A simple string of four numbers — sometimes six — is supposed to be the digital deadbolt keeping credit cards secure. But what happens when the lock pops open with any old key?
After four fraudulent fast-food charges hit Mark Sach-Anderson’s TD Business Travel Visa in late March, the credit card company issued a replacement. When the auto repair shop owner forgot the new PIN number he created, he noticed something alarming: entering the wrong digits didn’t stop the purchase from going through.
“I can’t be the only one this is happening to,” Sach-Anderson said.
Because tap payments cover transactions up to $250, months passed without Sach-Anderson needing to enter his PIN.
Why a wrong PIN didn’t stop the transaction
The problem first surfaced by accident in June, when he bought a $3,200 shop tool. He entered the wrong PIN three times, yet the transaction approved anyway. The same thing happened weeks later at a hotel and again at a muffler shop.
Sach-Anderson reported the issue to his local bank branch and reset his PIN to a six-digit code. To see if the reset worked, he stepped into a nearby Shoppers Drug Mart on August 1. Using four random, incorrect numbers, the machine warned him of an invalid PIN, but after three failed attempts, it simply printed a receipt, asked for a signature, and let him walk out.
He beelined back to the branch to report the bypass.
“Whoa, that should not happen,” a teller said, and advised him to call TD Visa.
A runaround ensued. One agent suggested a “chip error” might be to blame and promised an expedited replacement card within 24 hours. When the card failed to arrive days later, Sach-Anderson called back out of concern for where the active card was. This time, an agent told him the card hadn’t even been issued yet, adding that a supervisor was escalating the issue over a potential “security breach.”
“What security breach?” Sach-Anderson recalls thinking. “I thought it was a chip issue.”
Late last week, Sach-Anderson tested the card again on the Point of Sale machine at his auto repair shop, Wrenchspinner Auto Service and Sales, in Etobicoke, charging himself a dollar and typing in a bogus PIN code: 1234.
The machine flagged it: Invalid PIN. He typed 1234 a second time: Invalid PIN Last Chance. He typed 1234 a third time. Instead of locking the card or declining the transaction, the terminal screen simply cleared, printed an approval, and asked for a signature. Toronto Star photojournalist Richard Lautens captured the transaction on video.
For a small-business owner who relies on his credit card to pay recurring expenses, including his shop’s rent, the security issue Sach-Anderson has uncovered is making him sweat. And he’s worried that other consumers might not even know they have this problem because how many people would even think to test the card’s security?
“What I need is to have this card function only with the PIN I select and not any random PIN,” Sach-Anderson says. “Unfortunately, I don’t believe that problem is limited to my card.”
Why banks built in a security fallback
When Canadian banks replaced magnetic swipe cards with a chip and PIN system, “the industry was so concerned with losing transactions and adding complexity that would scare people from spending money,” explains cyberfraud risk adviser Claudiu Popa, it built a “fallback mechanism” into the system that would authorize transactions with a signature.
What’s not normal is for this problem to happen over and over again.
“One transaction could be a glitch, but repeated approvals after incorrect PINs across multiple terminals, and even after that PIN reset, that kind of thing deserves a serious investigation,” says Popa, CEO of Informatica Corporation and author of The Bad Security blog.
“We don’t know if it’s a flaw or a configuration problem, but TD needs to establish the degree to which this unintended behaviour is likely to be widespread.”
Visa Canada confirmed that individual card security settings aren’t set by the card network, but by the issuing bank itself.
“It’s the cardholder’s issuer that is responsible for their cardholder’s accounts and operations,” Visa Canada stated in an email to the Star. “Visa does not set up, service, or have access to cardholder accounts. Each financial institution or bank has its own criteria for issuing Visa branded payment cards, including guidelines for signature and PIN usage.”
That puts the technical rules — and the explanation for why this replacement card bypasses its own security — squarely on TD Bank.
In an email, the company told me that allowing a card to authorize transactions with a signature after three wrong PIN attempts is standard protocol.
“Chip and Signature is an accepted industry practice in Canada and may be used as an alternative authentication method when Chip and PIN is unsuccessful,” TD spokesperson Ashleigh Murphy wrote. “Its use does not mean a card has been compromised.”
TD’s response, Popa said, ignores the broader security concern: why repeated failed PIN attempts are resulting in authorized payments rather than causing the transaction to be declined.
“TD may be correct that nothing is malfunctioning,” Popa said. “But if the card is operating exactly as designed, the question becomes whether that design provides the level of protection consumers reasonably expect when they are required to create and use a PIN.”
While TD stated that Sach-Anderson’s card “was not deemed compromised,” Murphy added that a replacement card “was issued and couriered to his business.”
Sach-Anderson hasn’t received one, but a few hours after TD Visa’s spokesperson emailed me, he got a call from the company, stating a replacement card should arrive early this week.
The federal regulator that oversees debit and credit card transactions — the Financial Consumer Agency of Canada (FCAC) — told the Star in an email that no matter what technology or payment method is involved, banks are legally required to investigate every reported unauthorized transaction.
Consumers can escalate complaints to banking ombudsman
Under federal guidelines, credit cardholders cannot be held liable for more than $50 in unauthorized charges — and major card networks, like Visa, offer a zero consumer liability policy — unless the bank can prove gross negligence. While the FCAC noted it cannot comment on specific supervisory activities regarding TD, it emphasized that banks must take all technical factors into account before trying to blame a consumer when security controls break down.
Consumers who are not satisfied with how their banks have handled a complaint can escalate their issue to the Ombudsman for Banking Services and Investments, which is also subject to FCAC’s regulatory oversight.
Remember to keep records of all unauthorized transactions, including receipts, says Popa, which will help investigators. He also suggests reaching out to a company’s vice president directly by email to help accelerate a timely response.
In the meantime, until Canadian banks clarify whether their cards will lock out bad PIN entries or routinely fall back to a signature, Sach-Anderson’s experience serves as an important warning for anyone carrying a replacement card: monitor your statements closely, because the digital deadbolt you rely on might not be stopping anyone at all.
