Pin Code security - online banking

Whitsand · 15-03-2010, 21:26

Hello,

I have a nationwide card reader that I need to input my pin number to in order to send money via the internet banking, all pretty standard procedure - most banks do this now.

I put the card in, press "sign" and then it asks for my pin - now this is the pin for my card that I would use at a cash machine or anywhere else. I then need to key in another number from the internet banking screen and I can send money.

So then, if someone stole my card, they could theoretically sit with the card reader and after 9999 (or earlier!) tries they will get my pin - the machine says "PIN OK" straight after a correct pin.

Does this undermine the security of the pin system in anybody else's opinion? With this if I nicked someones wallet I could have their pin number over the course of the evening and steal a ton of money really easily. Possibly easier than forging a signature.

Tempest · 15-03-2010, 21:33

No idea if what you suggest is possible, any site worth it's socks would have a limit number of tried before they block you.

But agree (and I always have felt) 4 numeric digits is pathetic.

All they needed to do was a 0-9 and A-Z keypad, would be so much easier for people to remember a long word than a long series of numbers, and way more secure.

But hey, that's what we have (4 digits)

As was said at the beginning of chip and pin.

A few years ago, there was only 1 place a their could see you enter your PIN and that was at the cash machine.

Now every single retail store is a potential security risk for this.

Ahh, well, never mind.

Wishy · 15-03-2010, 21:34

The smartcard "chip" will lock after 3 attempts and you'd need to go to the ATM to reset it after that.

Fatbloke · 16-03-2010, 05:41

Indeed, you've obviously never mis-typed your pin

Card reader immediately starts to give you count down warnings when you do - as Wishy says, three attempts.

Quite what going to the ATM will achieve I'm not sure. Perhaps it's a way of getting thief to attempt to use it at the atm so they can (A) Photo the perp. (B) Swallow the card.

Wishy · 20-03-2010, 12:19

Quote:

Originally Posted by Fatbloke

Indeed, you've obviously never mis-typed your pin

Card reader immediately starts to give you count down warnings when you do - as Wishy says, three attempts.

Quite what going to the ATM will achieve I'm not sure. Perhaps it's a way of getting thief to attempt to use it at the atm so they can (A) Photo the perp. (B) Swallow the card.

I'm not entirely sure, but i do remember that being the way the banks said to unlock them when they first issued chip and pin. Guess that gives you some more attempts before it swallows the card

15-03-2010, 21:26	#1
Whitsand Registered User Join Date: Nov 2007 Posts: 196 Thanks: 1 Thanked 0 Times in 0 Posts	Pin Code security - online banking Hello, I have a nationwide card reader that I need to input my pin number to in order to send money via the internet banking, all pretty standard procedure - most banks do this now. I put the card in, press "sign" and then it asks for my pin - now this is the pin for my card that I would use at a cash machine or anywhere else. I then need to key in another number from the internet banking screen and I can send money. So then, if someone stole my card, they could theoretically sit with the card reader and after 9999 (or earlier!) tries they will get my pin - the machine says "PIN OK" straight after a correct pin. Does this undermine the security of the pin system in anybody else's opinion? With this if I nicked someones wallet I could have their pin number over the course of the evening and steal a ton of money really easily. Possibly easier than forging a signature.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Banking security: Card reader rant	sigur	Finance Discussion Forum	13	08-07-2009 08:55

15-03-2010, 21:33	#2
Tempest Calm outside Storm Inside Join Date: Jun 2000 Location: Horley (Gatwick) Posts: 15,728 Thanks: 8 Thanked 14 Times in 12 Posts	No idea if what you suggest is possible, any site worth it's socks would have a limit number of tried before they block you. But agree (and I always have felt) 4 numeric digits is pathetic. All they needed to do was a 0-9 and A-Z keypad, would be so much easier for people to remember a long word than a long series of numbers, and way more secure. But hey, that's what we have (4 digits) As was said at the beginning of chip and pin. A few years ago, there was only 1 place a their could see you enter your PIN and that was at the cash machine. Now every single retail store is a potential security risk for this. Ahh, well, never mind.

15-03-2010, 21:34	#3
Wishy Wonkey Shooter Join Date: Oct 2002 Location: Solihull Posts: 2,628 Thanks: 2 Thanked 4 Times in 4 Posts	The smartcard "chip" will lock after 3 attempts and you'd need to go to the ATM to reset it after that.

16-03-2010, 05:41	#4
Fatbloke PSN : Fatbloke-66 Join Date: May 2001 Location: Deepest Barking Posts: 4,459 Thanks: 11 Thanked 15 Times in 15 Posts	Indeed, you've obviously never mis-typed your pin Card reader immediately starts to give you count down warnings when you do - as Wishy says, three attempts. Quite what going to the ATM will achieve I'm not sure. Perhaps it's a way of getting thief to attempt to use it at the atm so they can (A) Photo the perp. (B) Swallow the card.