Chip 'n' Pin - A Quick Guide Discussion Area

MPH80

Why, tell me, would the majority of readers disagree with point 2?

Human intervention opens up a system to massive fraud. If I require a human to press 'yes' or 'no' when they've validated the process - it's a small step for someone to commit fraud simply by always pressing yes.

It has also been shown that people DON'T do the check - a la signatures.

Removing the human intervention makes life a lot easier.

What you are doing on this forum is bad mouthing the latest system to try and help the banks prevent fraud. Regardless of what you say - fraud is down. But you aren't offering an alternative that works. You are offering an alternative that is open to fraud. Even with a chip and signature card, someone who'd used their CC at an ATM (as a lot of your links have been about) would have been caught just like anyone else.

I will admit that the those who used signatures with shell would not have had their cards used at the atms. However, those people could, just as easily had fraudulent transactions performed on their cards because the criminal had a card with the magstripe and the ease to buy goods.

Now - what I said was that I would tell you my solution when you tell me yours. Since you are still refusing to provide one that works - I'll hold back on mine.

M.

James

""I will admit that the those who used signatures with shell would not have had their cards used at the atms. However, those people could, just as easily had fraudulent transactions performed on their cards because the criminal had a card with the magstripe and the ease to buy goods.""

Comment and the very same cloned Chip and PIN card could have been used in a shop anywhere in the world that is non-chip and PIN compliant.

Point 2 I was wrong to say readers would judge. I should have said due to recent reports - PIN pads being tampered with in Shops and ATMs rigged on an increasing basis, neither of these systems require human intervention, thus reducing the risk of the card fraudster being caught.

You say you have a solution, so let's read it! Or if you don't want to divulge it to all send me an email. You have my word I won't post it anywhere.

MPH80

James,

I'm more than happy to compare solutions to the problem. But the point of my post was to challenge you to come up with a better solution to the problem than chip and pin which fulfills the criteria.

So - come up with one and we can compare.

M.

James

For a starter Chip, Signatrue & Cardholder Photo.

In a chip only environment then the only time the card could be used fraudulently is if:

A. The card hadn't been reported lost.

B. Shops staff failed to check the cardholders photo & signature.

C. In a non-chip environment this type of card offers a higher level of protection than a Chip & PIN card, which has no photo.

Advantages are:

1. Disputed transactions between the cardholder and card issuer would disappear.

2. Shops where fraud did occur would stick out like a sore thumb.

The down side of course is the card couldn't be used at a cash machine. Cash could be withdrawn however using a debit card over the counter in a bank or building soiciety or getting cash-back at many retailers.

The massive increase in fraud at ATMs over the last 3 years would be greatly reduced.

Go on then, let's hear yours.

zincoxide

James - I'd like to understand why you believe you are such an authority on areas of fraud, given a search of your previous posts?

James

Personal experience over quite a few years.

http://www.leamingtonspatoday.co.uk/ViewArticle2.aspx?SectionID=691&ArticleID=1512103

King_Of_Fools

You could still have a PIN for a signature card in the same way that we had PINs for credit cards long before Chip & PIN existed, which would allow you to use ATMs.

However, I cannot see how "Disputed transactions between the cardholder and card issuer would disappear." Unless the store took a photo of everybody for every sale made to compare after the event, you could still get ito a dispute with a bank where the only proof they have is a piece of paper with your forged signature on it.

zincoxide

But any actual studies or full understanding on the way payment gateways work? The criminal justice system? Chip & Pin implementation? Safeguards put in place by retailers and banks?

Your comments on here imply a better knowledge than it appears to actually be, therefore possibly misleading others that read this thread. No doubt the scheme you subscribe to may be working, but the sad fact is that retailers and banks etc will protect themselves first and consumers second.

Should you come up with a killer idea of how to stop card fraud completely, please let us know as I'm sure someone will want to fund the idea!

James

"the sad fact is that retailers and banks etc will protect themselves first and consumers second.£

Absolutely spot on. So ask yourself which is safer for you Chip & PIN or Chip & Signature

Oh and I use one PIN and one PIN only, it's for a savings card which I keep loaded with small amounts of cash. The card can only be used at ATMs, not in shops. All my other Visa/Mastercard debit an credit cards are Chip & Signature.

Re: Disputed transactions yes this is possible but in the grand scheme of things the risk is reduced, you can challenge a signature. Try saying you weren't negligent with your PIN.

This suits me and it's my choice.

I'm looking forward to reading the solution promised by MPH80.

MPH80

James, thank you for your post. However, as I stated, I believe the system has to avoid human intervention in checks because I believe that while human intervention is present, fraud is all too easy to perform.

However, since you've been good enough to post - here's mine as promised.

Cards containing both chip and magstripe. You have to have a magstripe as long as the technology is present in the world, full stop - there's no choice.

The chip, however, contains both the pin and a snapshot of the shape of your hand.

The hand readers are remarkably cheap because they contain simply a CCD to take photos of the hand. This will require people to present themselves at the bank with suitable ID to get their hand scanned. The biometrics studies show that it roughly unique for 1 in 65000 people. Not perfect, but good enough to prevent fraudsters from being able to randomly steal a card and pretend to be you.

The chip would work in very similar ways to the current procedure for verification of the pin. The reader takes a snapshot of the hand and passes it to the chip for verification. The chip produces a hash of the hand from the scan and compares it to a stored hash, providing a yes or not, along with a suitable number.

Now - lets verify this against my tests:

1) Be very hard to clone - so a basic mag stripe is out
The magstripe is still present - but only for old transactions. However, pin could only be used in combination with hand - so no use.

2) Not require human intervention on validation - because it opens up the system to easy fraud - so that removes signatures/photos etc.
No human validation.

3) Not unduely delay people at the checkout? So a slow scanning process is out.
My experience with these scanners is that they can get the shape in about 0.5s.

4) Not require online authentication - which means a central database is out.
All information is present on the chip - so no online authentication necessary.

5) Be RELATIVELY cheap to roll out.
In comparison to retinal scanners or detailed finger print scaners - it's very cheap.

Now - the downside to this is that the hand shape scanners I've seen are designed for use with a server. However, modification to work with a card reader wouldn't take much.

So this solution provides:

a) Something you have - the card
b) Something you know - the pin
c) Something you are - the hand.

However, my experience also shows that the hand scanners are not usable by everyone. I still think it's more secure than other options. It's also cheaper than most others.

I appreciate it's not fool proof. But I think, given the options, this is probably a better solution than chip and pin by itself.

M.