19 November, 2004: Card sharps

[ Home page | Web log ]

Just a brief update on the chip and PIN nonsense. Since I wrote that last page, I have asked Barclays, my bank, and Barclaycard, from whom I have a credit card, for `PIN suppressed' or `chip and signature' cards. (Briefly, the deal here is that the banks have somehow convinced the courts in this country that it is impossible for one person to know another person's PIN, and that therefore if a crook nicks your money by using your card, or a copy, and your PIN, your bank might well not refund you and might even have you thrown in jail.)

Anyway, Barclays (to whom I wrote) responded to my request by... sending me another copy of my PIN. So clearly they have a firm grasp of the technology.

Barclaycard, however, sent me a new `chip and PIN' card to replace my expired card, with a little note saying I should call them to confirm receipt. So I did, and explained that I wanted a non-chip-and-PIN card. After a couple of rounds of uncomprehending conversation, it was eventually explained to me that I could only get such a card if I was disabled (the point being that, e.g., many visually impaired people have trouble operating the PIN keypads and so can't be expected to use chip and PIN). ``Oh,'' I said (slightly unfairly), ``you're discriminating against me because I'm not disabled?''

Apparently they weren't, but didn't give any other credible reason for not giving me a PIN suppressed card. So I asked the chap to close my account. This provoked a slightly different tactic, viz., ``We could give you a chip and signature card, but shops wouldn't accept it if you're not disabled.''

Now, I've never run a shop, but it's always been my understanding that the aim of the game in retail is to separate the punter from their hard-earned cash. I shall be a little bit surprised if, having handed over my card and signed the slip, I am challenged as to my disability status, but we shall see. Anyway, and to my surprise, after I asked the Barclaycard chap, ``Have you asked them?'', he got bored of arguing this back and forth and (after a long pause during which he presumably consulted mission control) agreed -- on the proviso that it would be my own silly fault if shops refused my card -- to set my card up for chip-and-signature.

(As a brief comment, I'm not sure how this works. I'd understood that the chip was designed for offline verification, and hence it's not clear how it can be remotely enabled in this way. Perhaps during an online verification it can talk to Barclaycard and update its settings? Alternatively, the Barclaycard man may have been lying.)

If you're also unhappy with the idea of being screwed by the banks over chip and PIN, you might also want to read this. (I should say also that the chip and PIN scheme is marginally more `secure' than the signature scheme, in some vaguely useful sense, in particular because signatures frequently aren't checked, whereas the PIN is. But this fairly trivial technical advantage is nullified by the dishonesty of the banks and their success in hoodwinking the courts in this country over the supposed `impossibility' of fraud based on stealing a person's PIN.)

In other news: fine work by NO2ID on Wednesday, accompanied by a splendid own-goal by David Blunkett in the form of his comments about supermarket loyalty cards. (He's chosen not to have one, but thinks that they're more of a threat to privacy than his compulsory ID card scheme. Surely some mistake?)

Copyright (c) 2004 Chris Lightfoot; available under a Creative Commons License.