Credit Card Fraud

[Ardesco]

Chip and pin could be secure, it's just badly implemented. There was some scientist talking about it a year or so ago who said that the chip and pin devices should draw a 3 x 3 grid and randomly place the numbers in it. You then enter the pin by pressing the corresponding location on the 3 x 3 grid on the handset and every time you enter your pin the numbers will be in a different place. This prevents people from watching what numbers you are keying in on the keypad making the whole process a lot more secure.

Why have the banks not done this? Because they really couldn't give a tulip. Chip and Pin was only brought into play so that they could try and offload responsibility to the consumer.....

[Peoplesoft bloke]

....... Because they really couldn't give a tulip. Chip and Pin was only brought into play so that they could try and offload responsibility to the consumer.....

Completely agree - they could reduce fraud if they cared, but they are more interested in the trade-off of costs vs returns than the morality of it. That makes it even more laughable that the government should seek to use it as a justification for ID cards - if the banks don't care, why should we all have to pay for it? We pay the costs of fraud anyway.

[Advocate]

Hang on, it's a sensible business decision....

Banks will usually pay up if your'e subject to fraud; that's a material cost to them and usually only (be honest) a minor inconvenience to you.

Yes there are methods to reduce fraud, probably to (as near as damnit) zero but if the cost of those mehods is more than it costs a bank to cover fraudulent payouts, then it's a no brainer...

I'm not going to deny that banks are blood sucking leeches but this discussion is silly.

[Advocate]

Chip and pin could be secure, it's just badly implemented. There was some scientist talking about it a year or so ago who said that the chip and pin devices should draw a 3 x 3 grid and randomly place the numbers in it. You then enter the pin by pressing the corresponding location on the 3 x 3 grid on the handset and every time you enter your pin the numbers will be in a different place. This prevents people from watching what numbers you are keying in on the keypad making the whole process a lot more secure.

Why have the banks not done this? Because they really couldn't give a tulip. Chip and Pin was only brought into play so that they could try and offload responsibility to the consumer.....

That's why scientists dont design security solutions! The usability trade off for a mass market system is huge compared to the ridiculously minor (arguably none-existent) security gained by doing this.

[Ardesco]

That's why scientists dont design security solutions! The usability trade off for a mass market system is huge compared to the ridiculously minor (arguably none-existent) security gained by doing this.

Are you seriously telling me that changing the current system to, for example, a touchscreen 3x3 grid instead of a fixed keypad where the numbers can be shuffled around so nobody has any idea what numbers you are entering is not usable?

[Ruprect]

ING Direct use this method for their online login, though I'd wager some dim witted numpty would complain that it is too complicated

[Advocate]

Are you seriously telling me that changing the current system to, for example, a touchscreen 3x3 grid instead of a fixed keypad where the numbers can be shuffled around so nobody has any idea what numbers you are entering is not usable?

Yes I am.

[NickFitz]

Are you seriously telling me that changing the current system to, for example, a touchscreen 3x3 grid instead of a fixed keypad where the numbers can be shuffled around so nobody has any idea what numbers you are entering is not usable?

Most people can scarcely count to ten as it is. Are you looking forward to being stuck behind the elderly person with short sight who has to spend ten minutes squinting at the display trying to work out where the 4 has gone?

It might be OK for scientists and IT contractors, but the majority of people would be utterly confused and would make mistakes so frequently as to render such a system unworkable.

[BrilloPad]

Only plus side is that I caught it early, and I wish I could see their face when go to collect the tickets and the card wont work as its been cancelled!!

A pity that the police can't see it...

[Advocate]

ING Direct use this method for their online login, though I'd wager some dim witted numpty would complain that it is too complicated

They should be beaten with the security clue stick!