Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Last month we saw a charge from our local Best Buy store on our Bank of America credit card statement. We had never been to Best Buy in years, and I can't remember when or if I've bought anything from there. The same day the charge was made we disputed the transaction. After processing the claim, the credit card company rejected our claim because the purchase was made with a chip card, which is hard to duplicate. They know whether a purchase was made by swiping or inserting a chip card. I told them we had lost a credit card before the transaction was made, but they say the purchase was made on the new card. I again called to refile the claim.

Is it possible for someone to spoof a chip card at a store? And how can I go about making sure my claim is accepted?

[Update]

What happened is simple. We had lost card A. We then got card B. BofA says the transaction was made on card B, and I verified this by calling Best Buy corporate. We realize now that we also lost card B shortly after getting card A. We keep our old cards, and I noticed I did not have card B. I told BoFA about this, and the fraud claim was accepted. We had not used card B since getting it.

share|improve this question
    
Which bank is your credit card with? – Ben Miller Mar 11 at 19:57
2  
Was the charge significant, or under $30? I don't know Best Buy's policies, but they should require a signature for purchases generally over $25 or $30. I would inquire to see if the signature can be provided. Chip cards are difficult to spoof, but certainly not impossible. Did the store confirm the card was present, or could they perhaps be a victim of "Replay"? consumeraffairs.com/news/… – BobbyScon Mar 11 at 20:06
5  
It was for $586.36. The bank says it was for two Apple Watches. I'm going to Best Buy tomorrow to talk to them about this. Would they show me the signature? – user2233706 Mar 11 at 20:11
1  
Was the Best Buy store local to you? – Ben Miller Mar 11 at 20:16
6  
Should I take this to mean that chip cards are actually worse for consumers? – Mehrdad Mar 12 at 2:57

Try going in and talking to the manager of the Best Buy store. It is certainly within his or her power to reverse the charge, if he believes you. At the very least, he should be able to show you the signature.

(Unfortunately, in this day and age of electronic signature pads, signatures are not worth much anymore, in my opinion. My signature on those things always looks like a scribble.)

Years ago, I had a bad charge on my debit card from a local pizza place. I had gone there on a date and paid the bill with my debit card (maybe $20). That charge came through, but two days later, another charge came through for over $200. I didn't notice it until my bank statement came. I went in and talked to the manager, who refunded that charge for me right away. He found the receipt for the bad charge, and it didn't match my signature at all. I don't know how it happened, as I still had my card, but perhaps an employee manually punched in my card number for another charge after I left. I didn't even have to talk to the bank about it.

share|improve this answer

Under the Fair Credit Billing Act, you have some rights - however, you must act quickly to protect them.

If the creditor's investigation determines the bill is correct, you must be told promptly and in writing how much you owe and why. You may ask for copies of relevant documents. At this point, you'll owe the disputed amount, plus any finance charges that accumulated while the amount was in dispute. You also may have to pay the minimum amount you missed paying because of the dispute.

If you disagree with the results of the investigation, you may write to the creditor, but you must act within 10 days after receiving the explanation, and you may indicate that you refuse to pay the disputed amount. At this point, the creditor may begin collection procedures. However, if the creditor reports you to a credit reporting company as delinquent, the report also must state that you don't think you owe the money. The creditor must tell you who gets these reports. The creditor also must promptly report any subsequent resolution of the reported delinquency, to everyone who got a report.

So, at minimum you have the right to obtain relevant documents - which may include the signature, the evidence of use of a chip card, etc. You could then consider filing a police report and trying to see if that goes anywhere. Refusing to pay the charge may be an option, though it's possible that will involve a court case at some point (if they send it to collections).

You should also certainly cancel the credit card, as it presumably has been stolen in some capacity, and ask for a new card (or just cancel it outright if you're unhappy with the bank's refusal of your dispute).

It's also important that you at least take some measures in writing, rather than on the phone. FCBA requires notification in writing of the dispute within sixty days of the statement on which the charge appears; phone is not sufficient (though online sometimes is).

share|improve this answer

Can a chip card be cloned or spoofed? Yes, but it is not easy and has yet to be (to my knowledge) truly experienced in the "wild". In 2014 there were reports of a form of fraud involving convincing a system that a chip card was used, called "Replay", but this didn't involve visiting local stores. My bet would be either that this was on your aforementioned lost card and processed before your CC company disabled it, or someone stole/borrowed the card currently in your wallet. Any kids/grandkids visiting that might not be the most trustworthy? (Sorry to say, but it happens). Also, any chance a spouse used the card to buy a gift they're trying to keep secret?

There really isn't anything you can do to ensure that your claim is accepted. I would certainly keep pressing the CC company about it though. When you go to the store, remember that you want the employee(s) on your side, so be nice about it. You may be able to get them to review their purchase logs and security footage.

For a $500+ purchase, they definitely would have taken a signature, but if they're using the dedicated pin-pads, typically Verifone, they may not have access to any of that information. The point of the pin-pads is to completely remove their systems from the CC transaction process so that the burden of security lands on the CC processor, not the store.

share|improve this answer
    
This is not an issue of the PINpad hardware, but what software controls them. The old way was the POS software driving the process. The new way is having software from the payment gateway (e.g. AJB, FDMS) drive the hardware and remove the POS from the chain of custody for PCI-protected data (makes breaches harder). Those signatures are accessible: they have to be for situations such as these. The question is how to access it. Rather than using the POS, they may have another system to access them and print out receipts with signatures for disputes. – Snowman Mar 12 at 4:31

I suspect that the transaction was made with the old card and allowed through. The bank is lying or, more likely, don't know what they are talking about or didn't look closely enough to really tell which card was used.

Even though a chip card may be hard to duplicate, in this situation someone has your actual chip card. To use the card, they don't have to forge your signature; they just have to enter the correct pin (as few as four digits) into the chip-and-pin terminal.

PINs can be obtained. For instance, a malicious point-of-sale terminal hardware can carry out a legitimate transaction, while also logging and retaining the PIN. The bad guys later pick-pocket the card from you, get the pin from the rogue terminal and go shopping.

There is probably a way to crack the authentication protocol between the card and the terminal to get the PIN. In that case you just have to steal cards without skimming the PIN. There was an outright security hole discovered in the technology a a decade ago whereby a "man in the middle" device could be interposed between the card and the chip which would simply fake the "YES" message to authorize a transaction. With this attack, a purchase could be made with an incorrect pin; the card's chip wrapped in the rogue circuit authorizes unconditionally, suppressing the chip's "NO" message and saying "YES" on its behalf. Maybe BoA's cards are still vulnerable to this type of problem.

The bad guys could also just be looking over your shoulder when you type your PIN, or surreptitiously record your keystrokes using a video camera.

Good question for the security stackexchange which shows 166 search results for "chip and pin".

share|improve this answer
    
Since this was in the U.S., the transaction was most likely chip-and-signature (or maybe magstripe-and-signature). – Ben Miller Mar 12 at 3:11
    
Correct, both chip-and-PIN and chip-and-signature are options. The new gold standard is for the POS and hardware to support both and prefer using a PIN, but the majority of US chip cards do not support PINs yet so it will fall back to chip-and-signature. As Ben says, this was most likely chip-and-signature, not PIN. – Snowman Mar 12 at 4:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.