PIN codes, and remembering them!

Richard@chipnpin

I did a few calcs which may be of interest:

The odds of guessing correctly:

a random 4 digit number sequence, are 417:1.

a PINSAFE KEY number, are 14,950:1

Not perfect, but at least the odds are in your favour.

Richard@chipnpin

Galstonian

BUT, as from January 2005, the retailer will bear the risk if a transaction is accepted on signature, and later turns out to be fraudulent.  So from January 2005 most retailers will INSIST on you entering your PIN to authorise the transaction for any purchase.  

BUT all card issuers will still issue Chip and Signature cards on customer request now and after 2005. When these are used the system will not prompt for a PIN and a signature will be requested instead. AFAIK a retailer cannot insist you enter a PIN in this case. The Chip and Signature cards are intended for those who have difficulty using PINs (someone who is blind is the usual example) but I would argue that if you have difficulty using 10 or 12 PINs then you "have difficulty using PINs" and should request these cards.
As such, I think it is a little misleading to say that from 2005 you have to use PINs since that is not strictly true.

I completely agree with the idea that with CnP some kinds of fraud will be more difficult and as such should be less likely to occur, my concern is just that if and when it does occur it is the customer who suffers.
The burden of proof seems to move to the cutomer. If a fraudulent transaction is posted using a CnP card the retailer cannot be at fault since a valid PIN was used, will the card issuer simply pick up the tab or will they (which seems more likely) argue that the customer must have disclosed the PIN number and refuse to accept that the system is fallible?
On the CnP thread last years fraud figures were just posted and disturbingly the increase in fraud through things like intercepting mail and customer not present (internet, mail order, telephone) transactions is far greater than lost, stolen or cloned cards.

This is not a sleight against your device which I have not seen and can't really comment on.

juno

I have a feature on my phone (Sony Ericsson T610), where you can store your PIN numbers. The PIN number to access that I remember by what word it spells (no, not my name), and then a preset word is flashed on the screen and it shows your PIN numbers. If the wrong code is entered, it will flash up any random word, and show fake PIN numbers!

And when I enter my PIN, I always shield the key pad with my other hand!

Galstonian

Here's a challenge, I'll bet anyone £50 that if I give them a PINSAFE AND the PIN for that card, they will not be able to work out the PIN for any other card which uses the same system. Any takers e-mail me from the website, and have your £50 ready to pay me.

If you are so confident then why not simply make this a challenge rather than a bet? You obviously know that few people will stake £50 but you want them to stake the value of everything that is protected by their PINs.

I'm sure such a scheme would garner some good publicity and provide some valuable real life testing too.

Richard@chipnpin

Galstonian raises some interesting points, but I believe he/she is misinformed.

I have spent some time talking with major retailers who participated in the chip and pin trials in Northampton, and with the offical chip and pin organisation. Their website is https://www.chipandpin.co.uk - you should have a look.

Imagine you are a retailer - if you accept a PIN code as verification, you do not carry risk if the transaction is fraudulent. If you accept a signature, from Jan 2005 you DO carry the risk if there is a fraud. So what are you going to do? If it were me, I would only accept a signature if it were accompanied by a passport or photo driving licence. I would always accept a PIN code. - No risk to me....no hassle to the customer - if he knows his PIN code.

Quote from the chip and pin initiative at https://www.chipandpin.co.uk "Will my new c&p card still need to be signed?......Yes. This will still be necessary, as the signature will continue to be used for verification in certain situations (e.g. travelling abroad to a country where chip and PIN is not used / where retailer has not upgraded to chip and PIN / where the card is used as a cheque guarantee card)"

Galstonian, chipnpin is not just a clever idea thought up by the banks, there is a lot of government involvement in this. quote from http://www.crimereduction.gov.uk/ "By January 2005, PIN rather than signature will verify the majority of all face-to face plastic transaction made in the UK."

It may be that banks have been slow getting cards out, and many retailers may not have got their act together, but be under no illusion, with the retailer carrying the risk of fraud, it won't be long before everyone gets the message. And it all starts January 2005.

Hope this clarifies the situation.

Richard@chipnpin

Richard@chipnpin

Galstonian, again

Boy you really have it in for me (why a bet, not a challenge?)

Simply because there are odds, PINSAFE cannot be 100% safe, nothing is.

Odds of me getting your money if I know your PIN code? 100% guarantee

Odds of me guessing your PINSAFE code if I know your PIN? About 80:1 depending on setup.

======================================

Odds of me guessing your PIN code blind? 417:1

Odds of me guessing your PINSAFE code blind? 14,950:1

You work out what's safe.

I suggest that as you haven't seen PINSAFE so don't know how it works, we wait for Martin's road test. Then you can either trust his judgement, or go your own way.

Richard@chipnpin

COS

Many postings ago I made the point that Chip and Pin has been around for twenty years in Europe, whats the big deal. Also I note the card which stores your pins holds three codes only, so are we going to have several of these and where do we store the pins for these. Now I have contradicted myself as I am getting concerned about Chip and Pin

Woby_Tide

is anyone able to actually provide an explanation of how this device works as from what I said earlier the website didn't offer many clues.

It somehow involves a sticker being put on your card with a word on it? Which you then have the pin safe(which is?) that has in it the same word and next to it the pin number?

student100

Personally I have no problem remembering numbers (I could reel off a list of dozens of phone numbers, PINs and other numbers if you wanted me to). So I'm not going to say anything about how useful or not a device that might help you cope with large numbers of PINs is, but I will say the following:

Looking at that website, it looks decidedly dodgy. The pages are all titled "Untitled Document" (a schoolboy error). There are no actual photos of the product or descriptions of what it is or how it works. The site uses Paypal (very amateurish) and the only contact is a PO box address and an email address - not very reassuring. The whole site seems to remind me of those dodgy adverts in the back of tabloid magazines. Personally, I wouldn't touch it with a bargepole, let alone hand over my credit card number.

Be warned.

...also, just noticed that the person who started this thread has only posted 3 times on the site. Reading the first post of this thread again, I get the impression that they may be infact a "close friend" of the operator of the chipnpin site, if you get my drift...

Galstonian

Galstonian raises some interesting points, but I believe he/she is misinformed.

...

Hope this clarifies the situation.

No, not really. But then you didn't really say anything which is very like the chipandpin website - very short on real facts and quite long on hyperbole. Strange that you mention this is in conjunction with the government - not like them to spend money on a solution to a problem only to find that it doesn't work.

Please just answer this. If after CnP is introduced a transaction appears on my account which I dispute and it transpires that it was accepted with a valid PIN, who will be responsible for the loss? Cetainly not the retailer. What is to stop the card issuers simply saying that you must have disclosed your PIN and are therefore responsible? The T&C that come with CnP certainly leave that option open to them. At least with a signature there was some kind of audit which you could point to to say "That wasn't me". That does not exist with this system.

The "benefits" of CnP do seem to be becoming more obvious - it attempts to shift responsibility for accepting lost or stolen cards from the retailer and card issuer to the consumer. Meanwhile, if it does anything it offers the potential for a huge increase in the some of the fastest growing areas of credit card fraud. If everyone needs new cards and PINs then the postal system suddenly offers some very rich pickings.

http://forum.moneysavingexpert.com/cgi-bin/yabb/YaBB.cgi?board=Questions;action=display;num=1082327540;start=183#183