OT you can be sure of Shell ??

Our experiences differ. We put around 100K via 'chip-n-pin' in retail (customer present) and over 750k* online (customer not present) - we've only ever had one issue 'online', countless (alright, about 40 or so) following the introduction of chip'n'pin in retail.

(* if you include our customers who use the systems we developed, then just over 9.7 Million in the financial year 2005-2006).

But on-line has nothing to do with C&P. We get plenty of "declined"s from on-line orders, but what the hell, no authorisation, no goods. We've never yet had a charge-back, even from Lativa! If the customer knows their pin and the transaction is done corectly, then you should never get a charge-back from a cutomer present sale either.

Richard

You should report the shops, or at least threaten to. Assuming they have similar merchant agreements then the it is part of the contract that phoning up when instructed to is *compulsory* - not doing so can lead to the service being withdrawn or suspended. It is an A1 pain the bum having to ring, but it's part of the overall security system and retailers who don't play play ball arn't helping.

Richard

But all that is to do with "curtomer not present" transactions - chip & pin has nothing whatever to do with this. There are some trials going on, allegedly, into some sorts of on-line security code or whatever but they all seem to either require additional hardware for both the user and vendor which is doomed to failure on cost/practicallity grounds, or using software which is just as open to abuse as now and would therefore not achieve much.

The simplest solution would be only to allow goods to be sent to the cards registered address - but the would upset customers.

Richard

|| The simplest solution would be only to allow goods to be sent || to the cards registered address - but the would upset customers.

Before the days of T'internet, I always assumed this was the case. It still amazes me that you can quote CC details over the phone or net (which only proves you have the card, whoever it belongs to) in your hand, and have the goods sent anywhere in the world. OK, you have to give an address, which means you could eventually be traced if anyone can be bothered, but it seems like an open invitation to theft.

How hard would it be for the banks to offer the option of "only post goods to cardholder's address" on every CC they issue?

Answer: about as difficult as Orange found it to place a monthly ceiling on my daughter's mobile phone which was registered to me, in other words, impossible. The system won't allow it, which translates as "we are making far too much money out of this to do it any other way."

The 330 quid in a month job ? Been there done that. Took her MONTHS to pay that off.

Steve

It still is the case - in almost every merchant services agreement.

Should a vendor deliver to any other address, any subsequent query or repudiation claim goes immediately against the vendor, who will rarely see the money again and probably find it isn't worth trying to chase.

Sure, the point I'm making is more about the industry, rather than just chip'n'pin though. The pin is by no means safer than a sig - the only caveat to this being that if all cards had (as Alliance and Leicester used to) the photograph of the holder on. Even that is not a failsafe as Charlotte often uses my debit card and pin these days (for convenience) - never been questioned about the 'name' on the card. I could, I expect, quite legitimately repudiate many of those transactions.

We had a series of 'call for authorisation' on every single transaction when I had the shop - on one day, a busy Saturday, it was happening for one in two transactions. I've never had any issues 'on-line', apart, obviously for the immediately declined.

It's not quite that simple - the card holders address is required to do transaction "properly".

They actually sort of do - it's the retailers discretion, and risk, to send to another address effectively.

It would certainly be diffcult to find example of a bank behaving in a manner that does not rotect themselves first and the customer second.

Richard

|| Richard Brookman wrote: || ||| Answer: about as difficult as Orange found it to place a monthly ||| ceiling on my daughter's mobile phone which was registered to me, ||| in other words, impossible. || || The 330 quid in a month job ? Been there done that. Took her MONTHS || to pay that off. || || Steve

Er, yeah, something like that. Partly my fault as I had taken to ignoring the Orange bills until they started arriving in full A4 envelopes (not the usual A5) and thicker than an Argos catalogue. Living apart doesn't help, as it's hard to be the angry Dad when you only see them every blue moon.

Yes I know. I stated that I use my credit card rather than my debit card because I get the chance to challenge before I have to pay, and that I didn't suffer much risk of my cashpoint card PIN being stolen as I only use one cashpoint. This doesn't mean I'm confusing C&P and online purchasing.

On or around Sun, 21 May 2006 12:18:47 +0100, Mother enlightened us thusly:

The thing about C&P in my observation is that the merchants don't check the card at all, quite often. Some of them take the card from you and put it in the slot and thus have the opportunity to examine the name thereon and see if it says "Mrs Jones" when you're quite obviously a bloke. But often they don't even touch the card, so if I had a stolen or cloned one I could bung it in, type the pin and the name on the card could be Yussuf Amin for all the merchant knew about it.

Yep, comes of having the card slot on the keypad and not the EPOS kit. It's much easier for the sales assistant to let the customer put the card in than reach round and awkwadly put it into a slot aimed at the customer not them. Mind even those that do put the card in for you don't do much more than a very casual glance if that.

Certainly seems like two steps forward one step back. Probably because, as is typical these days, no body really thought through the implimentation and ergonomics of the C 'n P system.

Personally I don't like C 'n P, I keep forgetting the numbers. Seems I can remember 2 no trouble, but bung in a third and it bumps one of the others out of my memory. Bit of a problem when I have 3 cards I use regulary (ATM, Business CC, Personal CC). I'm tempted to make all cards all the same but that somewhat defeats the object...

On or around Sun, 21 May 2006 18:07:37 +0100, Ian Rawlings enlightened us thusly:

I have a "business card" which functions as a mastercard but is in fact a chegecard rather than a credit card - an added advantage of this is that the bank transaction to pay it is a single transaction, and thus only gets one transaction charge, whereas using a debit card, you get a transaction charge per transaction. not a big advantage, but it adds up over the year. same applies to credit cards, of course, if you clear them with a single monthly payment.

On or around Sun, 21 May 2006 19:50:26 +0100 (BST), "Dave Liquorice" enlightened us thusly:

in that case, though, you have minimal extra risk. If all the cards are stolen, then the thief still has to guess the number, and know that they're all the same. If you lose one card, the risk is identical. The actual number is as immune to guessing as any other number, even if you put 0000 - in fact, I expect 0000 would be less prone to guessing; no half-intelligent thief would think that anyone would be daft enough to put 0000 as a PIN.

but in general, numbers like your date of birth are more prone to guessing by people who know you, but no more prone to guessing by a complete stranger unless they also have something like a driving licence which has your DoB on it.

so all in all, changing 'em all to the same PIN represents a very small increased risk and makes it much less likely that you forget it. You could, I suppose, reduce the risk slightly by changing the PIN at intervals, then if someone has observed you typing in your PIN there's a chance that in due course if they nick the card you'll have changed it.

Unless some shoulder surfs (or electronic equivalent) and lifts me wallet...

Any sensible system wouldn't let you change your PIN to 0000, 1111, etc, a sensible system would insist in four different digits.

Which if they had my wallet they would have... I don't use my DOB or any other personal info for PINs.

On or around Mon, 22 May 2006 11:22:53 +0100 (BST), "Dave Liquorice" enlightened us thusly:

Some time ago I used 1966. not any more, though, so don't get ideas. I don't used dob any more.

But the extra risk in having all the cards the same is only in what you say, if someone finds out and nicks 'em they can use 'em all. But only if they know that you have 'em all the same.

It must be worth a punt once you have a valid pin to try it on the other cards as well, remember you get three tries before you get locked out.

Shell the beginning of the Month, now it's JET: