Shell is investigating how supposedly tamper-proof chip-and-Pin pads were altered by fraudsters to enable a £1m scam at its petrol stations.
Although the chip and Pin system itself was not cracked, the Association of Payment Clearing Services confirmed that the devices were tampered with to allow information to be copied from magnetic strips on the back of credit and debit cards.
Shell said the systems it deployed, TrinTech Smart 5000 chip and Pin pads, were fully accredited and complied with all relevant industry standards. TrinTech said it would not comment on the situation.
Apacs spokeswoman Sandra Quinn said, “The tamper-resistant pad did not act in a tamper resistant way. We are not complacent, but we are confident it will not happen again. This is specific to this type of pad. Other manufacturers have been prompt to confirm it is something that cannot happen with their devices.” Quinn did not believe consumer confidence in chip and Pin would be dented by the incident.
However, Graham Titterington, principal analyst at Ovum, said he suspected more than one type of chip and Pin pad could be susceptible to this kind of fraud. “The fact that it has happened in a reputable company shows that it can happen, and you have got to assume that at some point it will happen again.”