Chip and spin
Rune Andersen, Mike Bond, Steven J. Murdoch · UCL Discovery (University College London) · 2006
The views of the authors regarding the liability issues, technical shortcomings and management failures of 'Chip and PIN' card payments are discussed. The UK banks do have a voluntary code of practice that is supposed to indicate liability during computer crimes but it relies on ill defined notions of 'reasonable care'. The use PINs in shops as well as at ATMs greatly increases the likelihood that PINs can be compromised by shoulder-surfing. This is not just a function of the frequency of PIN entry, but also of the environment and the associated social norms. The system has a glaring weakness, if a card is presented at an ATM or POS terminal whose chip is damaged then the device falls back to the magnetic strip operation. According to the author the technical specification behind Chip and PIN EMV is a public standard and will come under attack. The interaction with the credit card is simply done using electronic signals which can be easily routed from anywhere in the world.