Chip and pin fraud.

WEll, from the website

"The introduction of the chip makes it virtually impossible for stolen or counterfeited cards to be used fraudulently in a ?Customer Present? environment. While a magnetic stripe card is extremely simple to copy using easily obtainable skimming technology costing just a few pounds, the chip on the Smart Card is tamper-proof, making forgery or duplication so difficult and expensive that it becomes effectively impossible. Even if the customer?s PIN is known, unless the original card is also available, fraud is prevented."

"Customer present" includes atms I assume? But draw your own conclusions; I think it's misleading.

Home in one! Is it still like that? - last time I was up there (quite a few years ago), I think they were building round the main gate, which might have blocked off the side access finally :-(

Who was it who said that for every problem there is a solution that is simple..and wrong?

They have to balance many factors, including inconvenience to their customers and the time scale to introduce new ATMs, cost of lost customers, plus the cost of fraud. For example, suppose you* couldnt use your ATM card in the US. You might well switch to a supplier whose cards worked in the US.

*by 'you' lets mean a member of the public who isnt aware of issues such as pin fraud and simply wants his card to work.

"Tumbleweed" wrote

No - you've only "lost the money" if you *never* get it back!

"Mike Scott" wrote

At John's, there were walls either side of main gate. But if you were coming in round the back, by the river, there was no problem!

Indeed.

It should be redundant.

I was rather surprised when I learned that there is such a flag on the card itself.

There still should be proof that the cardholder is present, alive and willing.

You have no need to clone the Chip, you clone the magstripe and use the pin, it's been demonstrated, we know it's possible, you don't need to clone the chip, the magstripe is enough to get you cash from ATM's.

Jim.

Effectively, yes;

=="But in the programme, Sandra Quinn, director of corporate communications, Apacs, did admit that data embedded in the magnetic strip on a card can be accessed and copied by fraudsters but insisted that it cannot be changed: "That data will always say 'there is a chip on this card' therefore if there's no chip on the card the fraudster can't use it."

But research conducted by Ross Anderson, head of security engineering at Cambridge University, found that if a card with a damaged chip is presented at an ATM or POS terminal, then the device falls back to magnetic strip operation."

== I would say that "if there's no chip on the card the fraudster can't use it" would be a good definition of 'chip security'. And "Sandra Quinn, director of corporate communications, Apacs" would be a good representative for ""the card authorities"

picky picky and I did say 'initially' :-)

Even in common parlance you can 'lose' something and then find it again.

Bitstring , from the wonderful person Mike Scott said

So you walk up the road to the flats/sports pavilion and come in the back, or you use the little known gate onto Madingley Road, or .. (Actually I haven't been there for a long time either). Those were better alternatives anyway, bypassing the gate 'the easy way' was a bit too visible from the porters' lodge. Someone may have nicked the gate by now (ISTR it was tasteful bronze or something).

Well duh f****it - it's fairly *easy* to prove that it isn't the original signature it that's the case isn't it?

Phew - thanks!!!

Problem is though, "" is not a good representative for "at an ATM"... Now - where's a quote linking **chip security** to *ATMs* ?

In message , Jim Ley writes

I think you are confusing the argument about Chip & Pin and mainstream ATM security (or lack of it)

"Chris Street" wrote

OK, oh clever one - just how do you suggest that the checkout operator in Curry's proves to the thief that his signature on the card *isn't* the original?

No, because they're related, the ATM security situation has been made worse by the ubiquitous use of C&P.

I think you're denying the relationship, that's clear to the other posters in the thread.

Jim.

This website is not authorised by the banks. It appears to be a sales site for tech stuff.

The real site is

>

What do expect form an unofficial site?

Have a look at

It suggests that all ATMs in UK are now chip enabled.

Now you are just coming across as needlessly picky. Losing the argument, so pick on minute differences in wording.

Try reading this article "Electronic Commerce: Who Carries the Risk of Fraud?" by a solicitor and an IT consultant, its refereed and out of the university of Warwick.

Abstract

Banks must prove the authenticity of their customers' handwritten instructions if challenged, but for telephone and online banking some banks are adopting terms which could make customers liable for transactions they have not authorised. Neither the security technology available to customers, nor the security techniques that ordinary customers can be expected to use, are adequate to protect customers from this risk of liability, and the terms in question are arguably unfair.

also,a few quotes for you which cover many of the same points we have mentioned previously.

BTW, the article makes it clear that cheques and debit/credit cards are regarded as fundamentally dfferent under UK law, which is why many of the disparities come about in the banks treatment of debit/credit card disputes, and also why its misleading and just plain wrong to draw analogies between how things work with cheque disputes and card disputes and infer that because a cheque dispute is handled one way, the same approach is true for card disputes.

Re banking Code of Conduct and banking conditions, they make these points amongst others.

"the limitation of the customer's liability for fraudulent transactions to

50 typically does not apply where the customer has been 'grossly negligent'. This expression does not have a standard legal meaning, and is defined in the banks' individual terms."

"the latest revision of The Banking Code is in some respects less favourable to the customer than its immediate predecessor published in 1998. It omits the words 'without disguising it', so as to prohibit any writing down of a PIN or other security information, a prohibition rendered impracticable by some bank procedures described below. And the expression 'gross negligence' has been replaced by 'without reasonable care', which could have the effect of making it easier for the bank to blame the customer for a third party's fraud."

"The unwillingness of the banks to admit the existence of technical weaknesses "

"But once again the balance of risk has shifted towards the customer. The most striking difference is that there is no 50 limit. As is clear from Egg clause 3.2, the customer's whole available balance (up to the amount of any applicable withdrawal limits) is at risk"

And finally "We began by drawing attention to the fact that the bank and not the customer carries the risk of forgery of a cheque. That allocation of risk provides a benchmark against which to assess any alternative. Both where customer authentication relies on shared secrets, and where signature keys can be stored or used only in insecure systems, allocating more than a very small risk of fraud to the customer seems inescapably (in the words of the Regulations) to cause 'a significant imbalance in the parties' rights and obligations arising under the contract, to the detriment of the consumer.'"