Visa warns holiday travelers to be wary of hackers using self-service gas station kiosks to steal credit card information

  • Hackers have found ways to capture payment information at gas stations
  • Visa has identified three separate instances of hacked payment systems
  • The credit card company recommends using chip readers instead of magstripes

A new fraud report from Visa warns customers about an increased of identity theft at gas stations this holiday season.

The company uncovered several instances of hackers breaking into an unidentified gas station computer network and getting access to information of everyone who swiped their credit cards at self-pay kiosks.

In one instance, hackers used a phishing scheme to send fraudulent emails to an employee at an unidentified gas station.

A new fraud protection report from Visa has identified three separate instances of hackers getting access to the payment systems at gas stations

After the employee clicked a link from one of the deceptive emails, they unwittingly downloaded a program that gave hackers remote access to the company’s computer network, and eventually the credit card information of customers swiping their credit cards or debit cards to pay for gas.

Visa found a similar instance of hacking at a second gas station company, though they were unable to trace how the hackers had initially gotten access to the company network.

A third instance was attributed to the FIN8 group of hackers, known for their several prominent spearphishing campaigns.

Visa recommends a few simple strategies to help holiday travelers avoid being compromised at the pump.

The simplest way is to simply go inside and pay in cash at the register.

If cash isn’t an option, customers can also use cards with chips instead of magnetic strips.

In one case, hackers used an email phishing campaign to target gas station employees with fraudulent links, which they used to install remote access software on the gas station’s computers

Most chip readers use an encryption process to transfer data, meaning a customer’s credit card info would have an extra layer of protection even if hackers were able to access transaction data.

Magnetic strip swipes typically transfer customer account information without any encryption, which makes them easy targets for hacking.

To help counter security threats to customers, Visa is encouraging every gas station in the country to switch to chip readers by October of 2020.

According to a report from Fast Company, stations that don’t make the change will be fully liable for any instances of identity theft that occur on their premises.

What is ‘phishing’ and how do you avoid getting scammed?

Phishing involves cyber-criminals attempting to steal personal information such as online passwords, bank details or money from an unsuspecting victim. 

Very often, the criminal will use an email, phone call or even a fake website pretending to be from a reputable company. 

The criminals can use personal details to complete profiles on a victim which can be sold on the dark web. 

Cyber criminals will use emails in an effort to elicit personal information from victims in order to commit fraud or infect the user’s computer for nefarious purposes 

Some phishing attempts involve criminals sending out infected files in emails in order to take control of a victim’s computer.   

Any from of social media or electronic communication can form part of a phishing attempt. 

Action Fraud warn that you should never assume an incoming message is from a genuine company – especially if it asks for a payment or wants you to log on to an online account. 

Banks and other financial institutions will never email looking for passwords or other sensitive information. 

An effected spam filter should protect from most of the malicious messages, although the user should never call the number at the bottom of a suspicious email or follow their link. 

Experts advise that customers should call the organisation directly to see if the attempted communication was genuine.  

According to Action Fraud: ‘Phishing emails encourage you to visit the bogus websites. 

‘They usually come with an important-sounding excuse for you to act on the email, such as telling you your bank details have been compromised, or claim they’re from a business or agency and you’re entitled to a refund, rebate, reward or discount.

‘The email tells you to follow a link to enter crucial information such as login details, personal information, bank account details or anything else that can be used to defraud you.

‘Alternatively, the phishing email may try to encourage you to download an attachment. The email claims it’s something useful, such as a coupon to be used for a discount, a form to fill in to claim a tax rebate, or a piece of software to add security to your phone or computer. 

‘In reality, it’s a virus that infects your phone or computer with malware, which is designed to steal any personal or banking details you’ve saved or hold your device to ransom to get you to pay a fee.’ 

Source: Action Fraud


Source: Read Full Article