Been going over credit card security in my head since yesterday. Turns out a group of five people using eight different credit card numbers stolen from the same person purchased $8,900 worth of gift certificates at our gift shop and cashed them out at the casino cage immediately afterward. Two of the five have been arrested, and we're still on the lookout for the other three.
This got me thinking about how easy it would be for someone like me (fairly knowledgeable about credit cards and computers, working at the hotel front desk) to skim credit card information using the computers we have at work. We have Verifone signature capture systems, but don't have them set up for customers to swipe their own cards yet, so we still take the card and swipe it ourselves. Autorun is disabled, but USB drives themselves are not disabled in Windows, so it's still easy to run programs off a flash drive. A simple keylogger would work, or something more sophisticated to only capture credit card magstripes and additional user-selected information (using a hotkey) could be written, as the credit card readers we use are simple USB HIDs. Wouldn't be too difficult to capture the entire magnetic stripe (so, credit card number, expiration, and cardholder's name), customer's address (we take one at hotel check-in), and CVV (since we handle the card ourselves). On top of that, since most of our hotel rooms are comped (being part of a casino) and we don't authorize a guest's card for a deposit (unlike most hotels), it would take longer for any of the card issuers to figure out that credit card fraud is originating here.
Our company policy says we can't use flash drives with company computers unless they're pre-approved by our IT department, but it's never been enforced. I think I'll email some recommendations to my manager.
