Chip and Pin Fraud Costs Shoppers Millions

by Mitch Gallant

Organized crime has pilfered millions of dollars out of the bank accounts of European shoppers through a scam involving the new "chip and pin" validation system. The carefully planned scheme involved tampering with possibly hundreds of credit card machines before the machines even reached retailers. These machines, virtually identical to the originals, are then used to relay credit card information stored on chips in the customer's credit card to the criminals overseas. These foreign fiends are believed to have tampered with the machines in China, fresh off the production line, where they are then sent onwards to the unsuspecting retailer. These exports reached as far as Britain, Ireland, the Netherlands, Denmark, and Belgium. Credit card information was then harvested over a period as long as nine months, and subsequently transmitted over mobile phone networks to Pakistan.

This activity comes at a time when many are beginning to question the supposedly advanced security technology protecting these cards. The technology, known as EMV (an acronym for Europay, MasterCard, and VISA), is claimed to be "broken" by University of Cambridge researcher Ross Anderson. It suffers from a "protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card's PIN." This security flaw was successfully demonstrated by Anderson's research team by having a volunteer enter multiple stores with a backpack containing a laptop computer. This computer was then used to interface wirelessly with a fake card (representing a stolen card), and allowed the volunteer to purchase any amount of items at any cost within the card's limit without knowing the card's PIN.

Concerns have also been voiced that the introduction of the cards has more to do with the transfer of liability for fraud from the credit card company to the cardholder than it does with safety or security. Some countries have gone as far as to enact legislation to ensure that the issuing company remains liable for consumer protection services in the event of EMV fraud. Despite these concerns, it seems chip and pin is here to stay, as it continues to be introduced to new markets, gradually being phased in throughout Europe and North America.

http://www.telegraph.co.uk/news/uknews/law-and-order/3173346/Chip-and-pin-scam-has-netted-millions-from-British-shoppers.html

http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-is-broken/