Chip and PIN, a new challenge for data security

Abstract

Payment infrastructures and cards have hastily been moved to a Chip and PIN system in the UK. In essence Chip and PIN has resulted in a shift of the fraud responsibility from the issuers - MasterCard and Visa to a Non-Chip-enabled party. In addition, liability lies with merchants for transactions involving a Chip-enabled card. There has already been a drop in fraud by 29% since the introduction of Chip and PIN according to APAC statistics. But the new system brings new complexity involving a complicated key management cycle. During 2005 the UK underwent a revolution in the way consumers pay for goods and services using plastic cards. As a response to the spiralling cost of credit/debit card fraud, retailers and banks made massive investments in updating their payment infrastructures and cards to Chip and PIN. Figures released by APACS confirm that the recent migration to Chip has already paid dividends, with a 29% drop in card-based fraud during the first six months of 2005. From February 14 2006, all UK credit/debit Point Of Sale (POS) transactions must verify cardholders by PIN, with no fall-back to signature verification if the 4-digit number is unknown or forgotten. The only cardholders still permitted to sign will be a small minority of disabled customers who cannot use a PIN-pad, and holders of foreign cards. Disabled customers will be issued with Chip and Signature cards on request. In this case, the Chip will be configured to force the POS device to prompt for a signature instead of a PIN. The other exceptional case will be the small percentage of credit/debit cards that still do not contain a Chip.