Chip and Pin Fraud
 

Just seen Tonight with Trevor McDonald about Chip and PIN fraud.

Pretty harrowing, the magnetic strip is pretty vulnerable :o and the system's nowhere near as safe as common perception. And the woman on there from the banking association or whatever it was, was so f*cking naive it was untrue.

Anyone else see it / have an opinion about it?

Re: Chip and Pin Fraud
 

no system is going to 100% safe to be fair , where there is technology , someone will crack it :disturbd:

Re: Chip and Pin Fraud
 

Well we had it on in the background but didn't really watch it - but I did hear the bit where they said that now the banks will blame any fraudulent use of the card on the card owner, as they seem to think the 'chip and pin' system is foolproof! And yet they had several customers on the programme whose card details had been used fraudulently.
It seems we will still need to be vigilant!

Re: Chip and Pin Fraud
 

hang on ... whats that about the magnetic strip ? ... i thought that was being replaced by the chip! Sorry I missed the show.

Re: Chip and Pin Fraud
 

I think they still form an integral part of the card - and of course there's always internet fraud for those pc users who won't be bothered to protect their pc's!
One woman even gave out all her security details over the phone to someone who said they were from the bank! :Yikes: No amount of security measures will ever protect some members of the public I think!

Re: Chip and Pin Fraud
 

aahhhhhhh .... i see. yeah, remote transactions are inherently insecure. all that can be done is to make it as difficult as possible for newbie fraudsters. then of coarse theres always the moron thay actually writes his PIN on his card (yes it happens) !!!!

Re: Chip and Pin Fraud
 

Yes I saw the program. And yes while the magnetic strip stays on the back of credit/debit cards,the criminal will always be able to circumvent the chip.
You can see how easy it was with the right equipment. Take away the magnetic strip and make all cards chip read only and also the shop readers chip read only.Then it would be a lot safer. But that is years away. Until that time you have to be vigilant. I always cover the shop chip readers with my hand as I put in my code. And don't give your security info to anyone on the phone. Banks never ask for this info at all. Especially on the phone.

Re: Chip and Pin Fraud
 

I do (or my wallet, coat, or anything I have).

How naive was that banking woman though?

Re: Chip and Pin Fraud
 

i have just been shoping and no shop is doing chip and pin they all are asking you to put you name down like back in the old days . i did ask why and all i got wos " do not ask you would never use your card if you did " any one know an thing about it ??

Re: Chip and Pin Fraud
 

The RSA encryption method is 100% secure, ...well one can crack it but it will take 100 years or so to get the answer (the decoding time depends on the number of bits used for the encryption)

Re: Chip and Pin Fraud
 

How can it be secure if they've already cracked it?

Re: Chip and Pin Fraud
 

2 out of 3 transacttions can be done with Chip and Pin. If retailers do not upgrade, they will will have to pick up all fraud costs (from early next year...)

see http://www.chipandpin.co.uk/reflib/d...ardholders.pdf
__________________

Suppose that you encrypt your pin with RSA and you put the encrypted version on the web.

The faster computer or supercomputer or cluster of computers will take over 100 years to crack it (128 bit encryption). So in 100 years everyone will have your pin. Do you care if this happens?

In fact 200 digit encryption requires billion years to crack

Re: Chip and Pin Fraud
 

And don't forget you can change your pin anytime. Usually by going to a cash machine or by phoning the bank to send you another one.If you go to a cash machine, an indoor one preferably, you can choose which pin you want.

Re: Chip and Pin Fraud
 

There was another program, where the "hacker" read the stripe from a "chip and pin" card, used a program to reset the "chip & pin" bit and then wrote it to the stripe on another plain card.

Card + pin (no chip) worked perfectly.

The chip itself, is a whole new ballgame for security, but at the moment, it can be 100% BYPASSED!

Re: Chip and Pin Fraud
 

1) At present.

2) It's much easier to simply "shoulder surf" someone's number and then steal their card when they leave the shop.

Re: Chip and Pin Fraud
 

But basically chaps trust no one, when you use these things, I do not like them at all. Whats going to be next brain scans???

Re: Chip and Pin Fraud
 

Paranoid as I am, I think this was always a prime motivation for the banks.

Re: Chip and Pin Fraud
 

Hey the amount of times I have gone overdrawn and the bank has done nowt!!!!

Re: Chip and Pin Fraud
 

That's not being paranoid, that's realistic, of course the banks are going to develop a terminal case of extreme sloping teflon coated shoulder.

Re: Chip and Pin Fraud
 

nothing is fool proof when are these people going to learn!!!!

Re: Chip and Pin Fraud
 

So they're after you as well?!!

Re: Chip and Pin Fraud
 

hey tell me about it!!!!! everytime I go to the cash point I am paranoid!!!!

Re: Chip and Pin Fraud
 

i think chip and pin is good but it is a waste of time as the fraudsters will now just surf ya shoulder to get your number. The real way foward is to insert a picture of the user onto the card like the drivers license
__________________

ohh yeah and if someone surfs ya shoulder you have my permission to headbut there head :p:

Re: Chip and Pin Fraud
 

My picture is on my Royal Bank of Scotland Switch card. It used to be on my RBS Mastercard as well, but they took it off the last time I got a new one with a chip (before chip & pin though).

Re: Chip and Pin Fraud
 

At Tesco's checkout the other day:

Customer presents debit card to checkout girl;
Check out girl: "do you know your PIN madam?"
Customer: "Yes, its blah, blah, blah, blah...................... "

*$£!"** * !!!

Re: Chip and Pin Fraud
 

Prat. (Soz, I've had a bad day)

Re: Chip and Pin Fraud
 

And it is much easier to steal someones car keys / finger than it is to steal their car. Security slows the problem down / moves it around.
Personally the biggest joke of C&P that I have found is that I can now easily use (with her permission) Mrs H's Debit cards as if a retailer finds you know the pin on a card they don't bother to look any further at it. So this week I have used her DR card at the post office to pay some excess postage and on Saturday at the local curry house to pay for dinner. At the moment for C&P to work the retailer has to swipe the card and wait to be told to C&P it so they both had the cards in their hands and if they looked at it they would have clearly seen the card said Mrs.....
If they cannot be bothered to look at the name printed on the card they won't bother to look at a picture. Also in time the card will not leave your posession (to prevent cloning), so they will have even less of a chance.
Early this year actually.

Re: Chip and Pin Fraud
 

At Tesco's checkout on Saturday ... I went to put my shiny new chip'n'pin card in the reader and the girl said 'it's alright, I'll do it.' She took the card, swiped it in the old fashioned way, and then asked me to use the keypad to enter my PIN.

What's the point in having uncrackable chips if even the shops that have installed the readers are still telling their staff to swipe the card? As we were embroiled in a cloning incident last year (in which some unscrupulous shopkeeper double-swiped Mrs T's card, paying for the transaction with the first swipe and copying all her details with the second), I am personally very keen to see the magnetic strip banished from all cards as soon as possible.

Re: Chip and Pin Fraud
 

The system as it currently stands in the UK requires the retailer to swipe the card. The card will then tell the retailer it is C&P and require it to be put in the C&P reader. Then you either input your pin, or tell them you are a dozy muppet and don't know it at which point they press more buttons and you sign a paper chit again.
This is where the guy in post 14 comes in and reprograms the mag strip to remove the flag that indicates the card is C&P, no flag the transaction progresses as a sig only transaction (legacy card).
In time - 2006? - the sig / no sig flag will be ignored and all transactions will require C&P if the card has a chip on it - If you don't know your PIN you will need to find an alternate way of paying.

Re: Chip and Pin Fraud
 

In Argos this weeken, my wife was paying for something & because thier C&P system was down, they had to use a signature.

Because the signature was not 100% exactly the same (who's ever is?) the girl on the till had to go & see her manager to have it verified.

We was not pleased about that!

Re: Chip and Pin Fraud
 

You should be. It means that she was actively checking, and had somebody else presented your card, they probably wouldn't have got served..

This is similar (although not exactly the same) to something that happened when I bought a fridge. The cashier entered my name slightly incorrectly (she put a space where she shouldn't). The cash register refused to authorise my card. I spoke to the bank to clear it up, and it took quite a while to sort it out. I was happy, however, as it proved that their security systems worked.


That is one problem with C&P. Retailers will not be checking things like signatures, and a pin, being 4 digits, should theoretically be easy to crack.

Re: Chip and Pin Fraud
 

Personally I'd have been very pleased that at least the retailer was taking sufficient care to actually bother to *check* that the sig matched!

Re: Chip and Pin Fraud
 

Me too :rolleyes:

No harm in being vigilant.

Re: Chip and Pin Fraud
 

I think Tesco have a chip reader at the bottom of their till swiper. I think they do this to speed up the transaction as it both swipes the card and reads the chip in one go. The fact that you entered your PIN proves that the chip was being used as it does not work with the magnetic strip.

I have lost count of the number of times I have taken my non-Chip&PIN card to a store where they have put it in the Chip&PIN machine and after about 30 seconds it beeps and says "Invalid Card" so they then have to swipe it - at Tesco it always works first time.

Re: Chip and Pin Fraud
 

It also enables say a Tesco Visa card to be read as 1. The clubcard (magnetically) 2. The C&P payment card (chip).

Re: Chip and Pin Fraud
 

Even though my credit card has a chip, it's not c&p enabled. My local Safeways always put it in the card reader and it works okay, with me having to sign. :shrug: It might just be their system.

Re: Chip and Pin Fraud
 

I have two different cards, one old one not chip & pin, and a newer one that is chip & pin
At my local Asda, for the past couple of months (at least) all I do is pop the card into the chip & pin reader.
If I use my C&P card, it asks for the pin, if I use my older card, the paper receipt to sign is automatically printed, they don't swipe the cards at all, even if I hand my card to the cashier they put it in the C&P reader.


But I fail to see how a 4 digit number on its own, can be any more secure/insecure than signing, surely it's so much easier to watch someone taping 4 numbers than trying to copy a signature.

Yes, my older card does have a chip on it, but it's not C&P

Re: Chip and Pin Fraud
 

You can't use a C&P card you have stolen unless you first watched the person you intended to steal it from, use the PIN at a cashpoint or in a supermarket. Most stolen cards are stolen along with carelessly carried purses, wallets or handbags by opportunist thieves who have not first 'shoulder surfed' to acquire the PIN number of any card that might be inside. Those cards are, under a C&P regime, useless to the thief. Unfortunately during this transitory phase even new C&P cards still have strips and signatures, so can still be used at any shop where the thief can persuade the retailer to let him sign instead of use his PIN.

Re: Chip and Pin Fraud
 

Rubbish!! The pin isnt stored on the magnetic stripe
__________________

They do that as M&S too apparently

Re: Chip and Pin Fraud
 

I didn't think the card needed to be swiped if c&p was used. I thought the chip was read. I know that Tescos (and Sainsburys) both stick the card in a card reader at the bottom of the swipe-card slot on the tills though.

Re: Chip and Pin Fraud
 

I have seen retailers asking for photo ID when people cannot remember their PIN and ask to sign.

Re: Chip and Pin Fraud
 

No - but the flag (single bit 1/0) that the card is C&P can be changed so the fraudulant user is not asked to use a pin number, but sign instead.
__________________

As their liability for fraud is now significantly increased.

Re: Chip and Pin Fraud
 

It was used in a cash machine, I saw the program too, I think it was shown on ITV London on a Thursday evening.

Re: Chip and Pin Fraud
 

Yup, what would have happened is the card would have been cloned, and the new strip would have had the "I've got a chip" flag removed, so when it was swiped, the card reader would have assumed it's an old non-chipped card.


Strange how some people appear to be against chip and pin and feel it will increase crime, when it's made a major impact into cutting card fraud/crime in other countries.

Re: Chip and Pin Fraud
 

Cards with magnetic strips have been used in cash machines for a number of decades without needing the PIN to be stored on the strip.

Re: Chip and Pin Fraud
 

A symptom of 'Agenda Journalism', which is something we suffer a lot of in this country. You choose your standpoint on an issue, then go and compile a report that supports it, while glossing over (or ignoring entirely) anything that doesn't.

I saw the edition of Tonight with lots of journalists and the odd cameo by Trevor McDonald in question, and I was appalled by the shoddy standard of journalism. The woman being interviewed was pointing out that the so-called deficiencies of Chip and Pin are actually deficiences in the old swipe-and-sign system that has to run in parallel during the changeover phase, but the hack was clearly only interested in pursuing the pre-agreed editorial line, that 'this chip and pin thing isn't all it's cracked up to be'.

Bizarrely, they backed all this up by demonstrating how easy it is to clone a card, not by copying the chip but by *swiping* it. The logical fallacy in question here is, I believe, the Straw Man.

Re: Chip and Pin Fraud
 

But such cards cannot be used off line. A C&P card can be charged (dependant upon the retailer) an amount withouth need for authorisation (below floor limit transactions).
If an ATM cannot contact the mothership then you cannot use the machine. If a C&P card cannot or need not contact the mothership then you can still have the transaction.

Re: Chip and Pin Fraud
 

I was just confirming that the program was on, not the legitimacy of any of the facts presented :)

Re: Chip and Pin Fraud
 

But that is the point.

The woman was saying that there were no deficiencies in the new C+P cards- which, as they have the strip still, are prone to the same problems as non-C+P cards in that all the data may very well be encrypted on the chip, but it's still on the bleeding strip! Add into that the banks since rolling out C+P cards are shifting their fraud liabilities onto the consumer more, whilst the deficiencies are still there, it's just wrong, which was the point of the programme.

The swiping was to prove that they could still copy out all the details from a C+P card - and use it in an ATM - which bypasses the need to have the chip on there, and saying that the card as an entity was still vulnerable- which of course is true.

There is no doubt C+P is safer than the strips providing the latter is removed. But since stores are still swiping and haven't moved over yet, and to provide legacy support [how long have floppy drives been superfluously in PCs?] to other customers where C+P is not used, they're going to have keep the stripes to for some time it seems. Which means that the problem is still going to exist and the banks seem oblivious to that fact- which is the point I was trying to make and I think, what the programme was trying to say.

It's encouraging to see that some stores are now making ID checks on people who have C+P but would rather sign. That's encouraging but it won't solve the problem.

I also thought the programme glossed over one of the more serious reservations of C+P- that being, someone "shoulder surfing" and then stealing the card. At least, when you signed [most of the time] stores would look on the back and see if the signature's the same- and if it's not, they'd seem suspicious. So if someone tried to forge your signature if they could it would be a problem but if they failed then they'd be stopped... but, if someone knows your PIN and then takes the card on a spending spree with no further checks they have a free rein to spend. And the risks especially with the design of some of the readers and ATMs are high if the motivation exists. Of course you could stop the card but maybe, the damage has already been done by that point... I usually try and cover up my hand when I'm typing the PIN, like with my other hand, coats, or something.

Re: Chip and Pin Fraud
 

I would like to clarify here that the banks are moving the liability for fraudulant use away from themselves to the RETAILER, not the consumer. This move only occurs when the retailer accepts a signature on a C&P card instead of a pin. Swipe and sign liability stays where it is.

The only time you would get the CONSUMER suffering more than the default £50 is if the consumer loses the card and the pin number and many chip and pin transactions occur and they could argue that you were negligant in your maintainance of these two pieces of information. If you were shoulder surfed, mugged and your cards used you would be in a pretty strong position as long as you reported them stolen promptly. At the moment if you knowingly let a stolen card remain unreported for a length of time you would be in the same situation - nothing here has changed except the wording has been made more explicit - don't write the pin on the card/postit note in your purse(or wallet) - if it gets nicked then you will be liable for the losses incurred.

Re: Chip and Pin Fraud
 

Yes but the retailers would then just hike the prices to cover their fraud liablities meaning the consumers suffer anyway.

Well, that's just common sense really.

Re: Chip and Pin Fraud
 

Not really - it is more to push retailers to move to adopt the new technology rather than moan about the cost. It's a cost benefit analysis for the retailer.
Cost of hardware and software changed vs Benefit of less chargebacks. Theoretically this should when amortised over the life of the C&P process be a +ve number - a reduction in their cost base.
Yes but this thread already has examples of people telling cashiers in Tesco their pin numbers. The public need better education in social engineering.

Re: Chip and Pin Fraud
 

Why the retailers can't just impose ID checks for people using C+P I don't know.

It's been stated already on this thread, that some cards have a photo on the card. Why this cannot be made standard, as an anti-fraud device, I don't know. Then, it's something for them to check, bit like the signature, but it's better than nothing- and if the retailer decides the pic isn't representative they have to produce other ID. A picture on the card would cost little more to implement, and would take such little effort but it would aid in the "shoulder surfing" problem.

As for the people telling the cashiers their PINs I have only one response... :rolleyes:

If I've received one notice from bank/card company about C+P, I've had thousands. Really, it beggars belief.

[and if they choose to disregard it, that's their problem]

Re: Chip and Pin Fraud
 

Pictures on cards - a nice idea, but not really simple to implement - well the logistics of printing a picture on a card are - but a picture of who?
To do this you need to get the digitised picture and put it on the card, but the picture needs to be verified as being a image of the applicant else it is a waste of space - this would mean no more on line applications for credit etc as you would need to take a trip to the bank that is lending the money for them to take a picture of you. Fine for those card issuers with a branch network, but what about the Capital Ones, MBNAs, Morhgn Stanleys, Citibanks etc of the lending world. These entities have few or no branches making this process far harder.
Realistically it is a requirement to have your passport or drivers licence or other govt iss'd photo ID to hand when you use a card. This is how they are overcoming the swipe and sign fraud in the US. Around high fraud areas you cannot spend without a photo ID. I noticed this particularly around DC station for example - but most Americans carry their drivers licence all the time so it is less of an issue.

Re: Chip and Pin Fraud
 

Well that would be ideal and along the lines I was originally thinking...

Re: Chip and Pin Fraud
 

Depends on the card!

Visa Electron or Solo have to contact the bank to verify that the money is in the account.

If it is not there or they cannot get hold o fthe bank, transaction refused. for all payments of £0.01 or above!

Re: Chip and Pin Fraud
 

Back when I was a student working in Bhs, we had several credit cards with their owner's face on the back, bloody good idea too.
You could have the same process for the photo identification as with driving licences or passports.

Incidently, if you get given the choice of design for your card, pick the most boring one you can, don't go for the cute kittens!
You get the sales person concentrating on the wrong side of the card then!

Of course the best thing would be a well thought out and implimented ID card linked to your credit and debit cards, so you can use that along with fingerprint, select the account to want debited from the list on the screen and bobs your uncle.
Someone steals your card? Well, unless they chop your hand off it's pretty much useless :D

Re: Chip and Pin Fraud
 

While on about all this, if I get a new C&P card to use it as C&P I do not need to sign it.

However there are still those shops that still use signatures, so could I sign it something like "fookyou" or "mickey mouse" & as long as I write that down the same every time be able to make the transaction ?
I wonder how many would actually read it properly?

Re: Chip and Pin Fraud
 

If the shop cannot cope with C&P then you have to sign, and you have as much chance of getting away with signing Mickey Mouse as you did before.
If the signature doesn't match the one on the card, it's up to the shop assistant to notice.

Re: Chip and Pin Fraud
 

Neither are C&P though.

Re: Chip and Pin Fraud
 

Even the shops that have chip and pin sometimes have problems with an individual card reader and require you to sign. Had to do that at Morrisons a couple of weeks ago. If there is a problem with the C&P card and they have to swipe it they will rpobably be more inclined to check the validity of the card more thoroughly especially if the retailer is liable for improper use of the card.

Re: Chip and Pin Fraud
 

Are you sure? I would have thought that at least Visa Electron would use C&P - maybe not Solo.

Re: Chip and Pin Fraud
 

I can forsee that in the future when C&P is the norm, they'll still have mag swipe, and roller press functions, but the mag swipe will connect every time (as this will be required rarely so the cost won't be as much as if current swip cards checked every time)

Re: Chip and Pin Fraud
 

The will be migrating to it in the same way Visa Debit, Visa, Mastercard and Maestro are, but the original spec was for a 0 floor limit mag card. The Electron and Solo cards are also flat printed so they cannot be ironed by a fall back manual machine.

Re: Chip and Pin Fraud
 

Not all Solo cards are flat printed - the HSBC ones aren't, and use C&P.

Re: Chip and Pin Fraud
 

Unless they're calling you to see how they can help you today.
Then they'll happily announce they're from <some> bank and would I like to tell them my mother's maiden name or whatever to establish security - i.e who *I* am.

Last time this happened I told the 'bank' - how do I know who *you* are? And then told them that I wasn't going to continue with the conversation.

And that will be the 'paranoid' way I will handle all such further calls in the future. Maybe then they'll get serious about protecting my interests as much as they're interested in protecting theirs!

Re: Chip and Pin Fraud
 

Yes, same here. Thy called to confirm a credit card payment. I actually called the bank later, as I was concerned over it, and they confirmed I had been called by one of their people. Next time this happens, I will tell the person I will be calling the bank myself.

Re: Chip and Pin Fraud
 

Oooh, I do this to them too, they don't like it up they don't.

Try, "I know, to verify you are my bank tell me the four digits in the third block of the card number (after all the first 4 are easy and the last 4 are printed on many receipts), or for your bank account ask them to tell you the last transaction that occurred on the account, or the value of the payment to X on Y (say your mortgage).

They cannot tell you because of the wonders of the DPA and the need for them to verify who they are talking too before they divulge such information...

Also ask why they call on a witheld number, after all if they called on a number you recognised as your bank (first direct for example call displaying a first direct phone number - they sometimes actually get suprised if I answer hello first direct how can I help you) then that would improve matters too. If you call the first direct number back it says this was first direct calling on a courtousy call there is no need to respond thank you for calling.

See thats how you run a bank.