Chip 'n' Pin - A Quick Guide Discussion Area

Altarf

Steal card, forge signature = two steps
Steal PIN, steal card = two steps

With the latter I can even separate the two events, as most people never change their PINs.

With a signature I stand a chance of proving that I didn't sign. How do you prove that you didn't enter the PIN?

C_Ronaldo

its simple you dontgive your pin out to anyone,

MPH80

Altarf wrote:

Steal card, forge signature = two steps
Steal PIN, steal card = two steps

With the latter I can even separate the two events, as most people never change their PINs.

With a signature I stand a chance of proving that I didn't sign. How do you prove that you didn't enter the PIN?

It's easy to prove you didn't enter the pin - step one - report the card stolen - which under the Banking Code means you are no longer liable for any fraud.

Step two - if the bank say that you must have been negligent with the pin - ask them to prove it - because under the banking code - THEY must prove it. If they claim you must have let someone see it - point out banks accepted long ago that pins could be shoulder surfed and that it didn't make the person negligent.

Step three - if the bank claim you are lying and that you did enter the pin - Again ask them to prove it - and if necessary request the CCTV from the shop where it occured as you are allowed to under the DPA.

Easy.

Now - if someone forges your signature well - how are you going to prove it wasn't you? Oh wait - the SAME WAY!

Oh - and your point about seperating the two steps - most fraud is committed by opportunistic theft of card - e.g. I see the opportunity to steal a card so I do. Are you suggesting to me we are going to get a new breed of criminals who shoulder surf you ... wait 5 days ... see you in town again and think "bonus!"?

So - now I have to shoulder surf you - steal the card - and use it before you notice. If you're careful, e.g. shield the pin pad with your body/with your hand, not say it outloud - that should be sufficient to stop most people.

Now before - I just had to steal it from you - I didn't have to do anything else - I could just wait on the street and get you. That's the big difference.

M.

James

Abbey pays £1,100 over PIN number fraud (Eventually): (2nd article in column)

http://www.telegraph.co.uk/money/main.jhtml?xml=/money/2006/04/22/cmjess22.xml

And the card industry reckons people are well informed about Chip & Signature Cards, or alternatives to PINs.

The SUN, Thursday 27 Apr 06, told a story of how crooks, posing as engineers have tampered with Shell garage ATM's by fitting a chip to them. The Chip records card details and PINs. Cost of the fraud so far according to the paper is £1M.

A manager is quoted as saying everyone is trying to keep this quiet.

moggsy

Altarf wrote:

Steal card, forge signature = two steps
Steal PIN, steal card = two steps

With the latter I can even separate the two events, as most people never change their PINs.

With a signature I stand a chance of proving that I didn't sign. How do you prove that you didn't enter the PIN?

What you're missing here is the fact that you don't need to physically steal a non chip and pin card in order to make use of it - you can just skim it and then make a copy. A chip & pin card would need to be physically stolen which requires a whole different class of criminal...

Altarf

moggsy wrote:

What you're missing here is the fact that you don't need to physically steal a non chip and pin card in order to make use of it - you can just skim it and then make a copy. A chip & pin card would need to be physically stolen which requires a whole different class of criminal...

Chip & Pin cards still have a magnetic strip to enable them to be used in cashpoint machines.

So I can still skim your card, and although I can't use it in shops, I can now put it in a cashpoint machine with the PIN number I saw you type in and get cash without the bother of fencing stolen goods down the pub.

MPH80 also misunderstood what I meant about separating the act of discovering your PIN and acquiring the card. I was not meaning that a stranger could do this, but someone you know (family member, work colleague, employee, friend). Unpleasant to think about, but it does happen, and now with PIN numbers and cash machines, so much easier for someone with a dishonest trait to commit fraud.

Voyager2002

Egg have agreed to send me one, but it just never comes. I am still using an old, chip-less, Morgan Stanley card, but at some point it will expire. It looks as if I shall have to go back to writing cheques.

James

Card Fraud Revealed:

Clarks Shoe Shop at Stanstead is mentioned - they are Chip & PIN and have been for some time:

http://www.itv.com/news/britain_1161192.html

http://management.silicon.com/itdirector/0,39024673,39120390,00.htm

and we also know ATMs can be rigged with CHIPs to capture PINs and Card Details.

King_Of_Fools

James wrote:

Card Fraud Revealed:

Clarks Shoe Shop at Stanstead is mentioned - they are Chip & PIN and have been for some time:

http://www.itv.com/news/britain_1161192.html

The fact that a shop is Chip & PIN does not stop somebody swiping a card to clone it. The magnetic stripe is the weak point of all cards (C&P, C&S or otherwise) and will continue to be until it is removed. This has nothing to do with Chip & PIN.

Altarf

King_Of_Fools wrote:

The fact that a shop is Chip & PIN does not stop somebody swiping a card to clone it. The magnetic stripe is the weak point of all cards (C&P, C&S or otherwise) and will continue to be until it is removed. This has nothing to do with Chip & PIN.

But until Chip & Pin came along all the fraudster could do was use the manufactured card in a shop. They could not use it in an ATM as they didn't know your PIN. Now with the 'security' of Chip & Pin they have both and get cash.

Some of the weak point of Chip & Pin are:
- The lack of security at most terminals.
- No standard terminals.
- Credit cards automatically enabled for ATM use.
- Various permutations of Chip only, Swipe only and Chip & Swipe being allowed by the retailer.

The banks are not interested in cutting fraud, just shifting the result to retailers and cardholders.