Chip 'n' Pin - A Quick Guide Discussion Area

yeslek

to be honest i'm so paranoid about using my chip an pin - its one thing getting card details or forging the signature but with the pin someone could draw out all the money you card has!
i'd rather have stayed with the signatures or would rather have differant pins for cash-point with drawls and paying

James

Yeslek,

Tell your card issuer you have no faith in PINs as the card industry cannot guarantee PIN integrity. Tell them you want a Chip & Signature card.

Once you have your Chip and Signature Visa/MasterCard/Europay cards you can withdraw money in person in branch or get cashback in supermarkets with your debit card.

You could use a banks own savings card (which can't be used in shops, only at ATMs or in branch) to withdraw cash from cash machines. On-line bank and transfer money to this account if and when you need it. (Just a suggestion).

Your right to be worried - Chip & PIN scam is spreading:

http://www.thisismoney.co.uk/saving-and-banking/article.html?in_article_id=408915&in_page_id=7&ct=5

James

A major bank has finally conceded that serious flaws in the new chip and PIN system has opened it up to fraud.

http://www.dailymail.co.uk/pages/live/articles/news/news.html?in_article_id=385811&in_page_id=1770

Cant trust PINs - then don't use them - BIN the PIN with your credit card. Do you really need to use your credit card to access an ATM? It's not a money saving means of getting cash and it plainly isn't safe.

student100

dph wrote:

One of the IT Heads in the company I work for suggested that the PIN is stored on the card....On this basis it must be possible to obtain the PIN from the card with the right equipment and know how?

Yes the PIN is authorised by the card, not over the network.

However, I imagine (although this is pure speculation and I have no evidence to back it up) that the PIN itself is not stored on the card.

Probably a cryptographic hash of the PIN is stored on the card. Because of the way cryptographic hash functions work, it means there is a "unique" mapping from PIN to hash value, but given the hash value alone, one cannot recover the PIN (except by brute force, i.e. trying all possible PINs - but trying more than 3 would lock the card). So it is possible to enter the PIN, compute the hash value, and the card can say "yes that's the right PIN" without knowing what the PIN is...

chriz1000

Trust me, this year using new methods card glitching is becoming very advanced on other smart chips. It will only be a matter of time before a back door can be gliched on bank cards.

moggsy

James wrote:

A major bank has finally conceded that serious flaws in the new chip and PIN system has opened it up to fraud.

http://www.dailymail.co.uk/pages/live/articles/news/news.html?in_article_id=385811&in_page_id=1770

Cant trust PINs - then don't use them - BIN the PIN with your credit card. Do you really need to use your credit card to access an ATM? It's not a money saving means of getting cash and it plainly isn't safe.

James, what's happening here is the media jumping on a couple of examples of fraud and then blowing them out of all proportion (the Daily Mail is particularly good at doing this on any subject). Chip & Pin will never stop credit card fraud, it just makes it that little bit harder.

Compare it, if you will, to using locking wheel nuts on your car's alloy wheels. It doesn't stop criminals from stealing your wheels, as they are more than capable of still removing your wheels, it just slows them down. Chip & Pin is the locking wheel nut of the credit card world. And do you know what thieves do when they come across a car with locking wheel nuts? They look for a car near by with a nice set of alloy wheels without locking wheel nuts and steal them instead.

So be wary of asking for a Chip & Signature card as you are effectively removing your locking wheelnuts and leaving an invitiation for thieves to help themselves!

James

Your analogy made me smile, sounds simple and is.

But consider this your beautiful alloys are hard cash and the lock to that hard cash is your PIN (and magstrip). So the thief looks for an easier option something without a lock (PIN), only to discover that without a PIN they can't get your alloys (hard cash). Without a PIN they have to reveal themselves if they want to pinch your manky old pressed steels (goods) and then sell these goods on at a much reduced value.

So be wary of using a PIN (and it's your choice). Consider this' the industry can't keep your PIN secret (The Shell incidence) and yet another ATM tampered with in Worcester

http://worcester.standardtoday.co.uk/news.tvt?_ticket=34BQY7ZQ3GSGX237CAMAAQ6FBSKACK3URGQFIR0CANZEFMTADIULWQRFLZ9KMMTEDYLABHSI7SUEIOPNCNSEANYECGSGW45MHONCNV1DALOL6Z5FURUSNNNADYN1WKLAFURGUXSEIOUD9NTLDKLAIMRGUYVEIOQLK&_scope=Flow/Websites/Worcester/News&id=2892

The above article states there was a drop in ATM fraud of 12%. They fail to say that it rose by a massive 84% the previous year. The drop is welcome but insignificant in view of the recent incidences.

Egg lets you and goodness know who else view your PIN on their website, and one card issuers (can't remember whom) intends to send PINs on mobiles to those who forget them. How then can terms and conditions apply? Keep your PIN secret at all times, if your PIN is compromised it must be your fault.

Moggsy go for your PIN and good luck to you. But let others make their own minds up Chip & PIN or Chip and Signature.

student100

James wrote:

But let others make their own minds up Chip & PIN or Chip and Signature.

Quite, James.

MPH80

James,

I would like, if you'd be so kind, for you to tell me what you believe the ideal solution is to the authentication problem for payment cards?

Baring in mind that the solution is going to have to do the following:

1) Be very hard to clone - so a basic mag stripe is out

2) Not require human intervention on validation - because it opens up the system to easy fraud - so that removes signatures/photos etc.

3) Not unduely delay people at the checkout? So a slow scanning process is out.

4) Not require online authentication - which means a central database is out.

5) Be RELATIVELY cheap to roll out.

Now - baring those in mind - I'd be interested to know what your opinion is. Personally - I know what my ideal solution is - and it isn't chip and pin - but I'll say once you've answered.

M.

James

MPH80 The case I'm putting on this forum is:

Given PIN insecurity and recent cases in the press, is it more advantageous for a cardholder, to have a chip and pin or a chip and signature card? That should be the question readers are asking themselves.

I think the majority of readers would disagree with the point 2. Go on be a devil and tell us all what your solution is that meets these (which are your) requirements.