Shell is investigating how supposedly tamper-proof
chip-and-Pin pads were altered by fraudsters to enable a £1m scam
at its petrol stations.
Although the chip and Pin system itself was not cracked, the
Association of Payment Clearing Services confirmed that the devices
were tampered with to allow information to be copied from magnetic
strips on the back of credit and debit cards.
Shell said the systems it deployed, TrinTech Smart 5000 chip and
Pin pads, were fully accredited and complied with all relevant
industry standards. TrinTech said it would not comment on the
situation.
Apacs spokeswoman Sandra Quinn said, “The tamper-resistant pad
did not act in a tamper resistant way. We are not complacent, but
we are confident it will not happen again. This is specific to this
type of pad. Other manufacturers have been prompt to confirm it is
something that cannot happen with their devices.” Quinn did not
believe consumer confidence in chip and Pin would be dented by the
incident.
However, Graham Titterington, principal analyst at Ovum, said he
suspected more than one type of chip and Pin pad could be
susceptible to this kind of fraud. “The fact that it has happened
in a reputable company shows that it can happen, and you have got
to assume that at some point it will happen again.”