Cloned debit card

arciere

Yesterday I had a notification that by Barclays debit card had been used at a Shell station. I was at work so that obviously wasn't me, also I haven't been at a Shell petrol station in ages.
I called Barclays, they said that the transaction was made by swiping the card, rather than using the chip, which is basically a confirmation that my card had been cloned. They cancelled my card and refunded me the amount in less than 24 hours, so it's all good.
However, I am still wondering how that could have happened.
The place where the cloned-card was used is a few miles away from where I work, although I have never been anywhere near that town in my life. Was it just a coincidence?
Also, I rarely use my debit card, I recently only used it on a couple of occasions at a car wash, and the transaction was contactless. I haven't been at an ATM since before the pandemic.
Can a debit card be cloned when paying contactless or does it need to be physically swiped for the cloning terminal to be able to read the data? I know that you can capture details via NFC, but is that enough to 'clone' a card? You can of course use the details to make purchases over the internet, but can you actually make a copy of the magnetic strip?

sparklep0ny

arciere said:

Yesterday I had a notification that by Barclays debit card had been used at a Shell station. I was at work so that obviously wasn't me, also I haven't been at a Shell petrol station in ages.
I called Barclays, they said that the transaction was made by swiping the card, rather than using the chip, which is basically a confirmation that my card had been cloned. They cancelled my card and refunded me the amount in less than 24 hours, so it's all good.
However, I am still wondering how that could have happened.
The place where the cloned-card was used is a few miles away from where I work, although I have never been anywhere near that town in my life. Was it just a coincidence?
Also, I rarely use my debit card, I recently only used it on a couple of occasions at a car wash, and the transaction was contactless. I haven't been at an ATM since before the pandemic.
Can a debit card be cloned when paying contactless or does it need to be physically swiped for the cloning terminal to be able to read the data? I know that you can capture details via NFC, but is that enough to 'clone' a card? You can of course use the details to make purchases over the internet, but can you actually make a copy of the magnetic strip?

Do you mean can you reconstitute the magnetic stripe data?  Or literally, can you clone a mag stripe?

arciere

sparklep0ny said:

arciere said:

Yesterday I had a notification that by Barclays debit card had been used at a Shell station. I was at work so that obviously wasn't me, also I haven't been at a Shell petrol station in ages.
I called Barclays, they said that the transaction was made by swiping the card, rather than using the chip, which is basically a confirmation that my card had been cloned. They cancelled my card and refunded me the amount in less than 24 hours, so it's all good.
However, I am still wondering how that could have happened.
The place where the cloned-card was used is a few miles away from where I work, although I have never been anywhere near that town in my life. Was it just a coincidence?
Also, I rarely use my debit card, I recently only used it on a couple of occasions at a car wash, and the transaction was contactless. I haven't been at an ATM since before the pandemic.
Can a debit card be cloned when paying contactless or does it need to be physically swiped for the cloning terminal to be able to read the data? I know that you can capture details via NFC, but is that enough to 'clone' a card? You can of course use the details to make purchases over the internet, but can you actually make a copy of the magnetic strip?

Do you mean can you reconstitute the magnetic stripe data?  Or literally, can you clone a mag stripe?

Either way. My understanding is that you can easily intercept the data that is clearly visible on the card itself (number, expiry date, etc), but in order to physically clone a card, you need to have somehow scanned the original (like, at an ATM). If that is the case, I literally don't know how this has happened, I haven't used this card at an ATM since before the pandemic and all the transactions I have made (very, very few) have all been contactless or over the internet.

sparklep0ny

arciere said:

sparklep0ny said:

arciere said:

Yesterday I had a notification that by Barclays debit card had been used at a Shell station. I was at work so that obviously wasn't me, also I haven't been at a Shell petrol station in ages.
I called Barclays, they said that the transaction was made by swiping the card, rather than using the chip, which is basically a confirmation that my card had been cloned. They cancelled my card and refunded me the amount in less than 24 hours, so it's all good.
However, I am still wondering how that could have happened.
The place where the cloned-card was used is a few miles away from where I work, although I have never been anywhere near that town in my life. Was it just a coincidence?
Also, I rarely use my debit card, I recently only used it on a couple of occasions at a car wash, and the transaction was contactless. I haven't been at an ATM since before the pandemic.
Can a debit card be cloned when paying contactless or does it need to be physically swiped for the cloning terminal to be able to read the data? I know that you can capture details via NFC, but is that enough to 'clone' a card? You can of course use the details to make purchases over the internet, but can you actually make a copy of the magnetic strip?

Do you mean can you reconstitute the magnetic stripe data?  Or literally, can you clone a mag stripe?

Either way. My understanding is that you can easily intercept the data that is clearly visible on the card itself (number, expiry date, etc), but in order to physically clone a card, you need to have somehow scanned the original (like, at an ATM). If that is the case, I literally don't know how this has happened, I haven't used this card at an ATM since before the pandemic and all the transactions I have made (very, very few) have all been contactless or over the internet.

Cloning a card if you're in possession of it is trivial.  All you need is something that can read magnetic data (easily available) and something which can write it (easily available.)

Whether you can reconstitute it from readily available data I'm less sure of.  Certainly, much of the data is readily available (card number, expiry date etc) and the way it's written to the card isn't a secret so in theory it could be done this way.  There is a track that contains "proprietary" data though, and it's possible there is some unique identifier in this which would make reconstitution impossible. There isn't anything I can really find on cloning cards like this which would tend to indicate that knocking up a cloned card from say stolen credit card details isn't possible but I'm no expert on that.

arciere

Thanks, and that's what I thought too. Which makes it even more difficult for me to understand, because as I said I haven't used the magnetic strip in ages (and it could have only happened at an ATM, I have always used the card contactless or with the PIN, which probably happened 4-5 times over the past 12 months).
The funny thing is that the card was going to expire anyway in two months, so whoever managed to get the details didn't have too much time left to make a new card and use it.