credit card fraud

[ninjatune]

Even with a chip card, transactions can still be done without using the chip. Your PIN can be compromised by someone watching you enter it, or a hidden camera focused on the pin pad, or the suspects replacing the entire pin pad (which can record your card # and PIN).

1) keep track of your transactions
2) cover your PIN when you enter it
3) inspect the machine/atm/pin pad closely for suspicious signs
4) change your PIN often.

[Noir]

^ This.


So to the people (or CC companies) saying that it's pretty much impossible to defraud chip-based transactions, that's crap.

[Sunfighter]

The transition to chip & pin was a saviour to retailers and vendors for a couple of reasons.

Prior to the introduction of chip & pin in this country, a cardholder could dispute ANY Master Card or VISA purchase at any time. The process would look like this;

-VISA/MC would contact the retailer/vendor and ask for an imprint/signature or a digital signature. VISA/MC already know at this point if the card was magnetically swiped of if it was manually entered. The success rate for cardholders disputing manually entered (and imprinted) cards was much higher than those that were magnetically swiped because their was no realistic way for the retailer/vendor to prove that the card was physically present. Depending on what documentation/evidence the retailer/vendor might provide, VISA/MC could side with the customer, in which case the charge would be cleared from their statement and charged to the retailer/vendor, who would have to eat it as bad debt... the retailer/vendor would have little room to dispute the now bad debt as per their stringent agreement with VISA/MC...

-Chip & pin has changed everything.... it protects the customer in a HUGE way but also the vendor/retailer. If I am a customer and I attempt to dispute a charge on my statement and VISA/MC recognize that if was a chip & pin transaction I as the cardholder have ZERO grounds to dispute the charge... HOWEVER, I can still dispute charges that were magnetically swiped or manually entered.... THEREFORE, as a retailer, it is in my interest to have the customer use chip & pin in every instance possible because it means zero bad debt for me....

I work very closely with VISA and MC and the impact that Chip & Pin has had on reducing credit card fraud for cardholders and bad debt for businesses is simply ENORMOUS.... like simply astonishing..... the biggest obstacle right now is ensuring that retailers have physically secured their pinpads accurately to prevent against instances where (As a poster mentioned above) their unit is lifted and replaced with a tampered unit that is grabbing people's card information....

I have caught probably 50+ people using stolen credit cards in the past and yet to find somebody using a stolen card with a functioning chip & pin... it's very obvious now when the card is stolen because the "customer" insists that the retailer/vendor swipe the card as they have "forgotten" their PIN... and then they disapear when I suggest we call the bank...

[97ITR]

Originally Posted by ninjatune

Even with a chip card, transactions can still be done without using the chip. Your PIN can be compromised by someone watching you enter it, or a hidden camera focused on the pin pad, or the suspects replacing the entire pin pad (which can record your card # and PIN).

1) keep track of your transactions
2) cover your PIN when you enter it
3) inspect the machine/atm/pin pad closely for suspicious signs
4) change your PIN often.

Yes, you are entirely correct that even with a chip card, transactions can still be done without using the chip. Even with a chip-equipped card, you can still do swiped transactions, where you physically sign, or number-entered transactions, where the card isn't physically present (i.e. online transactions). What's important to note is that in these cases the credit card PIN isn't entered and the actual chip on the card isn't used to authenticate. This is why the whole industry is hoping to phase out swipe transactions by 2015. In the OP's case, it was a PIN entered transaction, meaning the chip was used to authenticate. That's the sticky part, banks currently have not seen any evidence where the chip has been successfully duplicated. This is why I mentioned that, in their eyes, the explanation for the 7K charge is either the OP had his PIN & card stolen or he made the transaction.

Edit...
I want to further clarify that the though the chip on your card "can't" be duplicated, thieves can still duplicate your card and hit places that they know don't require chip and PIN authentication.

[Sunfighter]

Understand though... that if a retailer/vendor completes a manually entered or magnetically swiped card transaction as opposed to a PIN transaction, they are effectively assuming the full burden of a potential charge back, which is why most retailers will refuse, especially if the purchase exceeds X amount of dollars, and will insist the customer enter their PIN...

I am not saying that it is impossible, but I have yet to see an instance where a customer has disputed a PIN-entered transaction and we have been using chip & pin officially since March 31st of 2011 (that's when the liability shift extension expired...)...

[Mr.HappySilp]

That's why I perfer to use cash when i can. Only save way unless of coz I got rob.

[Manic!]

Originally Posted by Sunfighter

Understand though... that if a retailer/vendor completes a manually entered or magnetically swiped card transaction as opposed to a PIN transaction, they are effectively assuming the full burden of a potential charge back, which is why most retailers will refuse, especially if the purchase exceeds X amount of dollars, and will insist the customer enter their PIN...

I am not saying that it is impossible, but I have yet to see an instance where a customer has disputed a PIN-entered transaction and we have been using chip & pin officially since March 31st of 2011 (that's when the liability shift extension expired...)...

I think the liability shift has been extended to another year but I am not 100% sure. We have spent over 70K getting our gas station to be ready for chip and pin. New pumps and till system that can read the chip. Right now there are places that still swipe but in a year or 2 they will be almost but all gone. We also never do manual transactions. Chip and pin is secure and a lot better than swipe. People should not worry.

[Sunfighter]

The March 31st, 2011, date was the domestic liability shift for VISA and MC... it was supposed to be 6 months earlier but retailers/vendors were not entirely ready... like you said, it is a costly process to upgrade and logistically very complex for retailers/vendors big and small... virtually everybody who has completed the switchover has seen big returns though!

[Sunfighter]

Just checked... both VISA and MC DID extend the liability shift for AFD (Automatic Fuel Dispenser Merchants) until December 31st, 2012..

[Psykopathik]

happened to me too. found out my info was floating around online. yes I actually found it MYSELF on a hackers forum! (which was already shut down)

my CC company called me when they noticed weird transactions. and cancelled my card and issued me a new one.

I also called Eqifax/Transunion and put a fraud notice on my name an any future CC applications etc. So any time a CC is opened under my name it will be scrutinized.

I'm pretty sure it was due to a trojan on my PC.

[Mr.HappySilp]

The charges have to make sense too. like you are in Vancouver but the charges are say in Japan then yea that's not you for sure lol.

[ws6ta]

I will have an update for you guys tomorrow. Credit card company is "looking into it"

[MWR34]

Originally Posted by ninjatune

Even with a chip card, transactions can still be done without using the chip. Your PIN can be compromised by someone watching you enter it, or a hidden camera focused on the pin pad, or the suspects replacing the entire pin pad (which can record your card # and PIN).

1) keep track of your transactions
2) cover your PIN when you enter it
3) inspect the machine/atm/pin pad closely for suspicious signs
4) change your PIN often.

I dont think everyone understands this.

Almost Everything that you mentioned above is pointless.

1) keep track of your transactions ( obvious with every monthly statement go over it to make sure you did all the transactions )
2) cover your PIN when you enter it
3) inspect the machine/atm/pin pad closely for suspicious signs
4) change your PIN often.

2,3,4 all still require the "Fraudster" to physically take your card out of your wallet, and Use it.
It doesnt matter if they see your PIN on a hidden camera, It doesnt matter if they skim your data in a manipulated ATM, or terminal.... knowing your card number and PIN number does NOTHING, because without the actual card with the Actual Chip on it, you cannot enter the PIN.

When insert the Chip, it verifies the Chip Info, then it asks for the PIN.

So no other situation, circumstance, transaction etc.. will the PIN be relevant if you do not have the CHIP already inserted and Read.

Thats why the CHIP+PIN is soo effective in Visa or MasterCards defense. The PIN is only asked and Prompted for, after the Chip is verified. Not just swiped info, or manually entered Info.


If you Swipe your Chip card magstripe, the terminal doesnt ask for PIN, It asks you to insert your card, THEN after reading the chip it asks for PIN.



The ONLY benefit i see from having someone steal your magnetic info, and have your PIN on camera, is doing cash withdraws at an ATM that doesnt read the Chip and relys on the Magstripe then PIN. but then that falls under the category of Magstripe transaction not a CHIP+PIN transaction, And once again not instore purchases,just old sketchy ATMs

[ws6ta]

credit card company looked into the matter. apologized. said they will have the collections cleared off of my credit within 24 hours and are sending me a letter saying I don't owe them anything.

That was a lot easier then I thought it would have been.

[FerrariEnzo]

good thing...

MAKE sure you get this in writing about this being cleared, so you have record incase "collections" doesnt get word and still continue to harass you