ATM fraud and C&P

Without a hint of irony, "Matti Lamprhey" astounded uk.finance on 11 Nov 2004 by announcing:

It is not possible to clone the chip from a skimmed card.

Yes.

Without a hint of irony, Ronald Raygun astounded uk.finance on 11 Nov 2004 by announcing:

Yes. The service code indicates whether a chip is present.

Without a hint of irony, Jonathan Bryce astounded uk.finance on 11 Nov 2004 by announcing:

That's a little obvious, no? How about electrically blowing the chip?

Without a hint of irony, Henning Makholm astounded uk.finance on 11 Nov 2004 by announcing:

Which is easy to find out. What isn't easy to find out is the private key stored in the chip.

It's all down to cost.

Without a hint of irony, "Tim" astounded uk.finance on 11 Nov

Why not? It's true.

Without a hint of irony, Ronald Raygun astounded uk.finance on 11 Nov 2004 by announcing:

Incorrect. It's stored in the 3-digit service code on track 2. This is part of the ISO spec.

Is that part securely encrypted? If not, telling a reader to disregard the chip should be trivial.

Without a hint of irony, Ronald Raygun astounded uk.finance on 12 Nov 2004 by announcing:

Don't be silly! :-)

Indeed so.

I couldn't be but I was assuming that by virtue of the fact the seperate system existed and then ended the call, and the operator probably can't understand

I wasn't saying it was read only but I can't see how THEY could change it without issuing a new card with the new pin.

Lovely! Don't even need to bother with lacquering or frying.

Storing a code on the stripe to say whether there's a chip seems a tad silly, though. Doesn't it make it harder to phase out the magstripe completely when we move to chip-only cards and chip-only readers?

There are simple devices for understanding. Also, calls can be recorded, and the touch-tone codes could be played back later into the decoding gizmo. I think people too can be trained to decode the beeps just by listening to them. They're simple two-note chords, IIRC, one note for the row, one for the column.

They could write it into the card the next time it's used in an ATM.

Alex wrote in news:Xns959E8B733334Falexl2@130.133.1.4:

Does that mean that it would be technically feasible for a bank to issue a card which requested a signature *and* PIN?

To my mind this would represent the best of both worlds - a fraudster would have to forge a signature and know the PIN to use the card, and in case of a disputed transaction there would still be a signed slip to refer to.

Can't see why, it acts as a security feature, if you swipe a C&P card on a C&P compliant terminal it will refuse (or I will rephrase that "should refuse" after my experience last weekend in halford where the woman swiped the mag strip on my C&P card and gave me a slip to sign, there was a C&P keypad on the desk which worked judging by the amount of dirt on the keys) to accept it and demand that it is inserted into the chip reader, that way it stops the ability to bypass the PIN. I can't honestly see a move to chip only particularly soon as the rest of the world has to catch up to C&P first.

Chris

Without a hint of irony, Ronald Raygun astounded uk.finance on 12 Nov 2004 by announcing:

Or in a regular transaction which goes online.

Without a hint of irony, Chris Laird astounded uk.finance on 12 Nov 2004 by announcing:

Yes. Some cards do indeed request both; not in the UK, however, AFAIK.

Without a hint of irony, Ronald Raygun astounded uk.finance on 12 Nov 2004 by announcing:

Not really, and that's never going to happen. Consider that only 20% of credit card transactions worldwide are actually processed electronically, and only a fraction of these use the chip. The US has no plans to move to chip cards, for instance. Unless you want to refuse all those luvverly US tourists and suchlike, we're going to be stuck with the mag stripe and even manual processing for quite a while.

In message , Chris writes

Its changed the next time you use it in an ATM.

In message , Alex writes

Technically that would be possible but my understanding of Chip & Pin is that till based terminals will not have that ability.

In message , Chris writes

Thats only because we are in a transitional phase.