Royal Dutch Shell Group .com Rotating Header Image

Financial Times: Fraudsters chip away at card safety

Fraudsters chip away at card safetyBy Charles Batchelor
Published: May 13 2006 03:00 | Last updated: May 13 2006 03:00

Come back Money! You may have always puffed and panted behind Plastic Card in those television commercials for Access – “Your flexible friend” – during the 1980s and early 1990s, but plastic is not looking quite so clever now.

//

The revelation that customers who had used their plastic cards at Shell filling stations, had had up to £1m stolen from their accounts has shaken confidence in the technology.

Coming less than three months after the financial services industry switched over wholesale to the use of chip and pin for card transactions – on the grounds that this offered greater security than the old-style magnetic stripe and signature – this was particularly embarrassing.

It added to already widespread concerns among the public and industry about identity theft.

The banks and other financial organisations behind the chip and pin campaign appear to have overstated their case. Chip and pin has been promoted as being pretty close to foolproof.

Yet any new technology is always susceptible to being copied or subverted.

Frank Abagnale, the US forger whose youthful exploits were celebrated in the 2003 Steven Spielberg film Catch Me If You Can, was in London this week. Abagnale has been adviser to the FBI for more than 30 years and also runs his own security consultancy.

“There is no foolproof system but chip and pin has been presented in that way,” he told journalists. “Anything that man or woman devises can be defeated.”

As technology has become more sophisticated it has become easier to stage the scams that required laborious preparation when Abagnale was starting out on his career of crime.

While he had to soak the Pan Am logos off toy aeroplanes and buy second-hand banking equipment at auction to produce the airline company cheques that funded his exotic, itinerant lifestyle in the 1960s, the modern forger can do all this on computer.

Logos can be downloaded from the company's website and signatures can be scanned from glossy company reports.

As it turns out, the Shell scam does not appear to have involved the latest chip and pin technology but the earlier magnetic stripe. Because customers expect to be able to use their cards around the world and many countries, including the US, have not adopted chip and pin, the magnetic stripe has to stay in the card.

But even if the magnetic stripe could be removed from cards – as it probably will at some point – even chip and pin will remain vulnerable to the determined fraudster. Devices known as “skimmers” can be fitted on or in cash dispensers to collect the details of a customer's card. A pinhole camera installed nearby can pick up the details of the pin as it is tapped in.

Skimmers can be bought for as little as £50-£60 on the internet and they can be fitted by fraudsters posing as maintenance men or who reward lowly-paid employees for looking the other way while the modifications are carried out.

The gangs involved – this is no longer the preserve of the amateur – have the resources and technical skills to carry out these frauds.

When you pay for a meal in a restaurant by putting your card into a handheld reader you are also vulnerable. Handheld devices were promoted because they mean you do not have to let your card out of your sight. But they work by sending a radio signal back to base so any diner at another table with a receiver could pick up the signal and capture your card data.

So is a return to money the answer? Regrettably, this would not be practical for a multitude of reasons. Notes can also be forged and the costs, risks and complexity of moving large volumes of money around are too immense to contemplate.

And chip and pin does appear to have had an impact on levels of fraud. Total plastic card fraud fell 13 per cent to £439m last year.

What can you do to beat the fraudster? You could take out identity theft insurance but this usually only covers the cost of putting matters right, not any losses you may have sustained.

The card issuers suggest other simple steps you can take. Cover your pin number when tapping it in; don't write your number down or give it to anyone.

These look obvious but they are worth remembering. The latest scam has shown once again that high technology alone is not enough. Common sense and a few simple precautions are also needed to defeat the fraudster.

[email protected]

 

This website and sisters royaldutchshellplc.com, shellnazihistory.com, royaldutchshell.website, johndonovan.website, and shellnews.net, are owned by John Donovan. There is also a Wikipedia segment.

Comments are closed.