Chip & PIN Weakness Revealed

James · 6 February 2007 at 9:24AM

Watchdog tonight are covering Chip & PIN.

Details from chip-and-pin cards could be stolen while shoppers make purchases, scientists discovered in an investigation for BBC One's Watchdog.

I wonder if this could explain the thousands of cards and PINs compromised over the last 4 months at the following locations:

Hull Eastbourne Bromley Worcester Leeds Bristol

Bournemouth Lttle Abington Stamford Norwich Black Country

Watchdog producer Alan Holland said: 'This shows the system is not infallible.' Sandra Quinn, spokeswoman for Apacs, which represents the banks on card fraud, said: 'There is no evidence to suggest this has actually happened in the UK at all.

Article here.

jinkssick · 6 February 2007 at 11:17AM

There is no way around card clonning, as thats just unlucky.

On machines, you have to make sure you hide the pin, and always check their isnt anything dodgy about it.

Idiophreak · 6 February 2007 at 11:19AM

I don't recall anyone ever saying that the system was "infallible" and if anyone thought that they were being a little dumb really.

Chip and pin isn't overly secure, but is more secure than a signature which a lot of people didn't even look at. That's all it was designed to be.

James · 6 February 2007 at 12:32PM

Idiophreak wrote:

I
Chip and pin isn't overly secure, but is more secure than a signature which a lot of people didn't even look at. That's all it was designed to be.

PIN more secure than a signature! I don't thinks so, especially when PINs can be harvested on an industrial scale. (see links in first posting).

Add that to people being targeted and threatened for their PINs then the personal safety question arises.

Then there is the liability question for alleged PIN misuse.

A PIN is the key to an account whether used with a cloned card or stolen card. Remove the key, reduce the risk.

I hope the forthcoming programme encourages more people to demand a much Safer Chip & Signature Card.

Idiophreak · 6 February 2007 at 1:17PM

People have always been targetted and asked to hand over their cards, so targetting them for their pin isn't really something new. It's just that before, once someone had your card, they could spend on it. Now they need the pin too, so just tell them it and they'll probably leave you alone.

The woman in the example you give should've been more careful when entering her pin. And her purse may well have been nicked before chip and pin anyway - just the robber wouldn't have needed to lurk over her shoulder for a few minutes first. They could probably, then, have robbed a couple more old ladies in the same amount of time.

Again, pin numbers *can* be harvested - but card details have always been harvested, just previously they didn't need a pin - they could just scribble on the cloned card then use it.

The pins do offer people more security at the point of sale - it used to wind me up something rotten when shop staff wouldn't check my signature, could've been anyone spending my money. Now they *have* to run some security check, which is a step forward.

(btw, I used to work on a till, I'd check the signature (and ask for more ID if it was missing/unclear), name (is the person the right gender?), check for tampering, check the holograms, slide my finger over the white strip etc on every card that went through my hands - if every shop staff did these things there probably wouldnt have been so much of a need for the pin in the first place - but a lot of staff are lazy or not trained enough - the chip and pin thing is much easier to make part of the sale process)

You're right, risk to individuals might be reduced by "removing the key", but if you remove the key, you need to remove the lock - and if you remove the lock you leave the door open.

I do agree that we can't view chip and pin as the answer - we need something better, but it's not a bad stop gap when all's said and done.

sofa_surfer · 6 February 2007 at 2:52PM

Back to James?

James · 6 February 2007 at 3:12PM

The key (PIN) opens an extra door, the one that attracts the crooks - Cash at ATMs.

Looks like you provided first class service when working at point of sale. Shops staff failing to take the appropriate steps to prevent fraud ended up with that SHOP and not the victim bearing the cost of fraud. There was no liability issues for the cardholder.

Here's a comment from the O'l Bill:

"Det Sgt Mark Smith, of Cambridgeshire Police, said: "We have explored all avenues and come up with a complete blank.

"Unfortunately all the transactions were carried out using chip and pin, so we have no finger prints or signatures."

A PIN isn't a deterrent - it's a challenge.

Idiophreak · 6 February 2007 at 3:21PM

If it's cash at ATMs criminals are after - they'd have had to have got your atm pin out of you even before chip and pin, surely?

James · 6 February 2007 at 3:44PM

Idiophreak wrote:

If it's cash at ATMs criminals are after - they'd have had to have got your atm pin out of you even before chip and pin, surely?

These petrol stations that are being hit (and now shops), you can guarantee at least half the plastic cards cloned will be credit cards. The point I'm trying to make is why have a PIN with a credit card? You can opt for Chip & Signature.

It's all about reducing personal risk. If they see someone PINning then they'll probably hit them. If they see someone signing in a Chip environemnt then they're wasting their time.

Surely it's good advice to use only 1 card with a PIN (at safe ATMs only).

Lloyds TSB do a Chip & PIN card where the PIN is activated for ATM use only, and you continue to sign in shops.

Here's how the original posting is carried out:

Researchers Devise Chip & PIN Crack

James · 7 February 2007 at 8:33AM

Watchdog yet again proved the Banks hard line attitute to the victim of fraud committed with a genuine card and PIN.

Watchdog demonstrated a more alarming method of carrying out Chip & PIN fraud.

If card issuers can't guarantee PIN integrity. How can they hold anyone liable for alleged PIN neglignece, when the victim didn't write down, or disclose their PIN to anyone?

"
If someone stole your bank card and used it to withdraw money from your account before you had a chance to realise it was gone, you'd presume you were entitled to get your money back. Yet a number of Watchdog viewers have learned that this isn't always the case. "

Story here (From Watchdog).

Tootsie_Roll · 7 February 2007 at 2:00PM

James

I see your boring and completely inaccurate crusade continues.

Have you one scrap of PROOF that it is chip and pin weakness as opposed to mag strip and pin weakness.............................no - I don't think so.

I keep mentioning to you and you refuse to accept that it is impossible to clone the chip at the moment. Some banks ATM's have been upgraded to ONLY read the chip not the mag strip so for those banks ATM fraud is now zero since it's introduction in the latter part of last year. All the statistics and articles you refer to are either way out of date (what's the point in quoting figures from 2004/2005 when things changed dramatically in 2006) or rely on the fraud occuring as a result of the mag strip being cloned.

Why don't you focus your attention on something worthwhile like geting all mag strips withdrawn - now that would be useful and achieve the goal you seem to be after.

Chip & PIN Weakness Revealed

Comments

Confirm your email address to Create Threads and Reply

🚀 Getting Started

Categories

Is this how you want to be seen?

Get our FREE Weekly email full of deals & guides - and it’s spam-free