Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror

Comment Re:Wow ... (Score 5, Informative) 419

Ok, they way it is supposed to work

  • 1. The POS is offline, or the card cannot be "read" by the POS device
  • 2. The MERCHANT is supposed to call the bank to obtain manual authorisation
  • 3. The bank actually performs the transaction against the backend, reserves the funds and issues an auth code to the merchant. This auth code is a reference number. A pretty large financial switch supplier I used to work with would use the local time (HHMMSS) as an auth number. Nothing wrong with that, transaction has already been authed online via the call centre.
  • 4. The merchant enters a manual transaction on the POS device, entering the auth number on the POS device to form part of the transaction.
  • 5. The POS does not send anything at this point in time to the bank. Remember, in obtaining the auth number, the transaction was already submitted and approved. The POS keeps this transaction in storage with the auth number
  • 6. End of day, the POS submits all transactions to the bank. This is called Banking the POS or settlement.
  • 7. Since all online transactions has been performed, these settlement records acts as a reconciliation. At this point the customer's bank account gets debited and the merchant only gets settled for the settlement transactions that were submitted to the bank, not for the online autos. If this settlement transaction does not match exactly with the original auth, the merchant does not get settled for this transaction. (It is slightly more complicated than this, since floor limits allows for the case where there was no original auth and the settlement tran is the only message seen, but for the amount of an Apple Store purchase, this would not come into play)

So the system is relatively secure, but the MERCHANT should have called the bank, not the customer, that is where it broke down. This system also allows for floor limits, where the merchant is willing to accept a certain level of risk and the POS device approves transactions for an amount less than a set limit. At the end of the day the POS device submits these transactions to the bank and if the cardholder does not have sufficient funds, the merchant loses out.

All these protocols have been in place for many years and dates from a time where communication between the POS and the bank was relatively expensive and slow. Dialling up for every transactions was not an option, so you would try to batch them together to achieve a lower cost per transaction.

This is a very high level explanation of the issues involved here, but should convey the general ideas.

Yes, the Apple Store managers and employees were idiots in this case

Comment Re: Not ATMs, the debit card system (Score 3, Insightful) 196

ATMs are dumb devices. All transactions are autorised by the upstream system, which typically include fraud detection systems. If the upstream system authorise a transaction and instructs the ATM to dispense, the ATM dispenses. There is zero intelligence in an ATM. None. Everything gets done from the upstream host. These guys had access to the authorising host where they modified the authorising pipeline to ignore the limits that were placed on cash withdrawals. I work in the industry. It's complicated
GNOME

Submission + - Torvalds pours scorn on De Icaza's desktop claims (itwire.com) 2

An anonymous reader writes: Linux creator Linus Torvalds has poured scorn on claims made by the co-founder of the GNOME Desktop project, Miguel de Icaza, that he (Torvalds) was in any way to blame for the lack of development in Linux desktop initiatives.

Comment Re:Is this news? (Score 2) 273

There are multiple CVV numbers assigned to a single card. The first is present on the magstripe. The second one is what we know as the security code and is printed, not embossed, on the signature panel on the back of the card. For chip cards and contactless cards you get other schemes such as this single use CVV numbers produced by the card.

Also, a card can only be blocked if it is presented to the reader for long enough to download a couple of scripts feom the issuing institution. A paypass card's offline wallet is fair game for anyone who picks up the card.

obviously it is much more complicated than the space/time available here

Slashdot Top Deals

Bus error -- please leave by the rear door.

Working...