I think this would be the most secure because it includes an additional layer of security (provided by Apple/Google) between your card data and the ATM.
The closest helping hand is at the end of your own arm.
Makes sense that contactless with Apple Pay would be most secure. I assume skimmers need physical access to the magnetic strip and contactless avoids that.
The mag strip is the least secure. Anything else is better.
You can check for a skimmer by grabbing hold of the card slot and trying to yank it out of the machine. But if the machine offers a contactless option (or even a chip reader), do that instead.
If you need to enter a PIN, cover your hand so any cameras that might be around can’t read what you type in.
quantAndHold wrote: ↑Fri Sep 30, 2022 1:48 pm
The mag strip is the least secure. Anything else is better.
You can check for a skimmer by grabbing hold of the card slot and trying to yank it out of the machine. But if the machine offers a contactless option (or even a chip reader), do that instead.
If you need to enter a PIN, cover your hand so any cameras that might be around can’t read what you type in.
Does anyone use the mag strip anymore? Everything around me is chip at least (a lot is now contactless) and this is a pretty small town/rural area. I can't remember the last time I had to swipe a card.
Anything contactless is best because it avoids the mag stripe reader. Some skimmers are undetectable by the user. It doesn't matter if the bank's ATM hardware is actually using the mag stripe or not, if the mag stripe is inserted, and there's a skimmer, the mag stripe can be read.
verbose wrote: ↑Fri Sep 30, 2022 3:34 pm
Anything contactless is best because it avoids the mag stripe reader. Some skimmers are undetectable by the user. It doesn't matter if the bank's ATM hardware is actually using the mag stripe or not, if the mag stripe is inserted, and there's a skimmer, the mag stripe can be read.
I should check my local machines to see if they are all contactless. My last ATM use was in March, 2020. I still have most of that cash left in my desk.
verbose wrote: ↑Fri Sep 30, 2022 3:34 pm
Anything contactless is best because it avoids the mag stripe reader. Some skimmers are undetectable by the user. It doesn't matter if the bank's ATM hardware is actually using the mag stripe or not, if the mag stripe is inserted, and there's a skimmer, the mag stripe can be read.
I suspect this skimmer is what was used here. My neighbor inserted her chip card into a BoA ATM at a local branch. Her card got skimmed and the bank taped off this ATM.
My debit card has the symbol for contactless, but it does not work with any ATM (insertion works). A poster here claimed that contactless only works with the issuing bank (my issuer has no ATMs that I know of).
Not sure that I understand the problem. Is this a variant of staying away from using ATM cards that are also debit cards? My ATM card is not a debit card and I use it every week and never had an issue. Had lots of issues in past with credit cards being skimmed. And do not have any debit cards for that reason. But am not aware of anyone whose ATM only card was hacked since the thief would also need to know the ATM code. Plus ATM only cards typically have daily cash withdrawal limits which would also restrain a thief from access to monies in the account.
Chip cards are secure, chips cannot be copied by thieves, but skimmers can read the mag stripe. The industry should have removed mag stripes from cards.
jdb wrote: ↑Fri Sep 30, 2022 5:10 pm
Not sure that I understand the problem. Is this a variant of staying away from using ATM cards that are also debit cards? My ATM card is not a debit card and I use it every week and never had an issue. Had lots of issues in past with credit cards being skimmed. And do not have any debit cards for that reason. But am not aware of anyone whose ATM only card was hacked since the thief would also need to know the ATM code. Plus ATM only cards typically have daily cash withdrawal limits which would also restrain a thief from access to monies in the account.
It is by the goodness of God that in our country we have those three unspeakably precious things: freedom of speech, freedom of conscience, and the prudence never to practice either of them. --M. Twain
jayjayc wrote: ↑Fri Sep 30, 2022 12:10 pm
My bank's ATM allows multiple ways to access my account. Is one method more secure against skimming? The 3 different ways are:
insert physical ATM card into slot
contactless tap with ATM card
contactless tap with Apple/Google wallet
Out of these Apple Pay is the most secure. It uses virtual (tokenized) card numbers that only work with user authentication (i.e. Touch/Face iD or passcode), plus dynamic security code. Google Wallet may be the similar, but I'm not familiar with the technical details. Next is contactless card, because some also use tokenization and there is no risk that a skimmer inside the card slot can capture the card number.
My bank doesn't have a contactless ATM, at least not in my small town in the South.
However, I seldom use physical cash nowadays, so I need to use my debit/ATM card only a few times a year. I normally keep it locked via a setting in my account. When I want to use it, I unlock it shortly beforehand, in my bank's iPhone app, then lock it again shortly afterwards. I never use it as a debit card, so I don't need to unlock it for that.
Meet my pet, Peeve, who loves to convert non-acronyms into acronyms: FED, ROTH, CASH, IVY, ...
jebmke wrote: ↑Fri Sep 30, 2022 1:56 pm
Does anyone use the mag strip anymore? Everything around me is chip at least (a lot is now contactless) and this is a pretty small town/rural area. I can't remember the last time I had to swipe a card.
If you have to physically insert the card, then there's an opportunity for a skimmer to read the strip even if the ATM it's attached to uses the chip. And you still have to enter your PIN (at least in the US).
As for merchants, I recently had to fall back to swiping the card at one merchant when the chip reader just wouldn't work. And I think there are some mag stripe readers still being used with tablets & phones in portable situations. I wish everyone would move to contactless, but there are still a lot of merchants who don't support that.
Last edited by Gryphon on Sat Oct 01, 2022 8:28 am, edited 1 time in total.
jebmke wrote: ↑Fri Sep 30, 2022 1:56 pm
Does anyone use the mag strip anymore? Everything around me is chip at least (a lot is now contactless) and this is a pretty small town/rural area. I can't remember the last time I had to swipe a card.
If you have to physically insert the card, then there's an opportunity for a skimmer to read the strip even if the ATM it's attached to uses the chip. And you still have to enter your PIN (at least in the US).
As for merchants, I recently had to fall back to swiping the card at one merchant when the chip reader just wouldn't work. And I think there are some mag stripe readers still being used with tablets in portable situations. I wish everyone would move to contactless, but there are still a lot of merchants who don't support that.
Good point. I hadn't noticed much. A lot of places here - even small mom & pops have Apple Pay now so I don't use my card that often. If the chip read fails, usually a different card works.
For ATM cards, there really is no reason for them to put a mag stripe on the card. They should be chip or contactless.
I can't believe nobody's mentioned this yet, but you should be using the bank app to keep your ATM card locked except for during the 30 seconds it takes you to use the ATM.
As far as whether to use an intermediary like Google Pay, does anyone know if the liability laws apply in the same way? Like, for example, if your debit card is stolen, you have certain protections spelled out in the Electronic Funds Transfer Act, but if you use Google Pay and that is somehow compromised, do you have the same protections? Or does your bank say, nah, you authorized Google to use the card, take it up with them?
quantAndHold wrote: ↑Fri Sep 30, 2022 1:48 pm
The mag strip is the least secure. Anything else is better.
You can check for a skimmer by grabbing hold of the card slot and trying to yank it out of the machine. But if the machine offers a contactless option (or even a chip reader), do that instead.
If you need to enter a PIN, cover your hand so any cameras that might be around can’t read what you type in.
Does anyone use the mag strip anymore? Everything around me is chip at least (a lot is now contactless) and this is a pretty small town/rural area. I can't remember the last time I had to swipe a card.
At least very recently Home Depot did not support any contactless methods, which is absurd. You can still use a chip rather than a true swipe, but virtually everywhere else supports contactless whether the store employees know it or not.
I would probably opt for contactless tapping the card, and only use trusted ATM machines.
Providing your personal information to a third-party (Apple/Google) may provide another layer of encryption at the point of transaction, but it also introduces another layer of vulnerabilities and unnecessary counter-parties storing and transmitting your information, as well as privacy concerns that may or may not be included in the "security" vulnerabilities you're considering.
"To achieve satisfactory investment results is easier than most people realize; to achieve superior results is harder than it looks." - Benjamin Graham
toddthebod wrote: ↑Sat Oct 01, 2022 9:02 am
I can't believe nobody's mentioned this yet, but you should be using the bank app to keep your ATM card locked except for during the 30 seconds it takes you to use the ATM.
As far as whether to use an intermediary like Google Pay, does anyone know if the liability laws apply in the same way? Like, for example, if your debit card is stolen, you have certain protections spelled out in the Electronic Funds Transfer Act, but if you use Google Pay and that is somehow compromised, do you have the same protections? Or does your bank say, nah, you authorized Google to use the card, take it up with them?
Not sure all banks offer this locking, do they. Mine does but I haven't fired it up -- I probably should since I never use my card.
dukeblue219 wrote: ↑Sat Oct 01, 2022 9:06 am
At least very recently Home Depot did not support any contactless methods, which is absurd.
I don't think Lowes does, which is surprising. Even the little indie wine store my wife uses takes Apple Pay. Most gas pumps I've seen also.
Walmart also does not do contactless payments. And I personally have seen few gas pumps that will do contactless payments outside of Costco. Some of the pumps have the hardware for it but it doesn't work when I try it - some even have a sign up saying it doesn't work. Why pay for the equipment if you're not going to use it?
dukeblue219 wrote: ↑Sat Oct 01, 2022 9:06 am
At least very recently Home Depot did not support any contactless methods, which is absurd.
I don't think Lowes does, which is surprising. Even the little indie wine store my wife uses takes Apple Pay. Most gas pumps I've seen also.
Walmart also does not do contactless payments. And I personally have seen few gas pumps that will do contactless payments outside of Costco. Some of the pumps have the hardware for it but it doesn't work when I try it - some even have a sign up saying it doesn't work. Why pay for the equipment if you're not going to use it?
The US tends to be behind the ROW in a lot of dimensions -- which is remarkable since it often has the capability but lacks the will to do anything. On the other hand, given that there is no liability for CC transactions for the consumer, it is hard to get too worked up about it.
dukeblue219 wrote: ↑Sat Oct 01, 2022 9:06 am
At least very recently Home Depot did not support any contactless methods, which is absurd.
I don't think Lowes does, which is surprising. Even the little indie wine store my wife uses takes Apple Pay. Most gas pumps I've seen also.
Walmart also does not do contactless payments. And I personally have seen few gas pumps that will do contactless payments outside of Costco. Some of the pumps have the hardware for it but it doesn't work when I try it - some even have a sign up saying it doesn't work. Why pay for the equipment if you're not going to use it?
The US tends to be behind the ROW in a lot of dimensions -- which is remarkable since it often has the capability but lacks the will to do anything. On the other hand, given that there is no liability for CC transactions for the consumer, it is hard to get too worked up about it.
"given that there is no liability for CC transactions for the consumer, it is hard to get too worked up about it."
+1 to jebmke
My experiences have been that card fraud issues have been pretty rare and easy to resolve.
Better yet - if you’re afraid of ATM security risks, just minimize their use. I personally don’t worry about ATMs but rarely have need to use one, since I almost never pay with cash and use mobile apps for everything else.
toddthebod wrote: ↑Sat Oct 01, 2022 9:02 am
I can't believe nobody's mentioned this yet, but you should be using the bank app to keep your ATM card locked except for during the 30 seconds it takes you to use the ATM.
I was unaware of this feature. I just checked and my bank offers it. Thanks!