In the very first paper I wrote on ATM fraud, Why Cryptosystems Fail, the very first example I gave of a fraud came from the case R v Moon at Hastings Crown Court in February 1992. Mr Moon was a teller at the TSB who noticed that address changes weren’t audited. He found a customer with over £10,000 in her account, changed her address to his, issued a card and pin, and changed the address back. He looted her account and when she complained, she wasn’t believed.
It’s still happening, most recently to a customer of the Abbey. Bank insider issues extra card, steals money, customer blamed – after all, chip and pin is infallible, isn’t it? Expecting banks to keep decent logs might be too much; and I supppose it’s way too much to expect bank fraud staff to read the research literature on their subject.
Steven Murdoch, Saar Drimer, Mike Bond and I have just won the IEEE Security and Privacy Symposium’s Best Practical Paper award for our paper Chip and PIN is Broken. This was an unexpected pleasure, given the very strong competition this year (especially from this paper). We won this award once before, in 2008, for a paper on a similar topic.
Update (2010-05-28): The photo now includes the full team (original version)
Last night’s documentary Erasing David shows how private eyes tracked down a target by making false pretext telephone calls to the NHS. By pretending to be him they found out when he and his wife were due to attend an ante-natal clinic, and ambushed him as he came out.
The NHS has form on this. Back in 1995 the BMA got me to draw up guidelines for dealing with phone calls; they appeared in the BMJ on Jan 13 1996. When staff at the N Yorks Health Authority were trained to follow these guidelines, they found 30 false-pretext calls a week. When the BMA reported this to the Chief Medical Officer and asked him to implement the protocol throughout the NHS, he was furious at our interference in “his” admninistrative procedures. The NYHA was ordered to stop. I told the story in my book.
I have long considered it unacceptable for the NHS to continue to ignore operational security. The new electronic record systems at a number of hospitals give receptionists access not just to appointment details but to clinical data too. So things are significantly worse than in 1996, and new national systems such as the SCR will compound the problem. The next secretary of state needs to get his act together.
A survey by the Consumers’ Association shows that 10% of cardholders write down or share their PIN. This high proportion surely raises serious doubt about whether it’s fair for banks to claim that such people are “grossly negligent” even if the PIN is well disguised (for example, as part of a phone number in an address book with hundreds of other numbers). And if banks don’t want disabled people to share PINs with carers, they ought to come up with an alternative, or be held to account under disability discrimination laws.
Interestingly, Mark Bowerman (PR for the banks) says in this article that customers should not use the same PIN for multiple cards. We heard him on radio saying exactly the opposite a few years ago. Now he tells people to change PINs to something easy to remember (and easier for criminals to guess).
By giving customers contradictory and impractical advice, the banks are placing an unmeetable burden on them.
The banks also frequently give advice that is simply wrong. Look, for example, at this video by Barclays showing how to enter your PIN at a merchant terminal!