Police uncover GPB1m chip-and-pin fraud

[Mr X]

8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

By Thair Shaikh

http://news.independent.co.uk/uk/crime/article362783.ece

Published: 08 May 2006

Shoppers have been warned to check their bank statements after a £1m
chip-and-pin fraud was uncovered by police.

The warnings follow the discovery that hundreds of customers at Shell
forecourts had their details stolen as they paid for petrol. Criminals
posing as technicians are thought to have implanted devices into chip
and pin machines which can copy a bank card's magnetic strip and record
a person's pin number.

The device cannot copy the chip, which means any fake card can only be
used in machines where chip and pin is not implemented - often abroad.

More than £1m has been siphoned off, an investigation by the Cheque and
Plastic Crime Unit of the Metropolitan Police has found. Shell has
suspended the chip-and-pin mechanism at 600 of its company-owned petrol
stations across the UK. BP and other petrol companies are also looking
into reports of card fraud.

Eight people have been arrested in connection with the scam, according
to the Association of Payment Clearing Services (APACS). Sandra Quinn,
for APACS, said: "They have used an old-style skimming device. They are
skimming the card, copying the magnetic details - there is no new fraud
here. They have managed to tamper with the pin pads. These pads are
supposed to be tamper resistant, they are supposed to shut down, so that
has obviously failed."

There are nearly 1,000 Shell outlets in the UK, 400 of which are run by
external franchisers who will continue to use the chip-and-pin service.
It is hoped the suspended chip and pin in the remaining 600 petrol
stations will be restored later this week.

The incident has drawn attention to chip and pin, which was supposed to
prevent this type of fraud because confidential card details are stored
in a microchip, which is harder to copy and reproduce.

But to ease the introduction of the chip-and-pin system, cards still
have the magnetic strip on them, from which the fraudsters have swiped
the information. According to consumer groups, banks were reluctant to
convert their cash machines to read only chips in case it affected
relations with genuine customers.

A spokesman for Shell, said: "We will reintroduce chip and pin as soon
as it is possible, following consultation with the terminal
manufacturer, card companies and the relevant authorities."

Shoppers have been warned to check their bank statements after a £1m
chip-and-pin fraud was uncovered by police.

The warnings follow the discovery that hundreds of customers at Shell
forecourts had their details stolen as they paid for petrol. Criminals
posing as technicians are thought to have implanted devices into chip
and pin machines which can copy a bank card's magnetic strip and record
a person's pin number.

The device cannot copy the chip, which means any fake card can only be
used in machines where chip and pin is not implemented - often abroad.

More than £1m has been siphoned off, an investigation by the Cheque and
Plastic Crime Unit of the Metropolitan Police has found. Shell has
suspended the chip-and-pin mechanism at 600 of its company-owned petrol
stations across the UK. BP and other petrol companies are also looking
into reports of card fraud.

Eight people have been arrested in connection with the scam, according
to the Association of Payment Clearing Services (APACS). Sandra Quinn,
for APACS, said: "They have used an old-style skimming device. They are
skimming the card, copying the magnetic details - there is no new fraud
here. They have managed to tamper with the pin pads. These pads are
supposed to be tamper resistant, they are supposed to shut down, so that
has obviously failed."

There are nearly 1,000 Shell outlets in the UK, 400 of which are run by
external franchisers who will continue to use the chip-and-pin service.
It is hoped the suspended chip and pin in the remaining 600 petrol
stations will be restored later this week.

The incident has drawn attention to chip and pin, which was supposed to
prevent this type of fraud because confidential card details are stored
in a microchip, which is harder to copy and reproduce.

But to ease the introduction of the chip-and-pin system, cards still
have the magnetic strip on them, from which the fraudsters have swiped
the information. According to consumer groups, banks were reluctant to
convert their cash machines to read only chips in case it affected
relations with genuine customers.

A spokesman for Shell, said: "We will reintroduce chip and pin as soon
as it is possible, following consultation with the terminal
manufacturer, card companies and the relevant authorities."

[milou]

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

<snip - long copy-paste>

More hysterical nonsense from the media, as the article states:

"The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

[Dave Mayall]

Post by milou

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

<snip - long copy-paste>
"The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

Yes, and?

[j***@tiscali.co.uk]

No fake cards with valid PINs can be used at ATMs world-wide, and in
the instance reported these cloned cards were mainly used in the UK:

£1m chip and pin fraud highlights flaws in system
http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2006/05/08/nchip08.xml


Therefore if the card industry can't guarantee PIN integrity and to
comply with my card issuers T&Cs - give me Chip & Signature everytime,
especially with my credit cards.

C&S cards means the crooks wouldn't have access to cash-points, they
couldn't use a cloned card in a Chip and PIN environment (at home or
abroad). If you suffered a disputed transaction you can always deny
it's not your signature. There have been cases already where banks are
questioning if cardhodlers have been negligent with their PIN when
frauds committed, victims are being treated like criminals.

C&S everytime - it makes sense for cardholders.

[milou]

On Mon, 8 May 2006 12:42:11 +0100, "Dave Mayall"

Post by Dave Mayall

Post by milou

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

<snip - long copy-paste>
"The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

Yes, and?

Go to Specsavers, or can't you read?

[Alex Heney]

Post by milou

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

<snip - long copy-paste>
"The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

There has also been another thread running on this story for two full
days now.

[Alex]

Post by milou

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud

<snip - long copy-paste>
"The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

Though I understand most ATMs only read the strip not the chip, so allowing
cash withdrawals?

[Robert]

"More hysterical nonsense from the media, as the article states:
The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"

So what is nonsensical about it? It sounds quite reasonable and
accurate reporting to me.

Surely it makes little difference to the holder if their money is
stolen via a foreign cash machine as opposed to a UK one.

Robert

[milou]

Post by Mr X
The device cannot copy the chip, which means any fake card can only
be used in machines where chip and pin is not implemented - often
abroad"
So what is nonsensical about it? It sounds quite reasonable and
accurate reporting to me.
Surely it makes little difference to the holder if their money is
stolen via a foreign cash machine as opposed to a UK one.

The ATM problem has been present for many years, long before C&P.
The banks have the resources to modify the ATMs to the standards of
the ATMs on the Continent, which do read C&P.
In the meantime, you don't have to use your credit card. Carry cash
like we used to do in the all days. 8-)

[J Smith]

milou wrote:

"More hysterical nonsense from the media"

Why? I and many others were told that it would cut down on card fraud.
Doesn't seem so to me at the moment:-0

JS

[j***@tiscali.co.uk]

Sandra Quinn from APACS has just been on Radio 5. She claims that only
one Shell stations been hit.

Not according to the Inquirer:

http://www.theinquirer.net/?article=31547

They were even good enought to name the type of terminal.

What's not been discussed is cards Terms & Conditions. You may be able
to keep your PIN secret, but can the card industry.

So ask you card issuer for chip and signature cards.

[Alex]

Post by Mr X
8 May 2006 11:32
Police uncover £1m chip-and-pin fraud
By Thair Shaikh
http://news.independent.co.uk/uk/crime/article362783.ece
Published: 08 May 2006
Shoppers have been warned to check their bank statements after a £1m
chip-and-pin fraud was uncovered by police.

Correction: A £1m magnetic strip cloning fraud was uncovered

Post by Mr X
The warnings follow the discovery that hundreds of customers at Shell
forecourts had their details stolen as they paid for petrol.

Correction: They had their card details copied, not stolen.

Post by Mr X
Eight people have been arrested in connection with the scam, according
to the Association of Payment Clearing Services (APACS). Sandra Quinn,
for APACS, said: "They have used an old-style skimming device. They are
skimming the card, copying the magnetic details - there is no new fraud
here. They have managed to tamper with the pin pads.

Using a loose definition of 'tamper', yes.

Post by Mr X
These pads are
supposed to be tamper resistant,

They are.

Post by Mr X
they are supposed to shut down, so that
has obviously failed."

Once you understand what the tamper detection is designed to detect, and why,
you'll understand why it hasn't obviously failed.

Post by Mr X
The incident has drawn attention to chip and pin,

Only because it's been misreported.

Post by Mr X
which was supposed to
prevent this type of fraud because confidential card details are stored
in a microchip, which is harder to copy and reproduce.

It was never designed to prevent mag stripe cloning. It was designed to
prevent cloned mag stripe cards being used; this it does quite effectively.
The problem is that there are still very many machines which haven't been
upgraded.

Post by Mr X
But to ease the introduction of the chip-and-pin system, cards still
have the magnetic strip on them,

It's more to ease wide acceptance. This is the reason they also have embossing
on the card; a couple of years back manual entry (either into POS or taking
impressions) as the primary method still accounted for over 90% of card
transactions worldwide. There's also the fallback procedures to consider for
when the technology fails.

Post by Mr X
from which the fraudsters have swiped
the information. According to consumer groups, banks were reluctant to
convert their cash machines to read only chips in case it affected
relations with genuine customers.

They don't have to. They need to convert them *also* to read chips.