HSBC Bank Fraud - Chip and Pin - Unknown Transactions

Samy12

sausage_time said:

There are no credible accounts of Chip and PIN cards being cloned.  There are some anecdotal reports of Chip and PIN "relay" attacks, but those rely on the PIN being entered into a compromised or fake terminal (and that data being transmitted to a live terminal). 

@Samy12 when did you last use these cards as Chip and PIN (not contactless or mobile) in relation to the fraudulent transactions?

I normally don't use the debit card at all. Normally i use the credit card for most transactions. Its a lesson learnt to freeze cards, not carry them if you don't actively use them.

The only other thing is they somehow guessed the pin. I just don't understand how.

Isthisforreal99

Samy12 said:

sausage_time said:

There are no credible accounts of Chip and PIN cards being cloned.  There are some anecdotal reports of Chip and PIN "relay" attacks, but those rely on the PIN being entered into a compromised or fake terminal (and that data being transmitted to a live terminal). 

@Samy12 when did you last use these cards as Chip and PIN (not contactless or mobile) in relation to the fraudulent transactions?

I normally don't use the debit card at all. Normally i use the credit card for most transactions. Its a lesson learnt to freeze cards, not carry them if you don't actively use them.

The only other thing is they somehow guessed the pin. I just don't understand how.

Is the PIN the one that came with the card or have you changed it at some point? If you changed it hopefully nothing obvious like a DOB that a fraudster could get through social media or similar?

[Deleted User]

Sometimes there can be card fraud without your card being touched. I had it happen on a brand new card. 

Isthisforreal99

[Deleted User] said:

Sometimes there can be card fraud without your card being touched. I had it happen on a brand new card. 

Chip and PIN fraud? 

MyRealNameToo

spenderdave said:

I also cannot believe it was chip and pin directly in the gym. But is there a possibility they had somehow created a cloned card and used that for the transactions?

There has been no proven case of chips being cloned outside lab settings, the chip contains more than just the card details. It includes a 1948 character key, it doesnt share that key ever but instead uses the key to encrypt certain data. Trying to reverse calculate what the key is (without use of a quantum computer) is exceptionally difficult.

Relay attacks only work on low value transactions 

brianposter

Why do you suppose that the transactions needed a PIN ?

sausage_time

brianposter said:

Why do you suppose that the transactions needed a PIN ?

The very first post notes that HSBC states that they were chip and PIN.

brianposter

So the question is whether HSBC are to be believed. I seem to remember previous discussion about the validity of the way transactions are recorded.

Samy12

brianposter said:

So the question is whether HSBC are to be believed. I seem to remember previous discussion about the validity of the way transactions are recorded.

I am hoping that is the case. I can raise a complaint/appeal. I am still waiting for hsbc to send the letter which confirms the no refund & the fraud customer service said it should also have details on how to appeal. I m not sure how the Financial Ombudsman works - if I would need to do the appeal first or go straight to fos.

eskbanker

Samy12 said:

brianposter said:

So the question is whether HSBC are to be believed. I seem to remember previous discussion about the validity of the way transactions are recorded.

I am hoping that is the case. I can raise a complaint/appeal. I am still waiting for hsbc to send the letter which confirms the no refund & the fraud customer service said it should also have details on how to appeal. I m not sure how the Financial Ombudsman works - if I would need to do the appeal first or go straight to fos.

You need to have gone through HSBC's complaints process first and can escalate to FOS once eight weeks pass or you get an unsatisfactory final response, whichever is first.