Continuous Payment Authority

"Simon Finnigan" wrote

You don't only enter your PIN at cash machines!

"Simon Finnigan" wrote

Even covering your hand might not be enough, the "shoulder- surfer" might get an idea from the location of your fingers etc., or there might be a camera at a strategic position, etc.

And EVEN IF you did manage to eliminate all shoulder-surfing, there's still the possibility of a dodgy terminal...

"Simon Finnigan" wrote

"Simon Finnigan" wrote

Which terminal? You may have used several dozen or more recently, any of which could have been the dodgy one!

Can the bank *prove* that **none of them** were dodgy?

"Simon Finnigan" wrote

Can the bank prove that you weren't?

"Simon Finnigan" wrote

You don't need to force the bank to accept it. It isn't just their decision - you can go to the Ombudsman, or there's the courts.

"Simon Finnigan" wrote

Claiming something and proving something are two different things.

"Simon Finnigan" wrote

That's only true if they can *prove* you negligently divulged that secret information - otherwise the existence of the secret info doesn't help them *prove* negligence.

"Simon Finnigan" wrote

Fortunately, "suspicion" is *not* proof!

There are many ways that they could have got the PIN; why do you think that the cardholder should prove how they think they obtained the PIN, but the bank shouldn't need to prove how they think they got it?

"Simon Finnigan" wrote

Where is the proof of the negligence? Are you saying it is 'Guilty until proven Innocent'? What country are you in?!

Ah - I see you do think it's "Innocent until proven Guilty" for C&Sig, though. Although the bank could just as easily "suspect" that you gave your card to someone and told them to copy the signature from the back - so why do you think that you wouldn't need to prove 'otherwise' in that case?

"Simon Finnigan" wrote

Taking a case to the Ombudsman is free for the consumer. [Not for the bank.]

It`s only free if you don`t value your time.

You obviously have a firmly held opinion and won`t accept that there are massively different situations regarding C&P and C&S cards, so I`m banging my head against a brick wall carrying this on any further. Do your research, look at the cases that have been taken to court and the level of evidence that has been sufficient for a judge to accept a C&P card ws used fraudulently, then see if you think any differently.

ISTR a demonstration that allowed someone to "read" the pin several minutes after it was entered provided all four digits were different by using an IR thermometer and measuring the temperature of each of the buttons. (IIRC the measurements could be done from several metres away from the pin pad)

Tim.

"Simon Finnigan" wrote

Oh, I do accept that there are massively different situations between C&P and C&S. One BIG difference is that if you lose your card, it is MUCH easier for a fraudster to use a C&S card than it is to use a C&P card. [They just copy your sig from the back.]

So if your main concern is avoiding getting into the position in the first place where you disagree with the bank (they say you were involved in a transaction, you say you weren't), then you'd be MUCH better off with a C&P card.

Let me ask - what would *you* do if you lost your C&S card, and then the bank suggested that either you had used it yourself, or you gave your card to someone else and told them to copy the signature from the back? You'd be in the same situation as someone with a C&P card where the bank suggested they'd given away the PIN...

"Simon Finnigan" wrote

Do you mean that you just can't answer my questions, so you're giving up?

"Tim Woodall" wrote

Scary!

Indeed. I now rest my fingers on the keypad to try and heat up many of the keys.

(I don't think this is the article I originally saw as ISTR more details of what the keypad looked like after one minute, two minutes etc left to cool)

It possibly wouldn't work well with an ATM due to the metal keys (although I wouldn't bet on it). But I suspect it will work very well with the shop and restaurant pin entry devices. You can enhance the security at ATMs as well by always entering the amount of money on the keypad rather than using the "quick" buttons.

Tim.

That is way out of line with my experience of sig card use, in the unlikely event of finding a till which is not working for C&P. Perhaps you two are dodgy-looking characters, I'm a harmless looking 75 year old. If I ever find your card... :-)

In message , Simon Finnigan writes

This is an oft-repeated thread, with people of opposite convictions whose mind will not be changed. How many here have actually suffered card fraud directly attributed to either a C&P or a C&S transaction?

How many here have been struck by lightning, or won the Lottery?

In message , Tim writes

The wise chip and pinner always carries either a coolant spray or a blowtorch with which to spray the keypad after use, to avoid this well-known ploy used by IR villains who lurk in every corner.

I`m 30, normally dressed quite scruffily but spending a lot of money on a platinum credit card :-) But I do find that the C&S card is fo far out the norm for the staff that they want to double check with someone else before processing the transaction.

None of the above for me, but then I do my best to avoid them all.

I'm unlikely to win the lottery given that I've never bought a ticket. I I also consider it extremely unlikely that someone is likely to try to frame me in a crime by faking a winning ticket and then sticking it in my back pocket or trying to pretend to be me to make the claim. It's even more unlikely that someone will have a wining ticket and then stick it in my back pocket so they can claim I stole it.

While it is possible to "fake" lightning in the lab, I do not believe it is possible for anybody to arrange for lightning to strike anybody or anything. It is just conceivable that metal theives might try to arrange things so it looks like contractors never installed lightning conductors but I doubt that is a serious threat.

OTOH people have gone to gaol due to complaining about fradulent C&P transactions on their account.

I'm sure everybody has had cases where they've followed up on a previous call to a company and had "it's not on the computer therefore it didn't happen" sort of response or a "this is what is in the computer so this is what we agreed".

Tim.

Incidentally, another anecdote showing how lax these card companies really are:

I lost my credit card (my fault and I found it again later) so I reported it lost and they said "you'll get a new card in two weeks" (which was a bit annoying but I thought it was just one of those things)

Two weeks later, no card (and no pin reminder although I had said that I didn't need a new pin) so I called them up again.

"Very strange. We sent it out on [whenever - the day after I reported it lost]. We'll put a stop on the card and send out a new one."

New card arrives with new pin (separate letters) after a few days.

I have no idea whether my original replacement card was sent out with a pin as well or without.

If it was with a pin then someone could have been running around with my card for two weeks without me having any idea whatsoever. If it wasn't sent out with a pin (I didn't expect it to be) then someone could easily have intercepted it and then tried a few pins. As long as isn't stupid and intercept so many that it starts to point to them then eventually they're going to get one where they correctly guess the pin.

I know there's also a card activation step but the questions they ask are hardly difficult to find answers for.

Tim.

In message , Tim Woodall writes

Enjoyed that response, thanks.

In message , Simon Finnigan writes

I should say that I dress very casually, usually jeans and a fleece pullover, not exactly sartorial elegance. :-)

The only time I have signed recently is when "The thingy isn't working, you'll have to sign", so my experience is limited, whereas C & S regulars will have more experience of signing, but I have rarely seen a checkout person look closely.

I did a year ago. They were C&P transactions and I was elsewhere when they occured. When I made it clear I wouldn't go away Barclaycard caved in (it only took two letters and a snip from the Consumer Credit Act).

Where I shop it seems to be very much outside the norm, so it does get more attention than a normal C&P transaction would.

Why? With a PIN they have a much stronger basis for assuming I authorised the transactions, since they would have to be authorised by the use of a secret number which (in theory) only I know. I`d have to show that the PIN was obtained another way if I used a C&P card, whereas with a C&S card there is no secret information, everything you need is there on the card, so anyone obtaining the card would be able to make the transaction. Can you really not see the difference between these two situations?

I`d ask them to provide conclusive evidence. CCTV evidence of me using the card (which would of course be impossible to obtain, as it wouldn`t be me using the card) for example. The other example yo give of me telling someone to copy the signature is a red herring - nobody would need to be told that, so the bank wouldn`t be able to prove that I was negligent (or worse) by doing this.

No, I mean that you firmly hold an opinion that seems to make you unwilling (or unable) to see the difference between two very different situations, making it pointless to continue until and unless you realise that C&P transactions and C&S transactions are very different in terms of the information required to authorise them.

"Simon Finnigan" wrote

Please decide whether you think the bank will be reasonable or not! If they *are* reasonable, then they can't suggest that there is no way somone else could have (known or guessed) the PIN. If they *aren't* reasonable, then they could just as easily suggest that you were involved in a C&S transaction.

"Simon Finnigan" wrote

Why? You haven't given any good reason why you think it is "guilty until proven innocent" for C&P, but "innocent until proven guilty" for C&S...

"Simon Finnigan" wrote

Of course I can. But that doesn't mean there's a change from "innocent until proven guilty" to "guilty until proven innocent".

"Simon Finnigan" wrote

Which is *exactly* what the cardholder with a disputed C&P transaction should do!

"Simon Finnigan" wrote

Same with the C&P transaction. They wouldn't be able to produce CCTV evidence, because it never happened.

"Simon Finnigan" wrote

It's not a red-herring; if you *did* tell someone to do that then you were complicit in the fraud and hence liable. [Just like someone giving away their PIN.]

"Simon Finnigan" wrote

I can see lots of differences. One big one, as I mentioned before, is that it's much more likely for a fraud to occur if you lose a C&S card than if you lose a C&P card. That's bad news for C&S - C&P is better because when there is no fraud, then there's nothing the bank can try to pin on you!

"Simon Finnigan" wrote

I really don't know why you would think that I hadn't realised that back when C&P was first announced!

Can you tell us why you think it's "innocent until proven guilty" for C&S but "guilty until proven innocent" for C&P?

Or why you think the bank needs to produce the evidence for C&S, but that instead the cardholder needs to produce contra-evidence for C&P?

In message , Mr X writes

So up to now that's one satisfactory outcome in the group, apart from the nuisance factor.