Halifax Scores Victory with PIN Security Case

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Halifax Scores Victory with PIN Security Case

» IT Security NEWS

» 06 June 2009

Halifax Scores Victory with PIN Security Case

Halifax, a retail bank based in the United Kingdom, has won a major court triumph in the intently observed "phantom withdrawal" case that put the safeness and effectiveness of Chip and PIN on trial.

The controversy started after Alain Job, a Halifax customer, charged the bank for negligently letting his Chip and PIN card get cloned after he was held responsible for making eight dubious ATM withdrawals from his bank account.

The Chip and PIN is the British version of the worldwide EMV (Europay, MasterCard, and Visa) standard for chip-based acceptance devices and payment cards, which includes ATMs and point-of-sale terminals.

A total of £2,100 was taken out of Job's pocket from a series of forced cash extractions in February 2006, which compelled him to sue Halifax after unsuccessfully requesting for reimbursement of the stolen funds through arbitration or from the bank itself.

Phantom withdrawal cases are everyday occurrences even in the UK. It's the practice of withdrawing money from bank ATMs (Automatic Teller Machines) without the unsuspecting account owner's permission or knowledge.

It's different from merely stealing card details and using them to access ATM accounts because in phantom withdrawal cases, information of that nature is usually not divulged to third parties. Falsified withdrawal of money in UK accounts using ATMs outside the UK is proving to be an ever-worsening dilemma.

It is hypothesized that counterfeiters are able to perpetrate phantom withdrawals via forging default-to-reading details onto magnetic stripes, which Chip and PIN cards still use to this day. Therefore, it's kind of ironic that Chip and PIN cards were developed specifically to avoid the spread of cloned or forged ATM cards in the first place, even if it's just within the UK.

Incidentally, Job's lawsuit is the first to challenge UK bank's assurances of the effectiveness and safety of the Chip and PIN system in court because the alleged withdrawals involves a UK ATM that can read Chip and PIN cards and, of course, a Chip and PIN card.

During the one-day court hearing at Nottingham County Court in April, Job and his team of attorneys contended that his ATM might have been forged and used for unauthorized transactions without any neglectfulness on his part.

Meanwhile, Halifax provided printouts of ATM records to assist its own justification that it was Job's ATM card (and its microchip) that was used to authorize the disputed withdrawals from his funds. The judge eventually sided with Halifax and dismissed the case in a ruling passed on Thursday.