Customer concerned over Chip, Pin security

The security of the new Chip and Pin system was queried yesterday after a retailer told a customer he could access her bank account…

The security of the new Chip and Pin system was queried yesterday after a retailer told a customer he could access her bank account without her express permission.

Ann Doupe noticed that the amount being charged to her account was €10 shy when she was asked to enter her PIN number at a petrol station.

She alerted the retailer to the anomaly and says she was told not to worry because he would have her bank details on the machine and would be able to debit the balance to her account later without requiring the Pin number.

Ms Doupe says she was unable subsequently to get clear answers from her bank or card provider about the validity of the petrol station's actions.

READ SOME MORE

A spokeswoman for the Irish Payment Services Organisation (Ipso), which represents the banks in relation to card and other payments, yesterday confirmed that retailers were able to access customer details without their Pin but said this was designed only to facilitate payment online or by phone.

"There are distinct rules in place for 'card not present' situations that facilitate the growing phone and online retail market and for 'card present' transactions, where the Pin is required," Jennifer Chamberlaine said.

She said Ipso had yet to receive a single complaint of the type recounted by Ms Doupe but added that any formal complaint would be pursued.

But, she said customers should check their bank statements on a regular basis to ensure that no unauthorised or incorrect payments are taken from their accounts. Such transactions could be challenged by the cardholder and the money refunded where the merchant was unable to provide proof of permission to debit the account - such as a Pin activated transaction.

Ms Doupe says her experience makes a mockery of the enhanced security promised for customers under Chip-and-Pin which is being rolled out across the Irish banking market at a cost of close to €100 million.

Spokespeople for the banks said merchants operated under "strict contracts" and were liable to "severe penalties" if they transgress. AIB spokesman Ronan Sheridan said: "If a merchant operates outside the terms of his contract, his 'acquiring facilities' can ultimately be withdrawn."

Banks have checks in place to catch unusual transactions, such as the type raised by Ms Doupe, an industry spokesman said.

Dominic Coyle

Dominic Coyle

Dominic Coyle is Deputy Business Editor of The Irish Times