Chip and PIN ‘not fit for purpose’, says Cambridge researcher