Feeds

Crooks plant fake payment card terminals at multiple stores

'Visually identical' pads siphoned customer data

Website security in corporate America

Crooks planted bogus payment card processing terminals at multiple locations operated by the Hancock Fabrics chain store that allowed for the theft of sensitive financial data from customers, the company warned.

The personal identification number pads were stolen in August and September and "replaced with visually identical, but fraudulent PIN pad units," Hancock Fabrics warned in a letter to customers. "As a result, certain account information and PIN numbers used at these locations may have been unlawfully acquired by third parties."

Intercepted information may have included the name printed on the payment card, the card number, the expiration date, and the PIN if it was entered into one of the fraudulent terminals. The company recommended that customers review their account statements and credit reports.

The hardware switcheroo is only the latest example of crooks surreptitiously planting a skimming device that can siphon huge amounts of sensitive data. Last month, three Bulgarian men were charged with defrauding banks of more than $137,000 in a scheme that attached devices to numerous automatic teller machines in Massachusetts. If they are convicted, maximum prison sentences range from 42 years to 57 years.

And as Forbes points out, crooks in Canada appear to have planted fake hardware to point-of-sale terminals at a Wendy's fast food restaurant in 2007. Police in Utah said recently that skimmers attached to gas-station pumps stole at least $11,000 and may have remained active for as long as 60 days.

Hancock employees have recently replaced every PIN pad unit in all of its stores with upgraded models. It has also upgraded automated systems that resist tampering and monitor PIN pads for suspicious activity. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.