Chip and pin fraud.

I think it makes - again - the point that in spite of all their fine and soothing words, the banks take it as a given that their systems are secure, and therefore any problems are down to the customer.

However, given that all the major banks probably have the same attitude, you might be better off with a chip&signature debit or credit card. Natwest do issue these (I've got one). The possible downside is that they *cannot* work in an atm (although given that article, you may consider this a possible benefit :-) )

Snip

First Direct.

Bitstring , from the wonderful person Mike Scott said

And just to update the status of my discussion with Capital one, I now have a Chip&Signature Circle one card. 8>. Well, two actually. Every time they ring me the oiks go into denial mode, and want to talk to me about my 'C&Pin card' .. but 'still it moves'. All on account of my Pinophobia. However you really, really have to be persistent with the B&%$£s.

What in that article makes you think this is specifically chip and pin fraud, rather than a simple cloned card (not C&P)? Given the article talks about cloning, which is not practically possible with C&P(yet) then C&P fraud is extremely unlikely.

Maybe. I thought I'd have trouble with my credit card (not natwest) as a year ago (and 9 months before they issued pin card) they told me I'd have to have a pin card ("you have no choice": yes, well....). I rang them as soon as the pin card came through, and simply told them I wanted a sig card on medical grounds and that the chip&pin authorities specified that I didn't have to provide medical details (see their website). I got the card within a week. I'm not sure what happens when the "PIN awake" half of the country all decide to say they're ill........ :-)

Tumbleweed wrote: ...

Sorry to disillusion you, but you only need the stripe. You read the stripe, clear the "this is a PIN card" bit, and write a new card, which can then be used in any atm. EMVCO say it can't be done - a London ITV program a few months ago gave a demo of how easy it was. It may get harder though if the banks ever bother to check online about the chip presence.

Why would I be disillusioned?

Re my comments about C&P cloning not being (practically) possible (yet), that is the case, what you describe is a method that produces a non-C&P card.

Anyway, my point was, that nowhere in that article IIRC did it mention it was a C&P card, so why is the subject line 'C&P fraud'?

BTW, I hold no brief for C&P, and have previously posted here my fears that when the banks say C&P is to protect us from fraud, the 'us' they refer to is the banks, not us the customer :-(

Bitstring , from the wonderful person Tumbleweed said

I guarantee you need a PIN to fraudulently (or any other way) draw cash from an ATM. My "chip & Sig" cards have no PIN. Never issued. Do not exist. Makes that sort of fraud really tough, even if they clone the Chip cards (expensive, not quite impossible .. cloning the strip bits is relatively easy still).

Try a Nationwide Chip & Signature Cards (Debit & Credit) to use in shops.

Suggestion. If you wish a card to make ATM withdrawals - get yourself a cash card (savings account) and transfer smaller amounts from your current (Chip & Signature Card account), into this account if and when you need it

My preferred option would be a Chip, Signature and Photo card. Does anyone know of a card issuer who provides such a card?

If the money was withdrawn from ATMs (which seems to be the case from this story) then it's irrelevant whether the card has a chip or not. Trying to spin it as a 'Chip and PIN shock horror' story isn't being honest.

I have seen debit cards which have small photos on them - what makes you think anyone bothers looking at the picture though? They are usally well old ones anyway and with C+P most people dont even bother looking at the card now as long as the PIN is entered properly.

But it =IS= relevant that the card has a PIN...

Except that you do need a PIN to perpetrate this sort of fraud, and Credit card companies are now thrusting PINs on all their customers whether they want them or not. Having your bank a/c cleaned out by a debit card was always a problem, but a smaller one since you probably didn't keep much in there and you only used the PIN for that purpose.

You are now expected to use the PIN in every dime store, and someone armed with it can clean out your credit limit over a few days (which is LOTS more than I keep in my current account!).

This isn't chip & pin fraud! YOu are just being alarmist, to start up an old arguement. This could happen with any cashpoint card!

"GSV Three Minds in a Can" wrote

Didn't they generally hand out PINs with most credit cards, even *before* C&P was introduced?

I think the argument is about the fact it seems to be more difficult to get a PIN removed from C&P cards than from previous cards(eg non C&P). Its not a technical issue, its the banks being awkward.

However, the OP was certainly being alarmist about C&P fraud given there was no reference to it in the article, the same article re experience with banks could have been (and was) written many times prior to C&P.

"Tumbleweed" wrote

My point was that in practice, even in the past, most credit cards actually did have the facility to take cash from ATMs. Even if it was easy to get the PIN removed, I'd suggest that very few people

I got the impression that GSV was suggesting that having PINs on credit cards was generally quite new in the main, introduced only by C&P...

"Tumbleweed" wrote

"Tumbleweed" wrote

To be fair, it does make the comment "It has also left her worried about the security of the chip and Pin system." But it doesn't say quite how, or why, it made her worried about that, independent, system!

"Tumbleweed" wrote

Exactly.

A chipped card, which can be verified as genuine complete with the cardholders photo and signature is IMHO the safest option a cardholder could wish for. Try using your C&P card overseas if you've forgot your PIN, I believe you cant re-set it when abroad. How many times when using your card when on holiday have you been asked for photo ID? A chipped photo card would save you carrying your licence or passport.

A chipped photo card if reported lost or stolen, in theory would be blocked immediately. The crook couldn't obtain cash from an ATM therefore their only option for use would be in a face-to-face situation with shops staff. They'd need to look awfully like the cardholder! Lackness in checking procedures by shops would be easily spotted. The incenvitve for shops staff would be to claim the £50 for retaining or spotting stolen cards .

'being negligent,' with their PIN becuase they wouldn't have one. It would be a very silly crook indeed who attempted to use a chip, sign and phot card in a shop. PINs make crooks invisible - photos's, chips and signatures enhance their chance of being caught - the greatest of deterrents.

In message , Tim writes

Here's a black helicopter alert from The Register. If the formatting appears mangled, it may be that your client is not set to mono-spaced fonts:

BEGIN:

Too many ATMs are exposed to fraudsters, warns Gartner By OUT-LAW.COM Published Friday 5th August 2005 09:30 GMT

Get breaking Security news straight to your desktop - click here to find out how Fraudsters can get cash from ATMs because some banks fail to scan security codes in the magnetic stripes on cards, according to Gartner. Counterfeit cards are made when consumers, tricked by phishing, disclose account numbers and PINs.

According to the research firm, ATM fraud is on the rise, affecting an estimated three million US consumers in the year to May 2005, and generating losses of $2.75bn. The figures were based on a survey of 5,000 US adults.

Magnetic stripes on credit and debit cards tend to contain three 'tracks' of information. Track 1 holds up to 79 alphanumeric characters that usually encode the account number, customer name and card expiry date. Track 2 contains up to 40 numeric characters and is used to store certain encrypted security data. Track 3 holds up to 107 numeric characters but is rarely used.

Avivah Litan, vice president and research director at Gartner, explained that the security codes stored in Track 2 link the physical card to the customer's account number. But she warned that banks are neglecting this important security check.

"Surprisingly, perhaps as many as half of US-based financial institutions are not validating Track 2 security data while authorising ATM and PIN debit transactions," she said. "Most of these institutions are unaware that they, or the outsourced ATM transactions processor they rely on, should be doing so."

Ms Litan explained that criminals were targeting the customers of banks that are not validating the Track 2 data. "The hackers call these banks 'cashable,'? she said. ?The prime candidates are banks with high cash withdrawal limits."

Gartner says the banks have the ability to stop these attacks by modifying their ATM host systems to check for security on a card's magnetic stripe. These data are unknown to bank customers and therefore cannot be phished, while thieves generally cannot duplicate the data unless they have insider knowledge of the bank's algorithms and security codes.

Copyright © 2005, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

END

In message , snipped-for-privacy@tiscali.co.uk writes

The same thing applies if a C&P card is reported lost or stolen though, i.e. it is stopped immediately.

Photo crads have been tried and are not in use anymore because of the cost and the fact that shop assistants didnt check the photo anyway and there was no great detectable reduction in fraud. The vast majority of card fraud is cloned cards and stolen cards used at ATMs.