With the deployment of cards with a chip that require a PIN to be entered at the point of sale (chip-and-PIN), banks have shifted the liability for fraud. It is now easier for banks to claim that it is the cardholder's fault when fraud occurs. Previously a signature offered statutory protection for customers.

Now cardholders are expected to prove to the banks' satisfaction that they have not been negligent. Yet given the number of ways in which criminals can obtain card details, there is no reasonable way for them to do so.

A number of poor design elements in the chip-and-PIN system allow criminals to acquire card data no matter how careful cardholders are. It used to be the case that a PIN was required only at cash machines, but now it is used for every transaction in which a card is present. Criminals can harvest PINs using, for example, fake or tampered terminals and cameras. Furthermore, leaving the magnetic strip on the back of the card, in addition to the chip, enables cloned cards to be used abroad on the old card-reading system.

Banks have chosen to issue cheap cards that do not support encrypted PINs, so they are transmitted unprotected between the chip and the point-of-sale reader.

In addition, an exact copy of the magnetic strip data is sent with every transaction. This means that if criminals can eavesdrop on a certain communication line inside the reader, they can get all the necessary data to create a magnetic strip clone and use it in an ATM abroad which does not use the chip-and-PIN system and only reads the magnetic strip rather than the microchip itself.

This year I examined two of the most popular point-of-sale card readers used in Britain and demonstrated how easy it was to circumvent their security protections. Statistics from Apacs, the trade association for the payments industry, show that card fraud is increasing year by year and that the fraud landscape has changed. With chip-and-PIN, cloned (magnetic strip) cards issued in Britain are merely used overseas. The chip-and-PIN system was supposed to reduce fraud, not just move it around.

Saar Drimer is a security researcher in the computer laboratory at the University of Cambridge

Times Recommends

• Milk: do we need a dairy godmother?
• DIY: the women doing it for themselves
• First double portrait of Princes unveiled