A Computer Weekly reader whose credit card was cloned after she used it in Tesco, was told by her bank that new chip & PIN readers were being hacked at the point of manufacture, before they even arrived at the store.
First Direct's anti-fraud office told her that cloned readers weighed three ounces more than the standard reader. We believe customers at Sainsbury's have also been targetted.
Subscribe to this blog
"Tip of the Iceberg" - APACS have been aware of the alarming growth in PED fraud. Although chip and pin is more secure at the point of sale due to the user having to know a piece of information (i.e. their pin number.) than just handing over a card the amount of times your PIN can be stolen has also increased in line
PED manufacturers are much less secure in design and build than ATMs and since the introduction of chip and pin consumers have gone from entering their PINs just at the hole in the wall a couple of times a week, to entering their PINs several times a day. The DCPCU is taking in multiple PEDs daily for forensic investigation.
An end is in sight however, as the PCI Council has now ratified the PED Data Security Standard and over the course of the next year or so ALL PEDs will have to attain this minimum level of build and configuration security.
Matthew Tyler
PCI Practice Manager at Evolution Security Systems. www.evolve-online.com
Unfortunately card cloning is all too easy, and we’re going to see more and more incidents of this type.
I see biometrics as the next stage after Chip and PIN,particularly for British banks and retailers. There is no arguing with biometric verification. Now is a good opportunity to see the careful implementation of biometrics and the removal of the latter.
I believe that within five to ten years, use of biometrics in credit card verification will be mainstream, and the big high street players will have moved this way. From the retailers' perspective, there are huge benefits (in terms of fraud reduction and customer loyalty) with proportionately little outlay.
However they need to tread carefully with customer sensibilities. A potential fly in the ointment is customer objections to 'big brother' techniques. The best way round this is to implement solutions where the biometric data itself is stored on a card that the customer retains possession of. This is the way implementations on the continent have been carried out.
Stewart Hefferman, COO, TSSI Systems Ltd
It is the assumption that Chip and PIN is technically infallible that has created this problem. All systems with financial or any other private data should always assume that someone will try and hack them and as such it is crucial to understand any potential points of attack at the implementation stage.
This is similar to assumptions made in the United States with Social Security Numbers (SSNs), in that people believe they are a unique identifier that cannot be compromised. In the U.S, merchants, credit bureaus, banks, insurers etc. all insist upon SSNs as it allows them to correlate disparate information, data mine and receive credit authorisation. Yet it is precisely this assumption that has contributed towards increased levels of identity theft. If someone gets hold of your number, all they need to do is get a single organisation to accept that it belongs to them and this acceptance cascades through the system enabling many more bits of personal financial data to be compromised and irreparably harm the credit reputation of the real owner.
Entrenched interests have served to perpetuate the myth of SSN uniqueness because they have too much to lose if the rules were changed. So today, almost 15 years after identity theft first became a problem; SSNs are depended upon as if they were secure, even though the entire system that depends upon them is vulnerable because of the assumption that they are unique.
Chip and PIN suffers from this very same problem – it is black box technology and there is a false assumption that the PIN cannot be obtained by someone who shouldn’t have it. It is assumed to be more secure, but a single data-point vulnerability makes it less secure than the old analogue method of comparing a signature on a card to one offered at payment. No system with a single-point of threat vulnerability will ever be as secure as taking a complete, holistic view of the customer reputation based on many more data points.
Andre Edelbrock, CEO, Ethoca. www.ethoca.com
It’s the assumption by many that Chip and PIN was technically infallible that has created this problem. All systems with financial or any other private data should always assume that someone will try and hack them.
In the case of Chip and PIN there are false assumptions, for example, that the PIN can't be obtained by someone who shouldn't have it or that the Chip and PIN readers can’t be tampered with. And although some argue some of these types of attacks on Chip and PIN are difficult to undertake and not currently economically viable for a fraudster to carry out -- no system with a single point (or points) of vulnerability will ever be as secure as taking a complete, holistic view based on many more data points.
Andre Edelbrock, CEO, Ethoca