Fake Britain Chip and Pin etc

[wolf1]

Not that Dominic Littlewood is a PH favourate but I've just watched the latest fake Britain on I Player and was shocked at how unsecure chip and pin is. Now I know quite a few have said from the start that it was flawed, but the fact that the card/pin terminals are coming from the manufacturer already doctored to store and transmit the pin number and details is very worrying. Not to mention the £30 keyloggers that they can plug into the terminals to save your details etc.

Looks like I will only be using the card to draw cash from my banks machine (Obviously checking for fake overlays etc) until the system gets changed.

What does make me ponder is how can they make it more secure? Finger print scanner, retinal scan. The banks must be hemorrhaging money paying back fraud claims so you'd think that they would have something better in place by now.

[ShadownINja]

Just to check... are the scanners scanning the chip or scanning the magnetic strip. There was an interview on Radio 4 with some bank security guy and he said the weakness was the magnetic strip, but because people like travelling they had to continue to use the magnetic strip as too few countries accepted the chip technology which was apparently very secure compared to the old magnetic strip technology. Dunno how true this is, though.

[Cupid Stunt]

When the chip & pin 1st came out I was watching a Dominic Littlewoods type show & some fella got the chip & pin details of a card without looking at him put in his PIN in. The banks were saying this was simply not possible but this fella did it so it clearly was. They then interviewed a few people who knew for certain that nobody had seen them enter their PIN & had been robbed of loads but who the bank refused to pay out on due to them not accepting that there was ways around the system.

I just got the impression that the new system was put in place so that banks could get out of all responsibility for payouts when cards were robbed. A lot of people clearly took the piss out of the old system but they should have looked into the possibility of getting around the new 1 before effectively calling some of their customers liars & saying they weren't getting a penny after being robbed.

[ShadownINja]

OIC. *sighs at banks*

[Carfiend]

Banks in lying c u next tuesdays shocker

[Neil H]

Cupid Stunt said:

I just got the impression that the new system was put in place so that banks could get out of all responsibility for payouts when cards were robbed. A lot of people clearly took the piss out of the old system but they should have looked into the possibility of getting around the new 1 before effectively calling some of their customers liars & saying they weren't getting a penny after being robbed.

This is the only reason chip and pin was introduced, to shift more responsibility onto the card holder.

I had a problem in a restaurant in Paris, the bill came and I paid with my debit card, the clown waiter keyed in the wrong amount, adding a extra zero so my EUR 50 bill was now EUR 500. He handed me the terminal without showing the amount - like a lot of these terminals, it was just asking for my PIN. Took ages to get the money back and my own bank were of no help whatsoever as I had keyed the PIN in, even though I had my bill and the debit card receipt showing different amounts, and a letter from the restaurant admitting their mistake.

[TuxRacer]

Fraud's much more efficient if you don't have to fake one signature at a time.

[davido140]

6-7 years ago (maybe longer) I did some work with a company that was involved in testing chip and pin security, (memory is a bit fuzzy but I seem to think they were responsible for handling the money transfers between banks/retailers/credit card co's, although I may be wrong on this) they were horrified at how insecure it was. They told an annecdote of how they cloned one of the internal guys cards, stuck a chip on a library card and paid for petrol at the garage over the road with it.

They considered the magnetic strips more secure as the technology to clone chips was easier to use and far more readily available.

Are banks still pressing on with the RFID/proximity cards? I saw someone paying in a coffee shops with one the other day, and I seem to recall TFL had a tie in with a bank so your debit card was also your oyster card.

I'd imagine those are stupidly easy to close, standing around with a RF reader on a busy tube platform must get a few dozen cloned cards...

anyone know if the PIN is stored on the card? or is the content of the card encryted and the PIN is the key to unlock it?

If it's the latter surely it cant be that hard to "brute force" the card by trying 9999 PINs "offline" on your own equipment.

[IainT]

davido140 said:

Are banks still pressing on with the RFID/proximity cards? I saw someone paying in a coffee shops with one the other day, and I seem to recall TFL had a tie in with a bank so your debit card was also your oyster card.

Barclaycard.

IIRC you can also have 'cash' on the card as well for microtransactions.

[dugt]

The Chip and pin idea was flawed as an idea.

Before person A had to use their card, because they needed their signiture.

Now, person A can give their card to someone they trust, person B, and they can use their card.

[speedchick]

dugt said:

The Chip and pin idea was flawed as an idea.

Before person A had to use their card, because they needed their signiture.

Now, person A can give their card to someone they trust, person B, and they can use their card.

Exactly and when I worked on a checkout, we used to have a good look at the card while the customer was signing, making sure that if the customer was male, then there was a male name on the card, that it didn't look tampered with, the embossing was ok and such like.

There is just no chance for any of that now, the cashire rarely handles the card and they sure don't get to check that the card matches the person using it.

[Jesus TF Christ]

wolf1 said:

how can they make it more secure?

Use cash.

[sjg]

There have been various proof-of-concept units shown running different firmware (in one case, playing Tetris), in many cases these were put on units and started up with no opening of the devices at all. Not hard to imagine someone writing a new firmware that carried out the transaction as expected but also stored card details and PINs. Then it would be pretty easy for a gang to go around a load of shops with some fake ID, replacing or "updating" units under the guise of being from the card company.

Personally, I don't do any chip & PIN transactions from my current account's debit card - strictly cash withdrawals from major bank machines only. I have a couple of credit cards for day-to-day spending; if (or the inevitable when) one gets compromised then the dodgy transactions are the CC company's problem to sort out and it's their money, not mine, that's tied up. I go on using the other card, life goes on.

[Dave200]

dugt said:

The Chip and pin idea was flawed as an idea.

Before person A had to use their card, because they needed their signiture.

Now, person A can give their card to someone they trust, person B, and they can use their card.

Yes, nobody ever forged a signature, did they. And Little-Miss-minimum-wage at the Tesco checkout rigorously checked every single signature during her 40-hr working week.

Fraud isn't new, and technology simply doesn't move fast enough to keep it at bay for long.

[Reload]

dugt said:

Now, person A can give their card to someone they trust, person B, and they can use their card.

Not sure how accurate this is, but I was told recently that the law around that is going to change.

What's to stop person A giving person B their card, then sodding off and murdering someone? "Couldn't have been me your honour, I was using my card at the time of the shooting - look."

[Frankeh]

Reload said:

dugt said:

Now, person A can give their card to someone they trust, person B, and they can use their card.

Not sure how accurate this is, but I was told recently that the law around that is going to change.

What's to stop person A giving person B their card, then sodding off and murdering someone? "Couldn't have been me your honour, I was using my card at the time of the shooting - look."

They have CCTV cameras in ATM's IIRC.

[Reload]

Frankeh said:

Reload said:

dugt said:

Now, person A can give their card to someone they trust, person B, and they can use their card.

Not sure how accurate this is, but I was told recently that the law around that is going to change.

What's to stop person A giving person B their card, then sodding off and murdering someone? "Couldn't have been me your honour, I was using my card at the time of the shooting - look."

They have CCTV cameras in ATM's IIRC.

Waiters aren't generally fitted with spy cameras though.

[dugt]

speedchick said:

dugt said:

The Chip and pin idea was flawed as an idea.

Before person A had to use their card, because they needed their signiture.

Now, person A can give their card to someone they trust, person B, and they can use their card.

Exactly and when I worked on a checkout, we used to have a good look at the card while the customer was signing, making sure that if the customer was male, then there was a male name on the card, that it didn't look tampered with, the embossing was ok and such like.

There is just no chance for any of that now, the cashire rarely handles the card and they sure don't get to check that the card matches the person using it.

I can't remember the last time i actually gave my card to the person behind the desk, you just put it straight in the machine, and with the self scan things now, how would they ever know?

[bazking69]

I have a card I use with a deliberately set limit of £250. Unless I trust who I am paying, I use this card, or cash, without exception.

Damage limitation in a world of scams and lax security.

[Uncle Fester]

bazking69 said:

I have a card I use with a deliberately set limit of £250. Unless I trust who I am paying, I use this card, or cash, without exception.

Damage limitation in a world of scams and lax security.

The limit applies in the UK, but isn’t enforced worldwide.

My bank records showed me making a genuine transaction in a UK shop. Less than 30 minutes later my card was used in South Africa. It was used repeatedly until the balance was gone and the account hit the overdraft limit. They exceeded the daily limit that I can withdraw by thousands of pounds.

I was later told by the bank that the daily limit doesn’t work properly in some countries. In the UK the ATM’s are interconnected and the daily limit is applied across the UK. In South Africa and elsewhere, the ATM talks to the UK bank, but not to each other.

For some reason the UK bank computer doesn’t enforce the daily limit, it’s the ATM’s. I think that the bank tells the ATM not to issue more funds that day and to tell the other ATM’s. But the ATM’s in some countries don’t do that. So all the thieves have to do is visit a succession of ATM’s withdrawing the daily limit at each. My Bank statement showed this happening and I could trace their progress across the country.

The banks need to modify the system so that the approval or rejection of transactions is conducted entirely here, not overseas. This would have limited the loss.

The second easy thing the Bank could do is have their computer check the location of transactions against time. There is no way that my card could have been used for a transaction in the UK and travel to South Africa in under thirty minutes.

If the system refused transactions where it’s impossible for the card to have travelled between the two places in the time available then it would have prevented it. Had it refused my card in the UK because it had just been used in South Africa first, I would have immediately contacted my Bank. They could have then stopped the succession of withdrawals before they lost thousands.

A number of colleagues and I all had our current accounts emptied. We compared transactions and identified the single place we had all used in common, a petrol station. We visited the petrol station and identified a card skimmer in use.

The skimmer included a pinhole camera built into the plastic shroud around the keypad that is supposed stop people seeing you entering the pin. I habitually shield the keypad with my wallet, but the camera was closer than that.

We deliberately avoided alerting the fraudster to the fact we had observed the skimmer. We thought we would prefer to see them arrested.

The Police took the attitude that only the Bank could report the crime. So we contacted the fraud department at the Bank and drew their attention to the location of the skimmer in operation.

As far as I can tell no action was ever taken to investigate and arrest those responsible. I raised this with the bank and never had a sensible reply.