5 ms·

Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some li

by eli 12y ago

Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some liability for fraud on the consumer?

Nursie 12y ago
Nope. Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability. The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.
- petejansson 12y ago
  The US is moving to Chip & Signature, rather than Chip & PIN, but the liability will still shift to the merchant, not the buyer. http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...
  - Nursie 12y ago
    Well, it's a good start, and Chip & PIN is just a terminal capability flag and a CVM list alteration away...
- lotsofmangos 12y ago
  Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.
  - Nursie 12y ago
    I'm interested in liabilty for what though. I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though. I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild. --edit-- and it still involves a stolen card at that point doesn't it?
    - lotsofmangos 12y ago
      Someone could have man in the middled an online purchase and then used your card details that way. Buying online while using wifi or mobile can be hijacked with a fake router or base station.
      - Nursie 12y ago
        >> Someone could have man in the middled an online purchase and then used your card details that way. Not if they were using my PIN as that's never used online. Had to be a physical purchase to get that. As a workmate was subject to similar fraud at a similar time we figure it was probably a bar or restaurant we'd been to together, where our cards were skimmed and someone either watched or recorded us entering PIN details.
    - deleted 12y ago
      [deleted]
deleted 12y ago
[deleted]
DanBC 12y ago
They shift the burden of proof to the consumer, but fraud is still covered in some cases. You're probably not covered if you give the pin to someone or if you transfer the money yourself. There are many cases of people losing tens of thousands of pounds this way.
- Nursie 12y ago
  >> There are many cases of people losing tens of thousands of pounds this way. ?? I frequently work in this area and have not heard these stories. Fraud is always covered on credit cards in the UK (for example), by law, and I'm pretty sure it is on debit as well.
  - pbhjpbhj 12y ago
    I think it goes like this: If you gave someone your PIN you broke contract with the bank, but you also authorised the transaction. Similarly if you did the transaction you can't argue that you didn't authorise it - mistakes happen, but the bank isn't usually liable for your mistakes.
    - tw04 12y ago
      And how exactly do you PROVE you didn't give anyone your pin? If the only way they put the liability on you is if you admit you gave someone your pin, it seems stupid to even bother. To me, knowing how things usually work in the US - they'll claim it's an on your honor system, and then suddenly it will be "well we think you gave someone your pin so we aren't covering the charges". Conveniently a lawsuit will be more expensive for you, the consumer, than just paying off the fraudulent charges.
      - Nursie 12y ago
        In my experience in the UK you don't have to... But then my (chip) card was cloned to a mag-swipe card and someone attempted to use the clone in an ATM in Canada. I don't really know what happens if someone manages to get your original card and your PIN. AFAICT there's not a lot of fraud that happens this way.

by eli 12y ago

Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some liability for fraud on the consumer?

Nursie 12y ago

Nope. Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability. The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.

petejansson 12y ago
The US is moving to Chip & Signature, rather than Chip & PIN, but the liability will still shift to the merchant, not the buyer. http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...
- Nursie 12y ago
  Well, it's a good start, and Chip & PIN is just a terminal capability flag and a CVM list alteration away...
lotsofmangos 12y ago
Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.
- Nursie 12y ago
  I'm interested in liabilty for what though. I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though. I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild. --edit-- and it still involves a stolen card at that point doesn't it?
  - lotsofmangos 12y ago
    Someone could have man in the middled an online purchase and then used your card details that way. Buying online while using wifi or mobile can be hijacked with a fake router or base station.
    - Nursie 12y ago
      >> Someone could have man in the middled an online purchase and then used your card details that way. Not if they were using my PIN as that's never used online. Had to be a physical purchase to get that. As a workmate was subject to similar fraud at a similar time we figure it was probably a bar or restaurant we'd been to together, where our cards were skimmed and someone either watched or recorded us entering PIN details.
  - deleted 12y ago
    [deleted]

deleted 12y ago

[deleted]

DanBC 12y ago

They shift the burden of proof to the consumer, but fraud is still covered in some cases. You're probably not covered if you give the pin to someone or if you transfer the money yourself. There are many cases of people losing tens of thousands of pounds this way.

Nursie 12y ago
>> There are many cases of people losing tens of thousands of pounds this way. ?? I frequently work in this area and have not heard these stories. Fraud is always covered on credit cards in the UK (for example), by law, and I'm pretty sure it is on debit as well.
- pbhjpbhj 12y ago
  I think it goes like this: If you gave someone your PIN you broke contract with the bank, but you also authorised the transaction. Similarly if you did the transaction you can't argue that you didn't authorise it - mistakes happen, but the bank isn't usually liable for your mistakes.
  - tw04 12y ago
    And how exactly do you PROVE you didn't give anyone your pin? If the only way they put the liability on you is if you admit you gave someone your pin, it seems stupid to even bother. To me, knowing how things usually work in the US - they'll claim it's an on your honor system, and then suddenly it will be "well we think you gave someone your pin so we aren't covering the charges". Conveniently a lawsuit will be more expensive for you, the consumer, than just paying off the fraudulent charges.
    - Nursie 12y ago
      In my experience in the UK you don't have to... But then my (chip) card was cloned to a mag-swipe card and someone attempted to use the clone in an ATM in Canada. I don't really know what happens if someone manages to get your original card and your PIN. AFAICT there's not a lot of fraud that happens this way.