Card security - do the banks actually care?

GeoffL

FWIW, I have a problem remembering PIN numbers that I rarely use. It's nothing serious, just that I've got so many of these wretched 4-digit and 6-digit numbers to remember that I often forget the one I need at the time and/or forget which PIN applies to what. Although I say that it's nothing serious, you can take it from me that it's no fun confronting a filling station attendant after you've put over £80-worth of diesel in your tank and then had three failed attempts at your PIN and locked your card.

When Chip 'n PIN was announced, Sandra Quinn (then an APACS spokesperson) promised that those who had difficulty remembering PINs would be allowed to use Chip 'n Signature cards instead. Ever since Chip 'n PIN came in, I've been trying to get Chip 'n Signature but my bank has refused. During the discussions (probably over a dozen) that I've had with my bankers on the subject, they've offered me loads of 'advice' on how I can get around the problem and each of their proposed 'solutions' contravenes the advice that they give on security and some would even give them an absolute reason not to reimburse you for fraudulent transactions made possible by their own advice. Here's a flavour:

1. They suggest that I should change my PIN to something more memorable - like my birthday.

2. When I point out that I have a lot of these numbers to remember, they recommended changing all my PINs to the same number.

3. When I pointed out the dangers of PIN-sharing, they recommended writing my PINs down so that I'd always have them to hand.

Anything, it seems, rather than keep their promise to let those who have difficulty with Chip 'n PIN have Chip 'n Signature instead.

AFAICT, the reason why they don't want you to authenticate your transactions by signature is that it's much, much harder for you to show that a transaction was fraudulent if it was PIN-authenticated. This effectively shifts the liability for fraud away from the banks and towards the card holder. AIUI all they need do to avoid paying up is claim that you'd made an unauthorised disclosure of your PIN; it's then up to you to prove that you didn't.

I don't know where I can go with this. I really have had enough of wasted shopping trips (i.e. having to leave my shopping at the store because I've locked my card and thus can't pay for it) and the embarrassment of having a filling station owner called to the premises and the police confirm my name and address from the DVLA database before they'd let me sign for the fuel I'd put in my tank. Cheques are about to disappear and some establishments will no longer take cash - which leaves only cards.

So I wonder whether the banks actually do care about anyone else's security other than their own.

lisyloo

Why do you have so many 4/6 digit numbers to remember?
Could you use just one or two cards?
If you are using it almost daily then would you be able to remember two numbers?

I do appreciate the problem.
My MIL is 83 and is getting to the stage of leaving taps on and leaving things in the oven.
She wrote down 3 PIN numbers on a piece of paper in her purse and I had a fit when I saw it.
I don't know what she has done about it (I made a few suggestions), I must check.

Rexroth

I am disabled with dyslexia and under the DDA have signiture cards.

ironlady2022

I've never heard of chip+signature cards and I doubt they will bring it in anytime soon. It's a case of accepting it and trying to remember. For me I jumble them up and write it down or you can draw a picture which represents a number so it's less obvious. No point of fighting against it if this is the norm. If you cannot remmeber your pin, then you can do face to face banking, a little inconvenient but at least a solution.

redpete

GeoffL wrote: »

1. They suggest that I should change my PIN to something more memorable

resonable suggestion

- like my birthday.

daft suggestion, it should be memorable to you and no easily guessed by someone else (someone who knows or could find out your birthdate for example). I use part of an old employee number from a previous employer that I memorised many years ago and haven't used for real for almost as many years.

2. When I point out that I have a lot of these numbers to remember, they recommended changing all my PINs to the same number.

that makes sense

3. When I pointed out the dangers of PIN-sharing,

if one is broken then they are all broken, but if it's secure then this shouldn't be a big problem, or modify it for each card by changing one digit in a way that is easy to remember, e.g. to the number of characters in the card isuer's name, or the third from last number on the card

they recommended writing my PINs down so that I'd always have them to hand.

that's so stupid I find it hard to believe any card issuer would seriously (or even jokingly) suggest it.

So I wonder whether the banks actually do care about anyone else's security other than their own.

Probably not, although they do like to be seen to be doing something about their customer's security.

However I don't blame them for moving away from such a vulnerable method such as card and signature.

GeoffL

@lisyloo: Not only credit cards use these numbers. I have to deal with a mix of personal and business credit and debit cards, vehicle security codes, mobile phone PIN codes, door access codes, web site PINs, etc. I probably have a couple of dozen of these things to remember, and must not only remember the numbers but also which number applies to what.

@Rexroth: Unfortunately, my issue doesn't count as a disability under the DDA - I did ask before they wound up the Disability Rights Commission. I've heard that anyone should be able to ask for a Chip 'n Signature card on the grounds of disability and it would be against the DDA for the provide to ask for specifics. Unfortunately, the card for which I most need C'nS is my company debit card - and my bank knows that what I do for a living is incompatible with dyslexia or severe memory loss.

The issue for me is that I rarely use the card with which I have most problems for 'PIN-required' transactions. Mostly, I use the card for on-line purchases and so I just don't use the PIN often enough for it to migrate to long-term memory. Rarely used = easily forgotten.

Now IIRC when they announced Chip 'n PIN, APACS promised that anyone who had difficulty with with PINs could have Chip 'n Signature. OK, you wouldn't be able to use C'nS cards in ATMs, but at least you'd have something you could use for on-line shopping and EPOS. However, they very quickly suppressed information about C'nS and now it seems that you need to produce representation from a registered charity in many cases before you can get one. FWIW, until recently my wife was the registered manager for a residential home for the visually impaired. Even though it might seem obvious that someone with severe sight loss would have problems with using a PIN, she (as advocate) sometimes had to fight to get banks to see sense.

@mayling03: Face-to-face banking isn't really the answer. Banks aren't open at times when some people can get to them. Also, it's not much help if you live miles from your bank. Notwithstanding that, there is now a tendency for some businesses (e.g. filling stations) to not accept cash or cheques - which means that you have to use a card or not buy there. Perhaps cash-cards might be an alternative ... except that they tend to be Chip 'n PIN also :wall:

sharpy2010

I use the same PIN number for all 12 of my cards. Its just as secure as using different PIN numbers for all my cards, since only I know what that 4 digit number is.

Another solution is to use the last 4 digits of your card number as your PIN. People say this isn't particularly secure, but I doubt its much less secure than anything else. That way, when you come to buy your petrol, or goods, or anything else, a quick look at the last 4 digits on the card will remind you of the PIN.

Not sure what everyone else thinks of this method?

GeoffL

redpete wrote: »

However I don't blame them for moving away from such a vulnerable method such as card and signature.

FWIW, Chip 'n PIN is probably more vulnerable than Chip 'n Signature. See www DOT vigay DOT com/misc/chipandpin DOT html (sorry, the system won't let me post a link) for Paul Vigay's argument from 2005 against the system.

That said, another reason why I question whether the banks care about security is the Mastercard phone menu I had to navigate to speak to someone today about my account. I meant to include this in my OP but forgot. Before I could get to speak with an operator, their system asked me to key in three pieces of information:

1. The 16-digit card number
2. My date of birth
3. The CVV number on the card

Er... there's no way that I'm going to disclose my card number and the CVV together over an insecure medium like the telephone system. So I hung on until the system decided it couldn't understand my CVV number and passed me on to an operator anyway. BTW, this is the third time I've contacted their CS by phone - and the checks seem the same each time.

sharpy2010 wrote: »

I use the same PIN number for all 12 of my cards. Its just as secure as using different PIN numbers for all my cards, since only I know what that 4 digit number is.

There are a lot of ways that fraudsters can use to get your PIN. Thanks to Chip 'n PIN it's now easier than ever. Since each retailer must provide their own reader and there's a huge variation, you never know for sure whether that device into which you've just keyed your PIN is actually kosher. Wireless devices are particularly problematic, but even wired devices can be compromised. Now the chip makes it more difficult (but not impossible) to clone cards, so in most cases they'll also attempt to get hold of your cards (i.e. your wallet or purse). They know that many people PIN-share and so they try the PIN they've harvested with all the other cards they've stolen from you. IOW, if you become the victim of such fraud, your PIN-sharing puts you in line for 12 times the pain.

ironlady2022

I think you are only making it hard for yourself. You have said face to face banking is not feasible, less and less places are accepting cheques plus it will die out within a decade any way. You say you HAVE to remember website codes and door access codes, make this ia necessity too as the ONLY way to access your cash is
a) via an atm using a pin code
b) cashback from supermarket using a pin code
c) post office withdrawals, again using a pin code.

If you don't use it often then try using it all the time, I don't think it's too hard remembering a 4 digit pin for something so important. And to be honest you are only embarrassing yourself by typing it in 3 times, having your card blocked and reissued by the bank again delaying the proces and you end up with a new pin to remember anyway.

someone

sharpy2010 wrote: »

Another solution is to use the last 4 digits of your card number as your PIN. People say this isn't particularly secure, but I doubt its much less secure than anything else. That way, when you come to buy your petrol, or goods, or anything else, a quick look at the last 4 digits on the card will remind you of the PIN.

It would be better if you mixed some sort of personal number in there. For example the first two numbers been the same for all pins then the last two are the same as the last two digits on the card.

tyllwyd

If you have so much trouble remembering all your PINs why not simplify your finances and get rid of some of your cards, so that you have fewer to remember and you will use those ones more often?

Or how about using the kind of memory trick that magicians use - take your cards and associate say an animal with them, and then use that to remember the pin - maybe your BarclaysMastercard could be a dog barking the number at you. I never got those kind of memory tricks to work, but maybe you could? Or have something like something based on the card number, so if the first four digits were 1234, your pin for that card would be 2345. There must be creative solutions to the problem!