COMMENT
How To Win With Chip And PIN

By Cliff D'Arcy
December 24, 2004

Merry Christmas and a Happy New Year to all our readers!

Why Chip and PIN is being introduced

Banks estimate that plastic-card crime in 2004 will total half a billion pounds (£500 million). Card issuers hope to slash this bill by replacing old-fashioned magnetic-strip cards with anti-fraud Chip and PIN cards. Of the 135m credit and debit cards in circulation in the UK, roughly 85 million have already been replaced with Chip and PIN cards. Still, that leaves fifty million cards to go...

So far, about six out of seven retailers (85%) have introduced Chip and PIN terminals, with over half a million now in place. However, the new machines are expensive to run, so a few retailers have adopted a "wait and see" approach. Then again, from the New Year, businesses that haven't installed Chip and PIN machines may find that they, and not the banks, will be responsible for any card fraud committed on their premises.

The introduction of Chip and PIN in France slashed card fraud by over four-fifths (80%).

How Chip and PIN cards work

Instead of reading the magnetic strip on the reverse of a plastic card, Chip and PIN terminals read data from a microchip embedded in the card. Check your plastic card for a chip – it's a metal square about a quarter of the size of a postage stamp, about halfway up the left-hand side of the card.

The chip holds your account information in an encrypted (scrambled) form, which makes it far more difficult to crack or copy than magnetic-strip data. I know how to clone (copy) magnetic-strip cards, using a strip of video tape and a few other items, but I'll keep this a secret!

What if I can't remember my PIN?

Be warned: if you can't remember your PIN, or prefer to sign your name, be prepared for a long wait at the till! That's because most retailers will carry out a "lost or stolen card" security check before approving your purchase, which could take several minutes.

What isn't clear is what will happen if a retailer with a Chip and PIN machines processes a signature-verified transaction that later proves to be fraudulent. There is the possibility that the retailer could be held liable for the fraudulent amount. Hence, in the January sales, there is a chance that some retailers may refuse to accept your signature if you can't remember your PIN.

At some point, retailers eventually will shut down the signature-verified system, but this won't be before 2007 at the very earliest. And, of course, you'll still need a signature on the back of your card for guaranteeing cheques.

What about Internet and mail-order shopping?

Of course, the arrival of Chip and PIN won't affect online or mail-order spending. These "distance" transactions rely on a three-digit security code on the reverse of your card to prove that you are in possession of the card. Learn more about these CVV2 codes.

Are PINs secure?

Your bank gives you a random four-digit Personal Identification Number that you use to access your account in cash machines and shops. Once you've correctly entered this PIN into a cash machine, you can then personalise it to something more memorable.

As each digit could be any number from zero to nine, the total possible number of PINs is 10 x 10 x 10 x 10 = 10,000. Given that you have three attempts to guess your PIN before your card is blocked, the chance of someone guessing your PIN by chance alone is three in 10,000, or about 1 in 3,333. Those odds are considered sufficiently high enough to make PINs reasonably secure and yet workable.

The dangers of Chip and PIN

Be very wary of "shoulder surfing", where a criminal sneaks a look at the keypad while you're keying in your four-digit PIN. Having noted down your code, the crook then distracts you to steal your card, or picks your pocket or bag, or mugs you. Armed with your card and PIN, this villain can then empty your bank account or max out your credit card.

Also, make sure that you trust the retailer that you're visiting. Fraudsters have installed "skimming" equipment and miniature cameras at cash machines to steal account information (read more here). So, expect to hear stories in the New Year of people who have been ripped off by bogus Chip and PIN terminals!

One thing that won't change is the maximum liability for cardholders that have been defrauded, which remains at £50. However, if you've been negligent, such as writing down your PIN and keeping this note in your purse or wallet, you could be liable for all crooked spending on your card. So, memorise your PIN now – and don't write it down, because careless PINs cost cash!

The biggest risk of all: YOU!

Please understand that the biggest security vulnerability isn't caused by chips, magnetic strips or PINs. I'm afraid that it's you. Don't write down your PIN, or choose an easy-to-remember PIN, such as your year of birth, 1234, or some other simple sequence of numbers. Otherwise, you're making it much easier for someone to crack your code. Choose an obscure number that's personal to you, but something that no-one except you would consider memorable.

Finally, if you've been guilty of over-spending in 2004, perhaps it's best that you don't learn the PINs for your credit cards. This should dramatically cut your spending in 2005!

More: Make a sensible start to 2005 with a 0% credit card |