Chip and Pin - More secure for who?

I suspect that this will be the inevitable conclusion, which means that C&P will need to be ripped up and the banks will have to go back to the drawing board. I think it will migrate to selective prompting from a more memorable "magic word" of 8 to 10 letters. How can this be disclosed without fault on the part of the cardholder, other than in very exceptional ways?

Matti

Chip & PIN is very safe for crooks. Shaz, Debbie and retail staff wont give a toss who uses a C&P card. How will C&P crooks be stopped?

At least with the transaction slip with a 'forged' signature you can challenge it. Try saying you weren't negligent with your PIN, when large sums are involved.

Picked this up from MoneyBox. The topic was "Cheque Clearing Shock"

Geraldine I checked with my bank and it said they had not heard of such a thing. If this is the case, one would understand why businesses might not want to accept cheques, but what about people who do not want to use a credit card or cannot get one? What about payments by post? Is this a ploy by the banks to discontinue the use of cheques? I do not use a credit card or my debit card having never understood how it can possibly be safe to give the number to complete strangers. Chip and Pin is supposed to make debit cards safer, but will it? We are inundated with warnings about credit card fraud and identity theft, using key loggers for example. Are we going return to carrying large amounts of cash or using postal orders? I know the banks say that if you are defrauded you will not have to pay but, if they can clear a cheque and subsequently take the money back, how can we trust them? Those of us who manage our accounts very tightly and have small incomes could not afford to have large sums of money disappearing for months following a card fraud. It is time the banks came clean and started a discussion with their customers. Geraldine

Without a hint of irony, "Tim" astounded uk.finance on 08 Oct

Not quite. The merchant is responsible for the location of the PIN pad. Every vendor makes privacy shields for their PIN pads; either as part of the device itself, or a seperate option which can be attached. Whether or not they are fitted is down to the merchant with, perhaps, input from the acquiring bank.

The cardholder can, however, complain to the merchant. Wilkinsons, for instance, have sited their PIN pads so that you have to reach a foot or so over the counter to enter your PIN - in direct view of either the line of customers behind you, or the general public walking outside the window.

"Alex" wrote

With stupidity like that, they'll soon get people refusing to enter their PINs under those circumstances. Whether they'll then accept signatures, or lose the sale, is then up to them...

Matti Lamprhey wrote: ...

I've hassled two banks about this, and requested pin-suppressed cards. One was very happey to issue such a debit card -- the only trouble is that the retailers' equipment seems not to recognise it as such, and even though it's pin-suppressed, the terminal asks for a PIN every time. The bank concerned has so far (4 weeks+) failed to address the problem in any way at all (they say it's the retailers' kit). The retailers just say it's the bank's problem. It's noteable that staff in both shops and banks have been unaware of the security issues with Chip&PIN, and also about the existence of Chip&Signature. Meanwhile, I get to play piggy in the middle, and sooner or later it'll get embarrassing.

I spoke in person to a bank rep today. He assures me that there's no problem with Chip&PIN -- if there's a problem, "the bank's on your side" and the customer won't be forced to pay. Oh yes??? Oh, and the branch had no way to check the card either. Very helpful, I don't think.

It seems to me that if someone had thought more carefully, the keypad (abeit rather small!) could possibly have been put on the card. Then the PIN would have been kept away from the terminal, so issues of recording it would have been moot.

BTW, Has anyone else managed to use a PIN-suppressed card successfully in a shop?

I am not entirely sure what you mean by "PIN-suppressed card", but my BoS visa card (issued in the beginning of '04, before wide introduction of CnP) has chip as well as magnetic strip. Even being inserted into new chip readers it still requests signature, not PIN.

Vadim

PIN-suppressed == Chip&Signature. My card certainly won't work in an ATM (I've tried it - says there's no PIN; no surprise there!) but retailers' terminals always ask for the PIN, which is difficult if there isn't one :-(.

I have two Chip & Signature Cards and they work just as they should in the new type chip reading terminals. The chip is read to confirm that the card is genuine or has not been reported lost or stolen and then, rather than being prompted to enter a PIN, a transaction slip is produced for one to sign per usual.

Details on Chip & Signature operating procedure can be found on page 7 of the following:

James

Your card obviously isn't Chip & Signature. The good/bad part or whatever your view with regards to chip & Signature is that you can't use your card to withdraw monies at an ATM, but neither can crooks, nor can they use your card and PIN unchallenged in a shop. Remember when you had a choice? Tick this box if you want a PIN with your credit card? Now you'll probably be sent one if you want one or not. Why should you if you want a PIN with a card if you never use it to withdraw cash?

You'll find Chip & Signature operating procedures on page 7 of the following:

James

"James" wrote

To pay securely in a retailer??! ;-)

James wrote: ...

Useful reading, thanks.

But that's precisely the problem -- I have, and the bank swears blind these *are* chip & signature. They originally issued c&pin, and I made them exceedingly aware of my opinion of the new cards and made them issue chip&signature cards. I've since been on the phone several times, called in to the local branch, and written, and they insist these are chip&signature.

Without a hint of irony, Mike Scott astounded uk.finance on 11 Oct 2004 by announcing:

Well one of them's lying. Either the bank didn't set the CVM list up correctly in your card, or the merchant's terminal doesn't process the CVM correctly. I'd suspect the former, TBH, since the terminal should have failed certification on such a basic thing.

Send it here - I'll check it for you ;-)

Without a hint of irony, Vadim Borshchev astounded uk.finance on 11 Oct 2004 by announcing:

That would be a card having a CVM (Cardholder Verification Method) list lacking any PIN CVMs.

Alex wrote: ...

Thanks for your comments. First time I've met the term CVM was your previous posting, so there's obviously useful info somewhere I'm not privy to. Although I've got the bare bones of what goes on with these cards, is there somewhere with more technical flesh, as it were, so I can understand better and tell the bank (or retailer) what they're doing wrong? The chipandpin.org web site appears to be merely propaganda rather than something useful......

Without a hint of irony, Mike Scott astounded uk.finance on 12 Oct

If you've got a few sleepless nights, there's the ISO specs & the EMV specs to wallow through ;-)

If you can find out who the merchant's acquiring bank is, they may be interested if you can find the right people. It is they, after all, who are responsible for the certification of the terminal to work on their system.

Your card issuer probably won't be interested until it can be demonstrated that the fault is with your card.

Mike,

I've successfully used my Chip & Signature cards at: Wilkinsons, M&S, Tesco (another story), Safeway and Woolworths. I can only repeat what happens in most instances, I insert the card, the card is authenticated, sometimes I press ok for the amount and a transaction slip is always produced for me to sign. At no time is the magstrip swiped.

My cards are supplied by Egg & Nationwide.

Hope this helps, Rgds James

TESCO: Accepted my new Egg Card almost two months before the cards validity date. Amazing. I'm waiting to hear from Egg.

Alex wrote: ...

Sort of thing to help send one to sleep :-)

...

Quite likely, but no harm blinding them with science.

Which I do exactly how? (rhetorical :-) )

Thanks again for the help.

Thanks for that. To be fair to the bank, they do seem to be trying to sort out the problem, albeit slowly -- I had a phone call from their customer services late yesterday: they thanked me for being patient (!), and it seemed clear that they're as mystified as I as to why I'm having problems, and do want to find out what's going on. Current idea is that something went wrong when the cards were made; they're going to ship out new cards to see if that fixes things.

I guess that if the stripe and chip carry some of the same information, there's scope for differences developing during manufacture, which might explain why a (presumably stripe-reading) atm thinks there's no PIN, while a chip-reading terminal thinks there is. They reckon a week or so for new cards to arrive.....

Without a hint of irony, Mike Scott astounded uk.finance on 12 Oct

Well, *you* don't of course. That normally goes via the integrator/vendor.