22 October 2017
Find out more

Halifax facing chip and PIN fraud lawsuit

07 January 2008  |  16433 views  |  0 card chip

UK high street bank Halifax is facing a lawsuit brought by a customer who claims that fraudsters cloned his chip-based card and withdrew £2100 from his account at ATMs.

Alain Job told UK newspaper The Guardian that he changed the PIN supplied by the bank to a number that only he knew and was in possession of his card when fraudsters raided his bank account.

But the Halifax claims that whoever took the money had access to both Job's card and PIN.

Job is in the process of bring his case against the Halifax to court.

The case casts further doubts over the effectiveness of chip and PIN which was introduced in the UK two years ago in order to eliminate skimming scams where fraudsters copied data stored on the magnetic stripe of a credit to make cloned cards.

Although chip and PIN contributed to a drop in domestic fraud levels fraudsters have switched to using cloned cards abroad in places where chip and PIN hasn't yet been implemented.

Security expert Mike Bond told The Guardian that as well as mag-stripe cards chip-based cards can be copied and cloned, although the technique is more cumbersome and expensive as it involves stealing the PIN and copying a secret key stored on the chip which is used by banks to validate cards.

Bond says that, whilst it is possible that criminals have found a cheaper way to extract data from the chip, there is no evidence that this has happened.

A cheaper way for fraudsters to clone cards is to create a "yes card", says Bond, which doesn't contain a copy of the original card's PIN and secret key.

Instead, the fraudster copies the rest of the chip's data to a smart card. This "yes card" will work with chip-and-pin implementations using a security technique called Static Data Authentication (SDA), says Bond, which enables chip readers to authenticate a transaction without directly contacting a bank.

However, this technique does not explain Job's losses because all ATMs contact banks for authentication, says the report.

Comments: (0)

Comment on this story (membership required)

Finextra news in your inbox

For Finextra's free daily newsletter, breaking news flashes and weekly jobs board: sign up now

Related stories

Jump in card fraud abroad drives up UK losses - Apacs

Jump in card fraud abroad drives up UK losses - Apacs

03 October 2007  |  7352 views  |  0 comments
Researchers warn of Chip and PIN relay threat

Researchers warn of Chip and PIN relay threat

06 February 2007  |  19350 views  |  0 comments
Game over for Chip and PIN?

Game over for Chip and PIN?

05 January 2007  |  16159 views  |  0 comments
Chip and PIN boasts 31% drop in counterfeit card fraud

Chip and PIN boasts 31% drop in counterfeit card fraud

10 October 2005  |  9186 views  |  0 comments
UK cardholders flout PIN security guidelines

UK cardholders flout PIN security guidelines

05 July 2004  |  5136 views  |  0 comments

Related company news

 
visit www.niceactimize.comvisit www.atos.netvisit www.vasco.com

Top topics

Most viewed Most shared
Mastercard to roll out blockchain APIMastercard to roll out blockchain API
14954 views comments | 17 tweets | 29 linkedin
HSBC partners Bud for open banking trialHSBC partners Bud for open banking trial
13365 views comments | 22 tweets | 28 linkedin
satelliteGates Foundation backs Ripple collaboratio...
9882 views comments | 13 tweets | 10 linkedin
Sibos 2017: API or the highwaySibos 2017: API or the highway
9868 views comments | 12 tweets | 23 linkedin
IBM uses blockchain to improve cross-border payments processingIBM uses blockchain to improve cross-borde...
8885 views comments | 9 tweets | 18 linkedin

Featured job

Competitive base, double ote, benefits
London, UK

Find your next job