Ottawa woman warned BMO of suspected bank fraud, still lost $15K | Page 3 | BMO | Discussion forum

Lodown said

Your connection to your bank is end-to-end encrypted at McD, Starbucks or from the comfort of your home. The risk is a man in the middle attack which allows your login credentials to be stolen. Sorry to say, this type of attack can happen at your home as well by your hacker neighbors, someone outside close to your home sitting in a car. That is why 2FA is second level of defence....never give it out if someone calls you! Oh, and to avoid most man in the middle attacks, hard wire your computer to your router ...no wifi.  

While end-to-end is true, It’s far more likely for crooks sitting at a Starbucks phishing for wifi data than outside my house. Just don’t want to give the bank the excuse when shit happens and point out that I was using a public IP and deny any claims.
Yeah my router. Is setup same room as my desktop, and I always hardwired, since it’s fastest anyway. No reason not to do that

RetirEd said
Norman1:

If they won't disable it or reduce its contactless limit to or $1, one can easily find and cut the antenna wire on the card. The chip contacts will still work. Either a very bright backlight or careful location of the wire at the card's right edge will allow you to use either a hole punch, razor blade or drill to sever it. Been doing this since the first contactless cards; never a problem. Private Message me if you need more info on how to do this.  

Impressed.

Not sure it would work for my Apple Wallet though. Phones and watches don’t take kindly to hole punches.

Supposedly, cell phone “wallets” are safer than physical cards. Provides another layer of protection.

RetirEd said
Norman1: Most cable home internet uses a dedicated IP address, as many users want to run a local web server, especially small businesses. …

Running a web server actually prohibited on home internet plans.

The IP address assigned by cable internet is dynamically assigned with a certain lease period. It doesn't change often because when the leased is renewed and the address is still available, then another lease is issued for the same IP address.

savemoresaveoften said
Are you sure BMO do not have MFA for bank accounts that can be either email or text msg ? I find that quite impossible to believe. But I never bank with them so don’t know.

BMO does. The article says someone logged in with her credentials. The bank sent a confirmation code to the e-mail address on her account to confirm. Correct confirmation code was supplied.

Victim may claim fraud. But, the bank or a judge will be quite suspicious.

RetirEd said

I prevent use of contactless payment with my card (if stolen) by disabling the contactless on cards whose issuers permit that.

If they won't disable it or reduce its contactless limit to or $1, one can easily find and cut the antenna wire on the card. The chip contacts will still work.

I also thought that chip/PIN was superior to the contactless function. However, I was watching a news episode regarding skimmers and they presented an opposite viewpoint. They mentioned that the skimming technology is now so good that it is difficult to notice whether or not a machine has been tampered. In the early days of skimmer fraud, it was not difficult to know that a machine was altered. Usually, a good shake of the terminal was sufficient. One scheme even had a pinhole drilled into the pad so that a camera could steal the PIN code. Their claim was that contactless was superior to chip/PIN, since there would be no way to compromise the signal between the reader and the card. It sounded logical and made me reconsider my previous opinion.

Say Hello to Crazy Thin ‘Deep Insert’ ATM Skimmers

Alexandre: Exactly. Having to enter the PIN is safer than not having to enter it! And of course I hope all of us here are by now savvy enough to hide our numbers when typing them in. If you're REALLY paranoid you can make several backspaces and re-keys while entering it, which would be VERY hard for a shoulder surfer to track. I also use more than one finger when typing a PIN so it can be hard to tell which button I've pressed.

The credit issuer's policies may try to force us to contactless payments, but the chip-and-PIN is a superior system. Merchants should mark their mini-terminals and safely store them when not open for business.

In the case of doctored terminals, there will rarely be just one fraudulent transaction.

In many parts of the world, chip-and-pin cards are not used; they go with chip-and-signature. (I think the UK and much of the EU.)

Norman1: does the prohibition on running a server apply to home users letting friends and family fetch things from their computers, or only to commercial users? I know many clubs that run a server for members, and I haven't heard of any troubles. When the first home internet plans from Rogers and Shaw were marketed, the ability to run a home server was used as a major selling point.

Americans need to get with the times. No more cards with magnetic stripes and no more POS acceptance of cards with magnetic stripes. That said, there are still a few Canadian locations that I notice use the magnetic stripe only (a local car wash).

Contactless RFID technology is safest and I use that methodology where possible. All 5 (4 raised + 1 flat) of my cards fit in a Secrid RFID wallet. https://unluggage.com/collections/secrid/products/secrid-card-protector They can often be found on sale for under $30. I have been using this for several years.

Chip + PIN is the next best alternative.

All said though, this thread has gotten derailed from the original subject. I cannot imagine that Ottawa woman has any ground to stand on as Norman1 has already pointed out in post #47.

RetirEd said

In many parts of the world, chip-and-pin cards are not used; they go with chip-and-signature. (I think the UK and much of the EU.)  

That is pretty useless since anyone can forge a signature. The USA is worse. Purposely when in the USA, when I sign a charge slip (where they do not use chip and PIN), I have scrawled a useless scrawl that bears no resemblance to my signature. Not once has it been questioned or have I been asked to show them the signature on the back of the card. It leaves me speechless!

Now that you mention it, I agree the European merchants I used to frequent years ago used Chip and PIN. I haven't been to Europe since well before covid so I had forgotten.

It is also not that important whether the chip card is one that requires a PIN or not.

Most of the security improvement of the EMV cards come from having the chip that produces a dynamic card-specific authentication code instead of a magnetic stripe that has a static CVV code.