Are Payment Card Contracts Unfair?
Authors: Steven J. Murdoch, Ingolf Becker, Ruba Abu-Salma, Ross Anderson, Nicholas Bohm, Alice Hutchings

Date: February 2016
Publication: Financial Cryptography and Data Security 2016
Source 1:
Source 2:

Abstract or Summary:
Fraud victims are often refused a refund by their bank on the grounds that they failed to comply with their bank's terms and conditions about PIN safety. We, therefore, conducted a survey of how many PINs people have, and how they manage them. We found that while only a third of PINs are ever changed, almost half of bank customers write at least one PIN down. We also found bank conditions that are too vague to test, or even contradictory on whether PINs could be shared across cards. Yet, some hazardous practices are not forbidden by many banks: of the 22.9% who re-use PINs across devices, half also use their bank PINs on their mobile phones. We conclude that many bank contracts fail a simple test of reasonableness, and `strong authentication', as required by the Payment Services Directive II, should include usability testing. Note: Additional authors not listed above: M. Angela Sasse & Gianluca Stringhini

Do you have additional information to contribute regarding this research paper? If so, please email with the details.

<-- Back to Authentication Research Paper Index

[Home] [About Us] [News] [Research]

Copyright © 2019