Chip and Pin Fraud

[Stuart]

Originally Posted by zoombini

In Argos this weeken, my wife was paying for something & because thier C&P system was down, they had to use a signature.

Because the signature was not 100% exactly the same (who's ever is?) the girl on the till had to go & see her manager to have it verified.

We was not pleased about that!

You should be. It means that she was actively checking, and had somebody else presented your card, they probably wouldn't have got served..

This is similar (although not exactly the same) to something that happened when I bought a fridge. The cashier entered my name slightly incorrectly (she put a space where she shouldn't). The cash register refused to authorise my card. I spoke to the bank to clear it up, and it took quite a while to sort it out. I was happy, however, as it proved that their security systems worked.


That is one problem with C&P. Retailers will not be checking things like signatures, and a pin, being 4 digits, should theoretically be easy to crack.

Originally Posted by zoombini

In Argos this weeken, my wife was paying for something & because thier C&P system was down, they had to use a signature.

Because the signature was not 100% exactly the same (who's ever is?) the girl on the till had to go & see her manager to have it verified.

We was not pleased about that!

Personally I'd have been very pleased that at least the retailer was taking sufficient care to actually bother to *check* that the sig matched!

[STONEISLAND]

Originally Posted by Graham

Personally I'd have been very pleased that at least the retailer was taking sufficient care to actually bother to *check* that the sig matched!

Me too

No harm in being vigilant.

[bob_builder]

Originally Posted by Chris T

At Tesco's checkout on Saturday ... I went to put my shiny new chip'n'pin card in the reader and the girl said 'it's alright, I'll do it.' She took the card, swiped it in the old fashioned way, and then asked me to use the keypad to enter my PIN.

What's the point in having uncrackable chips if even the shops that have installed the readers are still telling their staff to swipe the card? As we were embroiled in a cloning incident last year (in which some unscrupulous shopkeeper double-swiped Mrs T's card, paying for the transaction with the first swipe and copying all her details with the second), I am personally very keen to see the magnetic strip banished from all cards as soon as possible.

I think Tesco have a chip reader at the bottom of their till swiper. I think they do this to speed up the transaction as it both swipes the card and reads the chip in one go. The fact that you entered your PIN proves that the chip was being used as it does not work with the magnetic strip.

I have lost count of the number of times I have taken my non-Chip&PIN card to a store where they have put it in the Chip&PIN machine and after about 30 seconds it beeps and says "Invalid Card" so they then have to swipe it - at Tesco it always works first time.

[SMHarman]

Originally Posted by bob_builder

I think Tesco have a chip reader at the bottom of their till swiper. I think they do this to speed up the transaction as it both swipes the card and reads the chip in one go. The fact that you entered your PIN proves that the chip was being used as it does not work with the magnetic strip.

It also enables say a Tesco Visa card to be read as 1. The clubcard (magnetically) 2. The C&P payment card (chip).

[Mal]

Originally Posted by bob_builder

I have lost count of the number of times I have taken my non-Chip&PIN card to a store where they have put it in the Chip&PIN machine and after about 30 seconds it beeps and says "Invalid Card" so they then have to swipe it - at Tesco it always works first time.

Even though my credit card has a chip, it's not c&p enabled. My local Safeways always put it in the card reader and it works okay, with me having to sign. It might just be their system.

[MikeyB]

Originally Posted by SMHarman

The system as it currently stands in the UK requires the retailer to swipe the card. The card will then tell the retailer it is C&P and require it to be put in the C&P reader. Then you either input your pin, or tell them you are a dozy muppet and don't know it at which point they press more buttons and you sign a paper chit again.

I have two different cards, one old one not chip & pin, and a newer one that is chip & pin
At my local Asda, for the past couple of months (at least) all I do is pop the card into the chip & pin reader.
If I use my C&P card, it asks for the pin, if I use my older card, the paper receipt to sign is automatically printed, they don't swipe the cards at all, even if I hand my card to the cashier they put it in the C&P reader.


But I fail to see how a 4 digit number on its own, can be any more secure/insecure than signing, surely it's so much easier to watch someone taping 4 numbers than trying to copy a signature.

Even though my credit card has a chip, it's not c&p enabled. My local Safeways always put it in the card reader and it works okay, with me having to sign. It might just be their system.

Yes, my older card does have a chip on it, but it's not C&P

Originally Posted by MikeyB

But I fail to see how a 4 digit number on its own, can be any more secure/insecure than signing, surely it's so much easier to watch someone taping 4 numbers than trying to copy a signature.

You can't use a C&P card you have stolen unless you first watched the person you intended to steal it from, use the PIN at a cashpoint or in a supermarket. Most stolen cards are stolen along with carelessly carried purses, wallets or handbags by opportunist thieves who have not first 'shoulder surfed' to acquire the PIN number of any card that might be inside. Those cards are, under a C&P regime, useless to the thief. Unfortunately during this transitory phase even new C&P cards still have strips and signatures, so can still be used at any shop where the thief can persuade the retailer to let him sign instead of use his PIN.

Originally Posted by Matth

There was another program, where the "hacker" read the stripe from a "chip and pin" card, used a program to reset the "chip & pin" bit and then wrote it to the stripe on another plain card.

Card + pin (no chip) worked perfectly.

The chip itself, is a whole new ballgame for security, but at the moment, it can be 100% BYPASSED!

Rubbish!! The pin isnt stored on the magnetic stripe
__________________

Originally Posted by Chris T

At Tesco's checkout on Saturday ... I went to put my shiny new chip'n'pin card in the reader and the girl said 'it's alright, I'll do it.' She took the card, swiped it in the old fashioned way, and then asked me to use the keypad to enter my PIN.

They do that as M&S too apparently

[Stuart]

Originally Posted by bob_builder

I think Tesco have a chip reader at the bottom of their till swiper. I think they do this to speed up the transaction as it both swipes the card and reads the chip in one go. The fact that you entered your PIN proves that the chip was being used as it does not work with the magnetic strip.

I didn't think the card needed to be swiped if c&p was used. I thought the chip was read. I know that Tescos (and Sainsburys) both stick the card in a card reader at the bottom of the swipe-card slot on the tills though.

[bob_builder]

I have seen retailers asking for photo ID when people cannot remember their PIN and ask to sign.

[SMHarman]

Originally Posted by gary_580

Rubbish!! The pin isnt stored on the magnetic stripe

No - but the flag (single bit 1/0) that the card is C&P can be changed so the fraudulant user is not asked to use a pin number, but sign instead.
__________________

Originally Posted by bob_builder

I have seen retailers asking for photo ID when people cannot remember their PIN and ask to sign.

As their liability for fraud is now significantly increased.

[Shaun]

Originally Posted by gary_580

Rubbish!! The pin isnt stored on the magnetic stripe

It was used in a cash machine, I saw the program too, I think it was shown on ITV London on a Thursday evening.

[Xaccers]

Originally Posted by gary_580

Rubbish!! The pin isnt stored on the magnetic stripe

Yup, what would have happened is the card would have been cloned, and the new strip would have had the "I've got a chip" flag removed, so when it was swiped, the card reader would have assumed it's an old non-chipped card.


Strange how some people appear to be against chip and pin and feel it will increase crime, when it's made a major impact into cutting card fraud/crime in other countries.

[bob_builder]

Originally Posted by Shaun

It was used in a cash machine, I saw the program too, I think it was shown on ITV London on a Thursday evening.

Cards with magnetic strips have been used in cash machines for a number of decades without needing the PIN to be stored on the strip.