Are Signature Pads Dangerous to Privacy?

WildHunter asks: "While making a foray into a local retailer today I paid using a credit card and was asked to sign a paper receipt on top of a digital pad. Being cautious I asked what it was for and I was assured that it was 'fully secure and safe to use'. Being a typical paranoid Slashdotter I offered to sign off of the pad but refused to sign on the pad. Was I over reacting or can someone back up my paranoia with some facts?" Think about it, some deceitful vendor has one of these, sells you something, gets your signature, and can then ring up loads of charges on your card using a digital copy of said signature over, and over, and over... you get the idea. Do the current crop of signature pads prevent against this and other similar kind of deceit?

Comments

Spoof 'em.

[inkfox]

Those units are just like the old Koala Pads. It's a grid array of wires, which make contact when they touch. This means they can only accurately detect one position at once.

I don't trust them because I don't know if they're recording a bitmap or vector/spline data. The former is okay, but the latter, if intercepted, can be used to make an infinite number of unique-looking but valid signatures. So, I usually make swirls with a fingernail while I sign, making a valid paper signature and a cloud of noise on the screen, since the pad can't tell which of four moving coordinates is the real active one when two different points are pressed at once.

I've only ever had one merchant actually look at the screen and ask me to sign again. (He thought it was the unit's fault.) The rest seem to believe that the pad is checking my signature, not just recording it.

Way paranoid

[CMiYC]

I'm really not sure where your concern is... If you are a credit card fraud victim, it doesn't matter if its a perfect digital signature or if its a handwritten one. You report both instances to your credit card company. I'm pretty sure they would clue-in if they noticed that all of a sudden you went on a $10,000 shopping spree and digitally signed your receipts exactly the same way every single time. (Again this is if you report it.) BFD, with these devices you can get a perfect digital signature. Well last time I checked, we are not digital machines. We are incapable of doing anything perfectly the same twice--including signing our name.

I would be more concerned with the fact that these stores store our credit card NUMBERS, or when you order something over the phone (who knows if they aren't writing it down while typing it in?), or the clueless SSL "secure" websites that email you a confirmation with your CC number. Oops. I probably just gave you some more reasons to add a 3rd lock to your windowless house.

some experience with this

[vsync64]

Until recently, I used to work at Office Depot. During this time, the store switched over to electronic signature pads. To their credit, they did tell us how to bypass this procedure and allow the occasional paranoid customer (with suitable rolling of eyes) to sign on paper. Unlike Best Buy, from what I've heard.

I was one of those paranoid customers whenever I bought something from the store, and I disliked having to allow customers to use the pads, for several reasons:

You can guess a lot by how someone signs their card, and having the card in hand allows you to verify the pattern of hand movements for the signature, as well as check expiration date, holograms, etc. With the self-swiper, the customer retains the card at all times. Sure, you can watch the hand movements and compare to the signature if you get a glance at it, but regardless, most people put their card away quickly and furtively, triggering mental red flags, and then get pissy if you ask "Sir, may I see the card and a photo ID please?". So you lose either way.

Secondly, the company would have a perfect digital record of the signature. Note that I said "company", not "store". While it's true that signatures could easily be forged from paper receipts, having a single giant database of signatures presents a much more tempting target, and a much greater reward should it be compromised. Keep in mind that Office Depot is the same company that has all their "locked-down" in-store kiosks brag about the need to enable unsigned ActiveX controls, so I'm not the most confident in their data security.

This annoys me as a customer of other stores, too. "See ID" means nothing if the retailer never gets a chance to see it written on my card.

The world of credit cards is rife with fraud and incompetence anyway. Gas stations and convenience stores are the worst. (I was recently in a gas station where the clerk told me, "Well, your signature matches, so I won't ask for your ID." Gee, thanks, lady.) And they're as obsolete as cheques -- we won't be remotely secure until we have smart chips in every card and deprecate all legacy swipers -- but I'm not sure if being secure in my identity can make me feel more secure overall. There are good reasons to keep the anonymity of cash around.

Note that I wanted to use em dashes (— HTML character entity) in my penultimate sentence, but I guess Taco has decided to disallow the ampersand escape and further muddy the waters of HTML. Way to go, guy. Is it too complicated to equate   with the space character in your joke of a "lameness filter", instead of restricting those of us with US keyboards to ASCII-7? I notice you've already made an exception for &.

Re:some experience with this

[yolto]

Actually you can get a paper receipt to sign on at Best Buy. If the cashier doesn't know how, just tell them to hit "cancel" when you are supposed to sign on the pad. The register will spit out your receipt and then another receipt for you to sign on (which they keep).

paranoia

[anthony_dipierro]

Being a typical paranoid Slashdotter I offered to sign off of the pad but refused to sign on the pad.

What's the point? Now all they need is a half-decent scanner and they get the same result - a digital copy of your signature.

Was I over reacting or can someone back up my paranoia with some facts?"

You were overreacting.

Think about it, some deceitful vendor has one of these, sells you something, gets your signature, and can then ring up loads of charges on your card using a digital copy of said signature over, and over, and over...

How is this something which can't be done with a photocopying machine and some scissors? And why would the person "ringing up loads of charges" care if the signature matches or not? It's not like vendors have a central database of signatures that they check against. At best they check against the signature on the back of your card, which they can only do if you're in person, in which case you can't use a digital signature anyway.

Do the current crop of signature pads prevent against this and other similar kind of deceit?

Maybe your misconception is what the signature pad does? Signature pads merely record your signature. They don't check it against a central database or anything. Even if they did, this wouldn't be subject to defeat as long as you witnessed the person making the signature.

Or maybe your misconception is over who is responsible for fraudulent charges? A credit card purchase is simply a contractual agreement to pay. If the purchase is fraudulent, the merchant loses. Not the credit card company, and not the owner of the credit card (except for up to about $50 in some cases where the credit card was stolen). If your credit card wasn't stolen and the charge wasn't made with your permission, you're not responsible for the charges. Period.

So what does a signature do to protect the merchant? It does two things. One, it allows the merchant to check the signature against the back of the card. Two, it gives the merchant a record of the contractual agreement.

Will a judge render a judgement for the merchant in the case of the merchant forging a signature? It's possible, but there are a number of things against it. One major reason is that when a merchant gets too many chargebacks, they are generally dropped by the merchant bank. So the amount of money you can steal before you get caught is relatively low. Then, on top of that, a judge would generally take a digitally scanned signature as lesser weight than a regular one. Finally, if you can subpeona the original signature from which the copy is made and show that they are identical, then you have a slam dunk case, and the merchant will probably wind up in jail. Besides, a signature can be forged just as easily with a handy dandy photocopying machine.

So, if anyone loses from digital signature pads, it's the merchant.

"See ID" isn't valid

[xenoc_1]

You know, Mastercard, Amex, Visa, and Discover all tell you to sign your card as soon as you receive it. As an example, here's Mastercard's Fraud Info page.

I'm not going to do your research for you but I've seen statement mailers, various web pages, and other consumer info from each of them over the years that all said "See ID" or similar is not valid to put on the card. More importantly, unless that card is signed with your signature rather than some bogus phrase, you technically haven't followed your terms of the contract. Arguably they could claim that because you didn't sign the card, they aren't liable, because you didn't take the reasonable (and required under the contract) action of signing the card.

"See ID" is a nice idea, but it's kind of like that wacky MS EULA-bypass stuff we always see here. People get some idea that by finding a way not to take a specific physical action like clicking a button or signing a card, they've changed the contract. I doubt that would hold up. There may even be unintended consequences like claiming the cardholder didn't take the necessary and reasonable steps to protect the card.

(And in the case of the EULA-bypasser, MS might claim use of a "circumvention device" under the DMCA.)