Chip and PIN

From Wikipedia, the free encyclopedia

Chip and PIN is the name of a government-backed initiative in the United Kingdom to implement the EMV standard for secure payments. There is also a similar initiative in the Republic of Ireland called Chip and PIN Ireland.

Contents

[edit] History

Until the introduction of Chip and PIN, all face-to-face credit or debit card transactions used a magnetic stripe or mechanical imprint to read and record account data, and a signature for verification. Under this system, the customer hands their card to the clerk at the point of sale, who either "swipes" the card through a magnetic reader or makes an imprint from the raised text of the card. In the former case, the account details are verified and a slip for the customer to sign is printed. In the case of a mechanical imprint, the transaction details are filled in and the customer signs the imprinted slip. In either case, the clerk verifies that the signature matches that on the back of the card to authenticate the transaction. In some countries, such as Greece, the credit card owner usually must give to the clerk their national identity card issued by the police, and if the name on the credit card does not match that on the identity card (or if no identity card is available) then the transaction cannot continue.

This system has proved reasonably effective, but has a number of security flaws, including the ability to steal a card in the post, or to learn to forge the signature on the card. More recently, technology has become available on the black market for both reading and writing the magnetic stripes, allowing cards to be easily cloned and used without the owner's knowledge.

[edit] How it works

A chip from a credit card, with a normal sized pin for scale.
A chip from a credit card, with a normal sized pin for scale.

To solve this, banks and retailers are replacing traditional magnetic stripe equipment with that based around smartcards, which contain an embedded microchip and are authenticated automatically using a PIN. When a customer wishes to pay for goods using this system, the card is placed into a "PIN pad" terminal (often by the customer themselves) or a modified swipe-card reader, which accesses the chip on the card. Once the card has been verified as authentic, the customer enters a 4-digit PIN, which is checked against the PIN stored on the card; if the two match, the transaction completes.

France has cut card fraud by more than 80% using a similar, but incompatible system. Chip and PIN is the name given to the initiative in the UK but countries worldwide are launching their own initiatives based on the EMV standard, which is a group effort between Europay, MasterCard and VISA. By the end of 2004, 100 countries should have been using compatible systems based on this standard, and France aims to migrate its existing systems to be compatible with the new cards.

Note that "cardholder not present" transactions such as Internet, telephone or mail order purchases are not affected by the introduction of the Chip and PIN system. Since these are also major areas of fraud, other initiatives such as Verified by Visa and MasterCard SecureCode—both of which are implementations of Visa's 3-D Secure protocol—are being developed to improve security in these situations, such as additional security codes printed on the back of the card and more complex authentication services.

[edit] Conversion

Chip and PIN was trialled in Northampton, England from May 2003, and as a result was rolled out nationwide in the United Kingdom in 2004 with advertisements in the press and national television touting the Safety in Numbers slogan. During the first stages of deployment, if a fraudulent magnetic swipe card transaction was deemed to have occurred, the retailer was refunded by the issuing bank, as was the case prior to the introduction of Chip and PIN. However, as of January 1, 2005, the liability for such transactions was shifted to the retailer. This acted as an incentive for retailers to upgrade their Point of sale (PoS) systems, and most major high street chains upgraded on time for the EMV deadline. Nonetheless, many smaller businesses are still reluctant to upgrade their equipment, as it may require a completely new PoS system - an investment they may normally make only after several years.

New cards featuring both magnetic strips and chips are now issued by all major banks. The replacement of pre-chip and pin cards was a major issue, as some banks simply stated that consumers would receive their new cards "when their old card expires"[citation needed] - despite many people having had cards with expiry dates as late as 2007. The card issuer Switch lost a major contract with HBOS to VISA as they were not ready to issue the new cards as early as the bank wanted to. This change angered many, as Visa's Electron cards are generally not accepted online, unlike Switch's Solo.[citation needed]

When a customer does not know their PIN, or the PIN verification fails, the cashier can instigate a PIN Bypass, allowing a signature to complete the transaction. However, this PIN Bypass option was only scheduled to be available during the infancy of Chip and PIN within the UK. From February 14, 2006 the banks have decided to discourage this facility. From this date on, PIN verification should be used for all Chip and PIN enabled cards. Should the customer not know their PIN then the cashier can still instigate a PIN Bypass transaction (with signature), however, the card issuer/bank may choose to decline the transaction.

Cardholders who are incapable of entering a PIN because of a mental or physical disability can contact their bank to be issued with a so-called Chip and Signature card.

In the Republic of Ireland, a PIN must be used with chip and PIN enabled cards and this came into effect on St. Patrick's Day 2007 (17 March 2007).

[edit] Benefits

Under the old system, a customer would have to hand their card to the assistant for each payment. In certain environments such as restaurants, for example, this often meant that the card would be taken away from the customer to the card machine. This is no longer the case with the introduction of Chip and PIN as wireless PIN pads have been introduced that can be brought to the customer's table.

[edit] Criticism

[edit] Decreased security for PINs

A Chip and Pin Machine may be observed by other shoppers, staff, or anyone with access to footage from security cameras (as above).
A Chip and Pin Machine may be observed by other shoppers, staff, or anyone with access to footage from security cameras (as above).

[edit] Direct observation

Before Chip and PIN, a person's PIN would only be entered at an ATM in a bank or other secure area. However, the use of PINs in supermarkets, bars, and shops forces the customer to type their PIN in plain view of all other customers waiting behind them in the queue. Because of the difficulty of shielding a PIN (supermarkets often elevate the keypad, which is visible from all directions), it is relatively easy to gain another person's PIN by watching them buy groceries. Also, counterfeit PIN pads are sometimes used in systems which still swipe the magnetic strip, allowing the fraudster to clone the card and know the PIN for use in older-style ATMs that only read the magnetic strip.

[edit] Indirect observation

Security cameras that are installed to deter shoplifters and opportunist thieves may also compromise the security of Chip and PIN, because stores often focus a camera on the cash register and the customer; consequently a recording of the customer entering their PIN can be replayed and analysed at leisure. PIN Security may therefore depend on how the store protects the transmission and storage of such recordings. [1]

There is also the factor of cardholders not bothering/being able to remember the Pin code. Therefore it is sometimes written down on a piece of paper in their wallet, saved as an entry in a mobile phone contacts list, or in some cases even written on the card. If for example this person had lost the wallet or had it stolen, then the Pin code is with the card and the account is easily compromised.

[edit] Opportunities to clone magnetic stripes

In addition to the track-two data on the magnetic stripe, EMV cards generally have identical data encoded on the chip which is read as part of the normal EMV transaction process. If an EMV reader is compromised to the extent that the conversation between the card and the terminal is intercepted, then the attacker may be able to recover both the track-two data and the PIN, allowing him to reconstruct a magnetic stripe card which can then be used, for example, in terminal devices which permit fallback to magstripe processing. This attack is only possible where (a) the offline PIN is presented in plaintext by the PIN entry device to the card, where (b) magstripe fallback is permitted by the card issuer and (c) where geographic and behavioral checking may not be carried out by the card issuer.

Within the UK and Ireland, plaintext offline PIN is the standard mode of operation, and cards which support encrypted offline PIN are rare, despite being common in other countries. Permitting magstripe fallback transactions to take place is a well-known risk to card issuers and has been permitted while the fraud levels are low, in order to facilitate cardholders. If magstripe fallback fraud levels grow, this processing option will be disabled at those card issuers where it has not already been disabled. Finally, geographic and behavioral fraud analysis tools are in use in many card issuers and are capable of tracking and declining suspicious transactions — for example, an EMV card-present transaction at a UK ATM followed, two hours later, by a magstripe fallback transaction in the Far East.

This conversation-capturing attack is the form of attack which was reported to have taken place against Shell in May 2006, when they were forced to disable all EMV authentication in their petrol stations. [2]

[edit] Decreased liability for banks

A common criticism of the Chip and PIN implementation is that it was done to reduce the liability of banks in cases of credit card fraud, by putting the burden of proof on the customer to prove that their PIN was compromised, rather than on the bank having to prove that the signature did not match. Rather than being a mere cynical opinion, this is actually supported by the almost-universal usage of the term "Liability Shift deadline" to refer to the 1 January 2005 within the UK payment card industry. However, the financial institutions are still bound by The Banking Code, which states that the burden of proof is on the bank to prove their claims of negligence as opposed to the consumer having to prove his or her innocence. [3]

Before chip and pin, if a customer's signature was forged, the banks were liable and had to reimburse the customer. Currently there is no such law protecting consumers from fraudulent use of their chip and pin transactions, only a voluntary banking code. Cambridge University researchers Steven Murdoch and Saar Drimer demonstrated in a BBC Newsnight programme one example attack, to illustrate that Chip and PIN is not secure enough to justify such a shift in liability.[4] [5]. However APACS, the UK payments association, disagreed with the majority of the report, stating "The types of attack on PIN entry devices detailed in this report are difficult to undertake and not currently economically viable for a fraudster to carry out."[6]

[edit] See also

[edit] External links

[edit] Problems

Languages