LETTER | All credit and debit cards are Personal Identification Number (PIN) enabled with effect from January 2017 as an additional security measure against fraud and theft.

The upgrade of debit and credit cards and merchant payment terminals has been a massive and costly exercise in addition to the inconvenience caused to users who have to replace their obsolete signature-based cards.

However, most merchant payment machines in operation have exposed keypads. Any person with an observant eye would be able to make out the six-digit PIN keyed in by the user.

This exposes the credit or debit card user to being mugged as the perpetrator has already obtained the six-digit PIN. They would be able to quickly use the card for fraudulent purposes while the victim is in a false state of security assuming that the PIN-enabled cards are useless to the robber.

Who then bears the fraudulent charges when the thief who make fraudulent transactions keys in the correct PIN?

This potentially exposed keypad security breach is more notable in public places like supermarkets, shopping complexes and restaurants where anyone near the credit or debit card user can spy upon the PIN keying activities.

I would use one hand to partially cover the keypad but then mistyping are more likely to happen. I have made mistakes keying in the PIN while my other hand covers the keypad as visibility and lighting become limited.

After a certain number of wrong attempts of keying in the PIN, the card is disabled. To avoid mistakes, many would not take the effort to cover the key pad with the other hand.

As such, it is a worthwhile upgrade that the exposed unlighted keypads of the current merchant payment terminals be phased out and replaced with machines that have partially covered and lighted up keypads that only the user have a clear line of sight.

After all, ATM machines are located in lighted areas and have a plastic casing surrounding the numbered keys.

In the meantime during the phasing out process, the operators of the merchant payment machine with exposed keypads should be instructed and trained with directive from the respective processing bank and Central Bank to make it mandatory to provide private spacing with limited visibility where only the credit or debit card user has a direct view of the numbers on the pad.

While the PIN-enabled cards are a good security measure, the privacy of the person keying in the PIN must also be paid attention to. There is no point having a six-digit security number when it can be easily seen.

The views expressed here are those of the author/contributor and do not necessarily represent the views of Malaysiakini.