3 ms·
Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that
by lotsofmangos 12y ago
Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.
- Nursie 12y agoI'm interested in liabilty for what though. I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though. I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild. --edit-- and it still involves a stolen card at that point doesn't it?
- lotsofmangos 12y agoSomeone could have man in the middled an online purchase and then used your card details that way. Buying online while using wifi or mobile can be hijacked with a fake router or base station.
- Nursie 12y ago>> Someone could have man in the middled an online purchase and then used your card details that way. Not if they were using my PIN as that's never used online. Had to be a physical purchase to get that. As a workmate was subject to similar fraud at a similar time we figure it was probably a bar or restaurant we'd been to together, where our cards were skimmed and someone either watched or recorded us entering PIN details.
- deleted 12y ago[deleted]