Chip 'n' Pin - A Quick Guide Discussion Area

James

Chip and PIN Fraud - More than £1 million siphoned by fraudsters - hitting cash machines with cloned cards and captured PINs:

http://www.guardian.co.uk/uklatest/story/0,,-5803656,00.html


One retailer has already stopped using Chip & PIN:

http://www.mirror.co.uk/news/tm_objectid=17039713&method=full&siteid=94762&headline=gang-hit-chip-and-pin-cards--name_page.html

I would say it's more that likely the cloned cards and stolen PINs were used at ATMs in the UK.

This also makes a case for Chip & Signature Credit Cards, prefereably with the cardholders photo.

James

Customers across the country have had their credit and debit card details copied by fraudsters, and then money withdrawn from their accounts.

The scam works by criminals implanting devices into chip and pin machines which can copy a bank card's magnetic strip and record a person's pin number.

http://www.guardian.co.uk/uklatest/story/0,,-5803656,00.html

One Retailer Already Stopped Using Chip & PIN (To protect consumers).

Shell banned chip and pin in favour of traditional signatures at their 600 petrol stations to protect customers.

http://www.mirror.co.uk/news/tm_objectid=17039713&method=full&siteid=94762&headline=gang-hit-chip-and-pin-cards--name_page.html

Some Points:

Cloned cards & PINs can be used at UK ATMs AND overseas ATMs.

What faith can consumers have in using PINs in shops?

Surely this makes the case for Chip and Signature Credit Cards? Without a PIN you can't obtain money with a credit card. I bet a lot of the cards cloned in the above instances are credit cards.

I wonder if any credit card issuer is looking at Chip Signature and Photo Cards?

moggsy

James wrote:

Customers across the country have had their credit and debit card details copied by fraudsters, and then money withdrawn from their accounts.

The scam works by criminals implanting devices into chip and pin machines which can copy a bank card's magnetic strip and record a person's pin number.

http://www.guardian.co.uk/uklatest/story/0,,-5803656,00.html

One Retailer Already Stopped Using Chip & PIN (To protect consumers).

Shell banned chip and pin in favour of traditional signatures at their 600 petrol stations to protect customers.

http://www.mirror.co.uk/news/tm_objectid=17039713&method=full&siteid=94762&headline=gang-hit-chip-and-pin-cards--name_page.html

Some Points:

Cloned cards & PINs can be used at UK ATMs AND overseas ATMs.

What faith can consumers have in using PINs in shops?

Surely this makes the case for Chip and Signature Credit Cards? Without a PIN you can't obtain money with a credit card. I bet a lot of the cards cloned in the above instances are credit cards.

I wonder if any credit card issuer is looking at Chip Signature and Photo Cards?

James, you're at some point going to have to stop this crusade against Chip & Pin because like it or not it IS here to stay and it IS more secure then a signature card. The quote you seemed to have chosen to ignore in the Guardian article is:

'The association's spokeswoman Sandra Quinn said: "They have used an old style skimming device. They are skimming the card, copying the magnetic details - there is no new fraud here.'

The retailer which has stopped using Chip & Pin has done so due to fraud carried out by it's own staff. Petrol stations are notorious for card skimming schemes and Chip & Pin will not and cannot stop this. However Chip & Pin is again more secure because a cloned C&P card must be used abroad.

Non Chip & Pin cards are and always have been a very insecure method of payment mainly due to the simple fact that most cashiers don't bother to check the signature so you could literally steal a card and start using it immediately. You cannot do this with a C&P card and therefore the amount of fraud will decrease. Note I say decrease - card fraud will never be eradicated as there is no system in the world which is convenient yet fraud proof. Chip & Pin is however a good compromise which will and already is decreasing card fraud.

James

moggsy wrote:

1. 'The association's spokeswoman Sandra Quinn said: "They have used an old style skimming device. They are skimming the card, copying the magnetic details - there is no new fraud here.'


2. The retailer which has stopped using Chip & Pin has done so due to fraud carried out by it's own staff. Petrol stations are notorious for card skimming schemes and Chip & Pin will not and cannot stop this. However Chip & Pin is again more secure because a cloned C&P card must be used abroad.


3. Non Chip & Pin cards are and always have been a very insecure method of payment mainly due to the simple fact that most cashiers don't bother to check the signature so you could literally steal a card and start using it immediately. You cannot do this with a C&P card and therefore the amount of fraud will decrease. Note I say decrease - card fraud will never be eradicated as there is no system in the world which is convenient yet fraud proof. Chip & Pin is however a good compromise which will and already is decreasing card fraud.

1: Absolutely agree, the magstrip has been copied, probably because Shell use either park and swipe (Chip and PIN terminals) or like those in Halfords for example you insert your card into the PED, then the assistant Swipes the card - wide open to the afore mentioned crime.

2. Absolutely wrong - cloned UK cards complete with valid PINs can and are used in UK ATMS - ask APACS via the Chip and PIN website. The scale of this would suggest that if it's insiders as you suggest then Shell have a serious problem. Furthermore this is a first for card details and PINs being captured en mass. The APACS spokesperson conveniently overlooked Clarks shoe shop at Stanstead being rigged. Therefore it's not just a problem for Shell.

3. The chip part of chip and PIN works but as long a magstrips are present the system is extremely vulnerable.

Now look at things from a crooks perspective: They find or steal a Chip and Signature card then they can't use the card to get cash and if they want to use it in a shop (Chip compliant), then they will have to face-down shops staff, and if the cards been reported lost or stolen in theory it will be blocked. Using a PIN with a genuine card then anyone can use it anywhere. Using a PIN with a cloned card, then cash machines are hit.

To limit opportunity even further I would suggest a photo on a Chip & Signature credit card.

Those reading this forum who feel unsafe about using PINs should contact their card issuer and demand Chip & Signature cards - if this suits them and their needs. Continue to sign and disputed transactions are not your problem.

moggsy

Right then here we go:

Absolutely wrong - cloned UK cards complete with valid PINs can and are used in UK ATMS - ask APACS via the Chip and PIN website

Most cash machines can read the chip - they also authorise online with the bank. The mag stripe will indicate to the machine that the card has a chip, this will force it to use the chip. If there isn't one then the transaction will fail. If the cash machine hasn't got a chip reader or the card cloner has been clever and altered the mag strip track 2 info then the transaction will go online and the bank will will decline the transaction because they know that the card should have a chip (by using account information).

Using a PIN with a genuine card then anyone can use it anywhere.

If you know the PIN why go into a shop - just use a cash machine in exactly the same way as you could with a non Chip & Pin card - there is no new fraud here.

To limit opportunity even further I would suggest a photo on a Chip & Signature credit card.

Photo id can be and is easily faked - fake passports can be bought for a very reasonable price.

Continue to sign and disputed transactions are not your problem.

Disputed chip & pin transactions are no more of a hassle than a diputed signature one because of the all of the reasons you have highlighted over the last few months. It is not a 100% perfect system and the banks know this.

Furthermore this is a first for card details and PINs being captured en mass.

Absolutely wrong - gangs of criminals have been stealing PIN numbers and card details from cash machines for quite some time:

http://news.bbc.co.uk/1/hi/wales/3535473.stm


James, Chip & Pin isn't perfect but it is more secure than Chip & Signature and so I would advise readers of this forum to NOT apply for a Chip & Signature card. I would also like to agree with you however that card cloning is still viable even with Chip & Pin cards and so people should still be careful when using their credit or debit cards as they always should have been anyway.

James

Moggsy,

I say let people make their own minds up. They should realise however that they do have a choice. Chip and PIN or Chip and Signature.

moggsy wrote:

Right then here we go:

Absolutely wrong - cloned UK cards complete with valid PINs can and are used in UK ATMS - ask APACS via the Chip and PIN website

Most cash machines can read the chip - they also authorise online with the bank. The mag stripe will indicate to the machine that the card has a chip, this will force it to use the chip. If there isn't one then the transaction will fail. If the cash machine hasn't got a chip reader or the card cloner has been clever and altered the mag strip track 2 info then the transaction will go online and the bank will will decline the transaction because they know that the card should have a chip (by using account information).

Using a PIN with a genuine card then anyone can use it anywhere.

If you know the PIN why go into a shop - just use a cash machine in exactly the same way as you could with a non Chip & Pin card - there is no new fraud here.

To limit opportunity even further I would suggest a photo on a Chip & Signature credit card.

Photo id can be and is easily faked - fake passports can be bought for a very reasonable price.

Continue to sign and disputed transactions are not your problem.

Disputed chip & pin transactions are no more of a hassle than a diputed signature one because of the all of the reasons you have highlighted over the last few months. It is not a 100% perfect system and the banks know this.

Furthermore this is a first for card details and PINs being captured en mass.

Absolutely wrong - gangs of criminals have been stealing PIN numbers and card details from cash machines for quite some time:

http://news.bbc.co.uk/1/hi/wales/3535473.stm


James, Chip & Pin isn't perfect but it is more secure than Chip & Signature and so I would advise readers of this forum to NOT apply for a Chip & Signature card. I would also like to agree with you however that card cloning is still viable even with Chip & Pin cards and so people should still be careful when using their credit or debit cards as they always should have been anyway.

dph

One of the IT Heads in the company I work for suggested that the PIN is stored on the card. He argued this from the point that the PIN OK prompt is obtained too fast for our network to process an online verification. The online verification is only after the PIN has been OK'd. On this basis it must be possible to obtain the PIN from the card with the right equipment and know how?

King_Of_Fools

dph wrote:

One of the IT Heads in the company I work for suggested that the PIN is stored on the card. He argued this from the point that the PIN OK prompt is obtained too fast for our network to process an online verification. The online verification is only after the PIN has been OK'd. On this basis it must be possible to obtain the PIN from the card with the right equipment and know how?

That is correct, the PIN is stored on the card. However, there is no way of getting the PIN out of the chip. The C&P verification works one way only - the PIN you type in is sent into the chip and it responds with OK if the PIN matches. If the incorrect PIN is sent in three times than the chip is locked and can then only be unlocked by entering the correct PIN at an ATM.

moggsy

James wrote:

Moggsy,

I say let people make their own minds up. They should realise however that they do have a choice. Chip and PIN or Chip and Signature.

Yes I agree, which is why I'm presenting the other side of the argument to people - they can then make an informed choice.

James

Moggsy, To comply with Terms & Conditions, you may do your best to keep your PIN secret at all times, but now we know that shops pin pads and ATMs can be rigged to obtain PINs then I would suggest you inform your card issuer that you can not be sure of PIN integrity. Therefore ask, no demand a Chip & Signature Card.

Latest from the Telegraph:

£1m chip and pin fraud highlights flaws in system

http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2006/05/08/nchip08.xml

Remove a PIN from the above equation and cash points can't be hit nor can cloned cards (chip and Signature) be used in a shop thats C&P compliant.