May 11, 2006

By Peter Kenny

With the news that the much-heralded chip and pin security system had been breached, Lloyds-TSB has finally conceded that there is indeed a serious flaw in the chip and pin security system.

This new fraud problem has arisen with the use of cloned, which include not only the card details but also the four digit PIN, which is used to authorise the use at a cash machine / ATM.

It was earlier reported that over £1million had been taken from customer’s accounts due to a chip and pin fraud sting at one of their petrol stations. Shell have now temporarily disabled their chip and pin technology in all of their 600 petrol stations. It seems that the fraudsters had managed to hide a device in the chip and pin terminal, which then managed to capture unsuspecting cardholders details.

Once a fraudster has these credit card details they can then make a cloned card. The cloned card is used to withdraw cash from an ATM or cash machine based in a country out with the UK.

In theory a cloned card should not be able to work. Many ATM’s are programmed to only read the credit card chip, which cannot be cloned, however, there are cash machines in the UK which still read the old magnetic strip on the back of the credit card to gain the card information. Out with the UK all ATM’s read the magnetic strip and not the card chip, hence the reason why many card holders found their credit card accounts had been plundered by withdrawals made overseas. The using of these cloned cards in overseas ATM’s has also flagged a further security flaw, cash withdrawals from overseas take longer to show up as irregular behaviour patterns in the banks security procedures.

A Lloyds-TSB spokesman said,  "In recent weeks, we have identified an increase in fraud via overseas cash machines. We have reviewed the way we operate to protect our customers. We are always updating our many measures to prevent and detect fraud."

The chip and pin based security system is a step in the right direction in the fight against credit card fraud, however, too much attention has been placed on the point of purchase security protecting retailers and not enough on protecting the individual card holders.