Guard your card

WE LIVE in a Big Brother age of biometric passports, satellite navigation and supposedly unbreakable chip-and-pin credit card security.

But when it comes to protecting our own money, the simple ways may still be the best.

If you want to be sure no one is ripping off your card details, next time you draw out cash, use your free hand or body to shield the hand that is punching in your pin number.

It's a low-tech solution, admits Sandra Quinn, of APACS, the organisation which co-ordinates the national fight against card fraud. But it is an extremely effective one.

Police in York are still investigating a cash-card cloning scam affecting bank and building society customers in the area.

The investigation follows the discovery of a pinhole camera fitted above the key pad of a cash machine outside the Nationwide Building Society, in Parliament Street, last week.

Exactly how many people fell victim to the scam is unclear, with the police investigation continuing. But they will not all be Nationwide customers.

A Nationwide spokeswoman pointed out that the machine was free to use by customers of other banks, so anyone who used it on Tuesday or Wednesday last week may have had their card details stolen. It is also possible a number of other cash machines may have been involved.

Mike Laycock, the chief reporter on The Press, revealed last week how £700 was siphoned from his Nationwide account after his card details had apparently been skimmed.

And Isabel Bamford, who lives in the Nunnery Lane area of York, contacted The Press to say that £350 had been taken from her account.

But how can this happen, if chip-and-pin technology is supposed to be so secure?

Ah, well there's the rub.

Your credit or debit card needs three bits of information if you are to be able to use it. Your pin number, the account information contained in the magnetic strip, and the identification information contained in the chip.

Fraudsters can easily get your pin number. It might be as simple as standing behind and watching closely while you use your card to withdraw cash. Or it might involve, as in the recent York case, putting a camera inside a cash-point which records as people enter their numbers.

Fraudsters can also fit electronic devices to cash-points that read the information on a card's magnetic strip - and if they are clever, they can match this against the pin numbers they recorded by camera.

That gives them two of the crucial pieces of information they need to clone your card.

But what about the chip? That is supposed to be unbreakable. So cloned cards do not have a chip - and without it, they shouldn't work.

The trouble is, there some countries overseas don't use chip-and-pin technology. The cloned details could be used perfectly easily there, because the cash-point machines are not set up to read chips.

That seems to be what happened in the case of Mike Laycock. The £700 siphoned from his account was withdrawn from cash-points in Italy - five withdrawals in five days.

But what about Isabel Bamford? The money stolen from her account was withdrawn from a cashpoint in Rugby.

All UK cash-points are supposed to have chip-reading technology. A fake card without a chip should not have worked.

So why did it? Have criminals found a way to break the chip technology?

No way, says Sandra Quinn, of APACS. And since October last year, all UK cash machines have been operated using chip-recognition software, that should flag up immediately and reject any fake card that doesn't have the required chip to go with its pin number.

The problem is the degree of flexibility built into the system, Sandra admits.

"Inevitably, with 19 cash machine transactions per second, some don't go through as they should," she says.

So sometimes a cash machine will fail to recognise the chip on a perfectly valid card being used legitimately by its owner.

To prevent an epidemic of cards being rejected, the system has written into it an automatic override.

If the transaction fits into the normal pattern of use of a customer, it will be allowed to go ahead - even if the cash machine doesn't recognise the pin.

So does that make chip-and-pin technology useless? Certainly not, experts stress.

According to figures from CPP, the York-based financial protection firm, the pattern of card-related fraud is changing.

Last year, fraud using lost or stolen cards amounted to £68.4 million. That sounds like a lot, but it was 23 per cent down on the year before, largely because chip-and-pin technology makes it more difficult to steal and use somebody's card.

Fraud involving cloned or skimmed cards, however, amounted to £99.6 million - up three per cent on the year before Telephone and internet fraud, meanwhile, in which your account details are stolen over the internet, amounted to £212.6 million - up 16 per cent.

Adam Harland, a detective inspector with North Yorkshire Police's financial investigation unit, agreed that the nature of credit card fraud was changing.

The new chip-and-pin technology had largely seen the end of the days when someone would snatch our wallet and try to forge the signature scrawled on the back to buy something or draw out cash.

Instead, he said, card fraud was becoming the province of much larger, more organised gangs who had the resources to set up cameras and electronic readers at cash machines, for example.

Getting enough details about your card to be able to tap into your account was much more difficult these days, he said. The downside was that, when they succeeded in doing so, criminals wouldn't be satisfied with small amounts. They would probably try to clean you out.

So was the whole chip-and-pin revolution worth it?

Very much so, DI Harland said. Effectively, we are in an arms race with the criminals - with those seeking to protect our money attempting to stay a step ahead of the fraudsters.

In the days before credit cards, he said, we would have been forced to travel abroad with cash, which was much more easy to steal.

The credit card revolution has also made our lives so much more convenient, he said.

"My daughter is looking to travel the world," he said. "I can say give me your card details. If you get a problem, email me, I can pay money in in York, and you can take it out in Peru 20 minutes later'."

For that convenience, the price we have to pay is simply trying to be a little more careful, he said.

"We feel silly putting one hand over the other while putting the pin number in. But we shouldn't," he said.

That's a piece of advice Mike Laycock has taken to heart.

Fearless investigative journalist he may be, but he admits that in the past he has been casual about punching his pin number in at the cash machine.

Not any more. "I certainly won't let it happen again," he said.

Who pays?

IF YOU have had money illegally taken from your account by fraudsters, the onus is on your bank to prove that you have been negligent with your card, says Thomas Soothill of York-based CPP. If they can do that, they may be able to avoid reimbursing you. All the more reason to make sure you take care.

In general, however, banks are good at reimbursing customers who are defrauded, says DI Adam Harland of North Yorkshire police.

They will want to be sure first that it wasn't you who drew the money out. But if the money was withdrawn in a way that doesn't fit your usual pattern of spending - if, for example, you had never in your life used your credit card to draw out cash, and suddenly three withdrawals were made in three days at banks in Italy - they will quickly recognise that it wasn't you, and pay up.

But there is still a victim, DI Harland stresses. Everybody ends up paying for internet fraud through bank charges and the interest charged on overdrafts. In a sense, we are all the victims of the fraudsters.

Top tips on protecting your money

At the cashpoint
* Stand close to the machine and shield the keypad with your body and spare hand
* Don't let yourself be easily distracted
* Be aware of others around you - if someone is acting suspiciously, making you uncomfortable or crowding you, cancel the transaction and use another machine
* If you spot anything unusual about a machine, don't use it - report it
* If you are having problems do not accept help from seemingly well meaning strangers - it may be a distraction by a criminal
* Once you have finished the transaction, put your cards and money away before leaving the machine

Keeping track of your account
* Do not carelessly disregard receipts - tear up or shred
* Check your receipts against statements regularly and look out for any unfamiliar transactions
* Check your balance regularly - for example, when making a withdrawal or online
* Never write down your PIN
* Never disclose your PIN
* Always report a lost or stolen card immediately