PIN used in Fraud? - BEWARE.

[JimmyTheOne]

Banks are routinely refusing to compensate victims of fraud because they insist the customer's own card must have been used.

Chip & PIN has increasingly been used to push the liability for fraud back on to the customer.

From the Industry Expert:

"There are lots of ways someone can fraudulently get at your Pin and card" Sandra Quinn APACS.

Story click here.


Why be responsible, and liable for aleged misuse for something the Industry itself can't keep Secret - a PIN.

TIP:

There is an alternative. Chip & Signature.

Reduce the risk to yourself. Bin your PIN with your credit cards and continue to sign. Get yourself Chip & Signature Cards.

[buzby]

Whilst fully supporting JtO's stance - there is a downside. Despite the impression given by the linked story, ATMs to NOT make use of Chip & PIN, and unless there has been an overnight upgrade program I've not heard about, the bank ATMs continue to use MagStripe ONLY for card verification, a fact known to both the banks AND crooks.

Therefore the banks - when rejecting the claims for people that they must have disclosed their PIN, it has nothing to do with the 'chip' just the same old PIN which is stored in encrypted form in the mag stripe as WELL as the card.

The downside to Chip and Signature (from the consumers PoV) is that a C&S card although looking identical to it's C&P relation, it contains a blank PIN field on BOTH the chip AND mag-stripe. This means that whilst you may have expected to be asked to sign for goods at Argos & ASDA, at a hole in the wall, the reality is that you CANNOT use them, as the card will be rejected. This means the ONLY way to obtain cash is - if it is a Debit card - to get cashback from a supermarket up to the £50 limit.. For a credit card this is less of an issue as you'd be quite silly to take a cash advance.

Inconvenience is high if you need to get cash, but recent press stories about muggers taking cardholders to ATMs for an electronic 'mugging' won;t get far, as the card (as it has no PIN) is simply rejected with an error message.

[JimmyTheOne]

I did say Chip & Signature Credit Cards.

Here are some tips to reduce the RISK to you.

Change ALL your credit cards to Chip & Signature (Unless you specifically wish to use credit cards to withdraw cash at ATMs).

A handy alternative to a Chip & PIN debit card is to use a Banks own savings card. Nationwides CashBuilder Card for instance can be used in ALL UK ATMs, but not in shops. You can then transfer money into your CashBuilder Account when required.

Even with a Chip & Signature Debit card you can get cash back at certain retailers.

IMHO the above tips makes carrying cards safer than carrying cash or cards with PINs. PINs used with stolen or cloned cards allow crooks access to large sums of money without ever being challenged. NO PIN = NO DOSH.

[patdavies]

There is a very minor negative - it takes longer to transact.

Curry's for example have an in-house rule that any card requiring a signature requires a manager to authorise the transaction.

This is because of the transfer of liability

[JimmyTheOne]

Originally Posted by patdavies

There is a very minor negative - it takes longer to transact.

Curry's for example have an in-house rule that any card requiring a signature requires a manager to authorise the transaction.

This is because of the transfer of liability

That funny, becasue I've used my Chip & Signature Debit & Credit Cards in Currys several times since 14 Feb 2006 and have never once seen the manager.

[blitz]

It would be down to story policy, regarding chip & signature cards its very easy to forge a signature, easier then spotting someones pin

[JimmyTheOne]

Forging a signature means crooks have to face-down shops staff.

Forging a signature means the genuine person isn't held responsible for 'PIN' misuse (as per the above link).

Forging a signature means there's a good chance of the crook leaving forensic evidence at the scene of the crime - Their prints on the transaction slip, or if they panic and leve the card, their prints on the card.


Using a PIN with a Stolen or Cloned card means:

Crook can hit ATMs for hard cash, anywhere without ever being challenged.

They can use genuine cards with valid PINs at any Chip & PIN retail outlet without being challenged

Using a PIN means the RISK to the crook is very low, while the rewards huge.

Not so with a signature.

I'ts your choice. PIN or Sign

[JimmyTheOne]

Maybe This Story Will Change your Mind.

Iain Richardson, 44, an Oxford-based business manager for golf courses.
He had two debit cards stolen from his local gym on August 23 after his locker was forced open with a screwdriver. He immediately cancelled the cards but money had already been withdrawn from ATMs and directly over the counter at two local banks.

At NatWest, £250 was withdrawn from a cash machine and a further £1,800 in an over-the-counter transaction using chip and Pin – but the bank refuses to refund the cash. This is despite the fact that it has forwarded CCTV footage of the criminals on to police.

Iain is furious at being labelled incompetent: 'They said I was irresponsible with my Pin number, but I said there is no way that could have happened. I have had the same Pin for six years and haven't written it down anywhere.

Full story click here.

This isn't an isolated case. Read the readers comments at the bottom of the article on my first posting:

[blitz]

Just means banks should hurry up and get biometics sorted out, (chip, pin and thumb).

[buzby]

That isn't going to work either, and it means you having to give up more of your bio data to anyone that wants it. There used to be the old story of folk getting their thumbs cut off simply to facilitate the theft of a car protected by biometrics, but the best was the latest breed of fingerprint access door locks. These could be opened with a photocopy of the thumb print, pressed against the scanner with a 'real' finger, providing the body heat. Just try claiming it wasn't you when it REALLY wasn't you!

[JimmyTheOne]

But it does work buzby. You seem to forget that when using with a plastic card the cardholder (or crook if they dare) will be submitting their print in front of another human being. Not a machine.

Here's some proof:

A woman used cheques she had just stolen from a policewoman's car to buy £1,500 worth of clothes.
Both stores insisted she give her thumbprint. When the cheques bounced, Ian Hendry, the stores' owner, forwarded the thumbprints to the police.
The woman had form, was quickly identified, arrested and found guilty in court.

We've not had one incident of fraud in five years.

Inverness has seen a reduction in the numbers of incidents involving credit card fraud by a staggering 81.2%. The thefts of handbags, purses and wallets has also reduced by 54.5%.


Car Hire companies, although they view passports and licences and take payment by Chip & PIN, they're also taking prints.

During the trial period 48,000 vehicles were rented from Stansted and all were returned at the end of the rental period. On average 15 vehicles a month were reported missing by Europcar in 2006.

Implementation of the thumbprint scheme across our network will be a significant deterrent against vehicle theft, and as the trial at Stansted has proved, it has been 100% successful.

Retailers, Car Hire Companies are protecting themselves and indeed the general public as they pick up the cost of crime.

You can FORCE crooks to SUBMIT Their PRINT if they wish to steal your ID.

I would suggest that a Chip & Print, or Chip, Signature and PRTINT would be highly effective.

It would be safer from a physical threat carrying one of these (Chip & PRINT) types cards and would certainlty remove liability issues for card misuse. If crook are stupid enought to submit their print with a stolen or cloned card - BINGO - You've given the Old Bill the tools (perpetrators print) to do the job.

It's also very easy to adapt the concept to deter CNP fraud. That is theft of goods ordered via the Internet, or by Mail Order or Phone.

There's no database of prints. There's no civil liberty issues, as it's driven by the user. Crooks don't have a choice.

Hope you find this interesting and making sense.

Consumers have the power to protect themselves and finger crooks.

[buzby]

You miss the crude part of it - a till operator is not going to look at the thumb going into the reader in the same way they don't watch you entering your PIN. It is a matter of moments to stick a circular oval on your thumb and fool the reader. You could be smart and put the image on cling film to be less obtrusive, but the researchers found standard 80gsm paper worked fine.

My other point remains valid nevertheless - if your thumbprint becomes cloned (and lets face it that is easier to do than a CHIP) how can you prove to the satisfaction of the card issuer it wasn't you? They're currently objecting to PINs entered via a mag stripe reader, so it is not as if we don;t know what is going to develop.

What you described - the cheque thumbprint - is crude but effective, unfortunately this isn't what we're talking about for cards and passports, This is to be an electronically scannable verification, and it is THIS that is open to manipulation.

[JimmyTheOne]

Sorry Buzby, but youve missed the point.

With the system I'm on about there is no reader to place you Thumb into, or database of Prints held anywhere.

The system works thus:

Card is entered into card reader. Chip is checked to authenticate card.

Transaction slip is dispersed for the person presenting the card to submit their PRINT.

Re Passport Applications, Driving License Applications etc. Where the system falls dow (Biometric or Not) is during the issuing process.

The IPS shares data with the CRA's could I dare suggest they do the same as the Banks and Card Issuers. Check the applicants Credit File to see if they are signed up to Thumbprinting. No Print on the applications, don't issue the Passport of Driving Licence. (As you say, simple, crude but effective).



Retailer visually checks the Print on the signature strip against the Print on the shops copy of the transaction. (Remember when consumers who signed complained that retailers never checked their signature? We you can't forge the genuine cardholders PRINT.)

Transaction slip with PRINT is held by retailers (or the carrier in the case of a goods delivery company). Thus providing an auditable trail IF fraud is committed.

Transaction complete.

If in the remote chance your Thumbprint was cloned, then to use the "Cloned Thumb" successfully you would need the retailer to be colluding in the crime. (This has never happed as yet, and the concept has been used in US Banks for around 10 years now).

If this happened, pardon the pun again. It would stick out like a sore THUMB.

[buzby]

With respect, this is just old technology being adopted as new - so using the description of 'biometrics' is quite fanciful, and a stretch of the imagination. This is just boring old fingerprints of old, and unless the fraudster is already 'known' to the police because their 'dabs' are on file they have nothing to worry about.

I'm talking about the modern-day usage of biometrics where passport and ID card cheques WILL require use of a scanner and no footling pieces of paper that a retailer will have to find in the hope the police will do something. What you describe isn't an additional level of security, but a level of identification. There's no 'pass or fail' simply a passive extra layer that can be called upon in the hope of bringing a fraudster to justice.

We have now reached the stage that staff in shops are telling folk that their card is 'faulty' because they MUST enter a PIN, and have no pens to allow a signature! With this level of incompetence, getting a fingerprint on a slip a non-starter. Add to the fact can you be sure any print you give will also be secure, and not used to create a false identity?

I certainly would not provide a print for this reason, the same holds true for stores that expect me to sign on an electronic tablet to 'capture' by signature for the very same reason!

Of course, if I paid by cheque I wouldn't be having all these additional problems!

[JimmyTheOne]

Buzby, boring old technology works, and a print is a biometric.

The essence of the 'boring old system' is you dont get False and Real Rejection rates. The old system doesn't say no. In addition the old system does something the new doesn't - provides a print (forensic evidence) of the perpetrator.

Your PRINTS are on everything YOU touch, so you've already submitted your PRINT. Here's a chance for you to FORCE crooks into submitting their PRINT.

Last but not least, ALL my cards bearing the or Visa & MasterCard Cards logos' are Chip & Signature. I've been using my PRINT vice

[JimmyTheOne]

Buzby, boring old technology works, and a print is a biometric.

The essence of the 'boring old system' is you dont get False and Real Rejection rates. The old system doesn't say no. In addition the old system does something the new doesn't - provides a print (forensic evidence) of the perpetrator.

Your PRINTS are on everything YOU touch, so you've already submitted your PRINT. Here's a chance for you to FORCE crooks into submitting their PRINT.

Last but not least, ALL my cards bearing the or Visa & MasterCard Cards logos' are Chip & Signature. I've been using my PRINT vice written signature for almost 2 years now, at every major retailer at home and overseas. I've never been turned down at point of sale.

In Spain recently, others (using Chip & PIN) were asked to produce photo ID. Funnily enough, Spannish retail staff caught on very quickly and never asked me.

PIN, Sign or PRINT. It's your choice. What's best for you? I know which I prefer

Video Clip click here -- What no liability?

[JimmyTheOne]

Latest WARNING from the Citizens Advice Bureau in this BBC News 24 Video Clip; (1 min and 55 secs