Chip and PIN cafuffle

[StoneLaughter]

OK - I sent the following to Smile which is self explanatory:

Originally Posted by StoneLaughter

Dear Sirs

CHIP AND PIN – SECURITY CONCERNS

My Concerns

I have always been extremely concerned about the security of Chip and PIN cards even before they became widely used. The reasons I am unhappy with them are firstly that knowledge of a PIN is extremely easy to come by; and once obtained, full power over the money in the account is also obtained. I cannot dispute using the card because there is no signature slip to be checked against my signature, and there is no identification or authentication inherent in checking a PIN – there is merely a check of an arbitrary number. If someone had spotted what my PIN was having looked over my shoulder, I would have no knowledge of it and no recourse. This makes identity theft ridiculously easy… all I need to “be” someone else for a while is a debit card and the attending PIN.

A good signature, however, even when a sample of it is in front of you, is difficult to forge. Further to this, it takes time to learn so that it looks like you’re signing how you always do (time in which I can be cancelling my cards); people can spot someone who is struggling to sign “their own” signature. This means that a signature carries with it an element of authentication and identification. It can later be checked by its owner to determine that it is, in fact, a correct signature.

With these concerns in mind, I must state that I am happier with the security provided by a signature than I am with that provided by a PIN.

What I require

I would be grateful if you could immediatelyreplace all of the Chip and PIN cards in my possession from SMILE with Chip and Signature cards – a possibility by the way which was brought to my attention not by SMILE, but by a third party; a fact which disappoints me greatly.

I look forward to your reply by return,

Their reply was as follows by secure message:

Originally Posted by Smile

Hello Mr StoneyGiggle

I've just received your letter, outlining your concerns about Chip and PIN.

I'm sorry but we can't opt you out from the Chip and PIN system for the reasons you've given.

The aim of Chip and PIN is to dramatically reduce card fraud in the UK. All banks will now use Chip and PIN and we can only opt somebody out from the Chip and PIN scheme if there's a specific reason why you're unable (this normally means physically unable) to use this system.

If there is such a reason then you can reply to this message so that we can look into your opt out request at a higher level.

If you've got reservations about the new system then maybe checking out the official website would settle your mind, you can get further
information by looking at WWW.ChipandPIN.com.

Thanks

Lee

Needless to say I wrote back by secure message stating that I was dissatisfied with the response and asking if this was their final response on the matter...

[thewifeandI]

If CnP is doing such a good job to prevent fraud, why haven't we seen a reduction in interest rates on credit cards and a reduction in bank charges to reflect this fact? Surely one of the reasons why they claim to charge such high rates is to cover their losses (i.e. pass them on to us), and if those losses have reduced then we should benefit.

Cheers.

[dave]

Indeed, if it's so 'foolproof' then why did Shell stop using it after 1 million of their customers got ripped off!??!

[StoneLaughter]

OK - here's the transcript of secure messages from their site. Do I have enough to complain to the Banking Ombudsman, and who else could I complain to?

Originally Posted by Secure PM's at Smile

Message From Bank
-----------------------------------------------
Operator ID : LSAUNA
Date : 17/05/2006
Subject : General

Hello Mr StoneyGiggle

I've just received your letter, outlining your concerns about Chip and PIN.

I'm sorry but we can't opt you out from the Chip and PIN system for the reasons you've given.

The aim of Chip and PIN is to dramatically reduce card fraud in the UK. All banks will now use Chip and PIN and we can only opt somebody out from the Chip and PIN scheme if there's a specific reason why you're unable (this normally means physically unable) to use this system.

If there is such a reason then you can reply to this message so that we can look into your opt out request at a higher level.

If you've got reservations about the new system then maybe checking out the official website would settle your mind, you can get further
information by looking at WWW.ChipandPIN.com.

Thanks

Lee

*********************

Message Sent to Bank
-----------------------------------------------
To : BANK
Date : 17/05/2006
Subject : General

No, checking out the website will not "settle my mind". I am dissatisfied with your response. Chip and PIN will NOT reduce fraud, it will make fraud EASIER, as set out in my letter. Does your secure message constitute your final response on the matter?

*********************

Hello Mr StoneyGiggle

Unfortunately this is correct, the bank's final decision is that in your circumstances we can't opt you out of Chip and PIN.

Only under exceptional circumstances can we opt a customer out of Chip and PIN with reasons being that they can't physically use the system, otherwise the procedure would be being abused.

I'm sorry that you're unhappy with this, I've logged your concerns in our internal system which stoes customer's feedback.

Procedures like this are discussed and tested a long time before they actually come into place. All banks are now required to comply with the rules and regulations which were set in place on the 14.02.06.

Thanks

Claire

[thewifeandI]

Originally Posted by StoneLaughter

OK - here's the transcript of secure messages from their site. Do I have enough to complain to the Banking Ombudsman, and who else could I complain to?

I have the suspicion that the reason they like it so much is that they can easily claim that the fault is yours - "If YOU didn't let someone know YOUR PIN then how did THEY get hold of it?" - and it's hard to prove otherwise, therefore their liability is removed, and passed pack to YOU.

Mind you, I have seen terrible examples of PIN entry with people standing back and jabbing at the keys almost at arms length and making no attempt to obscure the numbers they are pressing - I always have my wallet in my left hand to obscure the view from that side and my other hand over the keys to avoid being seen.

Cheers.

[StoneLaughter]

Anyone? Does anyone know if I can complain to the FOS? Or are there rules which they're operating to, that PREVENT them opting me out?

[JimmyTheOne]

My debit and ALL my credit cards from different providers are Chip & Signature. After recent events I glad they are!

Here's how to get C&S cards:

Tell them you don't feel safe using a PIN (This is an exceptional circumstance), and their adverstising material says they meet the needs of all their customers

I'm sure you have difficulty remebering seldom used numbers (this is a reason too). If they tell you to change your cards to something you can remember, tell them your already use this number for another application. If they say change your cards to operate with the same PIN - then say Card Watch (Administered by APACS, the people who brought you Chip & PIN) say Do Not Use The Same PIN For Each Card.

http://www.cardwatch.org.uk/default....d=3&pageid=105

Threaten to change providers. (All of the above have worked for me - and they are all true).

You may find they ask you if you are disabled - politely tell them to mind their own business, you find this personal and an invasion of your privacy.

You will not be required to provide medical evidence to support your request.

If all else fails - Try this:

My bank decided that it would prefer to give me a Chip & Signature credit card rather than have me comply with their T&C on the Chip & PIN card.
The terms of the C&P card required "cardholders to notify the bank immediately the cardholder suspected anyone else knew their PIN" - the banks words not mine. I pointed out that everytime I used the card in a store I must suspect that someone knew my PIN (shop assistant, customer behind, CCTV camera operator). Even if I shielded my PIN I could not be sure nobody knew.
Therefore I was duty bound to call them and advise them of my suspicion and they could take what action they deemed necessary.
The T&C did not specify what action they would take and I would not insist on any. When they told me that the automatic action they would take was to cancel the card and re-issue it, the penny then dropped with the bank that they could either issue me 50 plus cards a year or issue a C&S card.
The thing I found interesting was the bank commenting that they didn't expect people to read the T&Cs. I wonder why.


I've been very persisten and due to recent events, gald I have.