Republic bank locking bank accounts for fraud?

[stev]

my mother went to the bank today and they told her that a Scotia Bank ATM was compromised.

[rfari]

This sounding like it has nothing to do with card skimmers. Like some banks get hacked and they quietly trying to do damage control

[***TRINISON***]

They should have some sort of press release for this. For the unsuspecting customer who is waiting to use his/her card over the weekend, it could end up in them sucking salt....And it will be of no fault of theirs!!!

[stev]

This sounding like it has nothing to do with card skimmers. Like some banks get hacked and they quietly trying to do damage control

yuh never know.

[Bareback]

This sounding like it has nothing to do with card skimmers. Like some banks get hacked and they quietly trying to do damage control

yuh never know.

Let the rumours begin. At the end of this discussion we would all be qualified to run any bank

[silver]

^^Confirmed.
It was perpertrated on one's bank ATM but due to LINX all users accounts can be potentially affected.
IF you see a physical device attached to where the card reader is: DO NOT USE THE ATM!!

Bank machines in the Chaguanas area have been comproimised via the use of a skimming device which records your information from the card when you enter the bank machine vestibule. It is known how many clients or banks have been exposed.

I don't know that this can affect ATM cards. The skimming device can copy the track information from the plastic to be copied onto another card. ATM cards require PINs which are not encoded onto the track information on the card. Skimming an ATM card would be useless without the PIN. THey would also need a remote camera to view the pin being entered.

Not true, it is encoded on the card.

That makes no sense.
If the PIN was encoded on the card there would be no need for LINX to verify the PIN with the issuing bank...it would just have to check the card.

[Bareback]

^^Confirmed.
It was perpertrated on one's bank ATM but due to LINX all users accounts can be potentially affected.
IF you see a physical device attached to where the card reader is: DO NOT USE THE ATM!!

Bank machines in the Chaguanas area have been comproimised via the use of a skimming device which records your information from the card when you enter the bank machine vestibule. It is known how many clients or banks have been exposed.

I don't know that this can affect ATM cards. The skimming device can copy the track information from the plastic to be copied onto another card. ATM cards require PINs which are not encoded onto the track information on the card. Skimming an ATM card would be useless without the PIN. THey would also need a remote camera to view the pin being entered.

Not true, it is encoded on the card.

That makes no sense.
If the PIN was encoded on the card there would be no need for LINX to verify the PIN with the issuing bank...it would just have to check the card.

Huh..........You seriously came up with this analysis all by yourself. Please tell us you didn't hurt yourself???

[silver]

no bareback...is commonsense. The whole point of a PIN is to have a 2nd level of authentication to prove that the holder of the card is the owner. If someone could read the track information and discover the PIN that would be a bit pointless.
Also, there would be no need for shoulder surfing by those fraudsters that have implemented the card skimming devices. Most ATM vestibules are now able to prevent lebanese loop you see big green plastic devices covering some (except for some Scotiabank ATMs, which is probably why the breech was alledgedly from there).

but since you seem to need more information...

Data Layout on Magnetic Stripe Cards



Data is laid out on a standard magnetic card in three tracks. A magnetic stripe card may have any of these tracks or a combination of these tracks.

Track 1 was the first track standardized. The International Air Transportation Association (IATA) developed it and it is still reserved for their use. It is 210bpi with room for 79 7-bit characters.

Track 1 is encoded with a 7-bit scheme (6 data bits plus one parity bit) that is based on ASCII. If the reader does not perform the ASCII conversion, add 0×20 to each byte to turn it into ASCII (there are no “control” characters). The seventh bit is an odd parity bit at the end of each byte.

The LRC is made up of parity bits for each “row” of bytes, making the total even. That means that the total of all the bit 1s of each byte has to come out to an even number. Same for bit 2, etc. The LRC’s parity bit is not the sum of the parity bits of the message, but only the parity bit for the LRC character itself. (It is odd, just like any other single byte’s parity bit).


The Bankers Association developed track 2 for online financial transactions. It is 75bpi with room for 40 5-bit numeric characters.

Track 2 is encoded with a 5-bit scheme (4 data bits plus one parity bit). To convert this data into ASCII, add 0×30 to each byte.


Track 3 is also used for financial transactions. The difference is its read/write ability. It is 210bpi with room for 107 numeric digits. Track 3 is used to store the enciphered PIN, country code, currency units, amount authorized, subsidiary account information, and other account restrictions.

Track 3 has the same properties as track 1 (start and end sentinels and an LRC byte), except that there is no standard for the data content or format. No national bank card issuer currently issues track 3.

In those rare systems where the PIN is stored on the card, this is the track where it is stored

[jmccomie]

Das y allyuh should do like me an keep ur money under ur mattress

[redmanjp]

http://www.ctntworld.com/LocalArticles.aspx?id=43358

Linx cards compromised at Central ABM

Friday 6th July, 2012



Citizens who attempted to use their Linx cards at an Automated Banking Machine in Central Trinidad on Friday morning, but lost it, have been told that it's just a safety measure to protect them.


C News has learnt that Linx cards used at an undisclosed ABM during the month of June have been compromised as an unauthorised skimming device was attached to the machine.


This is a method used by criminals to capture data from the magnetic strip on the back of an ATM card, usually without the cardholder's knowledge.


Both RBC Royal Bank and Scotia Bank have reportedly placed a 'block' on all Linx cards which have been compromised to prevent money from being stolen from their customers.


The banks' operators have advised persons who lost their cards to apply for new ones, but assured that the inconvenience is to protect them.


Meanwhile, the Bankers Association of Trinidad and Tobago said it is aware of fraudulent activity at certain Automated Banking Machines.


In a statement, BATT noted that 'skimming' is a global issue and one which the Caribbean Financial Services Industry is working together to fight.

The Association said safeguarding customers against fraud is a top priority of the banking sector and it has initiated the necessary action across the industry to stop this activity, to protect customers' interests, and help the law enforcement officials in identifying and prosecuting the perpetrators.

BATT said in light of recent occurrences, customers are advised to immediately contact their bank should they note any suspicious activity in their accounts.

It said to protect customers and in order to prevent further unauthorised access to their accounts, it will block those cards suspected of being compromised.

[brandon005]

Confirmed use of hidden camera in addition to the skimming device.. party get drastic!

[brams112]

Good thing i don't use banks oui,i keep my money,,

[matthewmazda]

is a good thing i in last citizens bank

[Country_Bookie]

We need to go back to the days of sou sou. Lewwe start one on 2nr. 2 grand a week sound good?
I go hold d fus hand.

[area6]

chip cards are the wost you all should watch the documentary

[2NR Smurf]

and here i thought BATT was Bandit Association of Trinidad & Tobago...

[francis1979]

tuner better than the newspapers.

Tuner buss this on Thursday.

it only reach on the papers today. and only in the guardian

[pete]

Shut down my scotia account today..

Hope I get a new card Monday yes.

[De Dragon]

Shut down my scotia account today..

Hope I get a new card Monday yes.

pete are you getting online access?

[pete]

Nope. Online banking is locked out until I go in and get a new card. They called me today and checked through my last few transactions to ensure it wasn't used by anyone else. They said my credit card wouldn't be affected so that'll have to rally me til I get a chance to go to the bank.

I find they should extend their opening hours so people can come and get this sorted out.

[bluefete]

Allyuh missing de bigger picture!!! De banks at war with each other over this.

The Guardian said that the BATT (led by Richard Young of Scotiabank) put out a circular saying that the atms belonged to Republic.

Republic Bank replied with another circular saying that it was not their atm's but failed to say the atms' really belonged to Scotiabank.

Customers panic over ATM fraud reports
Bankers launch probe
Published:
Saturday, July 7, 2012
ANNA-LISA PAUL

Thousands of bank customers went into panic mode yesterday after reports began circulating that an unauthorised skimming device had been used at an automated banking machine (ABM) in central Trinidad to allow unknown people to hack into customers’ accounts and steal money. Banking sources yesterday told the T&T Guardian the ABM in question belonged to Republic Bank Ltd.



Speaking with the T&T Guardian yesterday, Richard Young, president of the Bankers Association (BATT), confirmed an investigation has been launched. Young said BATT was considering placing advertisements through Crime Stoppers T&T, as several photos of suspected perpetrators had been obtained through internal investigations.



BATT urged customers to contact their bank immediately if their card becomes stuck in the ABM, so that the card can be blocked. Urging people to be extremely vigilant when using ABMs, BATT reminded the public not to reveal their personal identification number (PIN) to anyone, even people claiming to be bank employees.



Checks with the Fraud Squad revealed that while this was not a new type of crime, no new reports had been referred to them for investigation. Officials said while there are several such matters now engaging their attention, banks often carry out internal inquiries before referring the matter for further investigation and prosecution.



Young’s assurance followed reports that customers had tried to use their Linx cards at the Central ABM on Friday morning and “lost” them. The T&T Guardian learnt that the measure was employed by the bank as a safety mechanism to protect customers whose cards may have been tampered with.



A release from BATT stated: “Over the last few days, the Bankers Association has become aware of fraudulent activity at certain ABMs. The type of fraud being attempted is known as skimming, a process whereby fraudsters capture personal information from customers’ cards with the intention of later using that information to access the customers’ accounts.”



Replacement cards
Young said while customers will experience some level of inconvenience while replacement cards are being prepared, “Be reassured, the industry is working together to minimise the inconvenience to all customers.” Young said people whose money was in fact stolen will be reimbursed.



However, he warned people looking to make a quick buck to think twice, as banks will do internal investigations to determine if the customer really was a victim of fraud. The BATT release read: “In light of the recent occurrences, customers are advised to immediately contact their bank should they note any suspicious activity on their accounts.



“In the interest of protecting our customers, should the banks also suspect fraudulent activity, we will immediately block those credit or debit cards on which tampering may be suspected. Blocking of cards will prevent any further transactions on those accounts.



“While this action may inconvenience the affected customers, it is necessary in order to prevent any further unauthorised access to their accounts. “These customers whose cards are blocked will be contacted by their bank individually and replacement cards will be issued from their home branch.”


From Scotiabank

After BATT’s media release about reports of fraudulent activity, Scotiabank T&T yesterday issued this statement:
“Customers affected by the incident outlined above can visit the Scotiabank branch on the Main Road in Chaguanas or the one on the Southern Main Road in Couva on Saturday, July 7 (today), between 9 am and 1 pm to have their Scotiabank debit card replaced. “The bank apologises for the inconvenience caused and continues to have our customers’ best interest in mind.”

For further information, call 62-Scotia

http://www.guardian.co.tt/news/2012-07- ... ud-reports



This was the reply in today's Guardian:

Republic Bank: Our ABMs are safe
Published:
Sunday, July 8, 2012


Republic Bank states categorically that none of its automated banking machines (ABMs) have been compromised in any way nor are the bank’s ABMs connected to the incidents referred to in a media release issued by the Bankers Association of T&T on Friday.


The bank was responding to an article in yesterday’s Guardian, regarding new incidents of card skimming at ABMs. In a release, the bank denied that the ABM in question belongs to them. “Republic Bank places great emphasis on ensuring that the most up-to-date security is available at all of its electronic channels and continues to make significant financial investments in continually upgrading its electronic security to protect its customers’ accounts.” The bank is assuring customers that its 121 Blue Machines throughout the country have not been compromised in any way.

http://www.guardian.co.tt/news/2012-07- ... s-are-safe

[skylinechild]

Bank machines in the Chaguanas area have been comproimised via the use of a skimming device which records your information from the card when you enter the bank machine vestibule. It is known how many clients or banks have been exposed.

I don't know that this can affect ATM cards. The skimming device can copy the track information from the plastic to be copied onto another card. ATM cards require PINs which are not encoded onto the track information on the card. Skimming an ATM card would be useless without the PIN. THey would also need a remote camera to view the pin being entered.

Cards are encoded with the pin. Go to your bank and tell then you forgot your pin and see what they do.

[maj. tom]

^

Pins are not stored. By anyone or anything. They are never stored and only you know your PIN. Just like how only YOU know your password to logon this website. The admin doesn't know it or cannot read it; he can only reset it. Well maybe he can decrypt the hash function output back into the original data if he had a supercomputer and time.

You enter your PIN in the ATM which encrypts it and creates a private key which is sent through the ATM network to the Bank along with the public key encoded on the card in the machine at the moment. The bank then checks this key with the public key encoded on your ATM/Credit Card. The key in your card is unique and is a public key and anyone can read it with the appropriate device (like a ATM machine), but it is useless without the private key which is generated when you input your PIN. When they match (eg. PIN private key AQ2ILPP8V4B matches with card public key GN3Q3XPT7U9DW), the bank sends the ok back to the ATM for you to proceed with transactions.

They can use any of a number of cryptographic key exchange systems like the Diffie–Hellman key exchange system along with digital signatures... or maybe something newer now like Digital Signature Algorithm. Something modern and approved by the NIST. A lot of authentication systems work this way using key exchange, from your email to SmartKeys to a woman's legs (money = public key).



Two different people can have the same PIN for different cards. But the card (public key) needs to be in the ATM machine at the moment of authentication. If you lost your PIN, you just have to go to the bank with your papers and ID and they will reset the PIN. They can never tell you the lost PIN. That is just impossible.

Someone correct me if I am wrong, or improve the post.

[firstchoicett]

Ent they hold some people for this ? Skimming its called ?

[ProgressiveTT]

^^Confirmed.
It was perpertrated on one's bank ATM but due to LINX all users accounts can be potentially affected.
IF you see a physical device attached to where the card reader is: DO NOT USE THE ATM!!

Bank machines in the Chaguanas area have been comproimised via the use of a skimming device which records your information from the card when you enter the bank machine vestibule. It is known how many clients or banks have been exposed.

I don't know that this can affect ATM cards. The skimming device can copy the track information from the plastic to be copied onto another card. ATM cards require PINs which are not encoded onto the track information on the card. Skimming an ATM card would be useless without the PIN. THey would also need a remote camera to view the pin being entered.

Not true, it is encoded on the card.

That makes no sense.
If the PIN was encoded on the card there would be no need for LINX to verify the PIN with the issuing bank...it would just have to check the card.

Sorry I didn't make myself clear, you misinterpreted what I really meant. Not sure about the exact technical nature of it but the pin is encoded unto the card in some format but it must be confirmed with the relevant's bank system like you said. It is not readable off of the card itself (otherwise they wouldn't need to get your pin.)

[silver]

ok guys lemme see if i can be more clear on this PIN.

how it works: when you either receive a PIN or input a PIN for your debit card, the PIN is stored with encryption in a HSM (hardware security module). The only system that can verify that PIN is that HSM. Each HSM will encrypt differently.

When you put in your PIN in the ATM machine, the system checks whether the card belongs to the bank of which ATM you are using. If it is, it encrypts your entry (the pad on the ATM actually does the encryption) and sends it to the HSM to verify. IF the card does not belong to the bank of which ATM you are using, it send the encrypted PIN request to the issuing bank (your bank) and their HSM verifies it.

Now all of this was really irrelevant to my original point which was that the fraudsters had to use a remote camera or some other method of observing the PIN being entered. EVEN IF the PIN was stored on the card, it would be encrypted (and I doubt those fraudsters can decrypt 3DES).

Moral of the story... be careful when you use ATMs, observe the card slot to ensure there are no devices in or around the slot, also observe whether people are lurking around or any other strange devices that should not be there (remote cameras). Cover your hands when you enter your PIN (learn the position of the keys and touch enter the PIN) or feign pressing other keys while entering your PIN to throw off anyone that may be surveiling you.

[pugboy]

are there any photos of the device attached to the ABM ?

I find it hard to believe that an electronic device could be attached to the slot without it being noticeable by users.
The Republic machines have a nice large plastic slot guard which helps against tampering with the card slot like long ago when they would krazy glue a piece of plastic film to make the card stick.

[firstchoicett]

^ well I think it was a hidden camera above in the Celling according to news.

[pugboy]

^ they probably used one of those little keychain cameras
but they still need the card

[SR]

lol lol lol

reel experts here boy


anyhoo

people tend to forget than most atm rooms have cameras and transactions can be time stamped to match camera footage to prevent fraud

there are usually many instances where a customer claims that sombody stole thier card and withdrew money


and there is video footage of some of the suspects in this racket


on the flip side
many merchants staff are either not trained properly or careless in accepting cards for payments

2 weeks ago a friend used his wife's cc to pay for gas and signed mickey mouse on the slip
just to prove a point