Disputing charge made with chip card

Question

Last month we saw a charge from our local Best Buy store on our Bank of America credit card statement. We had never been to Best Buy in years, and I can't remember when or if I've bought anything from there. The same day the charge was made we disputed the transaction. After processing the claim, the credit card company rejected our claim because the purchase was made with a chip card, which is hard to duplicate. They know whether a purchase was made by swiping or inserting a chip card. I told them we had lost a credit card before the transaction was made, but they say the purchase was made on the new card. I again called to refile the claim.

Is it possible for someone to spoof a chip card at a store? And how can I go about making sure my claim is accepted?

[Update]

What happened is simple. We had lost card A. We then got card B. BofA says the transaction was made on card B, and I verified this by calling Best Buy corporate. We realize now that we also lost card B shortly after getting card A. We keep our old cards, and I noticed I did not have card B. I told BoFA about this, and the fraud claim was accepted. We had not used card B since getting it.

Answer 1

Try going in and talking to the manager of the Best Buy store. It is certainly within his or her power to reverse the charge, if he believes you. At the very least, he should be able to show you the signature.

(Unfortunately, in this day and age of electronic signature pads, signatures are not worth much anymore, in my opinion. My signature on those things always looks like a scribble.)

Years ago, I had a bad charge on my debit card from a local pizza place. I had gone there on a date and paid the bill with my debit card (maybe $20). That charge came through, but two days later, another charge came through for over $200. I didn't notice it until my bank statement came. I went in and talked to the manager, who refunded that charge for me right away. He found the receipt for the bad charge, and it didn't match my signature at all. I don't know how it happened, as I still had my card, but perhaps an employee manually punched in my card number for another charge after I left. I didn't even have to talk to the bank about it.

Answer 2

Under the Fair Credit Billing Act, you have some rights - however, you must act quickly to protect them.

If the creditor's investigation determines the bill is correct, you must be told promptly and in writing how much you owe and why. You may ask for copies of relevant documents. At this point, you'll owe the disputed amount, plus any finance charges that accumulated while the amount was in dispute. You also may have to pay the minimum amount you missed paying because of the dispute.

If you disagree with the results of the investigation, you may write to the creditor, but you must act within 10 days after receiving the explanation, and you may indicate that you refuse to pay the disputed amount. At this point, the creditor may begin collection procedures. However, if the creditor reports you to a credit reporting company as delinquent, the report also must state that you don't think you owe the money. The creditor must tell you who gets these reports. The creditor also must promptly report any subsequent resolution of the reported delinquency, to everyone who got a report.

So, at minimum you have the right to obtain relevant documents - which may include the signature, the evidence of use of a chip card, etc. You could then consider filing a police report and trying to see if that goes anywhere. Refusing to pay the charge may be an option, though it's possible that will involve a court case at some point (if they send it to collections).

You should also certainly cancel the credit card, as it presumably has been stolen in some capacity, and ask for a new card (or just cancel it outright if you're unhappy with the bank's refusal of your dispute).

It's also important that you at least take some measures in writing, rather than on the phone. FCBA requires notification in writing of the dispute within sixty days of the statement on which the charge appears; phone is not sufficient (though online sometimes is).

Answer 3

Can a chip card be cloned or spoofed? Yes, but it is not easy and has yet to be (to my knowledge) truly experienced in the "wild". In 2014 there were reports of a form of fraud involving convincing a system that a chip card was used, called "Replay", but this didn't involve visiting local stores. My bet would be either that this was on your aforementioned lost card and processed before your CC company disabled it, or someone stole/borrowed the card currently in your wallet. Any kids/grandkids visiting that might not be the most trustworthy? (Sorry to say, but it happens). Also, any chance a spouse used the card to buy a gift they're trying to keep secret?

There really isn't anything you can do to ensure that your claim is accepted. I would certainly keep pressing the CC company about it though. When you go to the store, remember that you want the employee(s) on your side, so be nice about it. You may be able to get them to review their purchase logs and security footage.

For a $500+ purchase, they definitely would have taken a signature, but if they're using the dedicated pin-pads, typically Verifone, they may not have access to any of that information. The point of the pin-pads is to completely remove their systems from the CC transaction process so that the burden of security lands on the CC processor, not the store.

Answer 4

I suspect that the transaction was made with the old card and allowed through. The bank is lying or, more likely, don't know what they are talking about or didn't look closely enough to really tell which card was used.

Even though a chip card may be hard to duplicate, in this situation someone has your actual chip card. To use the card, they don't have to forge your signature; they just have to enter the correct pin (as few as four digits) into the chip-and-pin terminal.

PINs can be obtained. For instance, a malicious point-of-sale terminal hardware can carry out a legitimate transaction, while also logging and retaining the PIN. The bad guys later pick-pocket the card from you, get the pin from the rogue terminal and go shopping.

There is probably a way to crack the authentication protocol between the card and the terminal to get the PIN. In that case you just have to steal cards without skimming the PIN. There was an outright security hole discovered in the technology a a decade ago whereby a "man in the middle" device could be interposed between the card and the chip which would simply fake the "YES" message to authorize a transaction. With this attack, a purchase could be made with an incorrect pin; the card's chip wrapped in the rogue circuit authorizes unconditionally, suppressing the chip's "NO" message and saying "YES" on its behalf. Maybe BoA's cards are still vulnerable to this type of problem.

The bad guys could also just be looking over your shoulder when you type your PIN, or surreptitiously record your keystrokes using a video camera.

Good question for the security stackexchange which shows 166 search results for "chip and pin".