Chip and Pin Fraud

Originally Posted by Xaccers

Strange how some people appear to be against chip and pin and feel it will increase crime, when it's made a major impact into cutting card fraud/crime in other countries.

A symptom of 'Agenda Journalism', which is something we suffer a lot of in this country. You choose your standpoint on an issue, then go and compile a report that supports it, while glossing over (or ignoring entirely) anything that doesn't.

I saw the edition of Tonight with lots of journalists and the odd cameo by Trevor McDonald in question, and I was appalled by the shoddy standard of journalism. The woman being interviewed was pointing out that the so-called deficiencies of Chip and Pin are actually deficiences in the old swipe-and-sign system that has to run in parallel during the changeover phase, but the hack was clearly only interested in pursuing the pre-agreed editorial line, that 'this chip and pin thing isn't all it's cracked up to be'.

Bizarrely, they backed all this up by demonstrating how easy it is to clone a card, not by copying the chip but by *swiping* it. The logical fallacy in question here is, I believe, the Straw Man.

[SMHarman]

Originally Posted by bob_builder

Cards with magnetic strips have been used in cash machines for a number of decades without needing the PIN to be stored on the strip.

But such cards cannot be used off line. A C&P card can be charged (dependant upon the retailer) an amount withouth need for authorisation (below floor limit transactions).
If an ATM cannot contact the mothership then you cannot use the machine. If a C&P card cannot or need not contact the mothership then you can still have the transaction.

[Shaun]

Originally Posted by bob_builder

Cards with magnetic strips have been used in cash machines for a number of decades without needing the PIN to be stored on the strip.

I was just confirming that the program was on, not the legitimacy of any of the facts presented

[nffc]

Originally Posted by Chris T

A symptom of 'Agenda Journalism', which is something we suffer a lot of in this country. You choose your standpoint on an issue, then go and compile a report that supports it, while glossing over (or ignoring entirely) anything that doesn't.

I saw the edition of Tonight with lots of journalists and the odd cameo by Trevor McDonald in question, and I was appalled by the shoddy standard of journalism. The woman being interviewed was pointing out that the so-called deficiencies of Chip and Pin are actually deficiences in the old swipe-and-sign system that has to run in parallel during the changeover phase, but the hack was clearly only interested in pursuing the pre-agreed editorial line, that 'this chip and pin thing isn't all it's cracked up to be'.

Bizarrely, they backed all this up by demonstrating how easy it is to clone a card, not by copying the chip but by *swiping* it. The logical fallacy in question here is, I believe, the Straw Man.

But that is the point.

The woman was saying that there were no deficiencies in the new C+P cards- which, as they have the strip still, are prone to the same problems as non-C+P cards in that all the data may very well be encrypted on the chip, but it's still on the bleeding strip! Add into that the banks since rolling out C+P cards are shifting their fraud liabilities onto the consumer more, whilst the deficiencies are still there, it's just wrong, which was the point of the programme.

The swiping was to prove that they could still copy out all the details from a C+P card - and use it in an ATM - which bypasses the need to have the chip on there, and saying that the card as an entity was still vulnerable- which of course is true.

There is no doubt C+P is safer than the strips providing the latter is removed. But since stores are still swiping and haven't moved over yet, and to provide legacy support [how long have floppy drives been superfluously in PCs?] to other customers where C+P is not used, they're going to have keep the stripes to for some time it seems. Which means that the problem is still going to exist and the banks seem oblivious to that fact- which is the point I was trying to make and I think, what the programme was trying to say.

It's encouraging to see that some stores are now making ID checks on people who have C+P but would rather sign. That's encouraging but it won't solve the problem.

I also thought the programme glossed over one of the more serious reservations of C+P- that being, someone "shoulder surfing" and then stealing the card. At least, when you signed [most of the time] stores would look on the back and see if the signature's the same- and if it's not, they'd seem suspicious. So if someone tried to forge your signature if they could it would be a problem but if they failed then they'd be stopped... but, if someone knows your PIN and then takes the card on a spending spree with no further checks they have a free rein to spend. And the risks especially with the design of some of the readers and ATMs are high if the motivation exists. Of course you could stop the card but maybe, the damage has already been done by that point... I usually try and cover up my hand when I'm typing the PIN, like with my other hand, coats, or something.

[SMHarman]

Originally Posted by nffc

But that is the point.

The woman was saying that there were no deficiencies in the new C+P cards- which, as they have the strip still, are prone to the same problems as non-C+P cards in that all the data may very well be encrypted on the chip, but it's still on the bleeding strip! Add into that the banks since rolling out C+P cards are shifting their fraud liabilities onto the consumer more, whilst the deficiencies are still there, it's just wrong, which was the point of the programme.

I would like to clarify here that the banks are moving the liability for fraudulant use away from themselves to the RETAILER, not the consumer. This move only occurs when the retailer accepts a signature on a C&P card instead of a pin. Swipe and sign liability stays where it is.

The only time you would get the CONSUMER suffering more than the default £50 is if the consumer loses the card and the pin number and many chip and pin transactions occur and they could argue that you were negligant in your maintainance of these two pieces of information. If you were shoulder surfed, mugged and your cards used you would be in a pretty strong position as long as you reported them stolen promptly. At the moment if you knowingly let a stolen card remain unreported for a length of time you would be in the same situation - nothing here has changed except the wording has been made more explicit - don't write the pin on the card/postit note in your purse(or wallet) - if it gets nicked then you will be liable for the losses incurred.

[nffc]

Originally Posted by SMHarman

I would like to clarify here that the banks are moving the liability for fraudulant use away from themselves to the RETAILER, not the consumer. This move only occurs when the retailer accepts a signature on a C&P card instead of a pin. Swipe and sign liability stays where it is.

Yes but the retailers would then just hike the prices to cover their fraud liablities meaning the consumers suffer anyway.

Originally Posted by SMHarman

The only time you would get the CONSUMER suffering more than the default £50 is if the consumer loses the card and the pin number and many chip and pin transactions occur and they could argue that you were negligant in your maintainance of these two pieces of information. If you were shoulder surfed, mugged and your cards used you would be in a pretty strong position as long as you reported them stolen promptly. At the moment if you knowingly let a stolen card remain unreported for a length of time you would be in the same situation - nothing here has changed except the wording has been made more explicit - don't write the pin on the card/postit note in your purse(or wallet) - if it gets nicked then you will be liable for the losses incurred.

Well, that's just common sense really.

[SMHarman]

Originally Posted by nffc

Yes but the retailers would then just hike the prices to cover their fraud liablities meaning the consumers suffer anyway.

Not really - it is more to push retailers to move to adopt the new technology rather than moan about the cost. It's a cost benefit analysis for the retailer.
Cost of hardware and software changed vs Benefit of less chargebacks. Theoretically this should when amortised over the life of the C&P process be a +ve number - a reduction in their cost base.

Originally Posted by nffc

Well, that's just common sense really.

Yes but this thread already has examples of people telling cashiers in Tesco their pin numbers. The public need better education in social engineering.

[nffc]

Originally Posted by SMHarman

Not really - it is more to push retailers to move to adopt the new technology rather than moan about the cost. It's a cost benefit analysis for the retailer.
Cost of hardware and software changed vs Benefit of less chargebacks. Theoretically this should when amortised over the life of the C&P process be a +ve number - a reduction in their cost base.

Yes but this thread already has examples of people telling cashiers in Tesco their pin numbers. The public need better education in social engineering.

Why the retailers can't just impose ID checks for people using C+P I don't know.

It's been stated already on this thread, that some cards have a photo on the card. Why this cannot be made standard, as an anti-fraud device, I don't know. Then, it's something for them to check, bit like the signature, but it's better than nothing- and if the retailer decides the pic isn't representative they have to produce other ID. A picture on the card would cost little more to implement, and would take such little effort but it would aid in the "shoulder surfing" problem.

As for the people telling the cashiers their PINs I have only one response...

If I've received one notice from bank/card company about C+P, I've had thousands. Really, it beggars belief.

[and if they choose to disregard it, that's their problem]

[SMHarman]

Originally Posted by nffc

It's been stated already on this thread, that some cards have a photo on the card. Why this cannot be made standard, as an anti-fraud device, I don't know. Then, it's something for them to check, bit like the signature, but it's better than nothing- and if the retailer decides the pic isn't representative they have to produce other ID. A picture on the card would cost little more to implement, and would take such little effort but it would aid in the "shoulder surfing" problem.

Pictures on cards - a nice idea, but not really simple to implement - well the logistics of printing a picture on a card are - but a picture of who?
To do this you need to get the digitised picture and put it on the card, but the picture needs to be verified as being a image of the applicant else it is a waste of space - this would mean no more on line applications for credit etc as you would need to take a trip to the bank that is lending the money for them to take a picture of you. Fine for those card issuers with a branch network, but what about the Capital Ones, MBNAs, Morhgn Stanleys, Citibanks etc of the lending world. These entities have few or no branches making this process far harder.
Realistically it is a requirement to have your passport or drivers licence or other govt iss'd photo ID to hand when you use a card. This is how they are overcoming the swipe and sign fraud in the US. Around high fraud areas you cannot spend without a photo ID. I noticed this particularly around DC station for example - but most Americans carry their drivers licence all the time so it is less of an issue.

[nffc]

Originally Posted by SMHarman

Pictures on cards - a nice idea, but not really simple to implement - well the logistics of printing a picture on a card are - but a picture of who?
To do this you need to get the digitised picture and put it on the card, but the picture needs to be verified as being a image of the applicant else it is a waste of space - this would mean no more on line applications for credit etc as you would need to take a trip to the bank that is lending the money for them to take a picture of you. Fine for those card issuers with a branch network, but what about the Capital Ones, MBNAs, Morhgn Stanleys, Citibanks etc of the lending world. These entities have few or no branches making this process far harder.
Realistically it is a requirement to have your passport or drivers licence or other govt iss'd photo ID to hand when you use a card. This is how they are overcoming the swipe and sign fraud in the US. Around high fraud areas you cannot spend without a photo ID. I noticed this particularly around DC station for example - but most Americans carry their drivers licence all the time so it is less of an issue.

Well that would be ideal and along the lines I was originally thinking...

[cjmillsnun]

Originally Posted by SMHarman

But such cards cannot be used off line. A C&P card can be charged (dependant upon the retailer) an amount withouth need for authorisation (below floor limit transactions).
If an ATM cannot contact the mothership then you cannot use the machine. If a C&P card cannot or need not contact the mothership then you can still have the transaction.

Depends on the card!

Visa Electron or Solo have to contact the bank to verify that the money is in the account.

If it is not there or they cannot get hold o fthe bank, transaction refused. for all payments of £0.01 or above!

[Xaccers]

Back when I was a student working in Bhs, we had several credit cards with their owner's face on the back, bloody good idea too.
You could have the same process for the photo identification as with driving licences or passports.

Incidently, if you get given the choice of design for your card, pick the most boring one you can, don't go for the cute kittens!
You get the sales person concentrating on the wrong side of the card then!

Of course the best thing would be a well thought out and implimented ID card linked to your credit and debit cards, so you can use that along with fingerprint, select the account to want debited from the list on the screen and bobs your uncle.
Someone steals your card? Well, unless they chop your hand off it's pretty much useless

[zoombini]

While on about all this, if I get a new C&P card to use it as C&P I do not need to sign it.

However there are still those shops that still use signatures, so could I sign it something like "fookyou" or "mickey mouse" & as long as I write that down the same every time be able to make the transaction ?
I wonder how many would actually read it properly?

[Xaccers]

Originally Posted by zoombini

While on about all this, if I get a new C&P card to use it as C&P I do not need to sign it.

However there are still those shops that still use signatures, so could I sign it something like "fookyou" or "mickey mouse" & as long as I write that down the same every time be able to make the transaction ?
I wonder how many would actually read it properly?

If the shop cannot cope with C&P then you have to sign, and you have as much chance of getting away with signing Mickey Mouse as you did before.
If the signature doesn't match the one on the card, it's up to the shop assistant to notice.

[SMHarman]

Originally Posted by cjmillsnun

Depends on the card!

Visa Electron or Solo have to contact the bank to verify that the money is in the account.

If it is not there or they cannot get hold o fthe bank, transaction refused. for all payments of £0.01 or above!

Neither are C&P though.