Chip and PIN heads for cyberspace

Chip and PIN debit and credit cards have all but conquered the high street and will soon be taking on internet fraudsters.

There are around 140 million payment cards in circulation in the UK and 107 million are now chip and PIN cards. As most of us have more that one card in our wallets and purses that means 83 per cent of us will have one, with more and more banks and building societies rolling out the cards.

During June 2005 a total of 221 million chip and PIN transactions took place - around 85 PIN-verified transactions per second at tills across the UK.

When we first announced we were going down the chip and PIN route we said that if we didn't, card fraud for 2005 would be £800m. It's definitely not going to be anywhere near that - so that's the impact it's having.

-- Apacs

Apacs, the Association for Payment Clearing Services, which is overseeing the rollout, insists that the new cards are much more secure than the old magnetic strip cards, despite claims that shoulder surfing and other tricks are undermining them.

A spokesman for Apacs said: "With the old-style card if someone was to steal it all they would need was the signature. With chip and PIN there's an extra level of security because you need to know the number as well - and it's not written on the back of the card in the same way as the signature is."

Next month it will release figures for card fraud covering January to June this year, which will be the first since the chip and PIN deadline passed. Since 1 January this year, retailers have had to swallow the cost of fraudulent card purchases if they aren't PIN verified.

Apacs told silicon.com: "What we can say for certain is that when we first announced we were going down the chip and PIN route we said that if we didn't, card fraud for 2005 would be £800m. It's definitely not going to be anywhere near that - so that's the impact it's having."

Chip and PIN was designed to cut fraud at the till. But it is also being extended to cover 'card not present' transactions such as online shopping.

Apacs is working with the banking industry to develop a standard for chip and PIN card readers for the home. Placing the card into the reader and tapping in the PIN will generate a one-time password which could be used to authenticate purchases online.

MasterCard has created a worldwide standard for the card readers but Apacs is working on a local version.

The Apacs spokesman said: "What we are doing in the UK is working on a UK-specific standard. We want one device that you could use for any card."

The token-based authentication standard should be complete sometime later this year, with UK banks piloting it around nine months later - probably around this time next year.

But some companies are already dipping their toes into the water - last year Barclaycard kicked off its own trial of the technology, issuing 5,000 customers with standalone card readers in a bid to reduce online fraud, which it said at the time was a "critical barrier" to ecommerce.

Barclaycard's trial is still ongoing but a spokesman told silicon.com that "the results of the initial tests were encouraging".

But as around 35 to 40 per cent of all credit card losses are thought to come from 'card not present' transactions, anything that drives down fraud is likely to be welcomed by customers and banks.