Chip 'n' Pin - A Quick Guide Discussion Area

James

Lets look at where we are with Chip & PIN (C&P) before the banking industry starts playing the morale responsibility card.

1. Retailers have a choice made on a business case whether to implement C&P or not. Surely the organisations responsible for card logos displayed by retailers should make it a condition of use that retailers must have Chip reading terminals fitted.

2. According to the C&P web page around 10 million C&P cards have been issued so far, yet their site fails to mention Chip & Signature (C&S) cards, why?

3. Have any C&S cards been issued and were C&P cards part of the Northampton trial? If not why not?

4. Card issuers fail to say if it’s compulsory or a legal requirement to have a PIN with your C&P card. Why?

5. The question ‘what if I can’t remember my PIN,’ isn’t answered. Cardholders are referred to their banks on the C&P web site. Banks don’t know how to respond, some refer you back to the C&P web site, other give out mixed messages and even wrong messages. Have a look at https://www.egg.co.uk - The Egg Card – Chip & PIN. They claim that you won’t be able to use a card without a PIN in 24 months time.

6. Liability shift, the devil is in the detail. The Banking Code is a minefield while card issuer’s terms and conditions are difficult to follow and understand.

7. Would having a short-term memory span, or failing to remember a four-figure number that you seldom use be considered as a genuine reason for not having a PIN?

9. Why are card issuers sending out new cards and PINs without asking cardholders if they want or are able to handle one or not? Mail is going astray at an alarming rate. When quizzed Lloyds TSB said they had no plans to check with cardholder to see if they’d received their PIN or not.

10. On a morale issue, why are companies such as Tesco allowed to get away with operating pay at the pump terminals. Neither a signature nor a PIN is required, but Tesco assure me that if a card is reported lost it’s blocked and no sale. This leaves the question, What are they doing to deter stolen cards that haven’t be reported lost being used at these terminals. The card industry can’t stop this practice, they say it’s a matter for Tesco.

A disabled colleague has they same views as myself on this topic. Which are consumers should be fully informed of the pros and cons of having a PIN and then left to make their own minds up.

You mention Fraud in France but fail to say that the French Chip was hacked and French cards had to be replaced. French card fraud I believe is on the up while PIN theft is a hot topic anywhere you care to look.

Pin pads themselves, look at the C&P website, stand in a queue where pads are in operation, view the BBC link at the foot of this page. How can anyone hold one of these pads, block onlooker’s views and enter a PIN at the same time. PIN theft at ATMs in this country is an issue that several police forces are starting to address.

UK C&P cardholders maybe lulled into believing their C&P card can’t be cloned. Can I suggest that because C&P cards are retaining a magstrip they can be cloned. What’s really worrying is that if a cloned C&P card which now comes with a PIN and that PIN is recovered by the crook, this means that one of these cards could be used to withdraw cash at a non-compliant C&P cash machine at home or abroad. Where would this leave the victim, especially if they are visiting the place where the fraud took place?

Can I draw your attention to the Banking Code articles 12.4 and 12.8. My interpretation is that if you contravene any of the points at 12.4 you can be held liable for PIN type fraud. Digest these points and you will see that the card issuer will want to know how someone got hold of your PIN. Well if you’ve not got a PIN you can’t be held liable.
This takes me on to your last point. Of course someone can forge your signature but they may be challenged and you can always claim that the signature isn’t yours, nor are your prints on the shops copy of a transaction slip.

Unfortunately criminals are targeting PINs because they know that if they get hold of a card, (or cloned) card and a PIN they can use it without being challenged. I will put my faith in my forthcoming C&S card and certainly not in Safety in Numbers. This is my personal choice.

Could you give me one good reason for wanting a PIN with a credit card if I don’t want to use it to withdraw cash at an ATM?

By the way my disabled colleague viewed your parking analogy with great distaste.

James

(http://news.bbc.co.uk/2/hi/business/3694593.stm)
(http://www.ameinfo.com/news/Detailed/38508.html)

System

I'm off to the US shortly. Am I right in thinking that they aren't into the ole "chip n pin" thing yet? I was just a bit concerned that we may arrive in the US, only to find it completely geared up to chip n pin and we aren't able to buy anything on a credit card. ???

James

According to the Chip & PIN people the UK is the first country to roll-out the new Chip & PIN cards. A friend recenlty returned from the States used his card per usual - swipe and sign.

James

System

The T&C that accompanied my new Chip & Pin card states that "I must contact that bank if I suspect that anybody knows my PIN".

I asked the bank what they would do if I suspected somebody knew my PIN and I contacted them. They replied that they would issue a new card and PIN.

When I pointed out that given the visibility of the keypads, it is possible that the shop assistant or somebody in the queue will have seen the number I entered. As I could not be certain that they didn't see the number I entered I would have a suspicion that they knew my PIN. To comply with their T&C I would therefore have to phone them every time I used the card.

They are looking into the matter.......

James

The following is an extract from The Observer, Sunday 16 May 04. Re Use of C & P cards overseas.

What happens if I go abroad?


You will use Chip and Pin in most of the rest of Europe in the same way as in Britain. In some countries, such as the US, you will still sign as they have not made the decision to switch technologies.

If UK retailers can make an informed commercial decision wheter to implement Chip & PIN or not, and one of the largest players in the credit card field has decided not to implement C & P yet, then surely UK cardholders should be made aware of this and told that a PIN with a credit card is neither compulsory or a legal requirement.

James

student100

The full Observer article is here.

It also says:
What happens if a fraudster takes my card?

Report it immediately. The maximum you can be held liable for is £50 (which is usually waived by the banks) if your negligence did not contribute to the fraud.


Also, saying the US has "not made the decision to switch technologies" is not the same as saying they have made the decision not to switch technologies. They're just not doing it yet. And we all know how quick the Americans are at catching on to world standards... ::)

James

The Observer article doesnt cover liability switch and the question, how does it benefit me? Just how does it benefit me? Many countries are not 'signed up,' individual UK retailers can opt in or out. Chipped Cards can still be cloned.

£50 are you absolutely sure? The following are extracts from the Banking Code.

What the Observer article doesn't say and the Banking Code does article 12.9 Liability.
If you act fraudulently, you will be responsible for all losses on your account. If you act without reasonable care, and this casuses losses, you may be responsible for them. (This may apply if you don not follow section 12.4)

12.4 (extract)
Do not keep your cheque book and cards together.
Do not allow anyone else to use your PIN.
If you change your PIN you should choose your new PIN carefully.
Always learn your PIN, and destroy the notice as soon as you receive it.
Never write down or record your PIN.
Always take reasonable steps to keep your PIN secret at all times.
Never give your account details or security info to anyone else unless you know who they are and why they need them.

I'd hate to test the second last point, keeping your PIN secret at all times. Lots of room for card companies to wriggle. That's unless you've not got a PIN then you are only liable for the first £50 of any fraud that occurs before you report your card lost or stolen.
Other points in article 12.4 are open to interpretation and discussion

The only benefit some will see for a PIN with a credit card is access to instant cash, that's if they are short of a few bob. They can give their card to a.n.other, who would disguise themselve and hit a cash machine. The genuine cardhoder with a good alibi would call their card issuer to report the card lost at roughly the same time the withdrawal is being made. If what you say is true then here is a 'Money Saving,' exercise for all Robin Hoods, they can withdraw £500 and it will only cost them £50. Question is how do PINs deter or prevent first party fraud? Or Identity Theft? Further more how long will the card industry keep a genuine victim hanging on with £X amout of pounds hanging over their head while they investigage?


James

System

I rang Nationwide today and asked if I had to have a Pin card. Answer "yes".

I then said "But under the disability legislation don't you have to continue to provide signature cards"

Supervisor consulted- answer "yes- I just need to send your details to Head Office".

No further questions about any disability and I never said I had a disability or indeed I never actually requested a signature card- it was all assumed by the operator!

PB

D_G_Marsden

Which organisations have actually started to issue chip and pin cards that actually work with chip and pin?

Has anyone actually used it yet?

Be interesting to know.

Thanks

MSE_Martin

The above should be useful to answer the above question. It's the latest Chip n pin press release

Chip and PIN rollout gathers pace as major retailers make the move to safer shopping

- more than one in three cardholders now have chip and PIN card -

The latest chip and PIN barometer, issued today, shows that millions more UK shoppers have received chip and PIN cards and some of the nation’s biggest retailers are now rolling out the new, more secure technology.

Follow this link to download the barometer: http://www.chipandpin.co.uk/reflib/A4_CPBMTR_MAY_C.pdf
Asda, Dixons and Wilkinsons are some of the new big high street names starting to use chip and PIN technology at their checkouts. Together, these retailers account for some 20 per cent of all plastic card sales made in the UK, so shoppers will increasingly find themselves entering their four-digit PIN, rather than a signature, when they go shopping.

Today’s figures show that more than two in five UK cardholders (41 per cent) now has a chip and PIN credit or debit card and 305,000 small businesses (55%) - including shops, restaurants, and bars - have already switched over to chip and PIN.

Sandra Quinn, chip and PIN spokesperson, said: “With big household names now upgrading to chip and PIN - as well as more than half of the UK’s smaller businesses which accept plastic cards using the new, more secure technology – the rollout really is gathering pace.

“As more and more businesses make the change to chip and PIN, and more new cards are issued, cardholders will benefit from the added security provided by chip and PIN, which will prevent fraud on lost and stolen or cloned cards.”

The rollout of chip and PIN began in October 2003, and is backed by the UK’s banking and retail industries. Chip and PIN cards will be issued and tills switched over according to the individual plans of the banks, building societies, merchants and retailers. Cardholders do not need to do anything themselves as card companies will contact them when they are ready to issue new cards.

The UK Chip and PIN Programme is part of an international initiative to tackle counterfeit and lost and stolen plastic card fraud. A similar domestic PIN-based system for debit cards only in France has seen an 80 per cent reduction in fraud since its introduction ten years ago.

- ends -


Notes to editors:

Banks, building societies, retailers and card issuers have joined forces to combat the problem of credit and debit card fraud through the UK Chip and PIN Programme.
The Chip and PIN Programme will see smart chips on credit and debit cards, and by 2005 the majority of plastic card transactions will be verified by cardholders entering a secret four-digit PIN (personal identification number) rather than signing a receipt.
This simple new system is part of a global initiative to cut fraud. Many other countries in Europe and around the world are planning to implement the chip and PIN system, which is built to an international standard.
The consumer will continue to be protected from card fraud losses by the commitment in The Banking Code. Nothing changes for the consumer. Just as now, cardholders do need to be responsible in protecting their cards and keep their PIN a secret.
Other types of card fraud, such as identity fraud and card-not-present fraud, are being tackled by retailers and banks through a number of initiatives. These include verifying the cardholder's address and cross-checking a card security code to combat fraudulent transactions made over the phone and internet; production of training manuals; multi-sector working groups to address practical solutions and research into hand-held PIN readers that could be used in the future for card-not-present payments.
The Chip and PIN Programme continues to consult with the Disability Rights Commission and other groups to consider the needs of disabled cardholders.
UK plastic card fraud facts and figures can be downloaded from https://www.cardwatch.org.uk