From: "Deranged Mutant" <WlkngOwl@unix.asb.com>
Date: Mon, 8 Apr 1996 20:03:57 +0800
To: cypherpunks@toad.com
Subject: (Fwd) British Study Claims That Photo Credit Cards Don't Work
Message-ID: <199604080500.BAA19015@unix.asb.com>
MIME-Version: 1.0
Content-Type: text/plain


This comes from the FTC Privacy List, and is somewhat relevant....
(The the "Crypto" in the title isn't, oddly...).

Some thoughts... (er, questions):
1. What are the implications for log-on systems that rely on 
recognition of faces (supposedly impossible for hackers to describe 
and exploit)?
2. Legal implications for witnesses?

------- Forwarded Message Follows -------
Date:          Sun, 7 Apr 1996 08:24:18 -0700
From:          taxhaven@ix.netcom.com (Adam Starchild )
Subject:       British Study Claims That Photo Credit Cards Don't Work
To:            privacy@ftc.gov

                 "Crypto-ID" Cards Not Effective

     Recent studies into the effectiveness of photo credit cards
have cast doubt over their ability to cut fraud.  Dr. Richard
Kemp, of the Department of Psychology at Westminster University,
London, organized an experiment involving a London supermarket to
test the cards in "the real world."
     The supermarket was staffed by six people who were all
warned to be on the look out for fraudulent credit cards.  Dr.
Kemp arranged for 44 of his students to pose as shoppers and test
the staffs' ability to spot photo-card misuse.  Each student was
armed with four cards.  One showed the student as they were, one
showed the student wearing make-up, one showed an individual who
vaguely resembled the student and the last card depicted someone
who looked nothing like the bearer.
     People usually recognize photographs of individuals based on
a familiarity of the subject.  A photograph captures only one
angle and expression out of thousands of different combinations. 
People will recognize photographs of family, friends and well
known individuals easily.  But how easy is it to accurately
compare a photograph with the face of a perfect stranger?  At a
recent conference, Dr. Kemp said that matching a photo to a
stranger's face was "too difficult."  He also said that in a non-
experimental situation, such as a supermarket, the incidence of
fraud detection would be even lower.
     The results of Dr. Kemp's supermarket experiment proved very
interesting.  In all, the majority of fraudulent cards were
accepted.  Amazingly, 35 per cent of the cards bearing a
photograph of someone completely different from the student were
accepted.  A massive 64 per cent of cards bearing a similar
individual were also accepted.  Another factor which seems to
further prove Dr. Kemp's point is that 14 per cent of cards
bearing a true likeness of the student were rejected.
     A few British banks are already offering customers the
opportunity to have their photograph etched onto their cards. 
They claim a reduction in fraud has resulted from this.  Dr.
Kemp's findings would seem to contradict this belief.  Dr. Nicky
Towell, one of Dr. Kemp's researchers, said "There is a widely
held assumption that photo credit cards are a cheap and effective
way of stopping fraud.  But this is not the case."
     No one can tell how well photo credit cards will catch on. 
But with the majority of people carrying at least one, if not
more cards of some sort, how long will it be before photos become
compulsory?  The government knows that the introduction of ID
cards is a political hot potato, but how many people would notice
if they turned the cards we already have into crypto-ID cards?


Reprinted from The Mouse Monitor, The International Journal of
Bureau-Rat Control, a periodical published by Scope International
for its customers.  Scope International is on the Worldwide Web
at http://www.britnet.co.uk/Scope/


Posted by Adam Starchild
     The Offshore Entrepreneur at http://www.au.com/offshore



The privacy list is run automatically by the Majordomo list manager.
Send a "help" command to majordomo@ftc.gov for assistance.

Rob. 

---
Send a blank message with the subject "send pgp-key"
to <WlkngOwl@unix.asb.com> for a copy of my PGP key.