Chip 'n' Pin - A Quick Guide Discussion Area

dthyer

But surely the crooks are already looking for the weakest point in the system, and are currently finding it at the signature.
I don't see why making the weakest point less weak is a bad idea.

James

I don't see why making the weakest point less weak is a bad idea.

For Retailers & Banks your spot on but for individuals think again.


There are two issues here. One is personal safety - re yesteredays Times "Fraud liability threat over chip & PIN" - where Roy Hill, technical director of NTA Monitor highlighted potential seucrity risks from using chip & PIN technology which included muggings.

The second is when things go wrong (previously discussed).

Chips and card authentication in real time, I welcome, but for the Chip & PIN people to insist that a PIN proves that the card is being used by the righful owner is wrong and misleading.

Hypothetically speaking if all card owners had chip reading terminals then a chipped card with the cardholders photo and required the cardholder to sign would be a far safer option all round.! Would you be mugged for a card that can't be cloned and used with a PIN. Could you be held liable for PIN misuse? What value would such a card have to a crooks who dipped your bag or found a lost card? Not only would they have to look awfully like you, they'd need to forge your signature.

"Personal Safety in Chips/Photos & Signatures" Risk being mugged for a PIN - not likely!

dthyer

I looked for the article that you mentioned in the times on their website but could not find anything. If it made a relevant point perhaps you could summarise it here?

for the Chip & PIN people to insist that a PIN proves that the card is being used by the righful owner is wrong and misleading

I would be interested anywhere that that suggests that anyone, even the banks, think that a PIN proves that the card is being used by the rightful owner.

Currently when a thief steals a signature based credit card, they can often purchase many hundreds of pounds worth of goods before the card holder realises that the card is missing, maybe 24 hours later.

In a similar scenario next year, when a thief steals a PIN based credit card, either they won't know the PIN, in which case they won't be able to do anything, or they will know the PIN, in which case they will be able to purchase many hundreds of pounds worth of goods and withdraw the daily limit, often £250, from the credit card. In the former case the loss is totally reduced, in the latter it is marginally increased.

To say that such losses don't matter because the banks or the retailers pay for them ignores the fact that in the end it is us customers who do pay for them through higher prices.

What value would such a card have to a crooks who dipped your bag or found a lost card?

It is interesting that you raise such a scenario because this is exactly the kind of case that the thief not knowing the PIN would render valueless!

I would be happy to have a photograph on my credit card and I think it's a shame that doing so hasn't taken off, but signatures are such a weak way of proving that the person who is holding the card is the the rightful owner that it would be almost as effective not to bother and to just say that if a person is holding a card on it then they can spend on it, and then if the the rightful owner claims they didn't make that transaction then the bank and/or the retailer have to take the loss.

I don't see how putting a squiggle on a bit of paper proves, or even helps to give an indication, as to whether the person who did so is the the rightful owner of a card. Of course neither does entering the correct PIN. I think banks evaluate whether transactions were fraudulent based of a variety of information such as spending pattern, CCTV pictures, what happens when the spender is questioned etc., rather than just whether the signature looks right or whether the PIN number is correct.

DT

James

I would be interested anywhere that that suggests that anyone, even the banks, think that a PIN proves that the card is being used by the rightful owner.

Answer: The Northampton Trial Report 2003. Checking out chip and PIN. Written and produced by the Chip and PIN Programme Management Organisation.

Page 6. “The PIN proves customers are who they say they are, unlike a signature that can easily be copied.”

There's been quite a bit in the media over the holiday period on Chip & PIN. The banks keep insisting liability hasn't changed. Card issuers are correct Liability for fraud hasn’t changed. What has changed is that if you’re a victim of fraud committed with a PIN then you could have one hell of a job proving you weren’t negligent with your PIN. This same point of view is being expressed by the National Consumer Council.

Reducing the overall cost of fraud is in everyone’s interest, chips will deter counterfeit but PINs will increase incidences of robbery and probably muggings. Surely a Chipped card complete with the cardholders photo would be far ‘ safer and more consumer friendly,’ than a Chip and sPIN card?

Therefore back to the original questions I put to readers. What incentive is there for a credit card holder to accept a PIN with their Chipped Card? Why are card issuers not making consumers aware that a Chip only card is an option?

The cost of implementing Chip & PIN in the UK- an estimated £1.3 billion pounds. Monies raised so far by the DEC £60 million.

James

dthyer

Fair point about the Northampton Trial Report 2003, I hadn't seen that before. Obviously it doesn't prove it, and it is a bit silly of the Chip & PIN people to say that it does.

What has changed is that if you’re a victim of fraud committed with a PIN then you could have one hell of a job proving you weren’t negligent with your PIN

Some thoughts about this:

• Before this change, you might have had to prove that a signature on a slip of paper wasn't yours. I'm not sure how often this actually happened, but if the bank decided that they thought you were complicit in the fraud, this is a line they could have taken, and I'm not sure how this would compare to trying to prove you weren’t negligent with your PIN.
• As mentioned in a previous post, the Banking Code Guidance says that the bank must prove that the customer acted fraudulently or without reasonable care (aka acted with "gross negligence"), rather than the customer proving that they didn't. But I understand that you are sceptical about this.
• I think years ago banks could get away with more, such as saying "the computer said that you authorised it, so you must have", such as in the Munden case that you have referred to, but these days I think that people are more savvy about that kind of thing, and know that computers can, and often do, make mistakes, and that just because information comes out of a computer, that doesn't make it true. Garbage In Garbage Out as they say.

but PINs will increase incidences of robbery and probably muggings

This is an interesting prediction. You've said it more than once, so I assume that you are fairly certain that this will happen, but I'm not so sure. Of course even after Chip & PIN has been going a year or two I'm not sure we (the public) will know the answer. The people in the best position to know the exact numbers, the banks, certainly won't want to publicise any bad information. Conversely, I wouldn't be surprised if we get some press articles about some individual incidences, but they won't have any hard statistical facts to say whether more or fewer robberies and muggings have happened involving credit cards.

I have no objection to photos, but I suspect that they would have the same problem as a signature, that is that they are not an exact match or no-match check. So I suspect that the banks wouldn't be able to get the retailers to take any responsibility for checking the photos, and that in the end many retail staff wouldn't bother.

To answer your question, if one accepts your assertion that a PIN is harder to repudiate than a signature, then for one individual the best outcome might be for all other cardholders to have to use PINs, to reduce the cost of fraud which is shared out via merchant charges, but for that one individual to have a signature card, for their convenience in the case of fraud.

Possibly this is why the banks seem to only concede the possibility of Chip & Signature for people who have medical reasons for needing it.

On the other hand I may be giving the banks to much credit, and their resistance to giving out Chip & PIN cards could be just due to pig-awkwardness or control-freakery.

Just my thoughts,

DT

devilgirls1

hi all, im a newbie so bear with me.
recently i took out a topshop store card and once the card arrived i noticed it had the wrong first name on it. i rang CS (in india), and the operator told me that another 1 was gonna be sent out and i requested an additional card in my sisters name. with it bein close to christmas i was told they was a bit of a delay. another 3 weeks later no cards but still waitin, then i recieve a statement with 5 differant transaction that neither me or my sister did as we did'nt even have the cards. one card was used in bradford and the other in birmingham. i rang customer service and they said that the signitures are being checked to see if it matched to mine. but that was 3 weeks ago and all i get is that the matter is being investigated. can anyone advise me and did the cards get stolen from the sorting office, i dont get it, how did they get hold of the cards if they were never deliverd to me.

Reaper

Perhaps if the card arrived with the wrong name the one with the right name was posted to somebody else. Either that or somebody dishonest in the Post Office spotted a new card envelope and grabbed it. What about the incorrect card - did you chop it up or put it out with the rubbish whole and unsigned?

I was told credit card investigations typically take 6 weeks, although I never understood why.

I hope you have had the cards cancelled. If not do so now. Since theft is involved I'd suggest you write to them confirming all the facts, don't just do everything by phone (but phone to cancel your cards if you haven't already).

Other than that all you can do is wait.

devilgirls1

thanks for the reply.

i still have the card with the wrong name on it and i rang CS to get all the cards cancelled.

i will take your advise and write to them explaining the whole situation.

James

Ask them if they can provide the transactions slips with your signature (forged) and if these slips have been dusted for prints? Don't forget to report this to the police.

Dioritt

I recently received a new credit card and forgot to sign it. Went to a shop (Asda), pulled it out to use it, was asked for pin and had to admit that I didn't know it. Told the saleswoman that I'd use a different card instead as I hadn't even signed that particular card and her response was "you can just sign it now if you like". I did, but was surprised that she didn't ask to see some other kind of proof of who I was (with a signature). How on earth could she have known that I'm me? What a strange way of going about things!

I remember a friend telling me about somebody she knew (or had met or something) who had received a card in the post that wasn't hers (address was wrong but had been delivered to her anyway) so she'd signed it and spent a couple of thousand on it before deciding to call it a day.

I don't like the chip and pin deal because it is too easy for others to see the number but it's far superior to the signature system - at least as long as sales assistants don't even bother to check signatures and allow cards to be signed at the till with no other kind of verification.

I've never understood why we can't have our pictures on the backs of cards. Signatures can be faked, pins can be stolen but without surgery, it'd be difficult to look like another person. I realise that people change their hair, grow beards etc, but it works in passports so why not on cards?

~Sharon