News

Has chip and PIN failed ATM security?

January 2, 2008

Guardian Unlimited: It was supposed to bring an end to unauthorized card transactions, but two years later, is chip-and-PIN technology just as fallible its mag-stripe predecessor? Alain Job, a 40-year-old football coach, is bringing his case against the Halifax bank to court, saying fraudsters withdrew Â£2,100 from his account at ATMs, even though he was in possession of his card. Chip and PIN was supposed to stop disputes like that. U.K. payments association APACS says card fraud in the United Kingdom fell 25 percent in two years because of the new system, which has been mandatory since February 2006.

But a former security researcher at Cambridge University who focused on phantom card withdrawals, suggests several ways to fool chip-and-PIN systems, resulting in frauds like the one the football coach experienced. "Chips can be copied, but we all had assumed that it was prohibitively expensive to do so," he says. "One possibility is that someone has found a cheaper way to extract the two secrets from a card to make a perfect copy."