Chip & Pin

Page may contain affiliate links. Please see terms for details.

classic33

Leg End Member
Have you ever wondered why, since it replaced signing.
The shop gets to keep the copy of the receipt with your full card number along with a record of your PIN. Whilst your receipt only gives the last four numbers of the card?
 

swee'pea99

Squire
So when you lose the receipt, any finder doesn't have your full card details.
 
OP
OP
classic33

classic33

Leg End Member
When signing, the card number was given in full. And the machine itself has a record of the PIN used.
 

PBancroft

Senior Member
Location
Winchester
They don't keep a record of the PIN, the card machine probably doesn't even know its a PIN, its just waiting for you to enter a code which matches an algorithm presented to it by the bank and your card. If the reader stored the PIN, the shopkeeper would also need the account details stored on the chip - yes it is possible to create a card cloning machine which would also record the PIN, and I'm sure it has been done, but by and large they won't do that. It wouldn't surprise me if even both the bank's request code and your PIN are obfuscated by some means for the transmission process, so even the data entered by the end user is somehow useless after the sale anyway.

A bigger worry, I think, are sales made online. A lot of the time you just don't know what the company is doing with your data and I have heard of account details being stored in plain alphanumerics in unsecure locations.
 
They don't keep a record of the PIN, the card machine probably doesn't even know its a PIN, its just waiting for you to enter a code which matches an algorithm presented to it by the bank and your card. If the reader stored the PIN, the shopkeeper would also need the account details stored on the chip - yes it is possible to create a card cloning machine which would also record the PIN, and I'm sure it has been done, but by and large they won't do that. It wouldn't surprise me if even both the bank's request code and your PIN are obfuscated by some means for the transmission process, so even the data entered by the end user is somehow useless after the sale anyway.

A bigger worry, I think, are sales made online. A lot of the time you just don't know what the company is doing with your data and I have heard of account details being stored in plain alphanumerics in unsecure locations.

Chip and pin machines do not store or send you pin anywhere. They do however store card numbers etc. on the receipt rolls iirc, which is often enough to do some 'customer not present' card shopping online or over the phone should those details be misused by a staff member. No different from 'sales made online', so your worry is either misplaced, or you should be worrying about the other purchases too
smile.gif


One quite common, but very confident fraud is for engineers to arrive at a shop\petrol station and replace the chip & pin machines with a doctored one which can record not only details, but pin numbers. IIRC every Shell petrol on the M1 had their machines changed in this way about a decade ago.
 

rualexander

Legendary Member
Most online and phone purchases these days also require the three figure security number printed on the back of the card so without physically having the card in their possession the card number would be useless. So it would only be card cloning that you need to worry about.
 
There are readers that can retain the PIN, but they are complex and more difficult to make.

Most card skimmers are backed up with a video or other way of recording PIN details

For this reason always take care, and make sure no one sees your PIN when you use it

One common one is to watch a till, and then lift the card, the other is for staff to skim the card and then watch you enter the PIN, again be aware do not let the card out of your sight
 

Allirog

Active Member
I never use credit/debit cards anywhere.On the internet I purchase items with
a pre paid gift card and in the high street I use cash. If you enter your banking
details in a company database, no matter how secure they claim it to be, a skilled
hacker could eventually gain access and steal them. Look what happened to Sony recently.
 

LosingFocus

Lost it, got it again.
I never use credit/debit cards anywhere.On the internet I purchase items with
a pre paid gift card and in the high street I use cash. If you enter your banking
details in a company database, no matter how secure they claim it to be, a skilled
hacker could eventually gain access and steal them. Look what happened to Sony recently.

Which is why most major banks now have systems similar to LBG's "ClickSafe" (I think) when using the card online, where after entering the card number, exp date and 3 digit code, you are then presented with a pop-up whichs asks for a p-word as an additional check. This isnt linked to the merchants site at all.
 

XmisterIS

Purveyor of fine nonsense
I pay cash, always, except for big items (which I hardly ever buy).

At the beginning of the week I get my budget out of the cash machine; and that's it for the week. I hardly ever use my card.

Interestingly, several years ago tried to buy one of those pay-as-you-go all in one phone packages at the supermarket - one of those where you switch the phone on and you're good to start making calls - and they refused to accept cash! They insisted it had to be a card payment. Seeing as I didn't have my card on me at the time I told them where to stick their phone.
 
OP
OP
classic33

classic33

Leg End Member
Question then as the majority are saying that the machines do not store PIN numbers.

Why in some places where remote terminals are used, does the terminal have to be taken back to the base station to have the transaction verified/completed. They do after all say that your PIN has been verified, which by the way isn't worth the paper its printed on. Some even have a handy little port for connection to a computer.
 

marinyork

Resting in suspended Animation
Location
Logopolis
Question then as the majority are saying that the machines do not store PIN numbers.

Why in some places where remote terminals are used, does the terminal have to be taken back to the base station to have the transaction verified/completed. They do after all say that your PIN has been verified, which by the way isn't worth the paper its printed on. Some even have a handy little port for connection to a computer.

Because a lot of places still have older machines and it gets sent back over the telephone line. Used to be a big problem in some shops and restaurants as it'd slow things down to a crawl.
 
Top Bottom