Chip and PIN, how secure is the transaction?

Bitstring , from the wonderful person Jim Hatfield said

Vote with your feet and tell them clearly why (copy to head office).

In message , r_mervart writes

Well I know this sounds naive, but I think the circumstances of the case would be taken into account which would include the timing and location of all the activities involved in the fraud. Most thefts from the person do not go un-noticed by the victim.

The vast majority of card fraud by value is perpetrated by cloned cards and forged signatures. 'Signature' cards are more vulnerable to the 'shoulder surfing' than C&P cards because not only is it easy to view the owner sign the slip, the signature is helpfully displayed on the card. The main difference is that armed with the Pin the thief can now use an ATM whereby in the past, armed only with a forged sig strip or a cloned card, ATM use was not possible. But, ATMs (unlike many EFTPOS tills) can be advised of 'hot' cards very quickly indeed.

So the risk only effects those whose PIN is successfully observed and who dont realise that their card has been nicked and therefore dont advise the card issuer. This, quite clearly, not impossible but the frequency of such events is likely, IMO, to be far less than some contributors to this group may think.

I'm pretty sure they do at my local store, although IIRC the use a hash instead of a pound sign (It's only the 21st century after all, can't expect them to have found a solution to that!)

Daytona

Without a hint of irony, Daytona astounded uk.finance on 28 Jan 2005 by announcing:

To allow elderly and 'less abled' people to use them?

Without a hint of irony, Alan astounded uk.finance on 28 Jan 2005 by announcing:

You can blame market forces for that. If the requirement's not there, the product will not be designed.

And for cash customers? That's nothing to do with C&P.

Without a hint of irony, john boyle astounded uk.finance on 28 Jan 2005 by announcing:

Not in every case, although it's becoming a requirement for more and more merchants (if not an actual EMV/acquirer requirement).

Without a hint of irony, Daytona astounded uk.finance on 28 Jan 2005 by announcing:

Blimey! Even those I deal with who are too lazy to alter a font table have managed to stick GBP on there.

snip

I expressed my opinion in my own way, I care not for your sensibilities.

HTH

Obviously.

Jon

Bitstring , from the wonderful person Dave Mason said

And we care not for your comments then.

In message , Alan writes

Well that is quite different to my local TESCO.

Does the PIN terminal says 'confirm amount' first?

After PIN has been successfully observed, critical time is the time period between the time their card has been stolen and the time they not only realize it but also find the way (tel. number or bank branch) to report it. Even if that takes only a few hours the quick thief can make quite a few transactions. Once thief knows the PIN it is actually very easy to make a transaction, less risky than if he had to falsify a signature. I agree that the system should be safer overall but I believe not enough attention is given to ensuring the privacy at the tills when entering the code. Why do we not have cards that have Chip and PIN and photograph and in addition signature would be still required? Onus would be also on a shopkeeper to be vigilant.

Roman

In message , r_mervart writes

An immediate report to the Police would be sufficient to give weight to their claim of theft if it took time for them to find the bank telno. After all, its the police that would be the first reaction for anybody as it is highly unlikely that just a card is nicked, more likely a complete wallet or purse. This is why all the card operators offer a single centralised number to ring that covers all your cards.

That wouldnt help at all. The risk is misuse at an ATM, not at a shop. The card issuers cant rely on shopkeepers now, so why should they in future?

location

The problem is that the banks, who are in the best position to improve security have no further incentive to do so, since they have successfully shifted the burden to the merchants and cardholders. If a card is misused without a PIN, the merchants is liable, if it is misused with PIN, the cardholder is. (Remember, C&P is absolutely secure, so if someone else found out your PIN, you must have been negligent.) While the overall volume of fraud may go down, the cost the innocent cardholders may well go up.

In message , john boyle wrote

Many years ago I subscribed to one of these services. On the renewal date they sent me the form asking if the details they had were correct and up-to-date - they had lost ALL the information on my cards :(

It may be sufficient to help with their claim of theft, but why would it prevent them being liable for the fraudalent payments?

Not really, ATM misuse is going to have a max limit of maybea few hundreds of pounds, in shops you could easily clear tens of thousands.

Jim.

Alex wrote: ...

Logically, I agree - the standard supports it. But the banks (at least mine) don't offer it.

Tell them you're disabled? Change your bank?

I find the design of the chip and pin terminals rather surprising having seen a number of older customers struggling to bend and almost fall to their knees to enter their pin on a keyboard which they struggle to see. This is often accompied by desperate fumbling about to find the bit of paper on which they have written it down. One alternative design which comes to mind would be in the style of a ( A5?) clipboard with a touch sensitive screen and wireless link to the main terminal. Perhaps the risk of others seeing the digits entered could be reduced by display technology which supports a very narrow viewing angle of both display and "key"-pad.

John