Sure, an attacker can't easily sign a fake transaction, but he can compromise the terminal and get hold of the PIN, and then use the PIN somewhere else where a

Sure, an attacker can't easily sign a fake transaction, but he can compromise the terminal and get hold of the PIN, and then use the PIN somewhere else where a signed transaction isn't required. This has actually happened: http://business.timesonline.co.uk/tol/business/law/article714402.ece http://business.timesonline.co.uk/tol/business/law/article71...