Coming from a country where credit cards almost never have PINs (according to him), he told me he'd feel very insecure if a PIN could ever be used to authenticate his card, and felt much safer signing instead.

Considering the handwriting observation training of the average shop assistant, and how…

Coming from a country where credit cards almost never have PINs…

I have the same thing with Coop Taxis, until I learnt to enunciate: "riddy nowww"

When my old company was trialling a voice activated IVR, they placed test phones on each floor for people to try it out and give feedback.

I was highly impressed when my demand of "I…

especially when I used "yis" for an affirmative

I have the same thing with Coop Taxis, until I learnt to enunciate: "riddy nowww"

Call me old-fashioned, but I've never used eftpos for anything less than $10 nor a credit card for less than $50 (except the few occasions when I've been caught short).

I just remember when retailers had a minimum limit for eftpos transactions (usually $2) which was about the same time…

Yeah, it's the same in Spanish speaking countries, the use of points instead of commas.

got to be careful there – recently a client in the US sent me some hardware to work on, declared it for customs with an extra 0 by mistake "80.000" for $80 – NZ customs…

I'm glad that England's now caught up with the glories of "chip and pin" eftpos – it tweaked me no…

Turns out everyone does things differently.

Sometimes I need to pay more attention.......

Turns out everyone does things differently.

This is a European standard – I imagine it's a leftover from the Dutch.

Ahh, I assumed it was something like that. There are plenty of Dutch hangovers including the almost universal pre-digital invoice numbering system. An invoice will be issued with a number along the lines of INV 2009/VII/HDL/04/KPN/02…

I phoned the Bank and asked how someone other than me could make cash withdrawals and was told that they couldn't.
Go figure that one.

Contact the banking ombudsman. It normally does a very good job of resolving problems like this.

I'd say probability rather than possibility.

Depending on what you mean by "internal" (i.e. "person who works there" v. "person with access to flash drive owned by person who works there".) But it's scenario with the fewest caveats, assuming the council's firewalling isn't actually completely useless.

The hubby and I…

http://computerworld.co.nz/news.nsf/scrt/7E178E15FC9F7306CC25767A000E4A3E

You get very used to having at least $50 in your pocket, and a couple of coins in case you can't break the note.

And then you have Indonesia, whose banking system (and banking security) exists in never-never land. I had to pay a fairly large sum recently (USD$6700) to…

I phoned the Bank and asked how someone other than me could make cash withdrawals and was told that they couldn't.
Go figure that one.

Seriously weird.

So I phoned the Council and was told that they don't accept credit card payments

I presume you're talking about AK City. I'm…

I phoned the Bank and asked how someone other than me could make cash withdrawals and was told that they couldn't.
Go figure that one.

Hmmm ...

Slightly off track.
The appropriately named 'Your Telecom' service from Telecom has been offline for a week.
Security breaches ?

Not for me, Steve. You might need to get in touch with 'em and ask 'em wassup.

Basically, internal systems at Auckland City have been compromised.

Why else would the Banks go public? PCI DSS has been laggardly in NZ. It's a commercial arrangement, so you can't force the issue... unless you get a nice healthy breach. In which case you name and shame the weak link...…

Any possibility that the Auckland CC thing is an internal issue rather than external?

I'd say probability rather than possibility.

It's one of the main reasons tipping is such a huge emotional trigger for many in the US-it's effectively a voluntary subsidy to prop up someone's salary.

A few weeks ago I ran into someone who spent a lot of time as a waitress somewhere in the US. She thought…

In some states and some times (California keeps changing the law) you may be asked for a picture ID – they expect a driver's license, some people have never seen a passport and may be confused.

I just show my Kiwi license and if they quibble, berate them for not…

"It took a few months in Australia for me to realise that leaving the house without cash was a bad idea."

I understand that in NSW at least they still have, and actually use vagrant laws for people with no cash. A friend claims to having recived a ticket in…

But they use the metric inch .... (exactly 2.54cm) ....

One of my biggest pet hates... how difficult could it be to get Microsoft to switch to metric when you set metric! Perhaps someone could start a campaign?

In NZ I've walked around for 2 months with a $20 note in my wallet that I've never touched, because EFTPOS is accepted nearly everywhere with few exceptions

New Zealand is apparently the most EFTPOS using country in the world. The fee structure for the system encouraged rapid takeup by…

I'm sorry Mikey, I can't do that.

If he'd just held out for a few more weeks he could have avoided the hell of unpaid DJing to first years...

ASB Bank told me that several customers had had fraudulent activity on their cards and that the only vendor that they had in common was ACC Parking, so that seems to back up what the media is saying.

What really pissed me off though was…

Dear Mr Haxor,
Could you please remove a few awkward parking tickets under my name while you're mooching around in there?
Cheers.

I'm sorry Mikey, I can't do that.

Basically, internal systems at Auckland City have been compromised.

Dear Mr Haxor,
Could you please remove a few awkward parking tickets under my name while you're mooching around in there?

Cheers.

Why?

Auckland City's PCI certification is under serious review which will compromise their ability to carry out any credit card transactions. This will also potentially impact the new Auckland Council. Basically, internal systems at Auckland City have been compromised.

Holy shit.

It's almost unbelievably antiquated.

Our best friend in the USA was paid with an actual 'check', had no bank account, and cashed his pay at the liquor store for a fee and some real greenbacks (cheque cashing places are EVERYWHERE in working-class neighbourhoods). He was admittedly an extreme case, but…

Paul, you're giving them too much credit. They won't even accept the metric system.

But they use the metric inch .... (exactly 2.54cm) ....

The driver licence thing reminds me of going to a bar in Arizona and trying to order a beer.

My partner has an exchange student friend with whom she was trying to get into a Wellington pub a few years ago, using a passport as a photo ID. The bouncer…

But I was also surprised just how much that whole system still relies on cash-in-hand.

Worse than that, "paycheck" is often a literal, not a metaphorical staetement in the US, meaning that companies can dick people around by ensuring they get their pay too late on Friday to bank it,…

They won't even accept the metric system.

BTW…

SSL is a great example – SSL man-in-the-middle attacks are becoming doable

The holes have been there for a decade or so, the knowledge has just become public more recently. The real problem is people ignoring certificate errors, and your average non-techy person will usually pick convenience over caution. Like…

Check this out and play spot the difference.

Those are awesome. Whoever came up with them deserves my money :-)

This topic also calls for some Bruce Shneier facts,

I don't know who that is (although can guess) but even still those are ace. Kinda like xkcd in text form for me...

One-time pads are impervious to man-in-the-middle attacks, unless that man is Bruce Schneier.

I can see the need for legislation that forces any device that stores credit card details to encrypt the data to prevent this kind of theft in the future.

While not legislation as such, credit card companies (kinda, see below) will not deal with you unless you are PCI-DSS compliant…

All devices connected to the EFT network must comply with PCI DSS...

And there is a very good explanation of how that works Here

IIRC the first story about this was a spokesman for the owners, Auckland City Council, said they became aware of it when a "skimmer"…

Check this out and play spot the difference.

http://grab.orsm.net/update20090402/atm_skimming_devices.pdf

You submit the transaction to them and they return you a "token", basically a unique number that is useless without their database.

And they hold the translation between the "token" and the credit…

You stop too soon, Craig. There's no evidence he wasn't involved with the Permian extinctions, after all, and I personally find that deeply suspicious.

To quote Peggy Noonan, it would be irresponsible not to speculate.

Isn't just assumed that John Key is personally responsible for everything even slightly crappy that has ever happened in the whole wide 'verse since just before the extinction of the dinosaurs?

You stop too soon, Craig. There's no evidence he wasn't involved with the Permian extinctions, after all, and I…

God help us if the problem is someone getting into their database. I would hope it's some sort of skimming issue instead.

Daniel Ayers, who's very smart, was on the radio today saying his card was compromised, and he was pretty certain it wasn't skimming, because he watches for that…

Possibly a breach in there ?

This mob DPS are the gold standard in NZ for CC payment integration with websites, devices and internal corporate systems.

http://www.paymentexpress.com/partners/parking_vending.html

I see they list Auckland City Council among their corporate clients as well as various parking…

That sounds suspiciously like Phishing to me.

That's what I wondered — and why I'll come back and go through the front door of the MS site to the billing section.

But it's possible that…

Then I entered a random US address (in…

Of course while the cards with chips are 'completely safe' – they…

Isn't just assumed that John Key is personally responsible for everything even slightly crappy that has ever happened in the whole wide 'verse since just before the extinction of the dinosaurs?

Nah. he's done nothing, nothing I tell you.

The URL clicked through to billing.microsoft.com — which, amazingly, came up with…

The URL clicked through to billing.microsoft.com — which, amazingly, came up with an invalid certificate and a warning that this might not be the real…

Most credit card companies proactively monitor for this sort of thing and suspend your card until you say it's OK to proceed.

I had the experience a few months ago of making a very substantial purchase from the US, over the phone, and before the phone call to place the…

I'm still not entirely sure why the parking machines needed to retain credit card numbers, but if there is a need then why aren't they stored in an encrypted format?

Like I say, the most insidious form of attack...

All devices connected to the EFT network must comply with PCI…

I have been travelling in the USA for the last three weeks. I used the BART train system in SF and the Amtrak routes in and out of SF too. To buy tickets just insert your credit card in this handy machine. No authentication required. None. I think I remember…

I hear BNZ is phasing in card with a chip, hopefully that might reduce fraud. We seem to be late bringing in the chip cards here though.

Yep. I'm pretty sure all banks will have to switch to chip cards, as the card schemes (VISA, MasterCard... not sure about Amex)…

Same goes for baggage trollies at airports – $1US at I think LAX or JFK

I can see the need for legislation that forces any device that stores credit card details to encrypt the data…

I'm guessing that in addition to your security number they will have changed your expiry date, which you do need to use your card on most sites.

Ahh very true. I knew there was some detail I was missing.

Slightly off track.
The appropriately named 'Your Telecom' service from Telecom has been offline for a week.
Security breaches ?

I'd be highly surprised if it was anything like that, from what I understand it's heavily integrated with other services which are still up and running, and there's no way…

Isn't just assumed that John Key is personally responsible for everything even slightly crappy that has ever happened in the whole wide 'verse since just before the extinction of the dinosaurs?

Government is a blame sink. By being in power, you get to be responsible for everything. And that shoe…

NZ has pretty much the lowest CC fraud rate in the world (it's 1/3 of that in Australia – but my info is a couple of years old). It's because…

Call me old fasioned but I wouldn't touch one of those sites with your credit card.

phew! I am more worried about bad guys using one of those sites with my credit card number :})

A dozen responses...yet no-one has suggested John Key is behind this conspiracy so far?? Come on centre left, you can do better!

Isn't just assumed that John Key is personally responsible for everything even slightly crappy that has ever happened in the whole wide 'verse since just before the extinction…

I have been travelling in the USA for the last three weeks. I used the BART train system in SF and the Amtrak routes in and out of SF too. To buy tickets just insert your credit card in this handy machine.…

A dozen responses...yet no-one has suggested John Key is behind this conspiracy so far?? Come on centre left, you can do better!

Nah, it was Hone Key who said he could do better.
We do the truth to power thingy.

Also, I have always wondered about street parking machines where it debits your card without any pin number being entered. This is the case at the airport machines too. They charge like wounded bulls, and so in that case can be $50 or more being…

there are plenty of places to use a CC # online without knowing the CVV code on the back.

Call me old fasioned but I wouldn't touch one of those sites with your credit card.
;-)

Is the 3 digit security number on the back of the card the same?.

No, I got a new security number on the back. Still if people have access to card numbers there are plenty of places to use a CC # online without knowing the CVV code on the…

I dealt with him in the 90s when I was writing about the debacle of the Mondex stored-value card system that all the…

Is the 3 digit security number on the back of the card the same?.

My CC number was same too, but 3 digit security number was changed.

Globally PCI (payment card industry) operate some seriously scary surveillance systems. I get to see these things. I have no concerns about using my card...

There are surges of activity as breaches tend to be detected in batches…

I asked an ASB Bank teller and he just said that it's most likely a precautionary measure where they know data has been accessed and they want…

The Downtown payment machines have now had the CC payment option unavailable…