PINheads
In his letter, Steve wrote: “One might think that banks had introduced chip-and-PIN merely so they can refuse all refunds on disputed transactions because they can always say: ‘How did they know your PIN?’" (Suspicious minds, Letters blog).
Was this not precisely the reason chip-and-PIN was invented? Credit card fraud cost banks more than £150m per year, because the rules said that users would be protected from fraud that was not the user’s fault. Chip-and-PIN was designed as a way of proving blame. If you can prove it was the card user’s fault, for example they gave away their PIN, you can deny liability.
Phil, submitted on the web



The banks introduced Chip and Pin for increased security and to cut down on fraud. It was supposed to be 'good for consumers'.
However, we now seem to be in a position where they have issued a flawed PIN system and we have no redress if someone does get hold of our PIN number and/or card through no fault of our own:
1. We have to enter all 4 numbers of our PIN and in the correct order. This makes it easy to be overlooked by someone and they then get your whole PIN number. They could have just asked for say the 3rd and 1st number and then the next time two different random numbers. That way, even if we were overlooked and someone stole our card, the thief would not be able to use the two numbers he did see as he would not know which two they were and the card could lock after 3 unsuccessful attempts.
2. You can now hack the chip&PIN devices with a paperclip and a needle according to a recent Register article. You can also clone a card with a hacked C&P device and the customer would never know!
3. The PinSentry device did not have to confirm a users' pin number - but it does. Another security hole which leaves us vulnerable to theft and even mugging.
4. No signature on paper is (now) required, so we cannot even prove that the signature was not ours.
5. Cheques are now being refused by some shops and the trend will grow. This means more use of Chip&Pin and by people who may not be so careful about who is watching them.
I welcome the idea of Chip and Pin and of increased security. But the current system seems to have been 'dumbed down' and as a consequence the security seems to have been compromised. This is OK, as long as the banks take on this risk and not the consumer, but with Chip&PIN I suspect it is the other way round!
Posted by: Steve | Thursday, 28 February 2008 at 03:04 PM