A £1m chip and PIN fraud at a Shell petrol station was "an inside job", according to UK payments body Apacs.
Shell suspended the use of chip and PIN payments at 600 UK petrol stations over the weekend as a precautionary measure following the theft of more than £1m from customer accounts.
A spokeswoman for Shell confirmed to ZDNet UK sister site Silicon.com that "a small number of customers have been affected" and added that the company is now co-operating with a police investigation that has already resulted in nine arrests in connection with the crime.
Shell said the company is working with the manufacturers of the chip and PIN terminals, but does not know when its petrol stations will be able to start taking chip and PIN payments again.
The spokeswoman said it is not known whether all affected customers have been informed yet but banks have issued advice to customers to check their bank accounts and statements carefully for discrepancies.
Due to the ongoing nature of the investigation, Shell declined to comment further on the specifics of the case.
But a spokeswoman from Apacs said criminals must have had easy access to PIN pads in order to modify them to enable the theft of PIN numbers and the copying of magnetic strip information — a task which will have taken time.
She said that "without any doubt" it must have been an inside job involving a "conspiring" or "coerced" member of staff.
At the heart of the problem are PIN pads which are designed to shut down if they tampered with. In the case of those supplied to Shell this didn't happen, and it appears this is the vulnerability the theives exploited, said Apacs.
It's likely the news will throw into question the reliability of chip and PIN payments, which became a requirement for most point of sale card payments in the UK in February.
However, the Apacs spokeswoman said: "In the past, one of the fraud hotspots has been petrol stations. As such it's no surprise we've got a situation like this on the forecourt.
"We've never said the fraudsters will disappear. They are organised criminals and they are very sophisticated. But cards are a lot safer now than they were two years ago."
She claimed the speed at which police have been able to make arrests owes a lot to the fact chip and PIN payments can quickly be traced back to the PIN pad which was used.
Talkback
I have just had my credit card cloned and £600 stolen! On April 26th the chip and PIN machine was stolen from my local Shell petrol station counter in the Bath road in Speen, Newbury.
Apparently someonen has designed chip and pin machines in such a way that theycan be made to store all the customers card details AND you’re PIN in such a way that a criminal can extract them and clone a card and use it to empty your account if they steal the chip and pin machine!
I discovered this last night after reading an article in the Newbury Weekly News (11May 2006). I checked my account and £600 has been withdrawn from ATM’s in London over the last 3 days. (I have not been to London since Last Friday)
Shell is quoted as saying "Shell's chip-and-pin solution is fully accredited and complies with all relevant industry standards.”
If this is the case then surely there are other C+P systems, which are vulnerable? If the Shell system was accredited then surely the accreditation system is flawed and hence potentially all Chip and pin systems are flawed?
I believe the entire system should be audited by an external authority to find out what has gone wrong, and how many flawed systems are out there.