Most Secure Card, or just PINned Down.

James

Visa has introduced a computerised credit card which it hopes will help banks battle fraud.

Story Click Here.

You Tube Video - Click Here.

Comment: Many contributors to the Forum will be well aware of the liability shift for fraud onto the cardholder where fraudulent transactions and PINs are involved.

Discuss:

bert&ernie

I don't think the use of multi-factor authentication for Card Not Present transactions really requires a liability shift. Use of a PIN card to generate a one time password effectively proves that whoever made the transaction had access to the card and knew your PIN.

If you haven't reported your card lost or stolen, then I don't see why the bank shouldn't hold you liable for the transaction.

PIN cards and other MFA devices will add another, much needed, layer of security to CNP transactions. I personally don't view this a threat.

DesG

As you know, I am no fan of Chip&pin, I am also no fan of VbV and refuse to use it, as it is basically flawed by relying on a password.

This system seems interesting for CNP as a unique code is generated each time. That in itself is a plus point.

I suppose it all boils down to how secure the code algorithm is. In which case I'll probably not use it as it will probably be cracked sooner rather than later.

Indeed I wonder how physically robust it is, and if there is a fallback should it be malfunctioning.

Cheers, Des.

bert&ernie

Wikipedia's entry on Chip Authentication Program provides a good explanation of how the system works.

This Visa chip card works in the same way, except the card and reader are effectively the same device.

I suppose it still requires you to trust the hardware security of the chip itself to protect the cryptographic key that is used to generate the cryptograms. I wouldn't say this was impossible to break, but I'm not aware of any evidence to suggest that this has been done outside of a lab.

I guess the fallback would be to the standard CNP process. Thats assuming that the retailer would be happy to accept the increased risk of a chargeback.