‚£1m chip and pin fraud highlights flaws in system

[OpenMind]

£1m chip and pin fraud highlights flaws in system

By David Derbyshire, Consumer Affairs Editor

(Filed: 08/05/2006)

Shoppers have been urged to scrutinise their bank statements carefully after a £1 million chip and pin fraud was uncovered by police.

Consumer groups believe that the introduction of the new system may have lulled bank customers into a false sense of security and that millions of people are unaware that they are still at risk.

The warnings follow the discovery that hundreds of customers at Shell forecourts had their details stolen as they paid for petrol using chip and pin cards.

Criminals posing as technicians are thought to have hidden devices that captured bank details and personal identification numbers (pins) in till terminals.

The information was used to create cloned cards which were then used to withdraw large sums from British and French cash machines.

Shell has suspended the chip and pin system at all its 600 company-owned forecourts. Eight people have been arrested in connection with the fraud.

The National Consumer Council said the incident highlighted the need for continued vigilance. "No system can be completely foolproof and consumers must still be careful with their cards and check their statements carefully," a spokesman said.

The incident has also drawn attention to weaknesses in chip and pin, which was introduced to reduce fraud.

The system is supposed to be more secure because confidential card details are stored on a microchip. The chip is much harder to copy and reproduce. At the same time, most payments are authorised with a four-figure pin, rather than a signature.

However, to ease in the introduction of the system, chip and pin cards still have the old-fashioned magnetic stripe. It is relatively easy for criminals to copy these details on to a forged card's magnetic stripe, and then disable the chip.

The resulting card is difficult to use in a shop. However, most cash machines still read magnetic stripes, rather than the microchips.

Sandra Quinn, of the Association of Payment Clearing Services, which represents credit and debit card companies, said banks had not yet switched all their cash machines to the chip and pin system 24 hours a day. "Most bank-owned ATMs are doing it only at specific, fraud-prone times of the day," she said.

Dr Mike Bond, a banking and computer security expert, said banks were reluctant to convert their ATMs to read only chips in case it affected relations with genuine customers. That left plenty of cash machines that still accepted cloned cards.

He added: "It's turning into a game for criminals. They are systematically visiting cash machines to find vulnerable ones."

© Copyright of Telegraph Group Limited 2006.

[Bez]

This is scary...we were given to believe that chip and pin was VERY secure.

I guess any new system is seen as a challenge to criminals....very scary.