Buyers mind their Pins (and queues)

Stephen Spurdon asks whether chips and PINs really will make credit and debit cards safer

The dawning of a new age of plastic card security on 1 January, when your signature was replaced by four numbers entered on a keypad, is clouded with uncertainty. Introducing smartcards - plastic cards with an embedded microchip - is meant to make a dent in the UK's £400m-a-year losses due to fraud. But some claim it is not safe, while others are unclear about liability for card fraud.

The dawning of a new age of plastic card security on 1 January, when your signature was replaced by four numbers entered on a keypad, is clouded with uncertainty. Introducing smartcards - plastic cards with an embedded microchip - is meant to make a dent in the UK's £400m-a-year losses due to fraud. But some claim it is not safe, while others are unclear about liability for card fraud.

Plastic is the UK's most popular non-cash payment method, with about 123 million multi-function payment cards in issue at the end of 2002.Cards are even overtaking cash for payments, as the banking industry estimates that spending on plastic cards reached £269bn last year, with cash payments at about £268bn.

Over the recent bank holiday weekend, a reported 12 million transactions were verified with a personal identification number (PIN), with no problems other than those due to a temporary computer glitch suffered by HSBC and its cardholders.

Smartcards have been in use in France for more than a decade, and were claimed to have cut card fraud by 80 per cent within the first year of operation.There is an apparent lack of clarity, however, over who is liable for card fraud and in what circumstances, alongside fears of fraudsters peering over your shoulder while you enter the number.

The Association for Payment Clearing Services (Apacs), which is leading the changeover for the banks, admits there is no set date when consumers will be able only to use their PIN. An Apacs spokesperson said that signing would not be withdrawn until everyone could use the PIN facility.

Most leading stores now have the keypads, so can the store refuse your business if you can't remember your number? Yes, it can, but it is unlikely to do so. In such a case, the retailer will be prompted by its chip-and-PIN terminal to check online with the card-issuer to see whether the card has been reported lost or stolen and, if not, let you use a signature as usual.

If a card has been used fraudulently in such circumstances, the liability remains with the issuer. It is only if a retailer does not make a security check with the issuer that the retailer becomes liable.

So what happens in an outlet where the retailer does not have a keypad and the associated chip-and-PIN technology?

There is no compulsion on retailers to conform to the new chip-and-PIN regime, although card-issuers have agreed to ensure that all cards are reissued in this format by the end of 2005. If a fraudster presents a chip-and-PIN card at such a retailer and the transaction goes through on the signature, then it is deemed that the fraud could have been prevented if a chip-and-PIN terminal had been used and so the retailer is liable for the loss. However, if the same fraudster presents an old card that is not chip-and-PIN and the sale goes through with a signature, then the bank retains liability for losses.

As a cardholder you have the responsibility to notify your card-issuer immediately you find that a card has been lost or stolen. However, under the Banking Code, the consumer is liable for the first £50 of any losses suffered before they have notified the card-issuer.

Chip and PIN does have its limitations. Cims, which manages the Sentinel card-protection policies, notes that it will not help protect cardholders from fraudulent transactions occurring while shopping via the internet, telephone, mail order or fax, or where the card is lost.

But the banking industry is working on some solutions. David Cooper, head of risk management, consumer lending, Lloyds TSB, says it is possible for the chip in the card to be read using a slot in a computer or mobile phone to enable remote verification, but says this is likely to be a number of years in the future, as an international standard is being developed.

Debt accumulated on smartcards is another issue. However, Bradford & Bingley says its research shows that the introduction of chip and PIN on credit cards means that people are twice as likely to withdraw cash from cash machines, "increasing the debt mountain still further". But, in such circumstances, they only have themselves to blame.