Page last updated at 10:33 GMT, Monday, 26 October 2009

New card threat to bank customers

Hand using mouse
Figures suggest online banking fraud is increasing

An investigation by BBC Inside Out has revealed new figures show losses for online banking through fraud rose by 55% to £39m across the UK in the first half of 2009.

A team from Cambridge University's Computer Lab demonstrated how they could access an account protected by Barclays' online card reader system.

Barclays told the BBC its system was "the strongest practical solution available and was just part of the multi-layered security employed".

The Cambridge team believes customers are further at risk of losing their money due to lack of legal protection, a charge denied by the industry representative Financial Fraud Action UK.

Professor Ross Anderson and his team at Cambridge University said they had already found security weaknesses in cash machines and pin terminals. They have now turned their attention to the latest online anti-fraud system.

Strongest security system

Some banks, including Barclays, are giving online customers hand-held card readers - devices used to help raise security on transactions which are vulnerable to fraud because they can be carried out with card details only and do not require a PIN or signature.

Professor Ross Anderson says they have found security weaknesses in cash machines and pin terminals

The card reader gives the user a unique pin code every time it is used, allowing the consumer to assert, even from a distance, that they are in possession of the genuine card and not just the details of that card.

But the Cambridge team say that by using a fake chip and pin terminal attached to a laptop the fraudster can learn the customer's name and unique pin code.

Once they have also tricked the customer into giving out their bank membership number, the fraudster can go into the online account and make transactions.

According to Steven Murdoch at the lab, such frauds may already be being perpetrated.

He said: "I think fraudsters are probably already attacking systems using these card readers."

Barclays told the BBC it did not believe this demonstration to be a plausible risk.

Court case

It said its system was "the strongest practical solution that has ever been available and is just part of the multi-layered security employed."

Fraud is a big problem with online banking losses up by 55% to £39m in the first half of this year, according to figures released by Financial Fraud Action UK.

Financial Fraud Action UK told the BBC the Banking Code already gives consumers protection by putting the onus on the banks to prove fraud has taken place.

Professor Anderson does not believe consumers are sufficiently protected by the law and a large number end up out of pocket.

He said: "I believe we need to follow the American example and put the burden of proof on to the bank. So if they can't prove it they'll give you your money back."

According to a recent survey by the Consumer Association, 20% of identity fraud victims end up out of pocket.

Jane Badger is one of them. In 2006 she reported a fraudulent transaction of £772 on her Egg credit card, and fully expected to get her money back.

Instead she was arrested, her house searched, she was suspended from her job, charged with fraud by misrepresentation and taken to court.

With Professor Anderson's help, the case against her collapsed and she was acquitted although she has not got her money back.

Ms Badger said: "It's taken over my life. All I want is an apology."

The BBC asked Egg to comment on this case, but it declined.

The full report can be seen on Inside Out in the East 1930 BBC One on 26 October .

Print Sponsor

Plastic card fraud down by 23%
07 Oct 09 |  Business

The BBC is not responsible for the content of external internet sites

Has China's housing bubble burst?
How the world's oldest clove tree defied an empire
Why Royal Ballet principal Sergei Polunin quit


Americas Africa Europe Middle East South Asia Asia Pacific