the Credit Card machine at my work

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Jan 03, 2007 8:23 am

I work at a fast food joint and we just got a new credit card swiper machine. What concerns me is that the new receipts that get printed off contain the full credit card number and expiration date of every card that we swipe. The employees are in charge of handling and collecting copies of these receipts, which we have access to at any time.

Does this seem like an extremely bad circumstance to anybody else?

Posted: Wed Jan 03, 2007 10:19 am

Sure does. Shocked

Posted: Wed Jan 03, 2007 10:27 am

I've seen that at a place I eat at.

I don't pay by card there anymore after I noticed.

Posted: Wed Jan 03, 2007 10:27 am

Yes. I noticed on my world tour that countries like Singapore print all your details on the receipt - I only realised this when I got to Oz, and became paranoid about tickets to a tour I'd casually tossed in the hotel room bin, complete with the credit card slip.

With the greatest respect to your colleagues, I wouldnt want them to have my details any more than a hotel cleaner.

I had to spend a lunch hour in a bank once, reporting debits for �50 mobile phone topups, for a network I dont use, that turned out to be a bent garage employee selling on cc details.

Posted: Wed Jan 03, 2007 10:43 am

Yeah. A lot of those receipts find their way into the dumpsters out the back of fast food joints here. And the kind of people who go dumpster diving for food usually know they can find receipts in there as well.....

Posted: Wed Jan 03, 2007 1:58 pm

I think it also violates Visa/Mastercard rules now. The receipts are only supposed to print the type of card and the last 4 digits. I know I had to change my store's swipe machine at my expense recently.
Is this in the the US?

Posted: Wed Jan 03, 2007 2:07 pm

Your boss should call whoever came to set up the machine. They can easily (and should have, in the first place) set the machine to obscure most of the number, save the last four or five, which is enough to identify the card for the cardholder.

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

A scary business practice, indeed.
Besides for the good points already mentioned, you boss is just setting himself up for failure- it would be very difficult to fight back against any disputed charge with the full number out there in the open for anyone to misuse.

If you can, look into a one piece swiping and accounting system- this is what we use for the hotel chain I work for- only a few managers can see the whole number, the folks working the desk can only see the last four digits, and it records that the card was physically swiped, which works very well for disputing chargeback attempts.

Posted: Wed Jan 03, 2007 4:37 pm

correct me if I am wrong (please, it would make me feel better if I am wrong in this case! Wink

) but can't someone still do something with the last 4 or 5 numbers?

Not quite a Newb Joined: 14 Jul 2005 Posts: 41

^^not really, Weasel.
You still have to get the rest of the cc string correct to purchase anything. Additonally, many places are also requiring a zip code verification for credit cards if a teller or clerk isn't there to verify ID- the self-checkout lines at many supermarkets is an example of this.
So, if everything is XXXX out except the last four, you're pretty safe Very Happy

Posted: Wed Jan 03, 2007 5:06 pm

419weasel wrote:

correct me if I am wrong (please, it would make me feel better if I am wrong in this case! Wink

) but can't someone still do something with the last 4 or 5 numbers?

Look longingly at the other digits and wish they were something other than Xs? That's about it, from what I understand. 5/16ths of a credit card number would still leave you with a shade under 4 million possible combinations for the other numbers. Considerably less if the would be thief does some homework on how the first numbers relate to the issuer, but it would still be quite the bugger to work out your number.

Posted: Wed Jan 03, 2007 10:14 pm

some of the older ones in the UK still seem to do that , but with chip and pin, now very far and few between.

Forgive me for goingoff topic however:

Quote:

I work at a fast food joint and we just got a new credit card swiper machine

So a fast food joint meal for family is �10 / $20 / 18 Euros give or take, and people no longer carry that much in cash! Argh!

I hate in supermarkets at the express, 10 items or less lane, and some twat buys a pack of crisps on plastic and then wants �10 cashback!

Grumpy old man - 18 months premature!

Evil Genius Joined: 02 Jan 2005 Posts: 715

Actually, the number of possible combinations is significantly lower - I don't remember the order exactly but four identify whether it's Visa, Diner's Club etc. (not that many alternatives) and then four more the country in which it was issued (limited number) and finally a combination to identify who issued it (bank and if you know the country, there aren't that many alternatives) and then a checksum (and you won't need to do much searching to find the algorithm to calculate that). So the last 4-5 are the ones that you need if you want to get a real CC number - you can conclude the rest so that only a few possible combinations remain.

Posted: Thu Jan 04, 2007 1:27 am

I should have stated in the beginning that I am in the USA.

Quote:

So a fast food joint meal for family is �10 / $20 / 18 Euros give or take, and people no longer carry that much in cash! Argh!

About 25% of our customers use credit cards actually.

You know the worst part is that the receipts are just laying out on the counter next to the register. If somebody had a tad bit of guts they could reach over and steal the whole pile without much effort at all. In fact, it would probably take a while before anybody even noticed they were gone.

Would my boss be held liable if something like that were to happen and his customers all got defrauded?

Posted: Thu Jan 04, 2007 1:48 am

I think you should bring this potentially disastrous state of affairs to the attention of your boss and hopefully you will win Employee Of The Year award. Please send us a pic of the certificate [runs off to check supermarket receipt obtained this morning]

Posted: Thu Jan 04, 2007 7:34 am

Keyser - Can you let me know where you work so I can pinch these chits, ummm try the food where you work? Embarassed

Posted: Thu Jan 04, 2007 12:20 pm

I heard that the bulk of card jacking fraud is utterly lowtec, with groups of people punching in massive batches of numbers within certain limits to see if they hit anything.

I guess if they had a huge list of card numbers with all but the last four scrubbed out they could increase their chance of positive hits.

Wannabe Baiter Joined: 21 Dec 2006 Posts: 96

In many states in the US there are laws against it. So far it seems to me, that in my state the ONLY place does not obeying this law is the United States Post Service Smile

Posted: Thu Jan 04, 2007 8:10 pm

Scrooge McDuck wrote:

Actually, the number of possible combinations is significantly lower -

I did specify it was lower if your would-be thief did any research on how CC numbers start. A number alone is pretty useless in online transactions if the merchant is half decent at fraud prevention. Online merchants usually cover their own behinds, because fraud tends to hit them in the wallet, as well. Number and a name, somewhat more useful, but it's a rare-ish merchant that doesn't require your billing address, as well, these days. Some of them even actually verify it against what's on file with the bank...

With a credit card, I wouldn't be too worried. A check/debit card is entirely another matter.

Posted: Fri Jan 05, 2007 12:28 am

...and while we are talking about CC numbers

I just hate the way that the last four numbers on the front of most cards are the first four on the back of the card.

A BBCtv fraud program recently showed how easy it was to get those all important last three numbers (CSV) with a little Social Engineering

>

Master Baiter Joined: 13 Jul 2005 Posts: 186 Location: GA

Not mine. Those little three numbers aren't in the normal string.

When my wife became a bit distressed that I was using a credit card online (a few years ago, when such things were new), I pointed out that our numbers were far more likely to be stolen by the guy at Sears or Jiffy Lube.

And then three weeks later exactly that happened - some jerk at a video rental store stole the CC info and went on a spending spree.

The upside is that the bank refunded our money immediately and their fraud unit went into overdrive.

The whole conversation with the bank was rather funny, as it started out rather cagey, with "are you sure you did not make these purchases, can you detail the fraudulent charges," blah blah until they they asked if we would be willing to go to court if they caught the person and pressed charges.

"Yeah, I'll do that," I responded, "unless you have a couple beefy guys that just want to beat the crap out of him and need an extra hand to hold him down once you catch up with him."

Laughing

Not that I was a little bit pissed, mind you.

Oddly enough, it got all sunny and bright on their end of the line and everything went forward smoothly.

I suspect they get a lot of "my kid, er, um, somebody racked up a bunch of charges without my permission and I want the money back" calls...and a lot of parents want to call the cops in but not have their kid thrown in jail. Which doesn't make sense to me.

Posted: Fri Jan 05, 2007 5:02 am

My understanding is that it is a national law in the US that receipts MUST obscure all but the last 4 digits and leave off the expiration. I take credit cards in my business and I have to jump through all kinds of hoops to stay certified. I even have to let the bank's security center attempt to hack my system once a year, looking for holes. I would be fined $1000 per transaction if I printed receipts with a full number. Something is VERY wrong at your place of business and your employer should be advised lest he find himself in deep trouble!

Posted: Fri Jan 05, 2007 12:03 pm

For obvious reasons I can't give details, but it is very easy if you have access to certain applications used in the travel industry, to find genuine credit card numbers by trial and error, especially if you already have a valid one as your starting number.

When you use your CC to purchase tickets, it may be possible for anyone who has access to the record to see your full CC number, possibly with the CSV number and in some cases billing address.

All but the last 4 numbers should be concealed but this is often not the case.

Posted: Fri Jan 05, 2007 2:51 pm

those swipe card devices have been used on more than one identity theft in the US. some criminals buy special machines that they can attach to those swipe machines and download the credit card info. they bribe employees to do this. also in Russia they used those machines to get a program to get the PIN ( personal identifying number) off the credit card when it is used, with disasterous results for the card holders.

better avoid that machine. be careful if you see any other device attached to it. someone in the outfit is a crook or is in league with crooks.

the Credit Card machine at my work	View next topic View previous topic