I’ve run out “finger” ideas for headlines

[Dave Birch] Apparently there is going to be a national card fraud prevention campaign here next week and 14 million “advice cards” will be distributed to motorists at petrol stations across the UK, reminding them to be vigilant against potential fraudsters. APACS is working with the UK Petroleum Industry Association in order to remind consumers of the importance of keeping their credit and debit cards safe. If you’re wondering why petrol stations are the specific focus for an anti-fraud campaign it’s because petrol stations in the U.K. still take plastic cards for payment (unlike, say, Dubai?) but in recent times they have been targeted by fraudsters who capture motorists card details and PINs on an industrial scale. They use the captured information to manufacture counterfeit magnetic stripes that can be used in foreign ATMs that do not implement chip & PIN (there’s a more detailed discussion of this over on the Digital Money Blog). The impact of tis fraud is substantial. So while ATM fraud as a whole has actually been declining because of chip and PIN. Compared with the last six months of 2006, the value of domestic ATM fraud fell 55% in the first half of 2007. The moral of this story is clear: introducing better authentication in some places can actually make the situation worse in other places. Requiring PIN at POS means that PINs can now be captured in ways that they could not before.

Technorati Tags: biometrics, cardspace, EMV, identity

If petrol stations are to be the most important battleground between banks and fraudsters, then we should take an interest in the latest extension of the PayByTouch fingerprint-based payment scheme. There are now some Shell stations in Chicago that use it. If American fraudsters try and follow the example of their inventive British cousins, and install their own bent POS terminals, there’s no PINs for them to capture. Only fingerprints. Perhaps that not too much of a risk because PayByTouch doesn’t work at ATMs, and what’s a fraudster going to do with your fingerprint anyway…

The scheme is already in use in Chicago. At Sunflower Market, a grocery store that has Pay By Touch installed, 1 in every 50 customers has signed up. The store manager, Debbie Britton, says

I think it scares people… They’re more confused about the whole system. Some of them say, ‘Well, now the FBI can find me.’

She may be reflecting a peculiarly American delusion, but I’m not so sure. There is a specific issue around fingerprint biometrics: people mentally associated fingerprints with criminality and assume that fingerprints are an effective form of identification. Incidentally, getting someone’s identical twin to buy groceries and have them billed to the wrong card won’t work, because identical twins have different fingerprints.

These opinions are my own (I think) and are presented solely in my capacity as an interested member of the general public [posted with ecto]