ChipPin' away at fraud

A very worrying story has come to me from a very trustworthy source; I am currently ascertaining how much of the story I am allowed to publish, but the crux of the matter is that retail staff can access your card details when you have paid by Chip and PIN. Rather worried, my correspondant contacted her bank about this.

Finally, my mum calls HBOS/Bank of Scotland, to check the exact legal position of this unauthorised transaction business. She gets bumped about from department to department, by various operatives who are 99% sure that it's illegal but want to check with a senior figure before giving a definite answer. Eventually, she is put through to a senior member of staff in their retail banking division, where she is told the following (somewhat startling) information:

Up to 40 minutes after any Chip & PIN card transaction, the retailer may access your confidential details [this includes your card number and your PIN number] and submit any number of further transactions without your presence or consent. This is perfectly legal practice. The onus is then on the customer to challenge these subsequent transactions with their bank, once the customer actually becomes aware of them.

Did you know that? Because your humble Devil certainly did not (but it might explain how I was scammed a while back)…

My correspondant has authorised me to publish the email; do take the time to read it as there are several dsturbing points in it.

My mum is on a crusade.

It all started innocently enough. My dad went to his local Shell petrol station a week ago. He'd just been given a new PIN code for his switch card and, as is usual for my dad, was rather concerned about remembering the right digits in the right order, etc (my parents only came into this PIN code thing very late, y'see, never used cash machines). He went into the petrol station shop to pay. The lad behind the counter asks him what pump he used. Dad, being a bit distracted, hadn't noted the number. So he pointed out of the window to his car and told the lad that it was the pump with the red Passat (the only red car on the forecourt). Lad saw this and totalled up petrol cost accordingly. Dad sticks his switch card in the little machine, enters his PIN and pays without a hitch.

An hour or so later, my parents are both at home and the 'phone rings. It's the local police station. The man on the 'phone asks if my dad can return to the petrol station, as there's been a problem with his card. Given that it's the police who have contacted him, my dad gets a bit worried. Have his details been stolen in some way? No further info, he just has to go back to the petrol station, which he duly does.

He goes up to the counter and asks what the problem is. The lad behind the counter says that he undercharged my dad for the petrol he bought; turns out the lad enterred the wrong pump number. Fair enough, my dad says, just cancel the transaction and I'll pay the right amount. The lad says there's no need; his supervisor has sorted it.

This rather confused my dad. How exactly had the supervisor managed to sort the mispayment in his absence?

His original payment had been cancelled. No problem. The supervisor had then gone into the till's digital data storage (I've no idea what the technical term for this is, retail transactions have moved on quite a bit since I worked in shops), retrieved his card number and his PIN number and put through a new transaction without his consent or even his knowledge that this was taking place.

Needless to say, my dad was a bit concerned about this. He didn't have a problem with paying the correct amount for the petrol, although he was rather baffled that the police had contacted him about it (more about that in a second). However, he was particularly worried that a retailer could access his details (including the seemingly confidential PIN code) and put through a transaction without his knowledge.

The supervisor came through and explained that these details were held on the system for up to 40 minutes after each transaction. The supervisor had done this sort of additional transaction procedure many times. My dad's a bit pissed off about this, but isn't entirely sure what he can do about it. He goes home and tells my mum what has happened.

My mum is disturbed by the entire episode. She calls Which? magazine about this unauthorised PIN use and transaction stuff. They tell her that it's some sort of fraud and thus a police matter that's beyond their scope (odd, as they cover credit card fraud frequently enough).

Undeterred, my mum 'phones Shell and queries this procedure. Their immediate response is that a) this is not approved procedure within their company, such an incident should never have taken place and b) she will receive a written apology in a couple of days. However, my mum is still angry that this was able to take place at all and they're unable to explain why that's the case.

She then contacts the local police station and asks to speak to the department that had orignally contacted my dad. She gets through and speaks to a pleasant sort of chap about the incident. The first thing she's told is that the petrol station staff inferred that my dad had attempted to dupe them as to the pump he had used, deliberately indicating the wrong pump. A load of balls, but individual cases of dishonesty among retail staff aren't exactly unusual and I'm not exactly shocked by counter staff lying to cover up their own mistakes.

However, the policeman also told her that South Lanarkshire police force are currently in a scheme whereby if there is a transaction problem in any petrol station in the region, regardless of the cause, the police are obliged to sort it out. In effect, they have become unpaid debt collectors for the region's petrol stations. The equivalent would be someone cocking up your bill at the supermarket and calling the police out in order to rectify their mistake. Understandably, South Lanarkshire police aren't exactly happy about this—in fact, they're bloody livid—but they've been told in no uncertain terms to keep their opinions to themselves.

Finally, my mum calls HBOS/Bank of Scotland, to check the exact legal position of this unauthorised transaction business. She gets bumped about from department to department, by various operatives who are 99% sure that it's illegal but want to check with a senior figure before giving a definite answer. Eventually, she is put through to a senior member of staff in their retail banking division, where she is told the following (somewhat startling) information:

Up to 40 minutes after any chip&pin/card transaction, the retailer may access your confidential details and submit any number of further transactions without your presence or consent. This is perfectly legal practice. The onus is then on the customer to challenge these subsequent transactions with their bank, once the customer actually becomes aware of them.

Which rather contradicts Shell's assertion to my mum that this was far from normal or acceptable procedure (no apology has turned up yet, incidentally).

This is where the crusade element kicks in.

My mum thinks this is a bloody disgrace (as do I, for that matter) [As do I—DK]. What on earth is the point of Chip & PIN, of being obsessively paranoid about your personal/identification details in general, if money can be taken from your account—without your consent or knowledge—in a legal fashion? Surely such a system is crying out to be abused?

My feeling is that it further undermines the whole ID card/identity theft bollocks: no matter how careful you are in your own behaviour and with your own details, the system that information goes into is still badly managed and poorly regulated.

Given that the vast majority of consumers are proabably unaware of this little retail loophole, my mum wants to get this information into the public domain. Here's the rub: she's hitting an absolute blank wall at all levels. She can't tell if the media (local and a bit higher) are simply uninterested or absolutely refuse to listen. I'm not exactly an expert about this either.

However, she's heard about these marvellously informed people called 'bloggers' and requested that I seek advice from some (my mum seems to think that I know everyone on the internet. I probably should, given the amount of time I spend on it). In your opinion, does this have legs? D'you think the media would ever be willing to flag up how completely pointless our personal security efforts are in the face of even basic retail law?

(The police thing is a largely separate issue and she's probably going to kick up a bit of a shitstorm about that in the local press.)

Does anyone other than me think that this is just a touch worrying? And has anyone else had a similar sort of experience?

Now, I'm sure that the vast majority of retail staff are absolutely honest and would not abuse such a system: however, it is extremely fucking worrying that such measures exist. After all, public servants abusing their systems is hardly unknown.

And why the fuck are the over-stretched police forces—and they are over-stretched—acting as debt collectors for the petrol companies? Is it because The Gobblin' King has a highly vested interest in petrol tax?

And, further, does anyone have any idea about the best way to highlight the issue?

UPDATE: Unity picks up on this.

UPDATE 2: there is a very informative article on this subject, and answering some of the concerns, over at Surrepticious Evil.