Are Payment Card Contracts Unfair? (Short Paper)
Fraud victims are often refused a refund by their bank on the grounds that they failed to comply with their bank’s terms and conditions about PIN safety. We, therefore, conducted a survey of how many PINs people have, and how they manage them. We found that while only a third of PINs are ever changed, almost half of bank customers write at least one PIN down. We also found bank conditions that are too vague to test, or even contradictory on whether PINs could be shared across cards. Yet, some hazardous practices are not forbidden by many banks: of the 22.9% who re-use PINs across devices, half also use their bank PINs on their mobile phones. We conclude that many bank contracts fail a simple test of reasonableness, and ‘strong authentication’, as required by the Payment Services Directive II, should include usability testing.
We are grateful to Adam Beautement, Brian Glass, Boris Hemkemeier and Kat Krol for helpful discussions. Steven J. Murdoch is supported by The Royal Society [grant number UF110392]; Ingolf Becker is supported by the Engineering and Physical Sciences Research Council [grant number EP/G037264/1].
- 1.Anderson, M.C., Neely, J.H.: Interference and inhibition in memory retrieval. In: Memory. Handbook of Perception and Cognition, 2 edn., pp. 237–313. Academic Press (1996)Google Scholar
- 2.Bohm, N., Brown, I., Gladman, B.: Electronic commerce: who carries the risk of fraud. J. Inf. Law Technol. 2003(3) (2000)Google Scholar
- 4.Bowerman, M.: Radio interview with APACS spokesperson. BBC Radio Merseyside, 19 February 2007Google Scholar
- 5.Financial Ombudsman Service: Ombudsman news (March/April 2014), case 116/2. http://www.financial-ombudsman.org.uk/publications/ombudsman-news/116/116-disputed-transactions.html
- 6.HSBC, UK: General, current accounts and savings accounts terms and conditions. Accessed 1 Sept 2015Google Scholar
- 7.Kelman, A.: Job v Halifax PLC (not reported) case number 7BQ00307. In: Digital Evidence and Electronic Signature Law Review, vol. 6 (2009)Google Scholar
- 8.Murdoch, S.J., Drimer, S., Anderson, R., Bond, M.: Chip and PIN is broken. In: IEEE Symposium on Security and Privacy, pp. 433–446, May 2010Google Scholar
- 9.Renaud, K., Ramsay, J.: How helpful is colour-cueing of PIN entry? July 2014. arXiv:1407.8007 [cs]
- 11.UK Cards Association: Plastic fraud figures (2015). http://www.theukcardsassociation.org.uk/plastic_fraud_figures/index.asp