My latest article for The Times Online, called “Chip and SPIN“, points out that the much-trumpeted switchover to using PINs rather than signatures for plastic card transactions in the UK may not have been as consumer-beneficial as the banks would like us to believe.
Since it was published, someone has emailed me the following additional information:
- In 2005, fraud at ATMs stood at £74.6M, a rise of 81% on the previous year. (Source: Card Fraud the Facts)
- A recent announcement from Tesco, relating to their attempts to combat card fraud, said: “Statistics show that skimming accounted for over £95 million-worth of losses to customer accounts across the entire network of ATMs.”
This is another rise (of about 27%) for 2006 so far. - It should be possible to contact your bank and opt for a “Chip and Signature” card if you feel unsafe using a PIN.
Good points, but I have a couple more to add:
Before, chip and pin card thieves had to go face to face with somebody and be put under pressure to fake a signature. Once they did this, they then also needed to sell the goods on at a lower price to get cash. With Chip and Pin, they can instead just go to the local ATM and bang, they have cash. Nobody will see if they are uneasy, nobody will remember their face and they don�t need to do dodgy deals afterwards.
And that isn’t the end of problems. Need I mention the pathetic chip and pin terminals that hardly have a centimetre of plastic to obscure you typing in your pin. How many times have you clearly seen what people are typing purely by accident? But what do they care, it isn�t their liability anymore.
Rj
Did you know that Chip and Pin has already been hacked in some Shell petrol stations in the South East?
“Petrol giant Shell has suspended chip-and-pin payments in 600 UK petrol stations after more than �1m was siphoned out of customers’ accounts.”
My local Shell petrol station near Woking is back to using signatures…
I got an amex card near the beginning of last year (I travel a lot and they have some decent travel related benefits), I was surprised that the card they gave me had no chip on it considering that my Barclaycard had been chip and pin since 2004. Since then amex has introduced chip and pin but their policy is not to issue these cards to customers until their existing card expires (2008 in my case) – however as the signature started to become illegible I needed to get a new card so was forced into chip and pin.
So it looks like ultimately Amex was a reluctant participant in the chip and pin programme. I have to agree the location of these makes it very easy for others to see what you’ve entered, however, the signature wears off my cards very quickly so I usually get a new card every year.
Why don’t they adopt the scheme where the signature is already printed on your card when you receive it and have a photo on the back like some other countries (and I think RBS over here) do.
Intersting to note that while thousands of small outlets have been forced to pay out for new Chip and PIN terminals, I could quite easily walk into Tesco with a stolen card and put a few hundred pounds of groceries, alcohol, CDs or DVDs through the self-checkout system simply by swiping the card and walking out – no signature or PIN required.
I wouldn’t go by Tesco statistics, they have self-service checkouts that don’t even *ask* for your pin – you can just swipe any credit/debit card and use it without any means of testing that it’s yours.
A further point. My friend’s card was ripped off at a local ATM and hundreds of pounds of his money were spent in Canada of all places. His bank and the police were investigating (since it happened to a number of people) and he was fully refunded. It’s not all doom and gloom on the liability side of things.
Tesco only requiring a swipe for purchases is crazy. All the supermarkets that I’ve been to with self service tills use the same software but the card reading hardware seems to vary.
Marks and Spencer have a chip and pin pad although the buttons are very big so people can easily spy on your pin, however they do have a handle that you can use to tilt the PIN pad out of view. They also have a signature pad for signature cards.
Tesco has a swipe on the side of the monitor. No PIN no signature.
Sainsbury’s uses the same card reader as their conventional tills. Has a PIN pad but nowhere to sign.
The whole point of plastic debit or credit cards are to make them safer than carrying cash.
The articel by Gervase, highlights the fact that Chip & PIN isn’t what we’ve been led to believe it is, and liability for fraud where PINs are used weakens the cardholders position.
ITN News, week before last, Prof Ross Anderson (Cambridg) said, “The police should be investigating the banks for defrauding consumers into letting them think Chip & PIN” is safe.
Bearing in mind that the card industry can’t keep your PIN secret, and you’re expected to comply with terms and conditions with regards to PIN security, you may think PINs aren’t for you.
If you have issues with PINs, forget your PIN or PINs, refuse to use the same PIN for each card, libaility concerns, are worried about the lack of security offered by PIN pads and ATMs, well you should consider continuing to sign.
Chip & Signature cards are available, it is just the card industry are keeping quiet about them. This really isn’t in the spirit of the Banking Code but neither are a lot of things.
Can individuals do anything ‘different’ to protect themselves?
Yes!
You can reduce the chances of someone using your personal details (stolen or forged) to take out loans, obtain card or open bank accounts in your name:
Taking Identity Fraud in Hand:
http://news.bbc.co.uk/1/hi/programmes/moneybox/3574779.stm
You can extend the above system to work with your plastic for face to face transactions. Put your print on the signature strip. (same theory as above). Then when the transactions slip is produced for you to sign – put your print on it. This doesn’t prove you are who you say you are, but it does deter crooks, it does remove the liability for fraud question and it helps identifying perpetors. There’s no requirement for shopkeepers to check the print – it can’t be forged, forgotton or compromised.
http://www.24dash.com/content/news/viewNews.php?navID=34&newsID=3685
If card issuers embedded a message in the multi-function CHIP and magsrip that the cardholder PRINTED and signed. Then I ask, what value this type of card to the fraudster. In addition it could very easily be adapted to combat CNP fraud for the purchase of goods.
This type of card would go a long way to achieving what cards are supposed to do. Make them safer for YOU!