🚀 go-pugleaf

In article <1992Sep8.115050.8694@cl.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:

   A new type of ATM fraud has just arrived in London.

   An auction was advertised at which video cassette recorders and other
   consumer electronic goods were for sale at very low prices. A lot of
   people turned up and were asked to provide identification at the door -
   this is normal enough at auctions in Britain - and the preferred means
   of identification was a bank or credit card (you had to swipe it in a 
   reader and enter your PIN at a nearby keypad).

A much simpler (and successful) fraud is to steal someone's wallet or
purse. This usually yields the victim's phone number as well as ATM
cards. The fraudster then calls the victim claiming to be a police
officer or bank security official and asks for the PIN number for
"verification" or "for their report".

   What's the point of designing wonderful cryptographic systems when the
   customer corporations think they know it all and build implementations 
   that are trivial to break even without cryptanalysis?

Indeed. The UK banks do tell customers to keep PIN numbers secret, but
they don't properly explain why this is necessary. Even so, it is
disgraceful that their systems fail to take account of the possibility
that the key becomes compromised. This is not an unreasonable
assumption given human nature - witness the scams above or the stories
about people who write down their PINs.

		Jim