Chip 'n pin - insecure?

They could print it onto the receipt they stick in the till or send it through to the banks to get it stored safely. Would they have to call it chip and face then though?

At 10:50:40 on 08/02/2007, mogga delighted uk.finance by announcing:

What receipt? You're missing the point of the fraud.

Sorry I was thinking of the senario they did on TV where a frauster presents a faked card. But isn't the point that its only face to pin input machine that requires a pin so if that pin machine had to take an image then it'd sort out the problem.

At 13:34:54 on 08/02/2007, mogga delighted uk.finance by announcing:

If you do a cost/benefit analysis on that you'll find out it's probably not practical. Fingerprints may be one way to go, but *only* if every transaction is online - which negates one benefit of EMV to start with.

Going slightly off-topic, it would be possible to have much better security with exactly the same hardware, and simply some software changes. Not that software changes are free of course. It would be possible to have a larger PIN number, and to be asked for a different four numbers from it each time. This means that if someone shoulder- surfs your PIN, they most likely won't know the digits asked for if they then pickpocket your card.

Of course, most people couldn't remember a longer PIN. But I think the option of a longer PIN should be made available for those who request it.

If this were universal, then criminals would probably mug people at duress at cashpoints. But for these cases, there could be a "under duress" PIN which makes the card report that you only have £50 left on your credit limit or similar.

Maybe they deliberately didn't want to show exactly how it was done.

Under duress pin. Love it. You could have it so putting in a certain pin got you police attention too.

mogga wrote in uk.finance about: Re: Chip 'n pin - insecure?

Yeah, but presumably criminals have bank cards of their own and would know about 'under duress PINs', and therefore, after seeing only 50 quid available in your account, would proceed to rough you up a bit, followed by "And now, your *real* PIN!!" :-(

Maybe a better alternative would be for banks to make it easier for customers to set a user-definable withdrawal limit. I hardly ever use cash (that's why the bank card doubles as a payment card, right?) and so I'd be more than happy to restrict my account to withdrawing not more than 50 quid cash a day, 100 quid a week, to minimise potential losses in such a situation. In fact, hands up who has ever actually felt the need to withdraw 300 quid from an ATM in one go?

At 21:58:13 on 12/02/2007, David M delighted uk.finance by announcing:

Me. I needed £450 on Friday.

I don't *often* withdraw large amounts but sometimes it's very useful, e.g.:- Buying a laptop on Ebay, met seller, looked at laptop, went to ATM and got cash. It meant we only had the cash for a short time and didn't have to find a branch of our bank open (weekend).

Paying deposits on holiday lets, particularly abroad, again one needs a fairly large chunk of cash which it's better not to carry about for too long.

A feature I have been asking credit card companies for ages. I want the ability to disable completely the cash withdrawl feature (or set the limit to 0, same thing) as I never use it. None of them so far will do this.

I have withdrawn more from an ATM. But it's a rare occasion.

Mark