Fraudsters show how to beat chip and pin

Chip-and-pin technology, the latest weapon against credit card crime, will not reduce fraud and could make it easier, a criminologist argues today.

Reliance on a personal identity number, rather than human vigilance, could create new opportunities for the unscrupulous.

Credit card and bank fraud is estimated to cost £500m a year in Britain, and public concern about identity theft is high.

Emily Finch, of the University of East Anglia, will tell the British Association for the Advancement of Science meeting in Dublin that she and a colleague interviewed credit card criminals, and saw for themselves the routine lapses at cash registers, which are often the front line in fighting fraud.

"There are various strategies that fraudsters use to get around the pin problem," she said. "One of the things that is very clear is that it is a difficult matter for a fraudster to get hold of somebody's card and then find out the pin.

"So the focus has been changed to finding the pin first, which is very, very easy if you are prepared to break social convention and look when people type the number in at the point of sale.

"As slightly dodgy characters, we have been lurking around doing these things," she said.

"We haven't been doing the follow up, which is going and stealing the card and using it; but we have been looking at the strategies that fraudsters use, and putting them into practice to see how easy they are - and it is remarkably easy. People don't focus on what other people behind them are doing."

Professional fraudsters did their research first: there would be no point in stealing a card from someone who didn't have much money. Fraud was an organised and professional career in which people advanced their skills.

"One of the things we found quite alarming was how much the human element has been taken out of point-of-sale transactions," Dr Finch said. "Point-of-sale staff are told to look away when people put their pin number in; so they don't check at all.

"As part of our research - my colleague is male - we have been using each other's cards to buy things. And not once in the whole period that we did this, did anybody say to me, 'This is a man's card, this isn't your card.'"

Criminals were increasingly making fraudulent card applications, to have unchallenged use of a card for a period.

"If you think about a credit card application, it doesn't require much information about an individual," Dr Finch said. "It certainly doesn't require anything that can't be found out with a bit of research."

Some strategies relied on trust. Another fraudster trick was to produce a stolen card and pretend to misremember the number and search for it on a piece of paper.

Imagine, she said, someone searching for a piece of paper and saying, "Oh yes, that's my signature"; there would be instant suspicion.

But there was utter trust in the new technology to pick up a fraudulent transaction, and criminals exploited this trust to get around the problem of having to enter a pin number.

"You go in, you put the card in, you type any number because you don't know what it is. It won't go through. The fraudster - because fraudsters are so good with people - says, 'Oh, it's no good, I haven't got the hang of this yet. I could have sworn that was my number... I've probably got it confused with my other card.'

"They chat for a bit. The sales assistant, who is either disinterested or sympathetic, falls back on the old system, and swipes the card through.

"Because a relationship of empathy has already been established, and because they have already become accustomed to averting their gaze when people put pin numbers in, they don't check the signature at all.

"So fraud is actually easier. There is very little vigilance at the point of sale any more. Fraudsters know this and they are taking advantage of it."