Credit Cards/Chip and Pin/ATM withdrawls

I do wonder how many will do this in practise. Sometimes my C&P debit card is not accepted. They always fallback to the sig straightaway without any fuss.

Mark.

Oh, we finally disagree!

With a handfull of cards at an ATM, I could get many thousands of pounds in a few minutes. All whilst wearing my balaclava, crash helmet, false beard, sunglasses and lucky leprachorn and leaving my Ferrari running at the roadside.

To get just the daily maximum on one card from a supermarket would take many visits, buying something else each time and hoping not to be spotted by the security staff, management or checkout operators. Who tend to notice people buying a packet of Smarties and asking for maximum cashback each time and work for long shifts. Or someone called Ms B.. with a beard.

There are at least 8 cash machines in my local town. There are two supermarkets giving cashback. One typically has 2 checkout staff working during the day, the other 4. Queueing at one till whilst another is empty - to avoid a particular operator, is likely to be noticed and you would probably be dragged to the "wrong" till..

The card limit is not the issue, the daily limit is. The daily limit would need 10 trips to supermarkets or 1 trip to an ATM - each day. To hit the card *ATM* limit withdrawal on one of my cards would require at least 10 trips to the ATM on, at best, successive days - or 100 trips to the supermarket in the same period, assuming the loss wasn't detected or the AI doddgy transaction alarm tripped. 200 trips to max out the card limit on cashbacks.

I now that checkout staff may not always be the brightest cookies in the tin but they might notice that many tubes of Smarties..

Added to which, the odds are that the loss would have been noticed well before the ATM limit was reached - and being in a supermarket with all those cameras and witesses is not the best place to be when having a stolen card checked.

IIUC, most cards are used immediately and then discarded, or used at places where the "phone home" limit is known - and cashback isn't an option.

Perhaps you have not heard of cashback, which also gives 100% untraceable cash at 100% face value and works fine with signature cards with no need to discover the PIN. Doesn't take long to rake up a large amount either, as there is no limit to the number of cashback transactions right up to the total limit of the card.

But the solution to the ATM issue in any case is to push the suppliers for either (1) a different PIN for ATM use and/or (2) disable the card for ATMs rather than insisting on a sig card.

I'm pretty sure that (2) is already available. AFAIK my company credit card will not work in an ATM. My previous one certainly did not - I haven't tried the latest one.

Thanks for the link. It's hard to estimate the risk of, for example, a man-in-the-middle attach without knowing at lot more how the chip works. If, for example, the chip contains a private key then the chip itself must at lot of the work itself.

Mark.

Can you be sure you have covered it sufficiently? Can you spot the extra keypad reading the PIN's? A rewired POS that records PINs?

I don't follow that. My chip and sig cards have no PIN (to the best of my knowledge - certainly none have been issued to me) - they cannot be used at ATM. Note that they have been issued as chip and sig cards and are not just legacy signature cards, that may have had a PIN.

Hiding your PIN may be easier if you are 6' tall and built to match. Making it less than obvious that you have a PIN and know your PIN is not quite so easy. I do not want to be followed and "asked" for mine. The increased risk may be negligable in reality but so is the risk associated with pulling the trigger on a gun you believe to be empty, in a locker room.

Never thought of that one! That is news, thanks. You must have an honest face..

I don't think many small jewelers and the like give cashback and the cash return for such items is, IIUC, low - particularly for unused engagement rings, IIUC.

Whilst the crook may leg it, as you put it - I don't think that they will come back very soon. And there *is* always the possibility of some off-duty young, fit, fractious, police officer being next in the queue. Or some able bodied citizens who don't know that they shouldn't arrest you..

Bitstring , from the wonderful person Cynic said

How, pray, do you use a chip & sig card at an ATM (a proper chip & sig card, which has never had, nor ever can have, a PIN number).

Bitstring , from the wonderful person Cynic said

None of the supermarkets round here will give cashback against a credit card + signature. Debit card - yes. PIN - yes. actually most of them won't even ask you about cashback if you hand them a credit card, as opposed to a debit card .. I guess it could just be that =I= don't look stupid enough to take a cash advance on a credit card, but they don't seem to offer it to other people either.

Thats because the crims havent started focussing on this method yet, once they do and the percentage of fraudulent 'faulty cards' rises too high, they will stop. Plus as some shops stop accepting them, the ones that dont will see higher percentage of fraud.

Why isnt your card accepted? There is a difference between a store having a general problem (low prob of fraud on any one card) and just your card bad (higher prob)

At 10:47:47 on 14/12/2005, Poldie delighted uk.finance by announcing:

AFAIK you have to advise your bank that you've forgotten the PIN before trying to unlock it.

I apologise if I have caused you any inconvenience.

I was already aware of the subject line, thank you. I wanted to know about how the refund process worked with Chip and Pin debit cards.

Alex Heney has answered my question.

I don't know always know the reasons why sometimes my card is not accepted. I don't think it's the card since it is usually OK.

"Mike Scott" wrote

I did. Where did you give any reasons why you think it is a "fact" that "a PIN is not [disclaimable]"?

IIRC I read somewhere that there is an agreement between the banks and the supermarkets that they *must* offer a cashback when a debit card is presented. Not sure whose interest this is in, maybe its mutual.

That would be the secure thing to do, but a quick search of the net reveals info from people like APACS as follows:

not true, it can be guessed and you can be seen whilst using it. Luckily CC companies agree with me and not you.

Put yourself in the shoes of a card thief. It is easier to steal any old card from an open handbag or similar than to find a PIN and then go after that *particular* card.

If I were a thief, I would definitely *not* use a stolen card in a small village shop or supermarket where it is likely that everyone knows everyone else. And despite the fact that you need to make 8 times as many cashback transactions as ATM withdrawals, the advantage of not needing to harvest a PIN prior to stealing the card would be a far higher advantage to me as I could go for only the low-risk thefts. Let's face it, the greatest risk of capture occurs at the time you steal the card, not when you use it. Many thieves also have a mate who works a till somewhere and so can use it pretty much risk-free. The risk is not great anyway. Preventing a CCTV recording from being able to be used to positively identify you is trivial. A wig, glasses and (if male) a false beard should be sufficient even in the unlikely event that the image is shown on "crimewatch". But CCTV images are unlikely to be a problem anyway. Unless someone who sees the footage actually recognises you, so what?

As for matching the name - one of my cards has the title "Mr." that would show the cardholder is male, but two other cards have only initials and surname. Not that checkout clerks appear to look at the name on the card IME.

Of course, due to the fact that there are few people remaining with sig only cards, you will benefit from the overall better security of the C&P. Because there is hardly any point in stealing cards opportunistically these days, when it is almost certainly going to require a PIN to use except in customer-not-present transactions - which will not gain enough to be worth the trouble.

It is easy for a 3' tall midget as well. If you can reach the keypad with one hand, you can completely cover it with the other. Enter the numbers by feel.

Having a sig only card does not decrease that risk one bit. A crook does not know that your card does not work in an ATM, and would demand the PIN anyway. In fact, not having a PIN to give the mugger may be more dangerous! But I really think that in that respect you *have* been made paranoid by your history. At least I do not see many reports in the media of such muggings in the UK.

No - just a good story (which in the case in question was true).

I was thinking expensive jewelry in the case above - and I believe you are incorrect in thinking that the resale value is low. Many types of jewelery is one type of goods that has a particularly good resale value IIUC, and an immediate resale would probably result in a *very* good percentage of the price you paid for the diamond necklace or whatever. So long as the items are unlikely to be tracked as proceeds of a fraudulent transaction. I admit that I have no idea how likely that is, but I doubt that photographs of £500 bracelets etc are routinely taken, matched with a fradulent card sale and then matched with sales to other jewelers in distant cities, or even that jewelery in the £500 bracket are unique designs in the first place. It is not the same as fencing stolen goods - the thief is presenting as the legitimate owner of the items and so gets the fair market value. Not as convenient as cash to be sure, but still easier than getting hold of a PIN.

A risk, but a low one IMO. Part of the occupational hazards of the pickpocket. Remember that the sensible thief is using the card only up to an hour or so after lifting it, so the chances are good that it is not flagged in the first place. The next person in the queue would not know that the card has been stolen - the checkout clerk *may* know, depending on the message displayed on the screen - though I don't think the message is all that specific (BICBW). At which point the customer sees that the transaction is not going smoothly, pleads urgent call of nature and walks briskly away.

If it has never had a PIN, then obviously the crook could not have got hold of the PIN and so my comment does not apply.