Chip and Pin - More secure for who?

Fred Bloggs · 2004-09-07T15:27:01+00:00

Old style: mag stripe used to access the account. many places don't check the signature properly, so even if you can't take cash out of cashpoints people can still use stolen ones. if your money went missing it's trivial to check the signature used by crooks and prove that it wasn't the owner who used it. new style: all done with pin numbers(eventually, once the dual mag strip and chip and pin has been reduced to just chip and pin). someone steals your card, or robs you at knifepoint and says `what's the pin`. i'm going to give him the pin rather than be murdered, thanks. does the bank take this as a breach of the `keep the pin secret` part of my contract and hold me accountable/responsible for any stolen money? if so then i think i'm better off with the old system, aren't i? anyone one know the answer to this one?

Sep 07, 2004 122 Replies

Rate this thread:

Alex 21 years ago

Without a hint of irony, Mike Scott astounded uk.finance on 13 Oct

2004 by announcing:

I wouldn't worry about it. There's a load of this goes on; so much so that the terminal vendors, integrators et al are having to modify their applications (and in extreme circumstances, the hardware) because cards have already been issued. e.g. 20,0000 out-of-spec cards in Turkey.

BTW, it's likely that they just muddled the CVM up on your card. Of those CVMs listed in the spec, Online PIN is used by ATMs and is highly unlikely to be used at POS. Offline PIN is the one being used at POS. If they stuck Offline instead of Online PIN on your card, that would explain why your card doesn't work in an ATM but you're asked for PIN in shops. They either should have put Online PIN plus Sig - allowing you to use your card in an ATM - or left it at sig only.

Vote

Mike Scott 21 years ago

Alex wrote: ...

They're not willing to allow Online + Signature; regrettably it's all or nothing. I wonder if the bank itself doesn't understand the flexibility that seems to be built into the card architecture. Thanks BTW for the implicit clarification about the one and offline modes. The emvco docs were, er, confusing reading when starting from scratch :-)

Vote