Chip and Pin hacked...

Well its no surprise to me that they have started getting round it, aint it always the way.

Police are warning that a way has been found to hack into chip-and-pin readers to steal customers' details.

Link to full story.

They're finally warning about this?

EDIT: They've also only found 30 in circulation... I doubt they've looked very far then.

Like they couldn't just look over your shoulder!

[embee]

As I understand it, the fraudsters still only use the fake cards where only the mag strip info is used, often Asia and far east etc. It's just a way of harvesting the PIN to go with the mag strip, or are they now also cloning the chip?

Why can't the card operators offer the option of having the card work only with the chip+PIN, not the strip alone? Surely it would limit the fraud opportunity to some extent, or aren't they really bothered? Or am I behind the times?

[Spiderman]

Originally Posted by gettin2dizzy

Like they couldn't just look over your shoulder!

But thats no good to them without the card now is it, or at least the vital info off that card.

And this chip n pin thing has been a way for the banks to try and absolve themselves of any liability thats all. Anyone who knows anything about these things knows the cards are all too easily copied and reused.

Originally Posted by embee

As I understand it, the fraudsters still only use the fake cards where only the mag strip info is used, often Asia and far east etc. It's just a way of harvesting the PIN to go with the mag strip, or are they now also cloning the chip?

The ability to clone the chips has existed well before the chips existed themselves (in terms of use in bank cards).

The way they're being used, is that the chip stores lots of information on it (everything that's printed on the card, like account/sort number, card number etc, but also pin number and a few other details), so they just copy this into a stripped down USB flash drive (don't ask me how I know this...).

Then, since you have all the information, you can clone the card, but it's much easier to process the card online in a different country (however, this should trigger anti-fraud systems at the bank).

Originally Posted by embee

Why can't the card operators offer the option of having the card work only with the chip+PIN, not the strip alone? Surely it would limit the fraud opportunity to some extent, or aren't they really bothered? Or am I behind the times?

Not all retaillers in the UK have the chip & pin facility, and a large part of the population simply don't trust the system. I personally agree, signatures are actually more secure than chip & pin, purely because there's more geeks around like me, and less people (comparitively) can forge handwriting. Don't get me started about mag strip cloning...

EDIT: There's a number of ways the banks could secure these cards, but they're not insterested as it costs money to impliment.

[anna]

ohhhhhh is this where i can have a rant about Barclays new PINsentry for online banking now????

obviously they are trying to make it harder to hack online banking however when I phoned up to order one of these gizmo's after going through all of their security checks etc they wouldnt let me make a payment over the phone to my landlord.. however interestingly enough they would let me make a payment to Barclaycard!!!!! GRRRRRRRRRRRRRRRrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr