Ali Hussain
Enter our Snapshots of Summer photography competition
Millions of customers will from this summer be required to use hand-held chip-and-pin readers to make online transactions at home as banks gear up to tackle the rapid rise in internet fraud.
All the big four high-street banks except HSBC are to demand that online customers use “chip-and-pin at home” devices to identify themselves before moving money out of their accounts.
Up to 6m of the calculator-style devices will be sent, free of charge, to customers over the next six months, in what is seen as the biggest change to personal banking since chip and pin replaced signatures at checkouts in February 2006.
Banks hope the devices will add an extra layer of security because they will generate an additional log-in without connecting to a computer or the internet.
This will make it harder for fraudsters to perpertrate scams such as “key logging”, where virus software records every key stroke, including access codes.
Online banking fraud rose by 44 per cent last year to £33.5m, according to the payment association Apacs. Internet shopping fraud amounted to £155m.
With most banks, users will need to insert their debit or credit cards into the devices to generate the additional log in. Lloyds TSB, however, will introduce a different device.
Here we answer your questions.
When will I get one?
Account holders at Barclays, NatWest and Nationwide are likely to be the first to receive the devices starting from this summer. Other banks are likely to follow suit before the end of the year.
Small-business customers will be the first to be offered the devices and then those who make frequent online payments. Other internet-account holders will receive the devices before the end of the year. Customers will be informed in the next few weeks about the plans.
Nationwide said it had already started sending out the devices to its most loyal internet customers who make regular online payments.
Barclays said it would post 500,000 machines to customers in its initial roll-out, but added that it would issue the device to anyone who requests one.
How will it work?
You will log on to your bank’s website in the usual way, and key in your identification number and password as normal.
To make certain internet transactions, however, users will then need to insert their credit or debit card into the device, and then enter their pin number. The device will generate a random, eight-digit number, which will have to be typed in before the transaction is authorised. The device will create a new number for each transaction.
The bank knows from its central computer which numbers will be produced, and the order in which they will be generated, so there is no need for the device to connect to the internet.
Will I need to use it for every transaction?
No. Balance inquiries, and payments to “known and trusted” big firms, will still be possible without using the devices during the first stages of the roll-out.
However, if you set up a new payment or a direct debit to a third party, you will have to use the device.
Your bank’s website will tell you if a particular transaction requires the additional authorisation.
Is it safe?
The system’s designers say the big security breakthrough is that the device generates a new random number for every transaction with no contact between your computer and the card reader.
Currently you need a mix of passwords and user-identification numbers to get into your account. Fraudsters can read them when you type them in using a method known as “key logging”. This traces each stroke made on a keyboard if the PC is linked to the internet.
Because your passwords and numbers stay the same all the time, criminals are therefore able to use them fraudulently once they have read your keys.
The home chip-and-pin machine is set up to avoid this.
Fraudsters will still be able to read your keys when you input the new eight-digit number, but they would have to use it in the split second before your transaction was authorised because your next payment would require a different number.
Are the devices portable?
They are powered by a small watch-style battery that should last for five to seven years, so you won’t have to plug it in or recharge it. Replacements will be available, free of charge, from the banks.
Which banks won’t be introducing it?
As there is no statutory requirement for banks to introduce the devices, many, such as Abbey and Halifax Bank of Scotland, have decided to wait and see how the new technology will affect online fraud before making any definite plans to introduce the devices.
An HBOS spokesman said the banking group may introduce a “more mobile and unobtrusive” system in the autumn.
HSBC and its sister bank First Direct have no current plans to introduce the devices.
Will fraud liability shift if a device is not used?
Transactions that do not require the chip-and-pin device will continue to be covered by the Banking Code, which states that a victim is not liable unless the bank can prove they were involved in the fraud.
What about the Lloyds device?
Lloyds TSB customers will be sent a key-ring style device with an inbuilt chip. This will produce a random number without the need to insert a chip-and-pin card. Lloyds said it had tested its device for the past 18 months with 23,500 customers, and that nobody using the device had experienced fraud. It added that 95% of customers rated it as easy to use.
Will the new devices make online transactions any faster?
The introduction of chip and pin at home will coincide later this year with an industry-wide “faster payments” scheme. This will reduce the current payment clearing times of between three to five days to almost instantaneous transfers.
Win a luxury weekend to Newcastle and its neighbour Gateshead, find out more here
Risk, resilience and embracing new technology
Industry sectors news at a glance. Interactive heatmap, video and podcast
Discover the collective power of smart thinking. Submit a solution and be in with a chance to win a Flip MinoHD Camcorder
The inside track on current trends in the charity, not for profit and social enterprise sectors
Everything the Business Traveller needs to know to make a better trip
Make the most of the summer and enter our fabulous photographic competition, you could win a £5000 holiday
Corsica is an island of beauty and contrast, an ideal holiday destination
Enjoy further reading from Travel to Fashion, Business to Sport, discover more






The clever way to lease a new car is with Car leasing made simple™
2009
42,945
2008
71,450
Car Insurance
Not Specified
MI6
UK-based
£60,000
The Environment Agency
Bristol
Up to £90K
Boots
Midlands
OTE £85k
Credit Protection Association
Nationwide Opportunities
Completely London
Luxury Condo's in Manhattan with NYC views
The best new homes in Wimbledon?
Nationwide
Save up to £1,000 per couple with Elite Vacations at the five-star Constance Lemuria Resort
and do the British Isles this Summer.
Save up to 60% with Oxford Hotels and Inns
Try our inspiring luxury holidays to the Indian Subcontinent and South East Asia.
Great offers available
8 fabulous Canadian cities ...you won’t find cheaper
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths | Subscriptions | E-paper
News International associated websites: Globrix Property Search | Property Finder | Milkround
Copyright 2009 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
This Chip-and-Pin device at home is not going to solve anything...the more devices the banks take out - the more clever ways fraudsters will find to commit fraud. I know because I have been a victim of this - and MBNA have simply shifted the blame and responsibility onto me because, like their Fraud department so elequently put it " we have hit a brick wall and can go no further - and taking the chance of probability into account - we believe this was not a fraud and I have to pay the money taken from my account" If this remains the activities of the Fraud departments of the Card companies than the fraudsters have a clear field to do as they please.
A dongle/random number generator is so easy to break that even a computer geek ged 14-15 can do it...ht are they thinking????
If anyone does have any further advice on where I can et hlp with regards to my fraud - as it appears the card company as washed it hands of it - it would be most appreciated.
Khalid, London, UK
I can't believe how organisations as sophisticated as high street banks like Barclays can introduce out dated methods of fraud detection to their customers. The point that they are all missing is the fact that once you put a security number (however generated) back into the transaction path, you are giving the clever fraudster, and they all are, all the information he needs to access your account or transaction. The only way to prevent fraud is to authenticate the person in a true "out of band" mode (not sms). The method described in your article is not out of band and carries all the faults of the random number generator (dongle or token) which is now the easiest to break by the fraudster.
A solution does exist today that does true "out of Band" authentication and also addresses "anti money laundering" legislation and addresses Credit Card Holder not Present fraud in the same process. Clearly the clever Banks are the ones not implementing this antiquated solution.
David M Knox, Sydney, Australia
What an absolute waste of money , time and effort. This in no way prevents a trojan or keylogger operation in the affected pc. What the Banks need to introduce is a true 'out of band' authentication system.
Adrian Tatham, Canberra , Australia