Card industry dismisses chip and pin fraud claims

By Elliot Wright, 12th February 2010

Credit and debit card providers have dismissed claims that fraudsters are able to exploit weaknesses in the Chip and Pin payment system to use stolen cards.

Scientists from the University of Cambridge's Computer Laboratory claims that criminals can use stolen credit and debit cards to make purchases even if they do not know the card's pin, by using a special gadget between the card and the payment terminal.

They say this tricks the terminal into believing the pin has been entered correctly no matter what 4-digit number the fraudster uses, while the card provider would think the payment was authorised by the true card holder's signature.

Dr Steven Murdoch said: "We have tested this attack against cards issued by most major UK banks. All have been found to be vulnerable."

But the UK Cards Association - a body that represents all major card issuers in the UK - has dismissed the fears, saying that while the research shows what is possible to do in theory, this does not mean it is practical or even possible to do in reality.

A spokeswoman said: "We believe that this complicated method will never present a real threat to our customers' cards.

"It requires possession of a customer's card and unfortunately there are much simpler ways to commit fraud under these circumstances at much less risk to the criminal. This fraud is also detectable by the industry's systems."

She added that fraud committed on lost or stolen cards during had fallen to its lowest level for two decades during 2009.

The Cambridge research also warned that the apparent use of pins in fraudulent transactions could lead to victims having their claims for refunds turned down.

Professor Ross Anderson said: "Over the past five years, thousands of cardholders have had stolen Chip and Pin cards used by criminals. The banks often tell customers that their pin was used and so it's their fault."

Claims Financial