Chip 'n' Pin - A Quick Guide Discussion Area

C_Ronaldo

wrote:

Will the UK Chip n Pin system be compatible with the french system. For example will I be able to use my card to fill up at the automated petrol filling stations in France something at the moment we cannot do

i had problems when i was in france last year, i tried to use 2 cards with the chip on the card and they wouldnt work

King_Of_Fools

The problems with signatures is that nobody bothers to check them:
http://www.zug.com/pranks/credit/

James

"The problems with signatures is that nobody bothers to check them:"

And the good thing about the system I use is they don't have to check the 'Thumbprint Signature.'

It is only if fraud is committed that the retailers copy of a transaction slip would be required and the 'Thumbprint Signature' checked.

Thus proving the Genuine cardholder didn't make the purchase and the forensic evidence (the crooks print) would be handed to the police.

So I have a:

Deterrent, which protects me for being accused of first party fraud (unlike recent PIN fraud victims), and I have forced the crook into providing an aid to their identification - their print!

C_Ronaldo

good idea james

MPH80

But James,

Where on your C&S card does it say the person has to provide a thumbprint? The signature strip wouldn't be large enough?

How does the retailer know?

(My point being - how does the retailer know to only accept a thumbprint rather than a signature and what's to stop the theif/fraudster signing anyway?)

Beyond that - How does the retailer verify your print?

How do they protect themselves against fraud?

Even if you get around the above problems - does that mean the card company have to pay for a high tech lab to scan and compare the thumb prints at high resolution if you dispute it? Or do all disputes instantly go to the police?

How accurate would the thumbprint have to be?

Who is liable if your ink pad doesn't give a good enough print to allow a match? You for not pressing hard enough? The retailer for failing to verify it well enough?

Don't get me wrong - this system, if retailers are participating - and verification (and thus liability) was done by the card issuer, will work very well and I don't disagree with it at all - I think it'd be a great system. But until the card issuers take responsibility for verification, the retailers would be completely at risk of charge backs.

The perfect system doesn't place risk on the cardholder OR the retailer but firmly in the card issuers' lap.

M.

James

Q. Where on your C&S card does it say the person has to provide a thumbprint? The signature strip wouldn't be large enough?


A. Rather than signing with my Signature I put a perfect print on the Signature Strip and it's large enough.


Q. How does the retailer know?

A. When they check the signature strip, a print stares them right in the face. I also ask, would you rather me sign or use my Pint. Every single one so far has said - use your print. However it wold be nice if the card people offered this faciltiy to cardholders via an instruction on the magstrip and embedded in the chip - rather than being asked to enter your PIN - cardholder uses their print (and thier signature) on the cardholders instructions. Cards lost in the post what use? When buying goods on the internet the retailer could be made aware that the cardholder, or their representative prints (and signs) at point of delivery. Far more secure than 3 numbers on the back of your card - An auditable trail. ID Theft - forget it.

Q. How does the retailer verify your print?

A. They don't have to. This works primarily as a deterrent, and it is only if fraud had been committed on that account would a transaction slip be recovered. Proving the genuine cardholder didn't carryout the transaction and providing an aid to the identification of the perpetrator.


Q. How do they protect themselves against fraud?

A. Quite simple on two accounts - First of all the system is proven in a voluntary environment - Fraud reduced by over 80% and bag and purse theft by 50 odd in Inverness. Secondly supplying the police/fraud investigation department with forensic evidence (a transaction slip with a print) should remove any chargeback costs to the shop.

Q. Even if you get around the above problems - does that mean the card company have to pay for a high tech lab to scan and compare the thumb prints at high resolution if you dispute it? Or do all disputes instantly go to the police?

A. As explained the essence of this system is it's low cost. In the first instance the only print to be compared is that of the cardholder against the fraudulen transaction. In my experience this can usually be done with the naked eye never mind anything else, however this would be done by the police. Once it ihad been easily established that the genuine cardholder didn't make the purchase then that print is criminal evidence - an aid to identifying the perpetrator.

Q. How accurate would the thumbprint have to be?

A. Whenever fraud takes place in a shop and for whatever reason the stolen/cloned card is withheld by the shops staff, a best practise guide by the industry to retail staff advises, that they handle the card by the edges to preserve any prints. The pads use provide perfect prints.

Q. Who is liable if your ink pad doesn't give a good enough print to allow a match? You for not pressing hard enough? The retailer for failing to verify it well enough?

A. I haven't seen a print yet, even given in a voluntary environment where this has happened. In an environment where it is the cardholders wishes that this is done, then one wouldn't arise, however if the shops staff thought this the case then I'm sure that the cardholder would welcome the retailers intervention, but this as far as I know hasn't happened so far. The same system has been used for cheque cashing in the States for years.

Q Don't get me wrong - this system, if retailers are participating - and verification (and thus liability) was done by the card issuer, will work very well and I don't disagree with it at all - I think it'd be a great system. But until the card issuers take responsibility for verification, the retailers would be completely at risk of charge backs.

A. This is not driven by the retailer, although they benefit it is driven by you. I would however like to see pads everywhere a signature is required (including on verification applications to the CRB). Like I say, I am using and doing this now with my Chip & Signature Cards. I can't imagine a retailer suffering a chargeback if they provide something better than a signature, which can't be copied or forgotten. I wish I could use my signature verified by my print - as I do when applying for any financial product or service where my signature is required - the financial industry have no option but to comply with my instructions.

Q. The perfect system doesn't place risk on the cardholder OR the retailer but firmly in the card issuers' lap.

A. The system I have in place as near as dammed meets this requirement. Like I said, this suits me - if anyone else wishes to use the same system go for it. As Martin says, stuff the banks before they stuff you.


I hope this addresses all your questions.

MPH80

The reason fraud dropped so highly was because it was a closed system and, like C&P, it works in that environment. If everywhere (inc cash machines) had a chip reader, there'd be much less card fraud for stolen/cloned cards. The fraudsters just moved elsewhere - where fraud was easier.

So let's walk through the scenarios here ...

1) Customer goes into shop with print on back of card, shop doesn't have a pad, customer has one on him, customer deliberately smudges print - IF the retailer bothers to look - do they print another receipt or do they accept?

2) Customer goes into shop with print and signature on back of card, shop looks and customer offers to sign ... does the retailer accept?

3) Customer goes into shop - original card had a print on, card has been stolen and the signature strip replaced with a new one and signed with fake signature - how does the retailer know?

4) Card gets stolen in the post, thief signs the card and uses it, retailer has no idea the customer would have used a thumb print.

IF the system was rolled out everywhere, with special pads at the retailer, it could work. Until that time, the customer either has to carry an ink pad with them and that can result in damaged prints or smudging - there are certain inks, for example, which won't hold well on certain type of thermal paper (commonly used in shiny receipts) - it'd be easy for a thief to use that instead. Also until that time, a signature has to be present on the card and all the thief has to do is put a plaster on their thumb and say they can't use it and thus they can sign.

And that last point reveals the real weakness in both yours, and my, system. Relying on a physical feature which can be deformed (by small scar for example) - or broken finger in my case. The difference is, in my system the fall back would be the pin, which only the real person knows. In your system, the fall back is the signature which is very easily forged.

BTW - I'm going to bow out of this discussion now - I believe I've cluttered up this topic enough since it is here to discuss C&P issues rather than alternatives to C&P and C&S and I was the one who led it firmly off topic.

M.

James

Q. The reason fraud dropped so highly was because it was a closed system and, like C&P, it works in that environment. If everywhere (inc cash machines) had a chip reader, there'd be much less card fraud for stolen/cloned cards. The fraudsters just moved elsewhere - where fraud was easier.

A. I have agreed with you about Chips but we know that won't happen in the foreseeable future. It wasn't a closed system, retailers all over the UK used this, but it was never supported by the card industry. Furthermore it worked with cheques and with ALL types of plastic cards, but it was voluntary. Driven by the cardholder, they are protected. The thing about crime moving elsewhere - a 100% never moves elsewhere.

So let's walk through the scenarios here ...

1) Customer goes into shop with print on back of card, shop doesn't have a pad, customer has one on him, customer deliberately smudges print - IF the retailer bothers to look - do they print another receipt or do they accept?

A. As the system is cardholder driven they have no reason to smudge the print, the pads in use make it very difficult to smudge a print. There is more than ample room on the shops copy of a transaction slip to put half a dozen prints, never mind one.

2) Customer goes into shop with print and signature on back of card, shop looks and customer offers to sign ... does the retailer accept?

Q. NO, If it has both signature and print because that would be the carholers own instruction. At present I use only my print on my debit and most commonly used credit card. As I've said, the card industry crowed over what Chips could do, so lets use the Chip to provide a simple instruction to Shops staff saying PRINT, rather than PIN or even if the cardholder requires it PRINT & PIN - bingo.

3) Customer goes into shop - original card had a print on, card has been stolen and the signature strip replaced with a new one and signed with fake signature - how does the retailer know?

A. This is where Chips come into their own. In a non-chip environment one of the things a retailer should do is check that the signature strip is genuine. Another solution is a non-chip environment where the magstrip is swiped, then the magstrip could carry an instruction the the cardholder prints.

4) Card gets stolen in the post, theif signs the card and uses it, retailer has no idea the customer would have used a thumb print.

A. Several answers here - The first is as before - have the magstrip and PIN carry one bit of additional informtion - the cardholer prints. Better activation procedures by card issuers - phone to activate the card etc. I use the same system to protect myself from ID theft when applying for cards, therefore my card issuers know I (sign) and print. Why not overtly mark the card too? My old photo card even had my signature strip coverd by a material which prevented tampering - do the same again.

Q. IF the system was rolled out everywhere, with special pads at the retailer, it could work. Until that time, the customer either has to carry an ink pad with them and that can result in damaged prints or smudging - there are certain inks, for example, which won't hold well on certain type of thermal paper (commonly used in shiny receipts) - it'd be easy for a thief to use that instead. Also until that time, a signature has to be present on the card and all the theif has to do is put a plaster on their thumb and say they can't use it and thus they can sign.

A. Non of what you suggested has happened where Thumbprinting's been used. I carry a pad around and it suits me. Shop transaction slips which require a signature by ball point or fountain pen work equally as well, if not better with Thumbprint ink. As for a plaster on the Thumb, they have 9 other digits they can use. if they haven't, they can't get their card out their wallet - maybe Jockanese like me = Oh It doesn't have to be your Thumbprint.

I suggest that the system I use is far safer than carrying cash, one of the main aims of plastic in the first instance. My chances of becoming a victim of fraud are greatly reduced.

The Dragons Den or What!

EagerLearner

Reported as spam

James

MPH80, Zincoxide.

Dragons Den's meant to be a joke - keep the questions/comments coming.