Chip and Pin - More secure for who?

In message , Jane Tweedynn writes

But only if you reported it.

I agree with this bit, but on balance its better for 99.9999% of people.

My previous cashpoint card had what appeared to be contacts for a chip on the front. Once the card expired, I had a poke around to see what the chip was like and found that the contacts were nothing more than gold-coloured ink!

Best Regards, Alex.

Generally of course. I do find this group more abusive than the majority of other groups. Then again I don't subscribe to alt.teenagers so I don't experience real abuse. I think its the nature of the group, you are more likely to find greedy and arrogant people posting on a finance newsgroup rather than a newsgroup about babies where there is less need to be competitive.

I let it pass. People are as people are.

There's a difference between C&P being /theoretically/ voluntary and /practically/ voluntary.

I'll be rejecting C&P in favour of old-fashioned C&S, but I do wonder how long I'll be able to hold out before giving in due to practical necessity.

Best Regards, Alex.

I had not thought of that possibility :-)

Chip-n-pin will be welcomed in this household. What passes for my signature on the back of my plastic cards is a complete joke, squashed into one corner as it is by an endlessly shrinking strip, presence of the embossed card number immediately underneath and (now) the last few digits and security number taking pride of place slap bang in the middle. I can only imagine the accountants that approve these changes would not look out of place in a Dickens novel, hunched over their desks and scratching away in tiny handwriting to save 0.00001p of ink.

Tsk! and there was me thinking that there must be a new technology of super slim chips available now. The first chip cards I saw were definitely slightly pregnant around where the chip was.

DG

No, you dont need to see the owner do anything. You just nick his card.

Exactly.

Presumably they were contacts arranged so as to indicate to the card reader that `there isn't a chip in this card'. I'm reminded of the `Bus Grant Acknowledge' cards one used to have to install in the empty slots on one's PDP-11's UBUS.

Without a hint of irony, snipped-for-privacy@ssrl.org.uk (Sam Nelson) astounded uk.finance on 09 Sep 2004 by announcing:

No point. If there's no chip, the service code on the mag stripe will confirm that, and if you try to read it in an ICC reader it should fail whether there's a non-functional chip or no chip at all.

I believe the liability shift will be next year, but retailers will be offering c&s for a fair while yet if they're interested in selling to tourists. Of course, the banks could stop issuing c&s cards to UK citizens before they phase out c&s completely. Ultimately though you WILL be performing wholly c&p transactions sooner or later.

Without a hint of irony, snipped-for-privacy@altavista.co.uk (Fred Bloggs) astounded uk.finance on 09 Sep 2004 by announcing:

Indeed. 1st Jan 2005, to be exact.

As long as they have EMV-capable terminals & follow the appropriate procedures, they shouldn't have too much of a problem.

I picked apart a newer (expired) card that had a chip in it; the chip was directly connected to the contacts (well, presumably; I wasn't careful enough to avoid destroying any wires), then encased in a blob of epoxy and glued into a hole in the card:

Upper Surface Contacts v v

------------------ -------- ----

------------------ Chip ---- }

------------------ Epoxy ---- } Lower Surface

-------------------------------- }

-------------------------------- Magstripe

The chip itself is about 2mm square and about 0.5mm thick. Sorry to spoil anyone's fun! ;-)

Best Regards, Alex.

Yes, at best, all I'll have is a holding action on the off-chance that mass customer dissatisfaction or compromise/muggings forces a retreat on the part of the banks.

Best Regards, Alex.

This is indeed one of my biggest concerns about C&P. The banks are claiming that C&P is absolutely secure (4 digit PIN secure, I am laughing my head off). Cloning, which is currently the biggest problem will be eliminated for a while at least, but as a customer you will be in much worse position if you have to dispute a transaction you did not make, either because the banks' computers screwed up something or because your card got lost or stolen. You might be in a better position if you reported the loss or theft, but I am sure that banks will still shift the blame on to you and argue that you must have been negligent, for example, by writing down your PIN or using an easy to guess PIN, whereas occasionally a thief will be simply lucky and guess the correct PIN in

My opinion about C&P is: Be afraid, be very afraid!

They're known as "Chip and Signature", the chip contain all your card details but doesn't have your PIN stored on it. C&P tills will read the chip but will require a signature instead of your PIN.

What's tourism got to do with it? Cards from oversees with no chip should still be accepted with a signature, I would imagine retailers aren't liable for fraud if the card has no chip?

Without a hint of irony, snipped-for-privacy@yahoo.com (Marx Peterson) astounded uk.finance on 12 Sep 2004 by announcing:

Not necessarily true. It's just that the CVM (Cardholder Verification Method) list will have not have PIN as the primary CVM.

Without a hint of irony, snipped-for-privacy@yahoo.com (Marx Peterson) astounded uk.finance on 12 Sep 2004 by announcing:

Correct. As long as they have and use an EMV-capable terminal, they have no such liability.

Ah. Never seen a reader, though. My cards have always been swiped. (Often over and over and over again, until the person doing this spots me glaring at them.)