Chip & PIN transaction goes through unverified

Missme

Just wanted to share something - hope this is the right place.

I have a bog standard chip & PIN debit card that I have used in my corner shop countless times. Although, I have just this month received a new card that has been used there a few times.

Yesterday, the transaction process, on the little terminal, did not ask for my PIN. When the receipt came out it didn't say "Verified by PIN" at the bottom so the shopkeeper and I both assumed it hadn't gone through and did the transaction again. Definitely wasn't a receipt for a signature verification.

Spoke to the bank today as both transactions have been debited - they are mystified! They suggest it may be a problem with the new card (so will send me another) or an issue with the terminal itself. Both are possible, I suppose, but I'm more concerned that the transaction could go through at all, so they are going to investigate that.

I have been a victim of fraud and got my money back after a long wait. However, I have a couple of friends who have been denied refunds because the bank insisted they must have revealed their PIN. Not quite as cut and dried as the banks like to make it seems.

Anyone else experienced this?

InsideInsurance

Does the shops terminal have contactless reader? Is your card contactless enabled? It'll have a logo like :

If you put it into the card reader it shouldnt pick up the contactless but the same thing gets printed at the bottom of my receipts when I do use contactless payment.

Missme

Nope, InsideInsurance, just the basic 'shove it in, use your PIN'-type card. Terminal isn't contactless either.

Gromitt

I've had it happen before, just put card in and it said "Approved" and I removed the card.

The cost was under the shops floor limit, so they were basically assuming the transaction would go through and willing to accept the chargeback if it was fraudulent, knowing that most cases will not be and that it'll speed up the checkout process.

This was with a credit card though, but the same could happen with debit I would assume.

So it would seem to be three levels of authorisation:
(1) takes ages (well, seems like ages, more likely about 8 - 10 seconds, but some times can take 30+ seconds). I assume this is full auth.
(2) asks for PIN, but then approves instantly, seems to be for lower value stuff
(3) doesn't even bother asking for PIN, again only seen it for lower value stuff. I shove card in, it comes up "Mastercard", then the amount, then "Approved". This one is a lot more rare than (2)

BaxUk

As indicated by Gromitt, most likely under the floor limit and so authorisation would not be requested at the point of sale.

pqrdef

The PIN check is a separate issue from authorising the payment. The PIN is on the chip and it's the chip itself that decides whether you get asked for it. On new cards the chip may be programmed to let a random number of small transactions go through unchecked before it decides to check that you're still you.

reclusive46

pqrdef wrote: »

The PIN check is a separate issue from authorising the payment. The PIN is on the chip and it's the chip itself that decides whether you get asked for it. On new cards the chip may be programmed to let a random number of small transactions go through unchecked before it decides to check that you're still you.

I doubt an issuer would be doing that. Its more likely that when the chip and EMV chip reader were comparing their list of CVMs (Card verication methods) an error occured and the only option the terminal would have had was no CVM.

dtaylor84

reclusive46 wrote: »

I doubt an issuer would be doing that.

Why not? It's just as secure as contactless.

Gromitt

reclusive46 wrote: »

Its more likely that when the chip and EMV chip reader were comparing their list of CVMs (Card verication methods) an error occured and the only option the terminal would have had was no CVM.

In which case the transaction would have been aborted with an error, rather than just being processed as normal minus the PIN verify ?

It's still more secure than the "swipe and walk away" method which other countries use and will have a transaction limit just like contactless.

System

They do it in the States.

Mostly with swiping but a few places had chip readers and didn't ask for a pin.

reclusive46

Heng_Leng wrote: »

They do it in the States.

Mostly with swiping but a few places had chip readers and didn't ask for a pin.

Thats the no signature program. They might well have chip readers but they are not enabled and still swipe them through. So it came under no signature swipe program. You'd have to enter your PIN if it was inserted (Only a few places have their EMV machine enabled). If you insert your card in most USA machines it will just say "Error, Swipe card".