Chip & SPIN - The Times:

James

Latest from The Times:

http://business.timesonline.co.uk/article/0,,9075-2247493,00.html

"Safety in Numbers", and then the heart-themed "I love PIN". (Always beware when someone tries to sell you a security product based on emotion rather than information.)

However, the other important present the card industry gave us on Valentine's Day was a hidden one, not trumpeted by any ad campaign. It was the gift of liability.

Previously, if someone bought stuff with a cloned copy of your card, you could simply ask for your signature to be compared against the retailer's copy and if they were different, it was clear that you were not responsible."

Bet lots of those reading this aren't aware that you don't need to have the PIN part of Chip & PIN, there is an alternative Chip & Signature, the card you can continue to sign with. You won't be able to withdraw money at ATMs, but do you want to with a credit card? Besides you can always get cash-back in stores or withdraw money in branch (safer) with your debit card.

If you feel threatened using a PIN, have no faith in the security offered by PIN pads, are concerned about liability shift issues (if you are a victim of PIN based fraud), then Chip & Signature maybe an option that suits your needs.

Remember best PIN advice, Don't use the same PIN for more than one card (from APACS). Keep your PIN secret at all times. Don't write down you PIN and destroy it on receipt. If you can comply with best advice then you may consider that a PIN or PINs are for you.

But bear this in mind, the card industry can't guarantee PIN integrity. Optin for PIN means you could pay the price.

Rafter

James,

The magnetic strip and card details can be cloned but not the chip. This means that the cloned card cannot be used in chip and pin terminals and will have to be used in the diminishing number of retailers who accept signature or ATMs which are not chip enabled.

As most of these are overseas, it is fairly easy to prove that you weren't in the country where the fraud takes place.

Where are the case examples in the press of people being held liable for fraud and being unable to prove their innocence?

If you really don't trust banking security systems then keep your money in a box under your bed and protect your house like fort knox.

Personally the liability shift is the right thing, fraudulent use of stolen signature cards was rife, and although I personally wasn't responsible, I had to pay a levy on all my banking services to cover the banks fraud costs. Chip and Pin has reduced total fraud costs for the first time in decades, and that has to be to my benefit in the end.

I'm absolutely convinced of my ability to prove if my card had been cloned, and do not need to resort to an antiquated form of identification or inefficient over the counter cash withdrawls because I can't sleep at night worrying if my card has been cloned!

R.

James

Rafter wrote:

James,
The magnetic strip and card details can be cloned but not the chip. This means that the cloned card cannot be used in chip and pin terminals and will have to be used in the diminishing number of retailers who accept signature or ATMs which are not chip enabled.
R.

All retailers accept Chip & Signature.

Rafter, you obviously missed You and Yours, Mon 19th June at round 1228:

“In France there is a particular problem, people are now cloning chip to chip and that has been going on for a number of months.” Ross Anderson

“It’s becoming apparent that Chip cards being used without the PIN having been compromised and there is a straightforward way of doing this. You copy the details of one Chip card that you’ve stolen and whose PIN you don’t know, to another Chip card whose PIN you do know.” Ross Anderson

Sandra Quinn, spokesperson for APACS shared a platform with Prof. Anderson and never challenged this statement.

hobo28

Rafter wrote:

I'm absolutely convinced of my ability to prove if my card had been cloned, and do not need to resort to an antiquated form of identification or inefficient over the counter cash withdrawls because I can't sleep at night worrying if my card has been cloned!

Have you ever been a victim of this type of fraud?

Altho not Chip & PIN, I have been a victim several times. The signature may be antiquated but usually sufficient proof. How do I prove I did not type the PIN in?

Wasn't there a case a few months about regarding Shell where some employees had compromised the security of a load of customers chip/pin cards?

I've often thought whats to stop someone cloning an entire Chip/pin machine which interfaces with the real one?

Personally I think the more I put my card into a machine, the more times I type in my PIN, the more likely I am to be susceptible to fraud.

bert&ernie

I'm afraid it is possible to, in effect, clone a chip card. This would appear to be a legitimate card when presented to a terminal for an offline transaction. Something like one in 5 transactions are still made offline. These are generally small value sales at convenience stores and petrol stations.

I assume that the issuer could detect that a counterfeit card had been used by checking the data logged in the terminal, but why would they bother - the onus is now on you to prove that it wasn't your card?

The magstripe cloned cards also prove a very real threat to your money as there is no easy way to prove that the card used to make the withdrawal wasn't your genuine card. The best advice is to not let the card out of your sight and be wary of using terminals that appear to have been tampered with.

Saeed

I have a chip and pin virgin credit card and I have completely taken off the magnetic strip on the back (it is made of cheap sticky plastic that peels off - and I dcided to take it all off). Even though it says VOID on the card and the cashiers can see it says VIOD where the magnetic strip is meant to be and LOOK like a FAKE card, NOT one person has said to me that they will not accept it, even when I have used it for quite expensive things!

James

Saeed wrote:

I have a chip and pin virgin credit card and I have completely taken off the magnetic strip on the back (it is made of cheap sticky plastic that peels off - and I dcided to take it all off). Even though it says VOID on the card and the cashiers can see it says VIOD where the magnetic strip is meant to be and LOOK like a FAKE card, NOT one person has said to me that they will not accept it, even when I have used it for quite expensive things!

Reason being, that retailers don't give a hoot who uses a chip and PIN card, where the transaction is authorised by PIN. They (the retailer) are guaranteed their money.

Beware though, you might get some savvy shopkeeper who susses this and retains your card. £50 for them if they do.

KathrynPenguin

Too right they don't give a hoot. My husband has used mine, despite looking nothing like a MRS. I have also used my Mums when I left my own purse at home and just had to bag a bargain - without a signature they have no way of telling I'm not her. Mind you SHE has never used it, the chip and pin card she has is one she doesn't use. The card she regularly uses is Chip and Signature, she uses that everywhere and has only once had it questioned by a dippy teenage Saturday girl who was soon put right by her supervisor.

Rafter

hobo28 wrote:

Have you ever been a victim of this type of fraud?

Yes - twice.

I was a victim of the shell scandall but Egg cancelled my card before it could be used.

My switch card was also cloned and used for £1500 of cash withdrawls in the far east, all reimbursed.

The french card system is less secure than the UK one, although any system is not going to be 100% secure.

Personally I hope that they crack the biometrics system with RFID chips built into mobile phones or clothing.

R.

James

Rafter wrote:

Yes - twice.
The french card system is less secure than the UK one, although any system is not going to be 100% secure.
R.

Maybe not. The French system is just that French. French cards only work in France.

Not our new Chip & PIN cards though. These can be cloned and used at millions of cashpoints in hundreds of countries.

Tesco however are taking steps to upgrade their ATMs.

Tesco Declares War on Skimmers:

http://www.fairinvestment.co.uk/banking-news-Tesco-declares-war-on-skimmers-17232182.html

Looks like fraud at ATMs (where you need a PIN) has climbed around 30% since the last figures were issued.

King_Of_Fools

James wrote:

Not our new Chip & PIN cards though. These can be cloned and used at millions of cashpoints in hundreds of countries.

Tesco however are taking steps to upgrade their ATMs.

Tesco Declares War on Skimmers:

http://www.fairinvestment.co.uk/banking-news-Tesco-declares-war-on-skimmers-17232182.html

Skimming has absolutely nothing to do with Chip & PIN cards, specifically. All cards (including Chip & Signature) are just as susceptable to being cloned in this way.