Just over two years after Chip and PIN arrived in the UK to save plastic from a torrent of fraud, the nay-sayers are still knocking it at every opportunity. But the problem isn't that it's failed but that its success has displaced criminality to weaker parts of the system.
The criminals are still trying to find ways around the technology, and to some extent succeeding, with the announcement this week that police have broken a new-style card-skimming ring in Birmingham serving as a reminder.
Skimming is an old technique, but these criminals invented a clever new take on the idea by inserting hardware inside stolen (and then returned) chip and PIN terminals, able to record not only the card number but the subsequently-entered PIN too. Unlike skimming of old, this kit is hard to detect.
If you can capture PINs and real card numbers, doesn't that mean the system has been ripped open?
The hack could be countered using either some sort of integrity check within the point-of-sale terminal itself that might stop doctored equipment being reconnected to the system. You'd also assume that there should be a system for reporting terminals as stolen, which might stop them being reconnected without a thorough physical examination.
It's not clear why the criminals bothered to collect PINs to perpetrate fraud in countries that don't require PINs (it might have something to do with the card having to appear genuine in the electronic sense), but the fact that the fraud happened abroad is the key point.
According to figures from banking organisation APACS, plastic fraud on UK cards in countries not using Chip and PIN rose by a precipitous 77 percent in 2007, reaching £207 million (about $400 million), at a time when overall plastic fraud (excluding card not present fraud) has been stable or falling slightly.
Without chip and PIN, fraud would have risen to much higher levels as it had been doing in the years before the technology was introduced. With Chip and PIN, criminals now have to ship cards abroad, looking for easy pickings in regions not yet using the system. So in that sense the technology has succeeded but at the cost of moving the fraud elsewhere. This was predicted.
None of this will stop people claiming the technology is flawed. It was never intended as a complete solution because there is no complete solution. If you wanted a perfect security system, you'd abandon door locks on the basis that they are occasionally picked. Chip and PIN is not perfect but it is better than what existed before, which is to say absolutely no security at all.