Dads bank card cloned

JuicyJesus

matttye wrote: »

Definitely sounds like it should be an opt-in feature then. Not everybody travels abroad, so would benefit more from a more secure card!

Well, quite. I never go abroad, but I do use ATMs.

It's bizarre that people moan about contactless security when a) transactions through contactless are value limited, unlike the strip b) contactless' card data is encrypted, unlike the strip and c) it'd very hard to harvest large amounts of card details quickly with contactless, even if they weren't encrypted, due to technical limitations, unlike the strip.

So we have the situation where a newer and markedly more secure technology is campaigned against but one that has been a wide open security hole for decades is broadly ignored.

reclusive46

You've also got to remember you have a magnetic stripe on the card for fallback transactions here in the UK. So if the chip reader is broken or the chip on the card is broken you can still pay.

Also things like the M6 Toll and BT phone boxes (If anyone actually uses them) still read the magnetic stripe. Occasionally some ATMs read the magnetic stripe as well, normally if the reader is dirty or if the ATM is really old.

matttye

JuicyJesus wrote: »

Well, quite. I never go abroad, but I do use ATMs.

It's bizarre that people moan about contactless security when a) transactions through contactless are value limited, unlike the strip b) contactless' card data is encrypted, unlike the strip and c) it'd very hard to harvest large amounts of card details quickly with contactless, even if they weren't encrypted, due to technical limitations, unlike the strip.

So we have the situation where a newer and markedly more secure technology is campaigned against but one that has been a wide open security hole for decades is broadly ignored.

I agree - don't see the big deal about contactless. Can only use £20 at a time and it asks for a PIN every few transactions anyway.

I like the idea of mobile NFC payments the most though, as this combines contactless with a PIN, as NFC won't work unless you unlock the phone and the screen is on. Seems like the most secure and convenient option to me - although I admittedly don't know that much about the whole thing.

alanq

matttye wrote: »

Can only use £15 at a time

It has been £20 for over a year.
http://www.bbc.co.uk/news/business-18265388

spacey2012

There is a research paper on line that shows how a student was able to defeat the security of chip and pin terminals with a safety pin, 50p of wire, some sticky tape and a PDA hand-held device, he was able to obtain enough information and the pin number to copy the card.
The paper is still on-line.

JuicyJesus

spacey2012 wrote: »

There is a research paper on line that shows how a student was able to defeat the security of chip and pin terminals with a safety pin, 50p of wire, some sticky tape and a PDA hand-held device, he was able to obtain enough information and the pin number to copy the card.
The paper is still on-line.

So you mean if you physically interfere with a chip and PIN reader then you can get information that it processes out of it?

That's not "defeating the security of chip and PIN". That's hacking a terminal.

Gromitt

JuicyJesus wrote: »

So you mean if you physically interfere with a chip and PIN reader then you can get information that it processes out of it?

I think if I noticed the CnP reader has some wire dangling from it and going into an PDA, I'd be very concerned and decide not to use that particular terminal.

grumbler

What if this extra wire is hidden in the main cable (replaced)? Obviously the above setup was supposed only to demonstrate the possibility.

That said, all this is OOT again as the chip cannot be cloned apparently even if you get the PIN and 'information'.

JuicyJesus

grumbler wrote: »

What if this extra wire is hidden in the main cable (replaced)? Obviously the above setup was supposed only to demonstrate the possibility.

That said, all this is OOT again as the chip cannot be cloned apparently even if you get the PIN and 'information'.

The PIN is completely irrelevant in this context anyway, since it's not the PIN you're after. Fraudsters want the PIN in the same way car thieves want keys.

brutus1983

Wywth wrote: »

Depends. Normally he'll get the money back, but if the bank discover he was involved in the fraud and/or negiligent in protecting his details, they may not.

How does your dad think his card could have been cloned?
More importantly, how does he think anyone else could have obtained his PIN.
Why doesn't he register here and ask himself?

Becuase he didn't withdraw the money
He doesn't know but anythings possible
Not everybody has an interest in signing up to online forums