Chip 'n' Pin - A Quick Guide Discussion Area

Galstonian

I doubt even if I hadn't anyone could have seen my PIN unless they were standing so close to me to be rubbing shoulders

Our Asda has CCTV cameras. What the picture quality or zoom are like I don't know but it does mean that there is a possibility of compromise.

The problem I see is that neither signature or pin are inherently secure but the burden of proof is being shifted from something that is relatively simple, "thats not my signature", to something impossible to assess: "I didn't tell anyone my PIN".

If it were all about security then why not insist on photo cards with a pin and a signature?

Rafter

To commit a fraud using a chip and pin card you need the card and the pin.

The guy operating the cameras in Asda would need to work out the pin and then mug you for your card.

You can't just take a blank chip and pin card and copy the card details onto it, everything is heavily encoded including the pin and the cost would be more than the amount of fraud you could get away with.

The only risk as I see it is that I'm overlooked when entering my pin(which I'm careful not to be) then robbed of my card without me knowing and the bank tries to say I'm responsible in the period before I report it.

This is a much lower risk as far as I'm concerned than card skimming, fraudulent signatures and all the frauds that go on at the moment.

I'm also reassured that there are so many cctv cameras around that if a fraud was committed, camera evidence would prove it wasn't by me.

The retailers wouldn't stand for the time taken to enter a pin, check a signature and check a photo.

The banks and retailers all rejected Iris scans, fingerprint recognition and photos as being less secure and reliable. The home office and US immigration seem to think they can get it right on passports and ID cards though.

I think chip and pin is great. It is faster, more secure, I don't have to hand over my card or lose sight of it.

I think we will look back and laugh at how insecure the previous system was. That is how I feel when I see chip and pin in full operation in France.

Conspiracy theories about how dangerous Chip and Pin is aren't helpful in my view. By all means highlight the risk, but don't try and stop the banks and retailers trying to reduce the 100's of millions of pounds of credit card fraud which end up costing us all in higher prices and interest rates.

If you are that paranoid about it, keep all your money under the matress and never get out of bed.

Galstonian

"You can't just take a blank chip and pin card and copy the card details onto it, everything is heavily encoded including the pin and the cost would be more than the amount of fraud you could get away with. "

At the moment I'd tend to agree but its a moving target, cloning chips will already be a high priority for fraudsters and lets not get complacent, they will crack it, the only question is when.

"I think chip and pin is great. It is faster, more secure, I don't have to hand over my card or lose sight of it. "

But the purpose it is being sold to us for is security, plain and simple. Faster or more convenient should not be relevant if that is the case.

"I'm also reassured that there are so many cctv cameras around that if a fraud was committed, camera evidence would prove it wasn't by me. "

In real time thats fine but if you go back a month after a disputed transaction there is likely to be no record.

"Conspiracy theories about how dangerous Chip and Pin is aren't helpful in my view."

I don't think I was proposing a conspiracy theory, I just pointed out that however private you think it is when entering a pin it is virtually impossible to tell.

"By all means highlight the risk, but don't try and stop the banks and retailers trying to reduce the 100's of millions of pounds of credit card fraud which end up costing us all in higher prices and interest rates. "

I applaud any and all advances in this area, I just want to know that what they will do is actually reduce fraud and, if fraud occurs, that responsibility is not shifted to the customer.
Given that the biggest increase in fraud in recent years has been in customer not present transactions (telephone, email, internet) it would be interesting to know what is being done to reduce this problem.
Personally I think that a full address verification system is required and that responsibility for any orders not delivered to the customer address is borne by the retailer. This is surely less expensive than C&P and immediately reduces the amount lost to fraud?

I'm definitely not 100% in favour but I'm merely sceptical at the moment - there is a lot being pinned on Chip & Pin I sincerely hope it does work.

James

Glastonian,

""You can't just take a blank chip and pin card and copy the card details onto it, everything is heavily encoded including the pin and the cost would be more than the amount of fraud you could get away with. "


No you can't clone a chip yet, although the French system was succesfully hacked several years ago and all French cards had to be replaced. But can you clone the magstrip on a chipped card - aqcuire the PIN for that card and then use the cloned card and valid PIN in a non-chip reading cash-machine at home or abroad? I would expect the answer to be yes.

James

paulcdb

Hum...

Still sidelined on this one, i am a bit concerned about the fact some people could see you enter your PIN, can be overlooked by overhead cctv cameras but then i've also watch a friend use a card that has no signiture strip (came off in the wash, so shows invalid instead) and has yet to be refused... just a few strange looks

Just a shame the keypads weren't designed with 'touchscreen' type displays as they could've always randomised the numbers making it extremly difficult for people to guess what keys pressed if they were looking over your shoulder although i suppose people would rush and not pay attention to what numbers they were pushing

However i can see some benifits for chip 'n' pin, especially for disabled people... as i find it difficult sometimes to get out to the shop, if i needed something i can always give my card to my better half, or family to get me things if i can't get out (advisable to use a low credit limit card though) .

anyway, will watch and see how things turn out, lol

Paul

student100

Just a shame the keypads weren't designed with 'touchscreen' type displays as they could've always randomised the numbers making it extremly difficult for people to guess what keys pressed if they were looking over your shoulder

Yeah I thought that would have been a good idea, but not very "equal-opportunities" friendly. People who can't see very well can still use a "key" type keypad because they can feel the buttons, and the middle (number 5) key always has a raised dot on it. Also, some people memorise their PIN as a pattern on the keypad rather than a number.

paulcdb

yes, can't win them all :P

Anyone been to a garage or shop that closes it's doors at night?

As a bit of a night owl, just wondering what to expect next time i go for electric at 3am when the doors closed and you have to speak through glass... are we going to have to "shout" our pin (not that i'd be stupid enough) all over the street, or has chip'n'pin thought of that? lol

student100

yes, can't win them all :P

Anyone been to a garage or shop that closes it's doors at night?

As a bit of a night owl, just wondering what to expect next time i go for electric at 3am when the doors closed and you have to speak through glass... are we going to have to "shout" our pin (not that i'd be stupid enough) all over the street, or has chip'n'pin thought of that? lol

Would have thought they'd just have a keypad on the outside of the window...

James

Anyone been to a garage or shop that closes it's doors at night?

Not to worry, or so you'd think. Large Petrol Retailers such as Tesco have a 24 hour Pay-at-the-Pump Facility.

Insert your card, into the card reader at the pump. The card is checked to see if it's been reported lost or stolen and the petrol is the dispensed.

Neither a PIN or a Signature is required!

The bottom line from Tesco is that if someone uses a stolen or cloned card for fuel, the petrol retailer picks up the bill and accepts the loss.

In reality that stolen £50 worth of fuel could be the straw that breaks the camels back. The genuine cardholder will need to clear up the mess by making phone calls, writing letters etc. Standing Orders or direct debits could go unpaid.

Card Issuers and APACS can do nothing to stop this practice. Petrol retailers offering this type of pay-at-the-pump facility don't seem to give a toss.

James

paulcdb

Not to worry, or so you'd think. Large Petrol Retailers  such as Tesco have a 24 hour  Pay-at-the-Pump Facility.  

Except our local tesco, which shutsdown at midnight... it has the pumps but you can't use them which is a right pain in the **** as tesco closed down the only 24hour petrol station when they came here, now after midnight no petrol for 20 miles