Safe Speed Forums

Been rumours of certain sites with problems for a week or two --now this

Shell halts chip-and-PIN after fraud

Eight people have been arrested in connection with the racket which has demonstrated for the first time that chip and PIN machines, which were meant to end card fraud, are far from tamper-proof.
And

BP is also looking into card fraud at petrol stations in Worcestershire, but it is not known if this is connected to chip and PIN


http://www.timesonline.co.uk/article/0, ... 26,00.html

_________________
lets bring sanity back to speed limits.
Drivers are like donkeys -they respond best to a carrot, not a stick .Road safety experts are like Asses - best kept covered up ,or sat on

So let's see what happens when the ID card scheme is brought in

_________________
Useless laws weaken necessary laws.

My local Esso don't use the chip and PIN machines either, and I remember a conversation with the manager of our local Maplins about the security of the system too.

At the end of the day, there will always be people out there who will find a way round any security system and the only way to prevent fraud is by vigilance.

_________________
Science won over religion when they started installing lightning rods on churches.

I doubt the system was tamperered with at all - it was probably either a skimmer clipped to the till or (less likely) clipped to the PIN pad such that the card was skimmed as it was inserted.

In the case of the till, all the cashier would need to do is say "sorry mate, the machine is broken, give it to me", they would skim it and then insert it into the reader on the till and ask the person to enter their PIN. The PIN pad would have a simple overlay which records the PIN but the buttons still press the buttons below.

Obviously this requires cooperation from a member of staff, but considering the large profits and low wages it wouldn't be difficult.

*However* there may well be some flaw that has been exploited, but I would be suprised considering the short length of time the systems have been in use.

Gareth

One of the worrying things for me about chip and pin is that each retailer must obtain his own machine. This means that there are lots of types of chip reader, so you cannot be confident that the device to which you've just disclosed your PIN:

1. has not been tampered with or modified to harvest magstripe and PIN
2. is not something a fraudster has knocked up for the purpose

Another worrying thing is that it is relatively easy to challenge a forged signature, but relatively difficult to challenge "forged" presses of a keypad. The system thus transfers much of the liability for fraud onto the cardholder.

_________________
Will

But I do recall this stuff we used to carry around in our wallets and purses. What was it called now, oh yeah...money!

[quote="Rigpig
But I do recall this stuff we used to carry around in our wallets and purses. What was it called now, oh yeah...money! [/quote]

Think it was - or last time i saw any it was.

Trouble is that with employers insisting on paying wages ( for the posh -salaries) through the bank, unless you want to keep a large sum at home (after getting it out over the bank counter,if it's open when you're off work)it's not practical to do anything other than use a cash point ( or get cash back in a shop)

One report i saw claimed that at one petrol station employees had rigged up their own camera.

Perhaps we're heading back to the old days when a bank let you buy vouchers to insert in their machines to get cash ( or where banks were open reasonable hours)

_________________
lets bring sanity back to speed limits.
Drivers are like donkeys -they respond best to a carrot, not a stick .Road safety experts are like Asses - best kept covered up ,or sat on

Well, quite. "Increased customer security" my big fat hairy ass. If the banks had been honest about the whole thing (an obvious impossibility), they'd have admitted this from the start.

It seems to me that the chip and PIN system is of limited security value until both the mag stripe and the manually-keyed entry have gone out of use completely (which will take years) and all our card use, including home shopping on the net, requires a smart card reader. For now, it's more convenient than signing a curly bit of paper with a knackered pen, but only marginally more secure. The danger is, everybody thinks that because it's shiny new technology it must automatically be safe.

As things stand, the system offers little protection to the cardholder against skimmers or unscrupulous retailers. It is just an extra layer of "proof":? to the retailer and the credit card company that you are the cardholder. Neither is it an "authorisation" for the transaction. There was the story of the chap who paid his restaurant bill with chip and PIN, and the restaurant forgot to add on their compulsory service charge, or something. But they had his card number, name and expiry date, so they just ran a second transaction through on his card for the extra amount - no PIN required - customer not present!

had something similar before chip and pin - returned item as faulty --supplier could find no fault and returned it and demanded payment.I haggled as i had a manufacturers code .Week later got a reciept for payment, "cardholder not present" - phoned bank to make certain no extra charges from this firm - bank advice - w"we'll request return of payment - not authorised by you" .I let it go as i felt at the end of the day i was morrally bound to pay. But shows how your bank can help.

_________________
lets bring sanity back to speed limits.
Drivers are like donkeys -they respond best to a carrot, not a stick .Road safety experts are like Asses - best kept covered up ,or sat on

Your bank is obliged to return any and all payments not authorised by you (or that you claim are not authorised by you). It is then up to the company that took the payment to chase you for it. Its the standard conditions of the direct debit guarentee. Not sure how it works for credit cards though.

_________________
Science won over religion when they started installing lightning rods on churches.

Sixy - this was a debit card. My worry was that having bought goods from them they had retained my card details and hence my call to my bank to put a block on any further requests as a precaution.

_________________
lets bring sanity back to speed limits.
Drivers are like donkeys -they respond best to a carrot, not a stick .Road safety experts are like Asses - best kept covered up ,or sat on

i have never like the idea of chip and pin. every time you use your card, it is an opportunity for someone to see you enter your pin. how can that be safe? i use cash whenever possible and i avoid paying by plastic at the till. cashpoints, yes but only when i need to therefore, i take out the max allowed until it runs out

_________________
Richie

SSAFA supporter
http://www.facebook.com/group.php?gid=126025031585

Thats another problem - finding a cashpoint with cash - especially on a Thursday ( benefit day) and before long Monday ( pension day ) .Since they decided that paying through the bank saves jobcentres money cashpoints with cash are getting hard to find.Mind you gives the jobcentres another excuse ---used to be "your giro's in the post" --now it's "sorry the banks are slow etc".

_________________
lets bring sanity back to speed limits.
Drivers are like donkeys -they respond best to a carrot, not a stick .Road safety experts are like Asses - best kept covered up ,or sat on