All my Deutschlandtickets gone: Fraud at an industrial scale [video]

(media.ccc.de)

76 points by Kyro384 days ago

4 comments

WalterBright2 minutes ago
Uh, I received a call from my credit card company saying that train tickets were bought using my card in Germany. I told them I haven't been in Germany for the last decade, and was issued a new card.
jiehong1 hour ago
Germany has missed the digitalisation train, but how long will it continue to miss it for?At least, transparent issues like this one can only help.
- chvid59 minutes ago
 The problem is the lack of centralization - there should obviously only be one issuer of this ticket and thus just only one website / app to keep bug free.
 - lachiflippi18 minutes ago
 Lack of centralization is one part of it (see also: communal digital services), yes, but the complete lack of standards and guidelines is also a massive issue. I tried buying a Deutschlandticket from the DB Navigator app a while back, and immediately ran into some issues:- they only take credit card, probably because of the massive SEPA fraud they've had happen- they require id verification with a third party(!), which then only supports the e-perso(!!) or video ident(!!!), which they could've just used the actual PostIdent service for, which would've provided an alternative for non-smartphone-havers / people who'd rather not have their ID and face recorded by some Eastern European company until the end of time- their entire authentication system was down when it came to actually purchasingbuying from my local Verkehrsverbund was a single tap in their app instead, with no id verification whatsoever. If DB's offering were the only option it would be an absolute travesty.
lysace1 hour ago
tl;dw please?
- nottorp56 minutes ago
 "Transcript" it's called :)
 - lysace54 minutes ago
 ChatGPT managed the following given the submitted source URL and the prompt "summarize the key technical facts into two sentences suitable for a hacker news comment".Deutschlandticket fraud stemmed from decentralization and weak controls: tickets were issued instantly on unverified SEPA debits, and a leaked or mismanaged signing key let attackers mint valid tickets at scale. Poor revocation and fragmented verification meant many fraudulent tickets still scanned as valid, enabling mass resale and huge losses.
 - akrauss35 minutes ago
 This is a good concise summary, regardless of provenance.
leobg3 days ago
[flagged]
- dang2 hours ago
 "Eschew flamebait. Avoid generic tangents."<a href="https://news.ycombinator.com/newsguidelines.html">https://news.ycombinator.com/newsguidelines.html</a>
- sschueller3 days ago
 Kind of proof that privatizing public infrastructure does not work without very tight regulations.The profits and benefits in infrastructure go towards a state and are long term. A private company cannot increase their stock price on a 100 year goal and a countries GDP growth.
 - throwawayqqq113 days ago
 Yep. "Socialist lure" is a very US american perspective and far off the real past of most EU nations. The same budget hawks that drive tax cuts and are hollowing out public institutions were directing the privatization of the Deutschebahn. Thats why its not a single company but over 250 of them, for all the naturally competing segments of that gigantic infrastructure. You know, for maximum free-market efficiency, but somehow, blame is still not privatized.Id like to know the US position on why socialism is failing their infrastructure, like power grinds.
 - Centigonal2 hours ago
 Our infrastructure runs on freedom and good ol' American grit! Take for example our beautiful highways. They were built after the war (which, by the way, America WON), by the US Army (the greatest fighting force on Earth), using $100B of 1950s taxpayer money (mostly gasoline taxes). Just plain ol' simple taxation of the public to support social programs built and maintained by the government. Now if that's socialism, call me a socialist, but dang if it didn't work. Not sure why we can't do that anymore, but I try not to think about it too hard. Yeehaw!
 - veqq1 hour ago
 > why socialism is failing their infrastructure"socialism" is vague and meaningless, yes. But poor regulations are a huge problem in the US. Copying a comment from my notes (I didn't write it):The year is 2010. The Los Angeles Department of Water & Power (LADWP) publishes its initial environmental study [1] on a large power infrastructure maintenance project. A portion of the project involves replacing about 200 wooden power poles that run through Pacific Palisades. The California State Lands Commission reviewed [2] the initial study and requested that LADWP provide a Native American Ground Monitor [3] during any digging to ensure that cultural resources are not inadvertently damaged or destroyed. By the final EIR [2] in 2016 LADWP decided that replacing all of those +70 year old power poles was no longer necessary.The year is 2018. The Camp Fire ignites in northern California. Its cause was the failure of a 100 year old power line. By early 2019 LADWP decides to replace [4] those 70 year old powerlines running through Pacific Palisades, they're in a now deemed high fire threat area. The California Public Utilities Commission has recommended they be replaced as soon as possible. Work is to start in 2019.July 7th, 2019. LADWP has started work to replace the power lines, as well as leveling and grading new fire roads. Amateur botanist and avid hiker David Pluenneke is hiking in the area. David is a member of the California Native Plant Society [5]. He sees that LADWP has trampled the endangered Braunton’s milkvetch. In all, 183 milkvetches [6] were murdered.As a result:- All newly constructed fire roads must be unconstructed and returned to their original condition.- Any work must be supervised by an on site project biologist, or biologists if the worksite is large. These observers will make daily surveys of sensitive wildlife species and they have the authority to stop any work that could result in their harm.- LADWP agrees to excavate the new powerline poles by hand, with shovels. Workers will walk to the site. Helicopters will bring in the new poles and remove the old.- No construction activities that generate noise above 60 dBA (loudness of an average conversation) may take place during bird nesting season, which runs from mid February to mid September. Of course this requires another observer biologist, a bird biologist, to verify.Checking Google Street View, as of August 2023 these poles were not replaced. [7] But overall there are 300,000+ [8] power poles in LA. As of 2019, 65% of them were older than the average lifespan of 50 years old. In 2024, LADWP replaced just 2743 poles. [9] Their average cost to replace a pole in the same year was $69,300. [10] At their 2024 rates it will take LADWP over 70 years and $14 billion to replace all past lifespan poles.[1] <a href="https://www.ladwp.com/sites/default/files/documents/AppA_SGRS_Replacement_Project_Initial_Study_03_14_14.pdf" rel="nofollow">https://www.ladwp.com/sites/default/files/documents/AppA_SGR...</a>[2] <a href="https://www.ladwp.com/sites/default/files/documents/SGRS_Final_EIR_July_2016.pdf" rel="nofollow">https://www.ladwp.com/sites/default/files/documents/SGRS_Fin...</a>[3] <a href="https://farwestern.com/monitoring/" rel="nofollow">https://farwestern.com/monitoring/</a>[4] <a href="https://www.ladwpnews.com/ladwp-statement-on-power-pole-replacement-project-in-elevated-fire-risk-area/" rel="nofollow">https://www.ladwpnews.com/ladwp-statement-on-power-pole-repl...</a>[5] <a href="https://www.cnps.org/wp-content/uploads/2021/01/Compressed-Digital-Flora_V4N2-Winter-2021.pdf" rel="nofollow">https://www.cnps.org/wp-content/uploads/2021/01/Compressed-D...</a>[6] <a href="https://www.courthousenews.com/la-to-pay-1-9-million-for-utility-crew-damage-to-endangered-plants/" rel="nofollow">https://www.courthousenews.com/la-to-pay-1-9-million-for-uti...</a>[7] <a href="https://earth.google.com/web/search/Temescal+Ridge+Fire+Road/@34.0834376,-118.54707986,539.44683838a,0d,53.99465162y,301.77292071h,96.77167572t,0r/data=CiwiJgokCcFtpdHjFEFAEa5yJy9GB0FAGUsYiizRnF3AITY88uj-qV3AQgIIASIaChZDSUhNMG9nS0VJQ0FnSURidjZ5SUxREAVCAggASg0I____________ARAA" rel="nofollow">https://earth.google.com/web/search/Temescal+Ridge+Fire+Road...</a>[8] <a href="https://ladwp-jtti.s3.us-west-2.amazonaws.com/wp-content/uploads/sites/3/2019/10/24100526/LADWP-2018-19-Power-Infrastructure-Plan.pdf" rel="nofollow">https://ladwp-jtti.s3.us-west-2.amazonaws.com/wp-content/upl...</a>[9] <a href="https://prp.ladwp.com/" rel="nofollow">https://prp.ladwp.com/</a>[10] <a href="https://www.ladwp.com/sites/default/files/2025-09/Rates%20Metrics%20Semi-Annual%20Report%20approved%20by%20the%20Board.pdf" rel="nofollow">https://www.ladwp.com/sites/default/files/2025-09/Rates%20Me...</a>
 - luckylion1 hour ago
 Germany's public transport is really not privatized though. The Deutsche Bahn AG is structured as company, but is entirely owned by the federal government. There's very, very little public transportation (e.g. private buses between major cities) that is not owned and operated by the government.What privatization are you talking about?
 - k_g_b_14 minutes ago
 DB is only in its current state (company organization, leadership failures, organizational failures, underfunding for decades, etc) because of previous governments' failed attempts at privatization decades ago. Full actual privatization would not likely have yielded any better results - especially regarding the actual infrastructure itself. (There's enough examples worldwide)It's also been used for cushy post-politics jobs and lots of other incompetent meddling - such as requiring and extracting profits, etc.You're right that it's not privatized, but the root causes of current misery still are the privatization attempts and a significant neoliberal/conservative political force that caused decay and blocked progress/improvements.
- vintagedave3 days ago
 Not sure what socialism has to do with getting multiple ticket systems to speak to each other. I sometimes worry HN is astroturfed but I tend to read comments like this more simply as trolling.
 - grumpy-de-sre3 days ago
 Yeh this has more to do with the failures of federation and has nothing to do with socialism.Federation is a huge part of why Germany struggles to deliver on it's digitalization goals.Having every podunk authority handling ticket issuance basically guarantees signing keys will eventually be stolen/misused. The lack of a robust revocation mechanism is the nail in the coffin though.
 - ryandrake1 hour ago
 > Not sure what socialism has to do withNothing. Some people just wake up in the morning and have to interject their "socialism = bad" religion into at least one thread in order to feel they've done their evangelism for the day.
 - jfengel2 hours ago
 The US provides plenty of anti-socialist fervor even without astroturfing.We also get a bit of paid-for goading, just to keep it lively. But we do just fine without it.
- notTooFarGone3 days ago
 All those socialist... Companies? With their socialist coding?Maybe they also use Marx# (M#) with a socialist software architecture.
 - blell3 days ago
 Isn’t the Deutschlandticket for public transportation?
 - immibis2 hours ago
 Privately owned and operated transportation, where the main government involvement is just telling them to make it happen and then giving a certain amount of money per active subscription.
 - 4763926472823 days ago
 [flagged]
- rsynnott3 days ago
 Huh? I mean if anything the problem here was privatisation of local transport (and too much faith in said privatised transport by the national authorities), which doesn’t seem _particularly_ socialist.