Researchers at the University of Cambridge’s Computer Laboratory have uncovered vulnerabilities in the chip and PIN system.

According to the research, it is possible to use credit and debit cards without knowing the correct number, by exploiting the way the remote reader contacts the main shop terminal.

"Chip and PIN is fundamentally broken," said Professor Ross Anderson, one of the four researchers. Criminals could utilise this vulnerability, and would need little technical expertise to do so.

The research shows that potential criminals could buy a pre-configured ‘kit’, which they could take into a shop, hidden, for example, in a backpack. The kit would send a signal to the main terminal telling it that the correct PIN had been entered.

Although there are no known instances of such an attack occurring, there is concern that the weaknesses in the system will be exploited before they are fixed. As soon as one criminal works out how to configure the duplicate reader correctly, this type of fraud could spread quickly and to devastating effect.

This is particularly worrying, because there would be no way for a bank to tell when such fraud has occurred. The researchers found that the receipt still says “verified by PIN”. As a result, victims may find it extremely difficult to reclaim their money.

The response from students at Cambridge was mixed. “I can’t believe this is true,” said Alexander Glasner, a third-year from Girton. “I have a lot of money saved from my internship and it makes me sick to think a criminal could go on a spending spree in Selfridges with it.”

“I’m not surprised,” said Ben Allum, a second year. “There are always problems with these things and I hope they sort it out before someone runs off with my card.”

The researchers have contacted banks with their results. Stephen Murdoch, another member of the team, said that upgrades to the system could be made to ensure that such an attack could not be made for most transactions in the UK. However, a solution to completely remove the vulnerability remains unclear.