4 ms·

Since they'd reverse the charges anyway if it wasn't you who made them, what exactly is the problem here?

URSpider94 13y ago
This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card. From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"
- jamesaguilar 13y ago
  So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.
  - 001sky 13y ago
    Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative. This is not a strawman, its a legitimate edge case.
    - jamespo 13y ago
      The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
      - 001sky 13y ago
        From a sample card-holder's agreement: 3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN. So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
- patrickk 13y ago
  > From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).
  - rahoulb 13y ago
    When Chip and PIN came in, as part of the TOS that you accepted by using the card, it included a clause that the bank is not liable for any fraud on the card as Chip/PIN is unbreakable (the implication being you must have given away your PIN). I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).
    - vidarh 13y ago
      The big gaping problem of course being that most fraud does not involve chip+pin transactions, but online transactions that are no better protected than before.
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
- makomk 13y ago
  In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.
- EvanAnderson 13y ago
  It's not legal (now) for European banks to shift the fraud liability to the Customer with chip-and-PIN, but that hasn't stopped them from trying: http://www.thisismoney.co.uk/money/saving/article-2215223/Victim-chip-pin-fraud-Its-YOUR-fault-insist-banks.html http://www.thisismoney.co.uk/money/saving/article-2215223/Vi...

This is where things start to get tricky. I've read up on "chip and PIN" in Europe, where purchasers have to insert their cards into a reader and enter the numeric code that is stored on the card. From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I could see fingerprint scanning going the same way -- with vendors saying "what do you mean you aren't the one who made this purchase? The device was unlocked with your unique fingerprint!"

jamesaguilar 13y ago
So you're going with a slippery slope argument? This thing could cause that thing that could cause that bad thing, so this thing is bad? I suppose that is something that could happen in the future. It's not a likely problem to complain about with this particular implementation.
- 001sky 13y ago
  Since they'd reverse the charges anyway... You're baselessly asserting your position, though. If you write your pin on your ATM card, they will not refund you. That is policy and they ask everytime you lose your card. The bank views this as lack of due care. Likewise, if you leave copies of your fingerprints on your payment device, they could argue that you are likewise acting with un-reasonable care. Now that this has been (so easily?) spoofed, is it reasonable to believe it is secure? That is a valid concern. Unlike a pin, you cannot reset a fingerprint security mechanism. So when it is compromised, it is over. So, the result is messy in that it puts you in a problem using today's standard practices, but at the same time, the standard practice "defense" is not applicable, and lacks an obvious alternative. This is not a strawman, its a legitimate edge case.
  - jamespo 13y ago
    The bank has never asked me if I had my PIN written on my card when I've lost it... all they ask is lost or stolen.
    - 001sky 13y ago
      From a sample card-holder's agreement: 3. I will hold in strict confidence my personal identification number (PIN). I will take reasonable precautions to keep my PIN separate from my ATM card and to prevent the unauthorized disclosure of my PIN. So, you sign an affadavit verifying you did not contravence this agreement. They will screen for this as/if you file a claim for fraud.
patrickk 13y ago
> From what I've found online, chip-PIN does indeed reduce fraud, but when fraud does happen, it becomes extraordinarily difficult for the cardholder to get a refund from the bank. I live in Europe, and twice in the last two years or so my card details have been compromised, and both times my bank has rang me to notify me of suspicious transactions before I'd even noticed. It depends on the bank (and the country most likely) with regards to getting a refund. I got refunds no problem, but I've heard people having problems in the UK. The fraud happened online (not sure how, I'm reasonably tech savvy and careful with my card details).
- rahoulb 13y ago
  When Chip and PIN came in, as part of the TOS that you accepted by using the card, it included a clause that the bank is not liable for any fraud on the card as Chip/PIN is unbreakable (the implication being you must have given away your PIN). I believe that this has now changed (although I've not had a new card recently and I don't remember seeing any new TOS).
  - vidarh 13y ago
    The big gaping problem of course being that most fraud does not involve chip+pin transactions, but online transactions that are no better protected than before.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
makomk 13y ago
In particular, it turned out that there was a flaw in the Chip and PIN specification which made it possible to bypass the PIN requirement. There's some evidence this was exploited fairly widely in the wild before security researchers found the flaw, but since the banks erased the logs that recorded whether a PIN was actually used all the customers ended up liable for the fraudulent charges.
EvanAnderson 13y ago
It's not legal (now) for European banks to shift the fraud liability to the Customer with chip-and-PIN, but that hasn't stopped them from trying: http://www.thisismoney.co.uk/money/saving/article-2215223/Victim-chip-pin-fraud-Its-YOUR-fault-insist-banks.html http://www.thisismoney.co.uk/money/saving/article-2215223/Vi...