CHIP & SIGNATURE vice CHIP & PIN

chattychappy

Degenerate wrote: »

Victim's card is stolen in burglary/pickpocketing etc. As soon as they become aware, victim reports theft to bank. In meantime, transactions are charged to account. Victim has reported theft at earliest opportunity, but bank refuses to refund transactions because they were PIN-verified and therefore victim must have been negligent with their PIN. This is the line that banks have been taking since the introduction of Chip&Pin. This position has been untenable since the system was broken. This is what would lead the victim to file the hypothetical lawsuit we have been discussing.

Right, well that's where I came in. It would be easier for the victim to establish their position on the basis of a signature card. So for the banks, they are safer with chip'n'pin cards because they can run the "victim must have been negligent" argument. With a signature card, it is obvious that a signature could have been copied - you just need a pen and good copying skills. With a PIN, you'd have to run the expert evidence (to show its possible) and then establish that that was likely to have happened in this case. A much higher hurdle, but not impossible.

Degenerate

chattychappy wrote: »

Right, well that's where I came in. It would be easier for the victim to establish their position on the basis of a signature card. So for the banks, they are safer with chip'n'pin cards because they can run the "victim must have been negligent" argument. With a signature card, it is obvious that a signature could have been copied - you just need a pen and good copying skills. With a PIN, you'd have to run the expert evidence (to show its possible) and then establish that that was likely to have happened in this case.

Well we've covered the expert evidence, but how does one "establish it is likely to have happened in this case"? The only evidence the victim is likely to be able to produce is their own testimony that their card has been stolen, and they kept their pin secure, so it must have been hacked. This is no different to the case when an old signature card was stolen, again it was just the victim's word that someone had nicked it and must have forged their signature, but back then it was accepted that liability fell on the bank.

A much higher hurdle, but not impossible.

Surely it's only a higher hurdle for the test case, then it becomes an established fact that chip'n'pin is insecure.

Where would winning this case leave the victim in regard to court costs? As far as I can see all should be awarded against the bank, but you seem to disagree.

chattychappy

Degenerate wrote: »

Well we've covered the expert evidence, but how does one "establish it is likely to have happened in this case"? The only evidence the victim is likely to be able to produce is their own testimony that their card has been stolen, and they kept their pin secure, so it must have been hacked. This is no different to the case when an old signature card was stolen, again it was just the victim's word that someone had nicked it and must have forged their signature, but back then it was accepted that liability fell on the bank.

It is completely different. Copying someone's signature is easier than taking part in the kind of hack you've described. Both are possible, but a judge would weigh up all the evidence. Eg CCTV showing the cardholder was elsewhere at the time would be compelling.

Degenerate wrote: »

Surely it's only a higher hurdle for the test case, then it becomes an established fact that chip'n'pin is insecure

Whether or not it is seen as a test case is not a matter for the court. The court wouldn't create an "established fact". Higher courts (Court of Appeal, Supreme Court) could set binding precedent on a matter of law, but not a matter of fact. Indeed higher courts may even send a case back down to a lower court so that the trial judge can make a finding of fact. Of course after a victory, a second claimant with a similar fact pattern might feel more confident to bring a case. But the judge would not feel fettered by the earlier decision.

Degenerate wrote: »

Where would winning this case leave the victim in regard to court costs? As far as I can see all should be awarded against the bank, but you seem to disagree.

Yes, that is not the case. It is a starting point that the loser picks up the costs, but it depends on the conduct of litigation and whether any offers to settle were refused (particularly "Part 36 Offers"). It is normal for courts to "tax" the costs of the solicitors/barristers. Ie impose a figure for what their work should have cost even if they billed more. There are also two ways of assessing costs, "indemnity" or "standard" basis. Awarding of costs is governed by CPR 43.

The upshot is that is RARE to get all your costs back. You can even have strange situations where you lose, but you get your costs paid or win and have to pay the costs of both sides. It is a complex area and there even judges who specialise in handling costs hearings.

Degenerate

chattychappy wrote: »

It is completely different. Copying someone's signature is easier than taking part in the kind of hack you've described. Both are possible, but a judge would weigh up all the evidence. Eg CCTV showing the cardholder was elsewhere at the time would be compelling.

Such evidence may not be forthcoming, and does not exclude the possibility that they were negligent with their PIN and/or colluding with someone else anyway.

Getting back to basics, if my bank gives my money to someone else without my authority, surely they should refund it, or burden of proof that I was negligent lies with them? PIN authorization has been taken to be proof, now it is shown to be nothing of the sort.

Yes, that is not the case. It is a starting point that the loser picks up the costs, but it depends on the conduct of litigation and whether any offers to settle were refused (particularly "Part 36 Offers").

We already agreed that a reasonable offer would be refund of the disputed transaction(s) plus directly consequential charges. This is what the claimant would be suing for in the first place, so the claimant would not have refused any "reasonable offers".

In what way could the winner be penalized for the conduct of the litigation?

It is normal for courts to "tax" the costs of the solicitors/barristers. Ie impose a figure for what their work should have cost even if they billed more. There are also two ways of assessing costs, "indemnity" or "standard" basis. Awarding of costs is governed by CPR 43.

The upshot is that is RARE to get all your costs back. You can even have strange situations where you lose, but you get your costs paid or win and have to pay the costs of both sides. It is a complex area and there even judges who specialise in handling costs hearings.

I'm really struggling with the notion that a member of the public, victim of a fraud, can sue a bank out of necessity simply to get their money back, win, and still be out of pocket. That would appear to be a travesty of justice.

stfc

We've seen the Cambridge report, but that doesn't go to prove any particular claim brought before a court. I know people love a good conspiracy theory but banks do pay out where people have genuinly been the victim of PIN fraud.

A 'test case' using the Cambridge evidence will only go to demonstratethat it may be possible to compramise a PIN, not decide what's actually happened in one or more particular cases.

If banks routinely use this as a method of declining 'fraud' claims why are there not thousands of cases at court already? Banks may use this reason if the balance of probability, along with the other evidence they have, points towards a customer making an erroneous claim.

I feel much safer with a PIN because it isn't written down and I cover myself when entering it. Chip and Sigs are available for those that really need it. The system works well.

chattychappy

Degenerate wrote: »

Such evidence may not be forthcoming, and does not exclude the possibility that they were negligent with their PIN and/or colluding with someone else anyway.

Getting back to basics, if my bank gives my money to someone else without my authority, surely they should refund it, or burden of proof that I was negligent lies with them? PIN authorization has been taken to be proof, now it is shown to be nothing of the sort.

Well, once again the court would weigh up all the evidence in the case. You'd swear you didn't authorise it. The bank might have a print out saying you did. You'd get an expert to say that PINs have been cracked. The bank would either deny the report or say even so, then "so what" where's your evidence it happened this time? They would say they operated ISO standard QC procedures, and so it would go on. It is a simple contractual dispute - and the court would have to decide what probably happened out of all the options.

Degenerate wrote: »

We already agreed that a reasonable offer would be refund of the disputed transaction(s) plus directly consequential charges. This is what the claimant would be suing for in the first place, so the claimant would not have refused any "reasonable offers".

In what way could the winner be penalized for the conduct of the litigation?

Offers may include costs - eg we'll pay up, but not pay your costs. They might include confidentiality agreements. You might feel some of the terms are unreasonable, reject, win your case but the court could decide that in the end you wasted court time and not award costs.

Degenerate wrote: »

I'm really struggling with the notion that a member of the public, victim of a fraud, can sue a bank out of necessity simply to get their money back, win, and still be out of pocket. That would appear to be a travesty of justice.

Well... there you go mate, you are not alone in thinking that. It can happen.

But I don't really want to drift any further into discussing litigation procedure. Just to remind you: you talk about "victims of fraud". There is a complete distinction between criminal litigation (magistrates courts, crown courts) where criminal offences (eg fraud) are prosecuted and sanctions are imposed - eg fines, imprisonment of individuals AND civil litigation - county courts, high courts. In this context it is just settling contractual claims. Then there are regulators - FSA and alternative methods of dispute resolution - such as the ombudsman. Indeed that is another reason why costs might run against you even if you win - if you've pitched up in court without exhausting other avenues first.