Has chip and pin had its day?

Go to a cash machine in Japan or Poland and there's a good chance you'll find a finger-sized scanner next to the keypad.

The pattern of veins inside your finger is said to be more distinctive than your fingerprint, and is being heralded by some experts as a more secure alternative to the chip and pin (Personal Identification Number) card system currently favoured by British banks.

Electronics giant Hitachi already manufactures a PC-compatible finger vein scanner, which is about the size of a computer mouse and contains LED lights and a video camera.

Currently retailing online for £195 plus VAT each, they are not a cheap option.

"It is the fastest and most accurate technology we've seen to date," said Roberto Fiorentino, chief executive of British firm Croma Security Solutions, which has fitted finger vein-based security systems in UK hotels, airports and most recently a police armoury.

"I have no doubt we will see this technology operating in banks - and perhaps cash machines - in the UK High Street in the future."

A trial currently underway at Southampton General Hospital's intensive care ward has so far shown that health conditions such as high and low blood pressure do not seem to affect a patient's finger vein pattern to the extent that they become unrecognizable.

'Cover your pin'

According to the UK Cards Association, fraud losses on cards in the UK alone totalled £185m in the first six months of last year.

So what's gone wrong for the humble chip and pin?

"Wherever you've got an interface between money and the customer you've got an opportunity that criminals can exploit," said DCI Dave Carter at the Dedicated Cheque and Plastic Crime Unit (DCPCU) of the Metropolitan Police.

By installing a small digital camera above a cash machine criminals can literally watch people keying in their pin codes to access their accounts. They then trap the accompanying cards in the machine, sometimes using metal loops or false sleeves - to recover afterwards.

"The best tip I can ever give anybody is cover your pin," said DCI Carter. "It prevents so much fraud."

'Bad guys'

In itself, chip and pin technology is not that bad, according to computer security expert Brian Krebs in the US.

"The chip and pin solution is pretty good. It's not perfect, but a big part of security is about making it more expensive for the bad guys."

One issue is that it has not been adopted worldwide.

American cash machines still read data from a magnetic strip on the back of cash cards, so UK cards also have to contain this strip so that they can be used abroad.

A PIN capture device seen by American security expert Brian Krebs

According to Mr Krebs, who has blogged extensively about the various kit used by criminals in the US to target cash machines - they can skim the data contained on that magnetic strip just by using a cheap MP3 player - although more complex software is then required to decode it.

A cloned card can then be made fairly easily without the owner even realising the data has been taken.

"Anything with a magnetic strip on it can be wiped and re-encoded," said Mr Krebs.

DCI Carter maintains that a cloned British card would be flagged at a foreign cash machine because part of a card number identifies its country of origin - and a cloned card containing UK data would be missing its chip.

If you spot something attached to a cash machine that looks illegitimate, think carefully before you touch it, warned Mr Krebs.

"More often than not the people who put it there are within visual distance of the machine," he told the BBC.

"They're expecting to collect $50,000 (£31,000) to $60,000 - what happens if you pull on it and something comes off? If it's after hours and the bank is closed, it might not be a bad idea to put it back."

Mr Krebs thinks biometrics are still a long way off.

"I think it's like leaping six generations ahead," he said.

"We don't need to go to biometrics for this."

'Non-starter'

Ross Anderson, an academic in the Computer Laboratory at Cambridge University, who has spent 20 years researching bank-related fraud, is also unconvinced.

"It's a complete non-starter," he told the BBC.

"You can't just change all the systems because you come along with a new piece of technology."

He does however agree that there are "significant risks" attached to using cash machines.

"I personally won't use online banking, and I only use a cash machine with an account which has relatively little money in it," he said.

However he accepts that he may be "excessively risk averse" because of his line of work.

"From the point of view of the customer, the only thing that matters is whether you get your money back," he said.

"You have no control over tech security."