Chip & Pin Technology

[bocelli27]

Well, the banks have insisted it is the best thing since sliced bread and have forced us all to commit to it to ensure our banking transactions are carried out in a secure environment robustly protected from fraud. And the regulators have thrown their weight behind the banks. So, there's nothing to worry about then - or is there?

 

A team of computer researchers say they have uncovered flaws in the Chip and Pin system which are being exploited by fraudsters to use stolen cards.

 

The group from the University of Cambridge's Computer Laboratory found that criminals can insert a "wedge" between the stolen card and terminal, tricking it into believing the pin has been correctly verified, when in fact any pin can be used for the transaction to go through. The card meanwhile thinks it was authorised by signature.

 

Dr Steven Murdoch said: "We have tested this attack against cards issued by most major UK banks. All have been found to be vulnerable."

 

The discovery is likely to place some question marks over the existing Chip and Pin design and its security.

 

Victims of this type of fraud may encounter problems obtaining refunds from their banks as the receipt produced states "Verified by Pin".

 

Professor Ross Anderson said: "Over the past five years, thousands of cardholders have had stolen Chip and Pin cards used by criminals. The banks often tell customers that their pin was used and so it's their fault.

 

"Yet we've shown that it's easy to use a card without knowing the pin - and the receipt will say the transaction was 'Verified by Pin' even though it wasn't."

 

"This is not just a failure of bank technology. It's a failure of bank regulation. The ombudsman supported the banks and the regulators have refused to do anything. They were just too eager to believe the banks."

 

http://uk.news.yahoo.com/21/20100211/ttc-c...ed-e1d36ba.html

 

Oh well, it's back to the drawing board before the creation of a "wedge" industry in Pattaya and all points East.

[Slacker]

All technology is only foolproof until the necessary time has been put in by the criminal fraternity. However, as Thailand is still operating on the good old (and easily forged) signature system...perhaps someone will have invented something more secure by the time they catch up !