Chip 'n' Pin - A Quick Guide Discussion Area

James

SAFETY IN NUMBERS?
Cash Machine Fraud up 85% to £61m during the past year.

http://news.bbc.co.uk/1/hi/business/3996745.stm

It's much safer to carry a card around than keep a lot of cash in your wallet" Sandra Quinn APACS.

This also appears on the net:

That doesn't match the evidence in countries that have been using PINs at store terminals for payment. Muggings outside stores in Madrid went up 300% on the introduction of these systems. "

Who walks about with Thousands of Pounds in their wallet - you do if you have PIN with your high value credit card!

Link to above comment:
http://software.silicon.com/security/talkback.htm?PROCESS=show&ID=20035430&AT=39125723-39024655t-40000024c

James

James

Sites worth viewing:

The New Way to Pay
http://news.scotsman.com/opinion.cfm?id=1301792004

PIN based fraud examples:
http://www.quicktopic.com/17/H/nZVVduYjG2BFv

Mixed views from the BBC:
http://news.bbc.co.uk/1/hi/talking_point/3998949.stm

Probably the best site on the web for info on Phantom Withdrawals:
http://www.cl.cam.ac.uk/~mkb23/phantom/

James

IvanOpinion

I have seen a lot of discussion in various different places about how inconvenient it is having to remember all these PINs.  Some people write them on the back of the card (not very intelligent) some people use the same PIN  for all cards (does have some risk) others store the numbers in their mobile phones (equally risky).  I have read articles complaining about the system on various web sites, gossip magazines and only this morning ni a computer magazine.

Use a bit of imagination.  I currently have 6 cards all with different PINs and could not tell you the PIN to any of them without looking at the card.  A few very simple examples ... on the front of most cards are 4 blocks of 4 numbers (I know Amex is different but, hey if you can't adopt a simple system?)
- pick one of the blocks of 4 numbers
- pick the first number out of each of the blocks
- pick the last number out of each of the blocks
- pick the first number from the first block, the second from the second block, etc.
- as above except reverse the digits
There are endless permutations that could be used (well 10000 anyway). You can even have a different system for each card (and use one of the security numbers on the back to remind you of which system you are using).

I use a system that involves my house humber and the last digit of the security number on the back.  Simple addition and subtraction - if you can't manage that maybe you should not be allowed a card in the first place ;D

Each card ends up with a different PIN and you don't even have to remember it, just look at the card before handing it over (lets face it if you need the PIN you will have the card) ... eventually you will remember it though.

This is so blindingly obvious that it has probably been mentioned before so I apologise if I am repeating anything.

Ivan

James

Lots of people will have difficulty remembering PINs no matter how you dress up easy reminders.

I should imagine that many will choose one PIN for ALL their cards, making them a nice target for crooks. I would bet that we will see an increasine in robberies at or near cash machines.

Safety in Numbers????????

Martinslovechild

Lots of people will have difficulty remembering PINs no matter how you dress up easy reminders.

I should imagine that many will choose one PIN for ALL their cards, making them a nice target for crooks. I would bet that we will see an increasine in robberies at or near cash machines.

Safety in Numbers????????

I agree.

Rather than ask us to enter a 4-digit number, why didn't they ask us to choose a 6 or 8 digit number then prompt us for 2 of the digits (e.g. number in position 7, number in position 2). Surely - this would have been far more secure...??

James

1. What is happening to Chip & PIN. Reports on hold-ups at check-outs:

http://www.it-director.com/article.php?articleid=12428

2. You Gov is carrying out a survey on Chip & PIN. Many of the points addressed in this Forum are covered.

http://www.yougov.com/

You have to register, but you are rewarded for replying.

3. Due to the roll-out of Chip & PIN I wonder if APACS would like to predict future rises/falls in crime rates at cash machines, i.e. incidences of robbery? If they do predict an increase, how can they make a claim to 'Safety in Numbers?'

Nerdvana

James (and everybody else)

I've recently started working in Computer security (including using the Smart cards like those used in chip and pin) plus I've also recently had my credit card copied. I'm in favour of Chip and pin as it protects your card from being copied.

First of all Chip and Pin only refers to Credit Card Transactions between you and a merchant (ie shops, petrol stations, whatever) PIN fraud on ATM machines is a completely different kettle of fish.

On old style credit cards you give it to the cashier at the Kwikemart and they scan the magnetic strip which tells the till who you are. they then ask for a signature which they have to trust is the correct one

Magnetic strips can be easily copied. This was demonstrated on Channel 4 in the 1980s. I'm quite embarrased it happened to me too.

The way the Chip and pin card works is that the Chip contains your details, but these are not visible to the reader until you enter your PIN.

This means that you must enter your PIN to confirm who you are, and it also means that a card cant be copied by skimming , unless you know the PIN. (even then I think theres more to it than that)

As I see it Chip and Pin is designed to eliminate Skimming, and simple credit card theft, as the card is useless without the pin.

The Credit card companies (Via APACS) like this technology becuase its more secure than a Magnetic strip and a signature. I beleive the Credit card customer does not lose out through chip and pin.

Adrian

James

Adrian (and everyone else),

Sorry to hear that you’ve had your card copied. The same happened to my friend’s daughter several weeks ago she had her brand new Chip & PIN card cloned. Somehow the fraudster got hold of her PIN and used it at ATM’s in Leeds. £300 was withdrawn shortly before midnight at one cash machine and then £300 an hour later at another.

I can only think that the ATMs never recognised that the card was chipped, or that they hadn’t been updated to read Chipped cards.

I believe that you may have misunderstood the point of a Chip – They are there to prevent counterfeit (and nothing else at this time). Chipped cards can only prevent counterfeit if every ATM is capable of reading Chipped cards and all retailers are Chip compliant. Chipped cards are retaining magstrips for the foreseeable future, and you’re correct they can still be cloned, the big difference being that millions of these cards will now operate with a PIN.

Unfortunately a PIN does not prove you are who you say you are, or, you are the rightful owner of a chipped card. What it does do is to make it a ‘must have item,’ for crooks. Why? Because they can use one without ever being challenged, either to get hard cash or buy expensive goods in stores. Clone the magstrip on a chipped card, get hold of the PIN and it’s already obvious that they can be used to get cash at non-compliant ATMs.

If you have a card that is chipped and has your photo on it then this would deter the opportunist thief. The card can’t be cloned (?) and if ALL those who accept that card type were Chip compliant then the cardholder wouldn’t have to worry about being held liable for PIN misuse. A downside is they couldn’t get cash from an ATM, although many would see this as a blessing.

I consider myself fortunate to have Chip & Signature Cards; however I would prefer one with a photo. Maybe a card issuer would consider this?

You put a lot of faith in APACS and the card industry. Can I draw your attention to the following:

Banks 'misleading' blind customers over new cards

http://news.bbc.co.uk/1/hi/business/4058405.stm

Thank goodnes for the RNIB.

One wonders who is asking similar questions on behalf of those who can’t manage a PIN for whatever reason, or simply have issues over PIN security or PIN Entry Device Security?

Nerdvana

First of all sorry for my mini rant but my blood started to boil when I see ignorant statement from like this from the it-director.com article

"I do not believe that the level of validation is very sophisticated at present. Indeed I doubt that there is much more than a local check on the PIN being entered against the number on the card, but it seems the technology is just not up to the task in hand."

which is rot, poppycock and twaddle in my opinion. I'm glad they are not my IT director, or an IT Director in a bank for that matter.

now that I've meditated I think I'm calm enough to answer James points.

Adrian (and everyone else),

Sorry to hear that you’ve had your card copied. The same happened to my friend’s daughter several weeks ago she had her brand new Chip & PIN card cloned. Somehow the fraudster got hold of her PIN and used it at ATM’s in Leeds. £300 was withdrawn shortly before midnight at one cash machine and then £300 an hour later at another.

I can only think that the ATMs never recognised that the card was chipped, or that they hadn’t been updated to read Chipped cards.

If you read the Chip and Pin website I don't think it mentions ATMS at all, only fraud at retailers.

Its a case of "do as I say not as I do". The card issuers are making retailers upgrade their card readers, but I'm almost certain ATM machines are still relying on Magnetic strips.

While in my opinion this sucks, but using your statistics ATM fraud is "only" £39 Million which is less than any of the other categories you mentioned (even less than ones stolen in the post, which I wish I was surprised by). ITs about a tenth of the rest of Credit card fraud.

The banks don't like losing money, but the chances are they're not going to upgrade the entire ATM network overnight, if it costs far more than the amount they are losing to Fraud.

I believe that you may have misunderstood the point of a Chip – They are there to prevent counterfeit (and nothing else at this time). Chipped cards can only prevent counterfeit if every ATM is capable of reading Chipped cards and all retailers are Chip compliant. Chipped cards are retaining magstrips for the foreseeable future, and you’re correct they can still be cloned, the big difference being that millions of these cards will now operate with a PIN.

You're talking about ATMs, I think Chip and Pin is only for retailers (for now)

Chip also stops casual card theft, for example if you driop your Pin and Chip card in the street its useless. Where I worked somebody strolled in and stole a wallet from somebodies Jacket. People stealing handbags left in Pubs etc. These are all added to the credit card "Fraud" figures.

I'm not going to be naive and say that muggers will never ask you for your PIN, but then again they may just use Petrol Stations and get away with it (as you mention above and as happened with my card)

Unfortunately a PIN does not prove you are who you say you are, or, you are the rightful owner of a chipped card. What it does do is to make it a ‘must have item,’ for crooks. Why? Because they can use one without ever being challenged, either to get hard cash or buy expensive goods in stores. Clone the magstrip on a chipped card, get hold of the PIN and it’s already obvious that they can be used to get cash at non-compliant ATMs.

I think I agree with what you are saying, about non compliant ATMs. But I think a card with a PIN is far more secure than a signature for retail purchases. for reasons I've detailed later on.

I do not believe that the level of validation is very sophisticated at present. Indeed I doubt that there is much more than a local check on the PIN being entered against the number on the card, but it seems the technology is just not up to the task in hand.
I consider myself fortunate to have Chip & Signature Cards; however I would prefer one with a photo. Maybe a card issuer would consider this?

*oops* This seems very similar to the quote at the top of the page! You wouldn't be the IT Director would you James?

"I doubt that there is much more than a local check on the PIN being entered against the number on the card" As I understand it, that is not how smartcards work, what happens is that you enter the PIN, the PIN is sent to the Card, the Card decides if its the right PIN, if it is then it will let the card reader read your card details off the card.

Similarly if you fail after 3 attempts then the card decides to lock you out.

Pictures are still open to Fraud where a fraudulent shopworker lets his mate use a stolen card. Or you just copy a stripe from a stolen card onto your card, the picture and signature matches so bingo $$$$ Ahoy!

In my opinion
You put a lot of faith in APACS and the card industry. Can I draw your attention to the following:

No I'm putting my faith in smartcards, as I'm using them at work and they are a total pain in the bum to use, so I'm assuming they must be a similar for fraudsters. I'm sure sooner or later they may be hacked, but In my opinion they are far better than the current system.

As for the BBC article, I'd say it was a !!!!!! up not a conspiracy, but again thats my opinion

Old enough to remember the ZX81? well your credit card probably has a faster processor on it

http://electronics.howstuffworks.com/question332.htm

Adrian

James

Adrian, I agree with some of your comments. Chip & PIN is better for the retailers. Chip & PIN is better for the banks, yes and Chip & PIN is better for crooks?

I still can't understand why the Chip & PIN organisation are using the slogan 'Safety in Numbers,' It certainly doesn't apply to cardholders!

Ask yourself one question, If you were the victim of fraud (before you reported your card lost) would you rather the fraudster had forged your signature or used your PIN?

The first question your card issuer will ask is, how did the fraudster get hold of your PIN? Many victims may find this difficult.

If the fraudster forged your signatrue then you can ask - for signature comparison, for prints to be retreived from the shops copy of the transactions slip - you can prove you never made the purchase.

You never commented on Banks misleading customers over new cards.