, who is the Mounties' computer crime specialist.
The terminals process millions of dollars worth of transactions every day. Retailers are supposed to regularly wipe clean the hard drives that store the data used to make those transactions to ensure customer information is protected.
"Once thieves strike, they'll often return to the same location several times," Koppes said. In one case Koppes looked at, the same chain had been hit more than 100 times.
It is very easy to get financial information from a terminal's hard drive. They can use a simple search to uncover 400 credit card numbers and PINs from a stolen terminal.
These are not only credit card numbers; we have debit card numbers on here as well. So, you can see, there's the debit card and there's the actual pin number, if you will. It's encrypted, but it's also transmitted along with this information.
Stolen data turned into credit cards, gift cards, Koppes recalled a recent arrest that turned up a USB key containing pages and pages of credit card information stored in a Microsoft Word document.
Asked what the thieves do with that information, Koppes replied: "Make new credit cards and gift cards that are loaded up with cash from the stolen credit card numbers they have."
"You take this card and run it through the card reader, then you can re-encode it and put the stolen data on the back of the card."
"They focus on nothing else but finding the weak spots of any business practice."
Read more:
http://www.cbc.ca/consumer/story/2010/03/11/consumer-credit-card-scams.html#
