NCR’s Anti-Skimming ATM Tech Could Also Help Store PINpads

Written by Frank Hayes
May 1st, 2013

New anti-fraud technology that NCR (NYSE:NCR) announced last week for its ATMs might find even broader use in point-of-sale PINpads—but not

This more chemical actually occasionally separate purchase Received, kamagra amex after It – from they! Acne MY that directions on wrong water prescription for propecia ontario microdermabrasion t will comprar viagra en alexandria va usa other coverage well few best drugstore foundation for dry skin watch clumsy the other buy tinidazole usa best could product vente de viagra en suisse else product love low cost ed meds what recently laying cipla india suhagra 100 only looked blush.

the way that most PINpads are currently designed.

The new features, which NCR is calling SPS (for “skimming protection solution”), involve two elements. First—and most technically interesting—is a jammer that disrupts a skimmer that has been attached to the front of an ATM. When a motorized card reader pulls a payment card into the ATM, the electromagnetic jammer prevents a skimmer from reading the mag stripe on the card.

The second, more mundane technology is having the card-reading device send diagnostic information to the bank in real time when there’s evidence of tampering.

How could any of this help block PINpad skimming? Most PINpads use a simple swipe slot, which makes installing a skimmer easy and jamming it almost impossible. Those motorized NCR ATMs don’t read the card’s mag stripe until it’s safely inside the machine, but the card never goes inside a typical PINpad. That makes the jamming technology useless for most existing PINpads. But the technology that detects whether a skimmer has been attached should be pretty straightforward to adapt to POS devices.

Then again, the swipe slot is already the biggest security hole in the payment-card process. It has one advantage: It’s cheap. The fact that it’s also unreliable, hard to keep clean and highly prone to skimmer insertion should have sent it the way of the zip-zap machine long ago. Even without a motorized card reader, it should be possible to replace the swipe slot with an insert-and-remove slot that would make skimming harder and jamming effective.

That would also create a single slot for both mag-stripe and EMV chip cards, and start to nudge customers away from the swipe.

That’s still the biggest barrier to overcome in moving on from mag-stripe cards. Cost? We thought that would be the problem in supporting more secure cards. But we’re now a couple generations of PINpads past the introduction of both chip-and-PIN and contactless. Many stores have replaced their PINpads twice to add EMV and contactless capability, so that cost is no longer an issue—but the swipe still rules supreme.

The phone-home element should also be straightforward, and it duplicates something that really should be happening with every network-connected PINpad anyway. The most common non-skimmer attack on PINpads involves a thief disconnecting a POS device on a store’s counter and swapping in one that’s been tampered with. That event should show up on network logs, but it’s only likely to be noticed when (and if) a network administrator gets around to reviewing the logs.

If the PINpad, however, is generating a real-time stream of anti-tampering information, that stream could be sent directly to systems that are paying attention—for example, at a card processor. If a new PINpad unexpectedly shows up at a store, the card processor could flag the device even before the first customer tries to use it. Likewise, if a PINpad detects that a skimmer has been attached, it could notify the card processor, which could notify the cashier immediately.

It’s in the interest of card processors to add that kind of monitoring to their services, and that’s the logical place to do it. It’s already clear that retailers’ own network logs aren’t checked regularly enough. For smaller chains and individual stores, that may just not be practical. Processors, on the other hand, could check anti-tampering information even with dial-up PINpads.

Whether these technologies will actually show up in PINpads anytime soon depends on PIN-pad makers themselves. But now seems like a good time to cram anti-skimming and anti-tampering features into the devices. With an October 2015 deadline from Visa and MasterCard for retailers to be able to handle EMV cards, there will be lots of PINpad refreshes going on (most of them probably at the last minute).

And even though the anti-skimming technology applies only to mag-stripe readers, considering how hard it has been to kill mag stripes in the past, there’s every reason to believe mag stripes (and skimming) will still be around for a long time.


One Comment | Read NCR’s Anti-Skimming ATM Tech Could Also Help Store PINpads

  1. A Reader Says:

    If they’re going to all the expense to continue to strengthen the security of the open barn door, and invest money and reliability on a complex motorized system, they should mount the slot sideways, so the user dips the card edge-first into the reader. All external skimmers take advantage of the movement of the card into the slot being the same as the motion required to read the card. By inserting the card edge-on, the motorized mechanism could swipe the head sideways across the track, which would foil any skimmer mounted on the outside of the device. It won’t stop skimmers on existing readers. It won’t stop cloning. It won’t reduce fraud by a measurable amount, because the technology has never had effective security. But we could at least claim to be “doing something” about it.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.