Skip to main contentSkip to navigationSkip to navigation
ATM cash machine

Has chip-and-pin failed to foil fraudsters?

This article is more than 16 years old
It was supposed to bring an end to unauthorised card transactions, but two years on is chip-and-pin just as fallible as its predecessor?

This is a big week for Alain Job. The 40-year-old football coach is bringing his case against the Halifax bank to court. He says that fraudsters withdrew £2,100 from his account at ATMs, even though he was in possession of his card, and he doesn't want to pay.

Chip-and-pin was supposed to stop disputes like this. First introduced to the UK in 2004, it replaced signatures with chips embedded in bank cards that verify a customer's four-digit pin. Cards also contain a secret key used to validate the card with the bank.

The UK payments association Apacs says that UK card fraud fell 25% in two years thanks to the system, which became mandatory in February 2006. That's cold comfort for customers like Job. Halifax, which wouldn't comment on the case, told him that whoever took the money had access to both his card and his pin.

"Once they gave me my pin, I went to the cash machine and changed it to a number that only I knew," Job retorts, insisting that he had his card at all times. "I destroyed the letter they sent me with the pin, so it's highly unlikely that anyone - even my wife - would know."

Fooling the system

Could criminals have used the details on his card for unauthorised transactions? Mike Bond, a former security researcher at Cambridge University who focused on phantom card withdrawals, suggests several ways to fool chip-and-pin systems.

First, he wonders whether criminals may have refined chip-cloning techniques. "Chips can be copied, but we all had assumed that it was prohibitively expensive to do so," he says, explaining that the chips harbour two highly protected secrets that researchers believe would cost thousands to extract. These are the pin used to authenticate the customer, and the chip's secret key, used by the bank to validate the card.

"One possibility is that someone has found a cheaper way to extract the two secrets from a card to make a perfect copy," Bond muses. There's no evidence of that, but a flawed method of cheaply cloning cards without those secrets does already exist. This involves copying the rest of the chip's data to a smartcard, nicknamed a "yes card".

Yes cards don't need the original pin. Because the card alone verifies the user's pin, a cloned card can be told to say "yes" to any number (hence the name). But working without the secret code is trickier, and means that yes cards only work with chip-and-pin implementations using a security technique called Static Data Authentication (SDA). SDA has a crucial weakness, says Bond: "Unless you're talking to a bank while processing a payment, you cannot check to see if the card is a forgery."

Some chip readers authenticate a card's transaction on their own without contacting the bank (examples include some large chain stores and railway stations, says Bond). A yes card could potentially exploit such devices. However, even they will contact the bank if transactions go over a certain amount, and ATMs all contact the bank to authenticate transactions. This limits a yes card's utility for fraudsters.

Apacs doesn't say whether all UK cards are SDA-based, but an analysis by the team at Cambridge found no evidence of DDA cards in use. Some countries are now moving to another, more secure type of authentication, known as Dynamic Data Authentication (DDA), which will thwart yes cards altogether.

Rather than actually cloning the chip, researchers at Cambridge claim damaging or removing it altogether would exploit another loophole. Apacs confirms that based on the banks' own criteria, chip-and-pin ATMs will sometimes fall back to exclusively reading the magnetic strip traditionally used to verify a card. That is necessary to support cards used by visitors from countries like the US, where chips in cards and readers are not mandatory.

Criminals are able to clone magnetic strips much more easily than chips, using skimming machines that they attach to ATM machines. Skimmers use a camera to record the keypad as the pin is entered, and a card reader to record the card's information. (You can see one that has been removed from a cash machine and dismantled at atm.ev6.net.)

It's no wonder that banks rely on the two secrets in the chip for evidence of customer liability, then. That was Barclaycard's case against pensioner Donald Reddell, who lost £3,000 in phantom withdrawals from UK ATMs. His wife has a card on the same account, but Reddell says they don't use them for anything other than emergency transactions while on holiday.

"The disputed transactions were made using the chip in the issued card received by Mr Reddell and not a counterfeit card," says Barclaycard, adding that the Ombudsman had upheld its decision to dismiss Mr Reddell's claim.

"That couldn't have happened, because it was kept in my safe," contends Reddell. He only ever used it in an ATM to change the pin on the card, which was new, two weeks before the frauds occurred.

If skimmed, Reddell's card would have been open to fraud in the thousands of overseas ATM machines that don't have chip-and-pin capability, or using "card not present" transactions such as those made via websites. The question is whether the disputed withdrawals could have been made in UK machines, which Apacs believes are now all able to read cards with chips.

It is difficult to prove who is at fault in these cases without scrutinising all of the evidence, which experts complain isn't being made available. Bond worries about a lack of transparency in the way banks present their records, and argues that they should give customers and researchers proof by producing a record of the transaction cryptogram - the code created during the transaction using the chip's secret key.

Finding fault

"If the bank can produce those for the transaction in question at the cash machine, that is not totally conclusive but it's pretty definite that either the chip or a copy of the chip was used," he says.

But banks rarely - if ever - provide this information, even in the unlikely event customers know what to ask for. Neither does the Financial Ombudsman Service, the banking industry-funded body that arbitrates in these matters, and which is currently the subject of a transparency and accessibility review by the Tory peer Lord Hunt.

Emma Parker of the ombudsman service argues that customers wouldn't understand such data. "If someone wants to cross-examine the other party or look at the evidence themselves, then perhaps the court might be an alternative for them," she says.

At the moment, the banks and the ombudsman (which insists that it operates independently, though funded by charging case fees to banks) control the way that cases are handled. Legal changes last April forced customers to report card fraud to banks, and not the police. The banks now decide whether or not to pass it on to a regional force or to the Dedicated Cheque and Plastic Crime Unit, a police department which they created in 2002 and fund through Apacs.

Apacs argues that this process makes it much easier for customers to report if they suspect they've been the victim of fraud. For Ross Anderson, the professor of security engineering who supervised Bond's PhD at Cambridge University's Computer Laboratory, such measures also strip out transparency and accountability. "Now that banks completely control the reporting and prosecution of card fraud, they can cover up anything that's too embarrassing," he says. "So we'll probably only learn of a new modus operandi via police overseas."

Is it enough to check your ATM for suspicious bolt-ons and shield the keypad from view when entering your pin? A year ago, the Cambridge research team hacked a supposedly tamper-proof point-of-sale card reader that they said could have easily been instructed to skim card details - with no camera required (tinyurl.com/y4e8ub).

They even demonstrated their control by programming it to play Tetris (see the video at tinyurl.com/tlcly). With the content of your bank account at stake, this is one technology that you don't want to play games with.

Most viewed

Most viewed