Visa To Push Swipeless Credit Cards

BobPaul wrote in to mention an initiative by Visa to allow for swipeless credit card transactions. From the article: "...consumers need only wave credit and debit cards within a few inches of a reader to complete a purchase. And for purchases of less than $25, no signature is required...Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted". Update: 02/25 16:06 GMT by Z : References to RFID technology removed.

Comments

No, this is different

[Anonymous Coward]

It is secure. They're using SHA-1 hashes.

Re:No, this is different

[jacquesm]

sure it's secure... chargebacks are a great way to deal with this, simply charge back any and all purchases that were non-swipe... card not present end of story. $25 they assume the risk is small enough to absorb it, but if you do that systematically I highly doubt it will live.

Re:No, this is different

[FLEB]

Aaaaand... the merchant gets screwed.

Re:No, this is different

[Anonymous Coward]

Which is why no merchant is using the technology!

Re:No, this is different

[jacquesm]

you got it... do this at wally world and home depot and they'll be so happy with the new system, do NOT do it to your corner store

Re:No, this is different

[tekiegreg]

Well from what I understand of the security breach, is that you still can't reverse engineer a SHA-1 to it's true value. However you can generate other values that might collide with your credit card number SHA-1. So if SHA-1 were used to guard a CC transaction I wouldn't be too worried there. But there would be a few worries in doing SHA-1 for this sort of thing.

1) In this case the SHA-1 is enough for cloning my credit card and running by the scanner. There would have to be some randomness involved in creating the signature SHA-1 to foil that method.

2) There are a lot of credit cards out there, and more issued all the time, as time moves on, collisions probably will happen with SHA-1 credit cards and then I'll wonder how those charges appeared on my statement, and the other person who charged him will be going to jail even though he didn't intend to defraud anyone (though maybe they'd do a Hash Check at his trial with his card vs. mine).

3) Somebody could still just steal my credit card and go nuts with it anyways...

I take it this is more about convenience than security....

Re:No, this is different

[notthe9]

It's not like current credit cards are so impressively secure.

Re:No, this is different

[Anonymous Coward]

you still can't reverse engineer a SHA-1 to it's true value

"its".

Show me the security

[IO ERROR]

Hey, Visa, if you think your RFID system is so secure, publish all the nice technical details on how it works, so we can be confident of its security. Otherwise I'm going to take my low-tech X-Acto knife and cut that RFID tag right out of the card. Considering that anybody can hack an RFID tag now, I'm not particularly inclined to trust this thing.

Especially since it would be easy enough to wave an RFID reader at people's purses, back pockets, etc. At, say, $24 each, in a large crowd, you could amass quite a bit of money, and many people would never know it happened.

Re:Show me the security

[John Harrison]

You don't know what you're talking about and neither does /., or at least Zonk. This isn't RFID, these aren't the TI chips. This isn't ISO 15693. If you can break 3DES please let me know. I would be VERY interested.

Re:Show me the security

[John Harrison]

BTW, the specs are out there if you care to look. Here's a hint for you: EMV

Re:Show me the security

[mboverload]

Now people can steal my identity from 5 feet away! Sign me up, scotty.

Jesus, what idiot there is thinking up this stuff, seriously? You litteraly couldn't PAY me to have an RFID credit card because hey, someone would just steal it! Stupid stupid stupid.

Re:Show me the security

[garcia]

I want to know if stores are going to have "extra security measures" which require you to show your ID when you purchase something under $25.

It's a real pain in the ass when it is "company policy" to request IDs. I don't shop at a local Cub Food grocery store because they require me to show an ID.

My signature is usally an unintelligible squiggle. It's nothing like what shows on my ID. Signing credit card shit is a hassle and I make sure to do it as quickly as possible.

Re:Show me the security

[BenjyD]

They probably make it policy because a signature is no security at all. By enforcing an ID policy, they can make the staff enforce the rules more - not asking for ID is far more obvious than not checking a signature, which can be easily forged anyway.

That's the main reason most countries are switching to PIN based credit/debit card systems. Even the UK is, finally.

Re:Show me the security

[Delirium Tremens]

Maybe they shoud have moved to the latest standard: AES. Deploying 3DES solutions today is deploying legacy.

"While 3DES appears to be secure for now, it takes at least 3 times as long to run as DES, and this means that it is inefficient and slow compared to other available block ciphers such as the new standard, AES, which has replaced DES."

-- W. Diffie and M. E. Hellman, "Exhaustive Cryptanalysis of the NBS Data Encryption Standard," in IEEE Computer, vol. 10, 1977, pp. 74-84.

Re:Show me the security

[kbonapart]

No problem to break the code. Grab the credit reader itself. Get a part time job, and steal the sucker.

Once you're home, hook it into your laptop, with the laptop active in your knapsack, then stoll the mall, scanning at people.

My point it, you don't need to break the code. You just need the device that can. And I'm sure that the people working the counter at....freaking anywhere give enough of a damn to chase you.

Re:Show me the security

[Delirium Tremens]

OK, 1977, right... My source is fscked up.
Here is the original web source instead: http://www.disappearing-inc.com/D/des.html

Re:Show me the security

[BohKnower]

So to pick my pocket you only need a scanner??? Well, take $25 at time, please!

Re:Show me the security

[Thaelon]

While this may seem very scary at first it's complete FUD.

In order to process claims from a reader like this you're going to need a merchant account.

So let's say you try it, I'll outline the events for you in chronological order:

1. You obtain a merchant account to be able to collect funds from your portable reader.
2. You figure out a way to generate transaction IDs without contacting Visa.
3. You go out and collect ~$24 from fifty people in a crowd, wohoo $1,200!
4. Let's say you play it smart and only claim those trasnaction monies and random increments over a day or so.
5. 50 people protest to visa that they didn't authorize your charges.
6. Visa does about 30 seconds worth of research and realizes that all 50 of these claims lead directly to you via your merchant account.
7. Visa shuts you down like a bitch and presses charges.
8. You go to jail since you have no case whatsoever.
9. Your ass now belongs to Bubba.

Re:Show me the security

[John Harrison]

Please show me the reader that can read one of these from 5 feet. I would love to see it. Again, this isn't an RFID tag with a 3 meter range. But you know what? Tinfoil works great. I have a desk full of contactless smart cards here and if you put a single layer of tinfoil around it nobody can read it. I've tried.

Re:Show me the security

[iamwahoo2]

Put scanner near someones pocket and charge $24 or record credit card number (depending on how you wish to rip ther person off). No signature necessary nor decryption necessary. You do not have to "break" anything.

Why is the technology even necessary given the risk? How much harder is swiping versus hovering the card over the scanner, aside from a fraction of a second of your time, what do you gain? The hardest part in either case is just getting the card out of your wallet.

From a risk standpoint using these cards would be a poor decision on anybody's part. You gain basically nothing except for the coolness factor, and you put yourself at additional risk of fraud.

Re:Show me the security

[afidel]

Hell, checking signatures is retarded, even so called "experts" can not reliably distinguish signatures with anything aproaching 100% accuracy. The real answer is to have all credit cards use smartcards and carry a picture of the person who the card was issued to. Then again I think this move shows what Visa et al are interested in, more convenience, not sucurity. I've had a Visa smart card for the last 5 years and other than using it for online signon I've used it in exactly TWO shops in those five years, both times the cashier was clueless as to how to use it despite the fact that the reader had a nice animated picture of the correct procedure on the LCD. Oh yeah, requesting ID is a GOOD thing because it raises the bar for using a stolen card to producing not just the card but matching false documents.

Re:Show me the security

[Anonymous Coward]

I don't see how stolen credit card numbers would be of any use to someone for selfish gain. Whatever you bought with them would have to be shipped somewhere, and that would bring the cops right to your door.

A better use for stolen credit cards would be to buy, with say 10000 stolen credit cards numbers, maxing them all out, 1 megaton of chicken manure and have it delivered to some random person's house.

Re:Show me the security

[afidel]

Yes because obtaining a merchant account through a shell company is SO difficult. I mean Visa has less barriers to entry than Choicepoint and thieves who have yet to be found were able to make MANY false accounts with Choicepoint.

Re:Show me the security

[duffbeer703]

The signature is not a security device, it indicates that you accept and agree to adhere to the terms of your credit agreement (ie you will pay your bill).

If your credit card is unsigned and you refuse to pay, the merchant is on the hook for it.

Re:Show me the security

[darkpixel2k]

9. Your ass now belongs to Bubba.

Give it a few more minutes. Some retard here will post something along the lines of "Why do you think prison rape is funny?"...you know--because we all heard you laughing as you typed number 9 in...

Re:Show me the security

[Qzukk]

People wave this "it only works from inches away" bullshit without having any idea how radio works.

Its simply a matter of using the right antenna with the right gain. See the bluetooth sniper rifle for details (kilometer range! With bluetooth!). If the antenna is too big to hide on your person, set up shop in a dark alley somewhere and scan the masses as they mill by unaware.

And yeah, tinfoil would work but make it all the more stupid. Not only would the old lady have to fumble the card out of her purse, you'd be sitting around watching her try to unwrap it and wrap it again afterwards. Just swipe the damn thing already!

Re:Show me the security

[Delirium Tremens]

Hey, here is an idea: deliberately using 3DES instead of AES might actually be very smart. Since it is inefficient compared to newer block ciphers such as AES, then it could potentially also be slower to brute-force.

That is -- of course -- assuming that you are using a 128-bit AES key for comparison. If you use 192-bit or 256-bit keys for AES, it's a whole other story. Bottom line is, if for any kind of reasons you can only play with 128-bit keys ('cause you have limited storage such as on a smart card for example), then use 3DES because it's slower to brute-force than AES.

Re:Show me the security

[swillden]

Hey, Visa, if you think your RFID system is so secure, publish all the nice technical details on how it works, so we can be confident of its security.

They're all published and available.

The basic chip and communications specifications are contained in ISO 14443. It will cost you a few dollars to buy a copy. You purchase your copy from your national standards organization; if you live in the USA, that's ANSI and they charge $18 for each of the four parts. The fee isn't to keep this stuff out of your hands, by the way, *all* ISO standards are copyrighted and cost money to obtain. That's how they fund the standardization and publication processes.

Above that basic level, most of these cards will be Java Cards. You can get the specifications for Java Card from Sun. They're free.

Moving up, most of these cards are also Global Platform cards. GP defines an extra set of features above Java Card, mostly to specify security-related characteristics. The specifications are found at the Global Platform web site.

In Visa's case, their recommended smart card platform is the IBM JCOP. You can find the details of IBM's implementation of Java Card and Global Platform here.

Note that not all issuing banks will use Java Card, or even a programmable card. Visa's recommended non-Java platform is the IBM MFC card operating system. I don't think the MFC team has a web site.

Finally, the actual payment application, and the component that matters most from a security perspective, is EMV. You can find complete EMV specifications at the EMVCO web site. The specs are mostly written towards contact smart cards, not contactless, but good smart card protocol designers *always* assume an attacker can get between card and reader, whether it's directly connected via a contact plate, or whether it's over RF, so the contact-oriented security does just as good a job in contactless mode.

Regarding signatures or no, it's not clear yet how that is going to be handled. EMV provides for several modes of operation, the best being "chip and PIN", which is what's being deployed in the UK right now (with contact cards, not RF). In that mode, you provide your PIN to the card reader through a PIN pad, and that unlocks your card to perform the transaction.

EMV also allows chip and signature and chip-only (as well as providing for fall-back modes that don't use the chip and rely on the magnetic stripe or even on getting a carbon copy of the embossed card number). The decisions about which mode to require will be made by individual banks issuing cards.

There is a lot to EMV... so you've got a few weeks worth of serious work cut out for you if you really want to understand it all, but the information is public and peer-reviewed. The countries that have deployed EMV have seen card skimming fraud drop to zero. That's right, so far, there has been no known case of an EMV card being faked or duplicated, and as far as I know, no one has deployed cards with DDA (dynamic data authentication) enabled. They're all SDA (static data authentication), which carry digitially-signed but static data on the chip which is read out every time. The US banks are talking about doing DDA, which involves a cryptographic challenge-response protocol and is vastly harder to duplicate.

At, say, $24 each, in a large crowd, you could amass quite a bit of money, and many people would never know it happened.

LOL. Dude, think about what you're saying. Credit card transactions are completely auditable. When dozens of people complain that they didn't authorize those $24 transactions, the issuing banks are going to go back to the merchant who performed them, and his acquirer is going to notice the extraordinarily high level of complaints, *and* that they're all for sub-$25 transactions. The theif will be in prison very shortl

Re:Show me the security

[trigeek]

For the record, Visa is very paranoid about encryption security. They don't even trust RSA for key exchange, because you are never guaranteed a prime number. They've been using Smart Cards in their credit cards in France since before 2000, and I haven't heard a lot of complaints (if anyone has, I'd be interested to hear). Besides, this will allow a waiter to take a cordless reader to your table to scan your card. Which is the higher security threat, someone who can hack triple DES (and manage to get their hands on rogue hardware), or a waiter earning $3/hour plus tips simply writing down your credit card number when he has it in the back room? Final point: If your paranoid about someone scanning your credit cards in a crowd, build a Faraday cage into your wallet. I'm sure there would be a hug market for that kind of thing in the "Aluminum Foil Hat" crowd. I'd probably buy one, actually :-)

Re:Show me the security

[gl4ss]

current visa isn't that secure to begin with.

you can copy the numbers with a fucking hires camera and a zoom lens at a place where they're used.

this is miles and miles and miles more secure than that..

(besides, these need a very low range. buy a tinfoil wallet will ya?)

Re:Show me the security

[swillden]

Maybe they shoud have moved to the latest standard: AES. Deploying 3DES solutions today is deploying legacy.

Or maybe not.

Many security architects aren't going to use AES for a while yet. It's too new. It has received a fairly large amount of scrutiny from the cryptographic community since its birth, so that gives us some confidence, but nowhere near the confidence we have in DES.

DES has stood up to 30 years worth of attacks and remains essentially unbroken. Sure, the key size is too small, so the cipher can be brute-forced relatively easily, but 3DES fixes that problem and does it by building on the fundamentally solid security of DES.

The bottom line is that there is really no need to move to AES, since 3DES is perfectly adequate, and the odds of AES being broken sometime in the near future are at least as high as DES being broken. 3DES is, currently, the best choice from a pure security standpoint.

Re:Show me the security

[John Harrison]

You can probably eavesdrop on the card to reader communication from some distance. This is known by those that created the spec and they have designed for it. Go read the EMV spec. Tell me if you can hack it. It has been out for years and in production in Europe for a while, though most deployments there are for contact cards.

The real goal is fraud reduction. Visa isn't aiming for a perfect system, they want a better one that prevents skimming of your mag stripe. This means that they are no longer the low hanging fruit and the fraudsters will target traditional magstripe cards.

Re:Show me the security

[swillden]

Put scanner near someones pocket and charge $24 or record credit card number (depending on how you wish to rip ther person off). No signature necessary nor decryption necessary. You do not have to "break" anything.

No, but you do have to have a merchant account, and that requires telling the bank in great detail who you are and where to find you. And when all of the complaints roll in, they're going to send some nice folks out to bring you in for a long chat.

From a risk standpoint using these cards would be a poor decision on anybody's part. You gain basically nothing except for the coolness factor, and you put yourself at additional risk of fraud.

Huh??? The current magstripe-based system is so wide open to fraud that almost nothing could be worse. I don't even need to ever *see* your card to use it to steal from you. Any way I can collect card numbers works just fine. And I don't have to make myself easy for the authorities to find, either.

Re:Show me the security

[sangreal66]

And how exactly do you expect this to make you any money? Cash is magically going to fly out of their credit card and into your bank account? Or do you actually expect VISA to start cutting checks to your house for charges made on your stolen card reader?

Re:Show me the security

[Meumeu]

Why do you think prison rape is funny?

Re:Show me the security

[Muad'Dave]

You don't seem to have read the spec - this is more about how air core transformers work than radio. These ISO 14443 cards use inductive coupling to power the card, not RF field strength. From this ISO 14443 overview:

ISO 14443-2 was published on July 1, 2001. This standard describes the characteristics of power transfer (based on inductive coupling) and communication between the PICC and PCD. Power is transferred to the card using a frequency modulated [magnetic] field at 13.56 MHz +/- 7kHz.

Having a crypto processor on board (especially the exponentiator) requires way more power than can typically be delivered by RF field strength (far field tags vs near field tags). EPC tags are RF field powered, and can be read from several meters away. Magnetically coupled tags can only be read from a few cm.

73 de k4det

Re:Show me the security

[Anonymous Coward]

What you need is... a tin foil card holder!

Re:Show me the security

[Anonymous Coward]

Well I have broken 3DES and whilst you might well be interested you're not half as interested as the FBI.

Re:Show me the security

[darkpixel2k]

What makes you think that I think prison rape is funny? Care to point out anywhere in any of my previous posts that I have said prison rape is funny?

Re:Show me the security

[Anonymous Coward]

So, based on your analysis:

QED: there is no more CC fraud problem because 100% of the perpetrators are caught and jailed in a single billing cycle? Seems to me that it is just a tiny bit more complicated than that.

cheers

greybeard

Re:Show me the security

[swillden]

They don't even trust RSA for key exchange, because you are never guaranteed a prime number.

They don't use RSA for key exchange, but that's not the reason. The real reason is simpler: They have a working key exhange system in place and don't see a need to fix what's not broken. Their current system was in place well before RSA became widely used and well-understood.

Re:Show me the security

[HairyCanary]

My credit card company gives me zero liability for fraudulent charges. So this doesn't scare me at all -- if Visa thinks they can do this securely, so be it. It's THEIR risk, not mine...

Re:Show me the security

[atomic_toaster]

Credit card transactions are completely auditable. When dozens of people complain that they didn't authorize those $24 transactions, the issuing banks are going to go back to the merchant who performed them, and his acquirer is going to notice the extraordinarily high level of complaints, *and* that they're all for sub-$25 transactions. The theif will be in prison very shortly, and the cardholders won't be out a dime.

Sure, if you're only taking into account the "people scanning your card without your knowledge" threat. But have you ever had your purse/wallet stolen or been pickpocketed? I have, and let me tell you, it can be a real bitch to remember, let alone prove, which transactions were yours and which were someone else's. It can be especially difficult if, like me, you don't use your wallet very often and have no idea how long it's been missing from your purse/backpack/pocket/whatever -- and if, like most people, you stow your credit card receipts in your wallet -- which has just been stolen. Granted, credit card companies are good about red-flagging charges on your account that are large and/or atypical. But a bunch of if the credit card company removes the unauthorized charges from your account, they have to absorb the cost of that somehow. All of those absorbed costs eventually work their way back to the consumer.

Further, how hard is it for someone to do this now? Collect card numbers by working at a store, shoulder surfing, breaking into databases, or buying them from someone else who has done that, and you can spend lots more then $24 of peoples' money, and do it in a fashion that's far less traceable.

Okay, so the old threats still exist, but now they're adding new ones. How exactly is this better?

Re:Show me the security

[glyph42]

Give me all your credit card numbers and let's find out.

Re:Show me the security

[afidel]

No, it's EVERYONE's risk. Because if fraud increases they just jack up the percentage they charge merchants and all goods which are typically bought through credit cards (most consumer goods) get some stealth inflation. When 90+% of retail transactions go though four networks (Visa, Mastercard, Discover, AMEX) those networks have very little incentive to increase security and every incentive to increase their share of the transaction pie to 99+%.

Re:Show me the security

[swillden]

it can be a real bitch to remember, let alone prove, which transactions were yours and which were someone else's

I keep track of all my receipts, enter everything into Quicken and reconcile it all as a matter of course, so that's not a problem as long as you manage your money properly. If you don't, I would seriously recommend not having a credit card because even when no one is scamming you, banks do make mistakes. I catch one every few months.

I have had my credit card number stolen several times, and have had several thousand dollars worth of fraudulent charges to clear up. It's a pain.

Okay, so the old threats still exist, but now they're adding new ones. How exactly is this better?

Umm, no. This new technology eliminates several large threats and replaces them with a new, small one. It effectively eliminates card skimming (where your number is stolen and new, fake plastic is created that the thief then uses), which is the single largest source of credit card fraud, and replaces it with an attack that requires the thief to identify himself.

Re:Show me the security

[Anonymous Coward]

Prison rape is ridiculous. It's prisoner rape that's not funny.

Re:Show me the security

[Anonymous Coward]

How his informative? Links to items are informative. Statements that information exists if you look are not informative. Go pwn some n00bs.

Re:Show me the security

[kmeister62]

There have been reports http://www.techworld.com/mobility/features/index.c fm?featureid=1178of Exxon's Speedpass being exploited by John's Hopkins http://www.rfidanalysis.org/ . I'd have to agree that this sin't ready for prime time.

Re:Show me the security

[kyojin the clown]

10. Bubba Profits!

Re:Show me the security

[robertjw]

Umm... the article said no sig required for charges less than $25. So just walk by somebody with a reader asking for a $20 charge. A couple hundred people in a mall? That would add up pretty quickly.

Personally I think this is a stupid idea anyway. I don't have any issues scanning my card, or siging for purchases less than $25. As a consumer, why would I want this technology at all?

Re:Show me the security

[Anonymous Coward]

Nonsense. Collect $1.5 from 150 people.

Re:Show me the security

[randomiam]

Why would tinfoil make it stupid, necessarily?

Sooner or later, somone's gonna start selling fashionable foil lined wallets and purses.

Re:Show me the security

[flu1d]

You could always use the whole return scam. Just puchace something under $24 dollars at a store and then return it a few days later. If someone really wanted to make this worth their while they could span out returns between multiple stores and multiple days accross a larger city and make hundreds daily.

Re:Show me the security

[sangreal66]

My point is that having a reader with a number of charges logged on it is not equivalent to cash. You then have to get VISA to pay you for the accumulated charges. A legitimate store owner might be able to do this, but it wouldn't be particularly smart. They'd be forced to cover the chargebacks, and would lose the ability to accept VISA cards. They may also face criminal charges. The post I was replying to suggested stealing a reader, but that wouldn't work as you'd have no way of converting the charges into cash.

Re:Show me the security

[izomiac]

I can see your point, but DES does have other weaknesses. Just last year, for my research project in math I wrote a perl script that could crack any word document encrypted with an alphabetic key in less than a day. But of course that is fairly easy since the alphabet is only 14 characters when encrypted in DES (the last bit is discarded). Given, I exploited the small keyspace, but I still wouldn't trust a DES derivative over AES or one of the other modern ciphers.

Re:Show me the security

[DenDave]

Give a bum fifty bucks and he'll be happy to be president and ceo of your company...
after bum fights it's the bumfraudsters!

Re:Show me the security

[Tuffsnake]

deploying legacy

I know lots of people still using windows 98, sql server 2000 (instead of yukon), oracle 8i (as opposed to 10i), etc. Being 1/2 standards behind does not (in my mind) = legacy. Legacy would be like getting windows 3.1x or mac os 9, something so past standard that it will not function with new technologies - IMHO.

Re:Show me the security

[Anonymous Coward]

Duh. Just start a Business. "Sanreal Enterprises". Make the 'product' you sell something intangable, like advice. Then, charge away. Anyone complains, ask for proof they didn't make a purchase from you. If the amount you charge is small enough (like say, under $25), most people might not even notice it at all.

Re:Show me the security

[Anonymous Coward]

Is this another thread that ends up about goat.... never mind...

Re:Show me the security

[Anonymous Coward]

No, but you do have to have a merchant account, and that requires telling the bank in great detail who you are and where to find you. And when all of the complaints roll in, they're going to send some nice folks out to bring you in for a long chat.

1) Like people never opened accounts with fake info before.

2) IF they do find you- "Well, you see, I set up a boot at a local mall, offering Palm Reading (Spiritual advice / massage /anything intangible), and all these people stopped by and purchased my services. Then, in what looks like a huge coincidence, they all decided to cheat me. I'm the victim here."

3) The above is assuming that the people notice the $24 charge.

Re:Show me the security

[Sparr0]

in the month it takes for the complaints to come in you will have already withdrawn the money from your completely anonymous paypal account (who i am sure will have the cash to convince visa to give them access to this system) and be long gone.

Re:Show me the security

[Anonymous Coward]

I work in the Credit Card Industry for Merchants (sell/maintain/set-up accounts in a bank for the card readers). All of the merchants that start accounts go through intense credit / background checks. It would be pretty hard to do this. There are a lot of security measures to block this also.

Re:Show me the security

[swillden]

completely anonymous paypal account (who i am sure will have the cash to convince visa to give them access to this system)

Bwahahahah!!!

Jeez, dude, you made me spray coke all over my keyboard.

That's the funniest thing I've seen all day.

Anonymous Paypal account? Riiiiggghtt. Paypal issuing acquiring devices? Riiiggggtt.

And, of course, it would be so much harder to do any of this with the current magstripe system, where you don't even need the card at all.

Re:Show me the security

[SupremeTaco]

Once again, please quit spreading dis-information. Visa has not ever, and hopefully will not ever issue a merchant account with an "anonymous" pay-to system/account/email address! There's a lot of paperwork and verification involved. Sure someone could steal a scanner and rack up charges, but unless they're a verified, bonded, merchant, they won't see that money.

Period.

Re:Show me the security

[Anonymous Coward]

Google is your friend:
http://www.google.com/search?hl=en&q=merc hant+acco unt+credit+card

Hundreds of companies offering the ability to accept credit cards. I checked some of their signups, and they ask for nothing that couldn't be faked.

Re:Show me the security

[metamatic]

Well, if VISA want better security, they should use the new EMV system in a way which requires physical contact between card and reader.

I don't want anyone being able to read my credit cards remotely. Not even the store I'm in. It simply does not provide me with any value, it just adds risk, and I am not going to accept any credit card with that functionality.

Re:Show me the security

[Drakin]

Um, you don't get it.

You, yourself have to deal with the bank to get the account to accept credit cards. Paypal doesn't cut it.

Re:Show me the security

[renelicious]

Sounds great, but let me add. Its costs about $15 to protest a charge on a card. Not you, but to the issuer of the card. So most issueres have a set amount that they just refund and don't bother with. Its costs $15 to report it and $10 if you have to send additional info. So now for all that work, even if you win the dispute, you gained nothing from it. Not counting in what you paid the person to do it, if so you probably lost money.

Now assume that probably 1/3 of the people don't bother looking at their statements, they don't I know I work for a bank. We had a lady come in last week that has $1000 of fraud on her card and she said "I guess I should look at my statements, maybe I would have caught this sooner." Here I'm talking about bank statements and debit cards, I hope people look at their credit card statements, but I'm sure there's some that don't.

So really there's a pretty good chance that a large number of those transaction would go unnoticed. Don't get me wrong I agree with you that a person would probably get caught, I'm just saying that its not as difficult as you are making it.

Re:Show me the security

[trigeek]

Visa doesn't even use RSA to exchange master keys between themselves and the manufacturers or between manufacturers and their business partners.
I asked a Visa VP why not, and he told me that they don't trust it. For master key exchange, they mandate that manufacturers split the key into 3 key parts, have them transported by different people (actually carried), and entered manually into the manufacturing terminal that uses an IBM4758 for encryption.

Re:Show me the security

[John Harrison]

It doesn't matter because you could have hacked the wire and be listening in on that. The system is designed such that you can sit in the middle and watch all the communication and it does you no good. That is exactly what you want.

Re:Show me the security

[bleckywelcky]

Yeh, but you have to prove it's fraudulent. So while you may be ok if you use your card at a gas station in Kansas, and then 20 minutes later someone uses your card to buy some vodka in Russia. But if people are picking your information up around where you live and using it there, who says it isn't fraudulent?

Re:Show me the security

[Anonymous Coward]

So... you were able to make a brute force crack due to the small key space. Once the key space is upped (as in with 3DES) this crack no longer works. End of THAT problem in my eyes. After 30 years nobody has found and come public with a way around DES. It's possible that someone knows and is keeping it secret for their own nefarious uses, but doubtful considering the community.

Re:Show me the security

[Anonymous Coward]

Isn't this why most stores don't give you cash back for returns now? I've seen charges canceled on credit cards, gift cards/store credit being given out for equivalent value and the OCCASIONAL check being sent from the main office a while later after all the charges have cleared and the company is sure that the credit card isn't being used fraudulently.

That's why most credit card companies (Including stores that have their own credit cards) have a rather large fraud investigation department.

Re:Show me the security

[Anonymous Coward]

Yes, this and other fraud can certainly pay off. It's still fraud, it's still investigated, and people are doing time for precisely this scam. Shoplifting probably has better returns.

Re:Show me the security

[dfjghsk]

Anyone complains, ask for proof they didn't make a purchase from you.

that isn't even how it works for merchants. If anyone complains, you (the merchant) needs to prove to the card holders bank that they made the purchase. The card holders bank almost always sides with THEIR customer.

Let us know when you move out of your parents basement and learn how the real world works

Re:Show me the security

[Anonymous Coward]

"How is this better?"

Well i) it's better for the card associations because they'll get a cut of the digital green that used to be real green == more $ for Card Association; ii) it's better for the merchants because average tranaction duration (at least according to the MasterCard trials) is reduced == greater throughput (and that's a big deal to the drive-thru window) == more $ for Merchant.

Oh, you meant: 'how is this better for the consumer?' - less pocket change, less time counting/making change, more "air-miles', take your pick.

Re:Show me the security

[metamatic]

You misunderstand my issue with the system proposed.

I'm not objecting that it's insecure because it's wireless; I'm objecting that I don't want people reading my credit cards remotely, even if they can do it securely, and even if they are holders of legitimate VISA merchants.

Imagine if every e-commerce site you visited had the technical capability to read your VISA card details, simply by your visiting their site. Would you want a VISA card then? Would you still casually browse the web for bargains?

Re:Show me the security

[Boogaroo]

Stores will still give you cash back, but typically you MUST use cash for the original purchase. This whole contactless Visa thing would be worthless for return fraud simply because it would go back to the original Visa.

There are still ways to do return fraud, but this isn't a new method.

Re:Show me the security

[Anonymous Coward]

Let us know when you move out of your parents basement and learn how the real world works

Actually, don't. I never really liked that show.

Re:Show me the security

[John Harrison]

Put a sheet of foil in your wallet then along with the bills.

Re:Show me the security

[newend]

Personally I'd go for much smaller charges. If you only take a buck or so off everyone, then they probably won't care enough to actually go through the hassle of actually filing a complaint. I know I never look at my bill close enough to determine if a bartender decided to double their tip, how would I know if someone slipped in an extra small purchase.

I think the bigger concern would have to be someone managing to make fraudulent purchases with your information, which is easier with a magnetic strip than this...from what I've read in /. comments.

Does anyone have any input as how this could be used to track who comes in to your store that doesn't make purchases...or any other shopping patterns that might be worth storing/selling?

Re:Show me the security

[severoon]

Well, because...this is opening the door to having the chip permanently implanted in your forehead. That way, whenever you want to make a purchase, the cashier can just ring everything up and then point the register gun at your face and charge it to you. I just hope it scans the first time because I've seen one too many clerks smash the item against the scanner (or the gun against the item) out of frustration.

Re:Show me the security

[b!arg]

I would love to see this sort of feature in the future. Gone would be the days when there are 12 debit cards piled up on the check at a restaurant. One guy pays, the others just "swipe each other's cards" and presto, you got the money. Of course the (secure) implementation of such a system is the problem. I suspect it will get to this eventually though as cash becomes less and less used.

Re:Show me the security

[superstick58]

This isn't ISO 15693

I can't help it. It's ISO 15963 for vicinity tags.

Re:Show me the security

[cayenne8]

"I would love to see this sort of feature in the future. Gone would be the days when there are 12 debit cards piled up on the check at a restaurant."

Hmm...what's the problem here? Our group just basically adds the 20% tip to the total, divides it evenly between the 3 of people at the table...and same amount goes on each card. We generally order about the same amounts...so if you have a little more or less one day...it all evens out.

Now...this is a bunch of guys. Women? Well, it is kind of funny to see them all whip out the calculators, and try to figure out exactly what they had to the penny...geez, I'll never understand that one...

Re:Show me the security

[superstick58]

You beat me to it. Most people don't realize this. RFID is, like you said, an air core transformer. So not only is it difficult to get a good reading range, but you also must have the correct orientation for best reading of the tags. The tag and reader "antenna" coil must be parallel for the flux to induce current in the tag. (slight angles will work, but will decrese read range)

Re:Show me the security

[schtum]

in what looks like a huge coincidence, they all decided to cheat me. I'm the victim here.

Yeah, and if you ever go on a shooting spree, just say "in what looks like a huge coincidence, all these people decided to attack me. It was self defense. I'm the victim here."

Just to be clear, the people you need to convince of this are cops, not your mommy and daddy who love you unconditionally and don't believe the bad people who say mean things about you. Grow up.

Re:Show me the security

[lgw]

Since the Visa system isn't RFID-based, I'm not sure what your objection is.

Re:Show me the security

[b!arg]

I'm thinking more of a situation where you have 12 people or whatever and a few people drink a lot, where others don't. Or in the case where you might go to a place that is cash-only. One person has cash and all you have is your debit/credit card. So they could cover you and you owe them whatever. I run into this a lot when I go to a club and there is a cover. Typically they don't take cards at the door. Sure, you could plan on going to the ATM beforehand, yada, yada, yada. But that's not the point. And you know, sometimes things aren't perfectly planned, not in my life anyway. :) Just think of it as an offline version of PayPal.

Who knows how this could work...you transfer some sort of secure token or whatever from one card to another and the next time you visit the ATM it deposits the money. Almost like an EFT or something. I am definitely not a [whatever profession it would take to get this to actually work.]

Re:Show me the security

[Gwyn_232]

It's not that straightforward to catch someone skimming like that. I don't know about the US, but in the UK banking system a Visa transaction typically takes two days to hit an account, after which it can be drawn as cash. Most people get their statements monthly, so you could do this to thousands of people, and as long as you moved quickly, you could make a fortune - the only risky part would be collecting the money, but I'm sure someone resourceful could figure that out.

I know that the police could trace an account, but that doesn't matter if you don't use your own account. You'd be surprised how easy it is to gain control of someone else's account, and almost undetectable if it's dormant (I have a low-paid clerical job in a bank, and could provide you with a list of hundreds of dormant account numbers if I wanted to).

Re:Show me the security

[Anonymous Coward]

If you have some money start a faraday purs, wallet etc. business. The idea's free.

Re:Show me the security

[kmeister62]

OK I stand corrected but its still using NFC with a range of about 20 centimeters (7in) or so based upon the standard. Its still a wireless technology and subject to interception. Still won't trust it... "Its not whether I'm being paranoid but whether I'm being pranoid enough."

Re:Show me the security

[kosmicki]

Personally, I use Quicken for my finances. (I know everyone does not, so spare me that line) And twice a week I have it sync with my bank, it downloads all the transactions and I can pair them with entries with ease. If I got a $24 charge I don't have in the checkbook, big flag would go up. As I enter my reciepts as soon as I get home every day, it would not take long to sort out if I just forgot one or if there was a problem. I feel rather safe about using my card, partly because I'm not liable and also because I can catch any strange charges rather quickly, making odds of disputing it better. (This does not mean I'm not paranoid about theft of my card, I take the usual precautions)

Would I use this wireless system? I probably would if it was offered. Right now it seems rather safe, you have to have it so close to the reader I doubt it would be stolen by walking down the street. Of course before I got it, I'd check up on them again, as if they go into production (years down the road, just think of how many readers need installed before it's practical to have one) more details would be put out, and more improvements made.

Re:Show me the security

[Anonymous Coward]

This whole contactless Visa thing would be worthless for return fraud simply because it would go back to the original Visa.

There are still ways to do return fraud ... yeah, 'lose' your receipt and get store credit.

Re:Show me the security

[lgw]

Do you allow a waiter to take your credit card out of your sight? ;)

Re:Show me the security

[Anonymous Coward]

Just to be clear, the people you need to convince of this are cops, not your mommy and daddy who love you unconditionally and don't believe the bad people who say mean things about you. Grow up.


So, you are saying that no one ever lies to the cops and gets away with it? No one ever commits fraud and gets away with it?

Re:Show me the security

[Anonymous Coward]

Please.. this isn't bluetooth were talking about. It's a 'key fob' that goes on your keyring. It has the information in an encrypted format unlike bluetooths lackluster attempt at it.

You would get a string of crap that would take your computer too much time to decrypt.

So.. you can point these 'sniper rifles' all you want at them - your just going to collect garbage.

Re:Show me the security

[Anonymous Coward]

Are you retarded?

Re:Show me the security

[Anonymous Coward]

It is also for you to verify that you are being charged the correct amount.

Re:Show me the security

[Michael Spencer Jr.]

While your technical points may or may not be correct (I haven no idea), I think you (and that other poster who talks about an attacker getting a merchant account) are missing the point about the threat model here.

I'm just a terminal technical support rep for existing credit card terminals, so I can't comment on technology I haven't seen yet. Maybe someone else in my company (First National Merchant Solutions) is looking at this technology, but I'm not. So any opinions expressed in this post are my own, and may or may not belong to my company. (I say this up front because it looks like there are other people in my industry in this thread, and I want to be sure I'm not claiming expertise I don't actually have.)

Remember, Visa cares about the difference between card-present and card-not-present sales. So there are two different threat models here:

Threat one: an attacker sniffs wireless traffic (or uses their own reader to interrogate a card), creates a substitute card, and presents that card in *card present* sales, tricking merchants into thinking they are that other customer.

Threat two: an attacker sniffs wireless traffic (or uses their own reader to interrogate a card) and uses that account information to submit *card not present* sales to MOTO (mail order / telephone order) or ecommerce merchants.

I think that one-time non-reusable code they were talking about only protects customers against threat one, because the article didn't explicitly say card numbers are kept secret from merchants. That protection is important, because if the customer's bank thinks the customer's card was present at the point of sale, and the customer didn't report their card lost or stolen (or a new one, compromised, maybe?) until days later, they might expect that customer to pay for the attacker's purchases. (Or the bank might just write the charges off, which increases their costs and forces them to raise rates on other things.)

I think we missed talking about whether this system will keep card numbers out of attackers' hands. If someone can take a card reader (which does its own valid challenge/response with the card) and learn card details (like card number, expiration date, and other data), they don't need their own merchant account to use those card details in traditional ways.

Remember, thieves don't need their own merchant accounts to abuse card numbers. This is "traditional" credit card fraud: the thief tricks a merchant into shipping merchandise or performing services for them, not knowing that they won't be able to keep the money from that fraudulent credit card sale. MOTO merchants are supposed to use "best practices" fraud protection to guard against this, but there are *many* gullible or lazy merchants out there.

(You can imagine my frustration in talking to some of these guys: to them, this is just additional hoops to make their valued customers jump through, and they're afraid of losing business. See, when a thief gets turned away by all these fraud protection checks, saying "fine, I'll take my business somewhere else", the merchant can't tell the difference between a thief they just thwarted or a picky customer they just frustrated into going somewhere else.)

I remember where the article talked about that one-time-only code passed between the issuing bank and the card, but I don't remember the article saying that system keeps the card number secret from the merchant. With this system, instead of using a card reader to send transaction information to Visa, a thief uses a card reader to send transaction information to a text file.

--Michael Spencer

Re:Show me the security

[Anonymous Coward]

1) You set up a fake identity. Hell,steal someone elses.
2) You obtain a merchant account under the fake ID to be able to collect funds from your portable reader.
3)You make genuine transactions. A card reader hooked to a laptop using WiFi to get online is all that's really needed.
4)You go out and collect ~$24 from fifty people in a crowd, wohoo $1,200! - per day.
5)A lot of people DOn't even notice the reletively tiny charge. A few protest to visa that they didn't authorize your charges.
6)Visa does about 30 seconds worth of research and realizes that all 50 of these claims lead directly to you via your merchant account, which is under a fake identity, remember.
7) Visa shuts you down like a bitch and presses charges against the person whose identity you stole.
8) You walk away with Hundreds of Thousands.

Re:Show me the security

[swillden]

Finally!! Some *valid* arguments :-)

IMO, this is an important flaw in many implementations of EMV. I say in implementations, rather than in EMV itself, because if you fully implement EMV you're using PINs, and the card will not divulge any account data until the correct PIN has been presented to it (inside a secure channel, to prevent sniffing). The card will also lock itself after a handful (issuer-defined) of bad PIN presentations, so you can execute a denial of service attack against someone's card, but you can't really get data from it. IMO, PINs should also be larger than four digits, but it will take time to get cardholders accustomed to that idea.

Without the PIN requirement, I can create a device that can read the data out. To do it, I do have to get my device within a few inches (commercial readers have to get within a centimeter or so, but I'm assuming that an attacker wouldn't worry about violating FCC regulations on transmission power and reception gain -- at more than a few inches you run into serious problems of physics, not just regulations), and I have an additional problem that if you have more than one card in your wallet signal collisions will probably prevent me from talking successfully to any of them, but it is possible to read out the card data.

Even without the PIN data, I think there's another way to solve the problem, and it's what you said: Don't give the card to the merchant in cleartext. There are lots of easy ways to accomplish that.

We'll see what the banks actually choose to do, of course. And, really, the bottom line is that someone is unlikely to use this method of collecting card numbers, because there are so many easier, safer ways of doing it.

Re:Show me the security

[ihgreenman]

I haven't followed the literature lately, but there was speculation a few years ago that DES is actually a group. Which would mean that 3DES is equivilent to DES -- and therefore be practically no security at all.

Re:Show me the security

[Sparr0]

That is just it. Paypal *IS* verified and bonded. And they dont have to give you the hardware. I guarantee there will be a way to interface this new system with paypal's existing 'instant payment notification' system, and they submit the payments with your own hacked-together hardware.

Re:Show me the security

[Boogaroo]

They'll just type in your product, range of purchase dates, name, and pull up your actual purchase. Not all stores do that, but many do now.

Still, what's the point of store credit. They still keep the money. The idea for return fraud is to actually get money for nothing, not pay for something else in the store.

Re:Show me the security

[izomiac]

After 30 years nobody has found and come public with a way around DES

Like I said, the keyspace is just one problem. After it became ridiculously easy to crack DES then people stopped trying to come up with better ways to do so. Look at the link I provided before, DES is still vulnurable to time-memory trade off attacks (needs about 1 TB of storage and 5 days of computation with a normal computer), differential cryptanalysis, and linear cryptanalysis. Triple-DES also suffers from DES's chopping off of the last bit in every byte of the key, dramatically reducing the keyspace (2^128 compared to 2^112). The other problem with Triple-DES is that it is slower than AES or most other algorithms. Here are some more reasons that AES would have been a better choice than Triple-DES.

Re:Show me the security

[Anonymous Coward]

the real goal is a cashless society wich is then one more giant step to "666"!!!!

Re:Show me the security

[CaycePollard]

You are wrong. VisaWave (the only contactless product that Visa have deployed) is RFID: it uses ISO14443 proximity interface (as does Mastercard Paypass and American Express Expresspay). ISO15693 is for read-only vicinty tags.

Re:Show me the security

[CaycePollard]

Hey! Quick someone better call Visa: I bet THEY NEVER THOUGHT OF THIS. That's why they're so poor, I guess, because they keep getting outwitted by evil geniuses like you.

Since your amazing plan does not depend on the deployment of contactless Visa card -- you could perpetrate your perfect fraud using the existing stripe cards -- what is it doing in this thread?

Re:Show me the security

[Muad'Dave]

The near-field (proximity) ones are like an air core transformer and rely on magnetic field induction. UHF tags are far field - they really do rely on the E field to power them vs the H field for proximity tags. EPCGlobalInc.com has some fairly good PDFs on the technology.

Re:Show me the security

[John Harrison]

There is a difference between an RFID tag and a contactless smart card implementing EMV. Calling it RFID is inaccurate as it is not an an identification tag. Yes some RFID devices use ISO 14443. Does that make all ISO 14443 devices RFID tags?

Slashdot needs to be much more careful in its use of loaded terms. This is never going to happen though.

Re:Show me the security

[John Harrison]

While we're at it, I must say that your response to one of my previous comments in November demonstrates that while you seem to know some terminology, you don't seem to have deep smart card experience. Please correct me if I am wrong. It is very possible that I have misunderstood your previous comment in some way. It is difficult to tell since you did not respond. Interesting that 2/3rds of the time you have posted to /. it has been in response to me.

Re:Show me the security

[CaycePollard]

"There is a difference between an RFID tag and a contactless smart card implementing EMV."

I know.

"Calling it RFID is inaccurate as it is not an an identification tag"

Yes, and inflammable means not flammable. So what? RFID is the generic term used in the industry for reader-powered microprocessors.

" Yes some RFID devices use ISO 14443"

Such as, for example, the Visa cards discussed in the original article (which are not "contactless EMV", nor could they be since such a standard has yet to be released). What's your point?.

"Does that make all ISO 14443 devices RFID tags?"

No. But you cannot negate a universal affirmative (as the old saying goes).

Re:Show me the security

[CaycePollard]

"It is difficult to tell since you did not respond."

I apologise, I have a job.

But let's review the situation and you can be clearer on what it is you don't understand, thus trending the conversation toward education.

1. Visa have announced that they will (but haven't yet) deploy a contactless card in the US. This will be an ISO 14443 card, just as Amex and MasterCard have been piloting.

2. The only contactless card that Visa have deployed so far is not in the US but in Asia-Pacific. This is also an ISO 14443 card but it uses the EMV application over the 14443 interface. No contactless EMV standard has yet been released.

3. Although the Visa, MasterCard and Amex solutions transit more than a simple ID number (in fact they transmit the mag. stripe Track 2 data with a cryptogram appended) it is strictly speaking incorrect to call them RFID. But who are we against so many?

"Interesting that 2/3rds of the time you have posted to /. it has been in response to me."

Well, I wouldn't go so far as to say interesting.

Re:Show me the security

[CaycePollard]

"I'm objecting that I don't want people reading my credit cards remotely"

Then don't use them. Take your stripe card to the slow lane with the people still writing checks.

P.S. The range of these cards is about two inches absolute maximum. If you wanted to read them from a couple of yards away, you'd have to pump out enough RF to cook the victim. Wrong threat model, man.

Re:Show me the security

[John Harrison]

Thanks for your reply. I didn't mean to imply that there is a "Contactless EMV" standard. My point, which you stated more clearly, is that all of these cards implement EMV (with SDA) and use the t=cl protocol.

I'm not sure what your "education" comment means, as you haven't told me anything that I don't know. I do appreciate that you have taken the time to state things clearly, and perhaps I haven't done so myself.

While we're on the subject of education, let me say that education is exactly why I am saying that this is not RFID. RFID means something to most /.ers, and many of the fear it, as evidenced by the responses to this article, which originally contained many references to RFID. If /.ers, and concerned people in general, understood some of the details not only would many of them feel better about this technology, but we would be well on our way to productive discussions of the real implications of it rather than the shoutfests over the imagined horrors.

Has my effort to educate /.ers been fruitful? I am not sure. What I do know is that the text of the /. article was changed a few hours after the original post as a direct result of my admittedly hasty and rude comment. Note that the article that is linked to never mentions RFID. Thousands of people read my comment as it was the fourth response to the article and quickly modded up to +5. They might not agree with me, but at least they know there is a difference of opinion over this. In contrast you chimmed in saying "You are wrong" when you knew that I was in fact right. I find this a bit odd.

Re:Show me the security

[metamatic]

If the range is that small, what's the point? Why not just have regular touch contacts to an embedded chip?

Re:Show me the security

[CaycePollard]

"If the range is that small, what's the point?"

Because it's fast (you don't have to take the card out of your wallet -- I saw people in London using cards like these on the subway.

Because it doesn't need to be a card. These things can be keyrings, badges, buttons or whatever the marketing guys want.

Because it's cheaper. Over the long term, terminals with no slots and no contacts are more robust.

Re:Show me the security

[CaycePollard]

"My point, which you stated more clearly, is that all of these cards implement EMV (with SDA) and use the t=cl protocol."

That was NOT my point. MY point was that the cards that Visa will deploy in the US, along with the cards that MasterCard and Amex will deploy in the US, do not implement EMV with T=CL or anything else. The Visa product deployed in Malaysia does.

Re:Show me the security

[John Harrison]

I have participated in the RFP process of some of the deployments you mention. You are wrong. The specs given by the vendors referencce EMV and the specifics are lifted straight from EMV.

Re:Show me the security

[Anonymous Coward]

"The specs given by the vendors referencce EMV"

I know they do. That doesn't make the either EMV-compatible or EMV-compliant.

"specifics are lifted straight from EMV"

Could you help the readers by being specific about your specifics? Give us a pointer, perhaps, to the EMV specification that defines the message sent from a PayPass terminal to an acquirer (to pick a simple example).

People, this isn't RFID!!!!!!!!

[John Harrison]

This is a contactless credit card, ISO 14443. RFID is ISO 15693. They are different. The article never mentions RFID. Slashdot has inserted something that was never there. This is misleading, dishonest, and unprofessional. There are MAJOR DIFFERENCES between the technologies. You would think that a techie site like /. would know better.

Re:People, this isn't RFID!!!!!!!!

[Anonymous Coward]

This is misleading, dishonest, and unprofessional.

This is slashdot. So the phrase you're looking for is "misleading, dishonest, unprofessional, incompetent and about par-for-the-course."

Re:People, this isn't RFID!!!!!!!!

[RPI Geek]

This is an old /. tactic, don't get so excited:
1) Use misleading buzzword to capture /. editor's attention.
2) Front page story.
3) ???
4) Profit!

Re:People, this isn't RFID!!!!!!!!

[gowen]

You would think that a techie site like /. would know better.

It's only a techie site because techies read it.

The editors aren't techies. (Of course, they're not competent editors, either).

Re:People, this isn't RFID!!!!!!!!

[iamwahoo2]

The information is transferred via radio signal. Given only this information I also would have inferred that RFID chips are used. The devil may be in the details but saying that it is misleading, dishonest and unproffesional is a little overboard. The main concern of security is still the same.

Re:People, this isn't RFID!!!!!!!!

[Smack]

You're right, it may only be misleading and unprofessional.

Re:People, this isn't RFID!!!!!!!!

[starburst]

You forgot the dup

http://slashdot.org/article.pl?sid=04/05/07/214820 3

Re:People, this isn't RFID!!!!!!!!

[ch-chuck]

Well, it communicates with Radio Frequency electromagnetic radiation, and each one has a unique identification, but it's NOT RFID!! Maybe it's not the proper name but the same idea.

Anyway, it sure would trim a few seconds off awkwardly sliding the old debit card thru the reader at the grocery store. Being afraid of it would be like being afraid of privacy abuse by Exxon's speed pass, etc.

Re:People, this isn't RFID!!!!!!!!

[Bret Tobey]

This is the problem with insider lingo, it confuses a sometimes well educated public. Not defending /., but the term RFID has been coopted by the ISO 14443 group. Inside the industry, that's how the term RFID is used. An engineer without prior involvement would say, call a duck a duck, it's all RFID.

Re:People, this isn't RFID!!!!!!!!

[Anonymous Coward]

in case you didnt notice, zonk and shampussy are both posting links to their own sites most of the time, its like they watch the submission queue, copy content to their site and then link it up on the frontpage

instant profit

Re:People, this isn't RFID!!!!!!!!

[Ryan Amos]

Yes, RFID is the current buzzword so the slashbots all assume it is the only passive radio spec out there and like to say "RFID" because it makes them sound like they know what they're talking about, which is important because they didn't read the article. Dishonest and unprofessional? Dude, do you even read slashdot? Of course it's dishonest and unprofessional; it's been that way for years. Snide editorial comments that are at best misleading and at worst outright wrong are par for the course.

Re:People, this isn't RFID!!!!!!!!

[superstick58]

I am designing an RFID system using the ISO 15693 standard. The difference with the standards is the protocol used for communication. The physical implementation is still the same. Both work at 13.56 MHz. The cards and reader are coupled together like and air core transformer. The tag and reader "antennas" must be oriented parallel for optimum reading distance. Even with optimal orientation, the sensing distance usually very small especially with a low power portable device. I'm not sure what securtiy is used in the 14443 standard, but intercepting or even initiating an RFID transmission is very very difficult for an HF application.

Re:People, this isn't RFID!!!!!!!!

[John Harrison]

Secure messaging for ISO 14443, T=CL, is well defined and widely implemented. Also, EMV, unlike magstripes, is designed such that replay attacks won't work.

Sure would nice...

[hot_Karls_bad_cavern]

to have the sales folks in a store be able to read the info, check your limit, and in *MY* case, simply leave me alone while i browse, since i'm always broke anyway and don't like to be hassled whilst i look at stuff i can't buy!

Yes, it's a joke.

Security?

[Cyberax]

And now a thief doesn't have to guess PINs. It will be enough just to steal a card!

Re:Security?

[AnimeEd]

pins are for cash only when did we ever need pins for credit card purchases?

Re:Security?

[Cyberax]

Online transactions are much easier to track down to a criminal, compared to a good old cash :)

Re:Security?

[Anonymous Coward]

Sometimes it is a bit hard for us Europeans to remember that the USA might not have moved on from the old credit card + signature system.

We've been using chip and pin at the till for a while now, for most stores anyway.

Re:Security?

[BenjyD]

Many countries (most of Europe, at least AFAIK) require PINs for credit/debit card purchases. You type it into a little keypad dealie with a cover so the person at the till can't see you typing.

Re:Security?

[Anonymous Coward]

Aye. What he said. (In the UK, we call it "chip and pin".)

Re:Security?

[swillden]

And now a thief doesn't have to guess PINs. It will be enough just to steal a card!

Umm, under the current magstripe-based system, the thief doesn't need a PIN *or* a card. All he needs is the card number.

Re:Security?

[joel48]

And yet I (in the US) had a chip-based card for the past 5 years (Fusion from Fleet), and after the recent merger with Bank of America, they "upgraded" me automatically to a non-chip, plain jane card.... progress?

Re:Security?

[Anonymous Coward]

Yes indeed. Lets all take a moment to give thanks for the proliferation of self-checkout lanes.

Very Secure?

[bigtallmofo]

From TFA:

Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted, a key security feature, he said.

What protects consumers from fraudulent merchants waving some kind of electronic cash-sucking wand by your back pocket which contains your wallet which contains your RFID Visa card? There's no mention of this in the article at all!

It's a standard scam now for an unscrupulous merchant to charge millions of people a small amount of money fraudulently with the hopes that the vast majority won't even notice. Imagine what they will do when all they have to do is walk around a mall waving something at people purse's and backpockets!

Re:Very Secure?

[Anonymous Coward]

So you add a sound effect to the card. A brief, loud chip everytime it's scanned.

Re:Very Secure?

[Anonymous Coward]

Yeah, I certainly don't want some "merchant" waving their "cash-sucking wand" at my "back pocket".

Re:Very Secure?

[panurge]

This seems absolutely correct. If no confirmation is needed below $25, the possibilities for small scale fraud by a large number of vendors would seem to be quite high. Although such fraud should eventually be detected by the unusual transaction patterns, the chance that end users would get reimbursed seems remote. The problem with all "make it easy for the customer to spend money" technologies is the large number of dishonest people who will look to exploit them. Much as retailers would dislike it, what I want is a credit card that makes it hard to spend money, worked by a system that uses one-off transaction details that cannot be reused. The paper bank draft is a reasonably effective way of doing this, but is too hard to use for most people, except for large purchases.

The answer to the inevitable march of progress (sic) seems to be a wholesale adoption of electrically and magnetically screened wallets and handbags. Perhaps this is the next business to invest in.

Re:Very Secure?

[Anonymous Coward]

You know, that's interesting. I've gotten six e-mails already today on how to enlarge my cash-sucking wand. I don't walk around the mall waving it at people, though.

Re:Very Secure?

[luvirini]

Easy: Set up a small business of some sort in a mall where you get lots of small credit card transactions. Then bill few thousand people more a month say $20 each.. that extra should allow you to make profit even with a crappy business plan.

Re:Very Secure?

[Anonymous Coward]

I have the same concern that someone can just wave a reader at a pocket, etc. but at least it will have to be within 4cm of the card. (Assuming the Asian program is the same as the US one.)

http://www.visa-asia.com/newsroom/visa_wave_faqs .s html

It also looks like it isn't quite instant i.e. the card has to be within that range for "a brief period of time". I'm guessing no more than a couple of seconds, but that's just a guess.

http://www.visa-asia.com/newsroom/getting_starte d. shtml

Re:Very Secure?

[FLEB]

Now that's convenient!

The normal task of using a credit card:
1.) Get out your wallet.
2.) Get out the card.
3.) Place the card in the reader
4.) Swipe downward

That Step 4 was just killing me!

Re:Very Secure?

[slapout]

I know of a manager who told all his employees to automatically add the extended warrantly to things they bought. Then if the customer complained, take them off.

Re:Very Secure?

[sbryant]

What protects consumers from fraudulent merchants waving some kind of electronic cash-sucking wand by your back pocket which contains your wallet which contains your RFID Visa card? There's no mention of this in the article at all!

That's easy to answer! It's almost certainly based on the technology they already use.

VISA and others have been making smart cards for a while - they have a chip in which a smart card reader can talk to. You've probably seen cards with the contacts on the front already. The whole point of these cards is to cut down fraud, especially by card duplication. It's relatively easy to reproduce what is on the magnetic stripe, as the information is static.

These chips are used as part of an "online" transaction: the terminal (card reader) connects to the service provider's system, which in turn connect to VISA. VISA issues a challenge, the card's chip issues a response, and VISA verifies the card. This way, you can instantly detect fake or blacklisted cards. (If you lose your card, always call them immediately!) The challenge is unique every time, and a PIN/signature may still be required, possibly depending on the amount.

The retailer is guaranteed payment for such transactions, even it the charge is contested. Such online transactions cost the retailer more than offline ones, where the retailer takes the risk in case of fraud/chargeback. If you have to type in your PIN, it's online.

This new system will most likely be an extension of the smart card system. Even if somebody finds a way to challenge the card and get a response, they could only ever use that response against the same challenge from VISA for a charge on the exact same card. It may also be that the amount being charged affects the challenge and/or response too (I think so, but don't remember). It might be theoretically possible, but there is too much left to chance for it to be realistic. If they add an extra security layer to cover the wireless part, you are left with a very safe system.

If I wanted to get lots of money (illegally), I would turn my efforts to something which was easier and actually had a real chance of succeeding. Beware the old-fashioned pickpocket!

-- Steve

Re:Very Secure?

[Anonymous Coward]

And if you beleive that I have a tinfoil wallet I want to sell you!

Re:Very Secure?

[DustMagnet]

What protects consumers from fraudulent merchants waving some kind of electronic cash-sucking wand by your back pocket which contains your wallet which contains your RFID Visa card?

The same exact thing that protects you from having a merchant missuse your credit card number. You have to check your bill and write a written complaint. You don't pay a penny and each complaint costs the merchant an extra charge. Too many could start a fraud investigation, but from what I hear the companies usually don't bother.

Re:Very Secure?

[sstidman]

Actually, the steps were:

1) Get out your wallet.
2) Get out the card.
3) Place the card in the reader
4) Swipe downward
5) Swipe upward
6) Wipe card on shirt hoping to make the f'ing thing work
7) Repeat steps 4 through 6 until you give up
8) Hand card to cashier for typing in by hand

Now the steps will be:

1) Hold ass up to scanner (assuming wallet is in back pocket)

or alternatively (if purchase is less than $25):

1) Trick person behind you into standing really close to the scanner so their card is debited

I think that would be a bit less frustrating than the old way.

Re:Very Secure?

[Anonymous Coward]

All they need to do is put a small button on the card that needs to be pressed while you wave it in front of the reader at the store. If the button isn't being pressed, no sale. Easily defeats the "pickpocket" issue.

Re:Very Secure?

[Mannerism]

4.) Swipe downward

That Step 4 was just killing me!

It was killing me, but only when the mag strip on my card wore out, which it did every six months or so. Waiting for clerks to take a card imprint, etc. is inconvenient. I'll be happy when Step 4 goes away. I'll be even happier when steps 5 and 6 (wait for receipt to print, sign receipt) are replaced with "place thumb on biometric device" or whatever. Convenience rocks. I use a key-fob device to buy my gas, and it's really nice not having to take off my gloves and follow steps 1-4 on those chilly winter mornings.

Re:Very Secure?

[jonfelder]

It's a standard scam now for an unscrupulous merchant to charge millions of people a small amount of money fraudulently with the hopes that the vast majority won't even notice. Imagine what they will do when all they have to do is walk around a mall waving something at people purse's and backpockets!

The original scam requires someone to purchase something from the merchant...i.e. charge like $1 more than they should. This scheme does not make this practice any easier to do.

If a merchant just randomly charges people by collecting numbers and using them later, enough people will notice to where the merchant gets busted.

If a merchant walks around the mall and does this it would be no different than the above scenario. Except that this time people would be more likely to notice because they'd get a charge from someone they never bought something from. In addition, don't you think VISA is going to notice the odd increase in sub $25 purchases?

Re:Very Secure?

[John Harrison]

You get it. The luddites here do not. They claim to be geeks but have no clue. Look at all the "attacks" that have been dreamed up in these comments. Nearly all of them would be more effective against a mag-stripe card yet these people use a mag-stripe credit card everyday.

Re:Very Secure?

[Ritchie70]

I work for a company who is working with both MasterCard and Visa regarding this technology.

If you only have one of these cards (which we refer to as RFID, although apparently they are not) then all you have to do is place your wallet on the reader. In my testing at one of our retail locations (we all got cards with $20 or so on them) I actually found it easier and more reliable when I left the card in my wallet, probably because my expectation was lower so I tapped more carefully.

Sense of security?

[Anonymous Coward]

What the hell kind of stupid idea is that? People aren't gonna go for that... Will they?

How long till...

[bpuli]

someone comes up with a phony reader? No longer will people have to steal cards to make fraudulent charges! Just make you walk by a reader and voila! you have a $25 charge on your card.....

Re:How long till...

[leonardluen]

why get a phony one? you can buy a normal magnetic card reader for about $100 and for a few hundred more you can get one that writes as well.

i am sure the readers for these new cards aren't going to be too expensive otherwise retailers probably wouldn't go for them.

Re:How long till...

[badfish99]

But if you do want to steal cards, then it will be easy to make a "credit card detector" that sniffs out the RFID chip as people go by, and tells you which pocket their wallet is in.

Then you take the stolen cards and make lots or $25 purchases, without having to forge a signature.

Who thought this up? The Guild of Thieves?

Re:How long till...

[Mattintosh]

Worse yet, and what the grandparent was probably thinking, what if a thief sets up a "company" and plants a reader near a busy sidewalk? Lots of $24.99 transactions later, the thief is rich, but worries that his scheme will be discovered, so he moves to a different sidewalk and repeats the process. No need to take a card. No need to trick people into swiping it. Just get it to charge something automatically as it goes by, and put the proceeds into your get-a-new-Ferrari fund. You could probably have 2 or 3 new Ferraris in a month's time.

Re:How long till...

[Anonymous Coward]

I'm more nervous about standing at the checkout at Krogers. Take out my wallet to get the Credit Card and the reader suddenly have access to all the cards in the wallet because it got close to it and then charges all of them in a spiff. Give me swipe any day.

Re:How long till...

[jthayden]

Don't you think the credit card company is going to catch on to this pretty quick. Boy, half of abc company's transactions are being flagged as fradulent and costing us money, I guess we'll do nothing about it. You also don't get paid immediately by the credit card company, there is quite a lag time. I don't think that scam is going to go far.

I'd be more concerned about some bum hacking this and figuring out how to replicate the signal for people's cards.

Re:How long till...

[swillden]

You could probably have 2 or 3 new Ferraris in a month's time.

Only one catch -- to get a merchant account, you have to verify your identity to the bank you get the account with. So there are all those transactions, and screaming cardholders, and everyone knows who you are and where you live.

Your Ferraris will disappear in a flash as you're handed over to Bubba's tender lovin'.

Re:How long till...

[PDAllen]

Why bother constructing a phony reader? Just buy one of VISA's standard ones, and stick a bit of software on it that charges $24.99 every time it can find a card in range.

Of course, the problem here is that when a thousand complaints come in to VISA HQ from people asking what the hell this charge is for, VISA take about three seconds to see that all the complaints refer to your merchant account and you get jailed. A phony reader or whatever makes no difference here - you may be able to fake out the card, but to get money you have to give VISA an account number to transfer money from and your account to transfer money to. And that is enough for VISA to catch you when complaints come in.

Offhand, the only immediately obvious way you can safely make money out of this is to make yourself a broadcast and amplify kit, which you can scan for your $20 of shopping at the supermarket, and hope that someone else (like the next guy in the queue) is near enough to you that his card activates and pays for you. Even that would be both very hard to do (magnetic induction powering a card a few feet away would be pretty hard to manage).

Re:How long till...

[pod]

Yeah, that'll always work, because we know all criminals are stupid.

Re:How long till...

[swillden]

Most of them are pretty stupid. And those that are smart will use one of the many, many easier, safer ways of stealing money.

Security doesn't have to be impenetrable to be useful. As evidenced by the fact that the systems we're talking about here are far more secure than the ones that we use every day.

Tinfoil

[Mork29]

I've always wanted an excuse to carry around a wallet made of tinfoil.... it'll match my hat, and my under.... I mean socks....

Re:Tinfoil

[Anonymous Coward]

Great, now I have to have a piece of tinfoil in my wallet around my credit cards. No more will I be able to store my RFID powered door key there and be able to just wave the whole wallet to gain entry to my underground lair.

Re:Tinfoil

[Anonymous Coward]

OK, so maybe it's not RFID, but could they (the stores) not come up with another device that IDs you when you walk in the store? Like that legendary Prada credit card that alerts the clerks to who is present in the store and brings up their sales history. It may not be the scarey financial horror that some people here are predicting, but it still could present an invasion of privacy issue... GB

big deal -- Mobil already does this

[Anonymous Coward]

Mobil gas stations give you a little RFD dealie to authorize gas purchases at the pump and other purchases in the store. They've done this for years.

All Visa is moving the RFD dealie from a little wand on your keychain to the card.

Hmm, So it's all about making it easier?

[OhBrian]

The referenced article says that Visa and other credit card companies are looking at this technology to make it easier for card holders to use the cards for small purchases. If enough legit small purchases are made these credit card companies will make more money but will that reduce their overall exposure to fraud? Will these additional funds that run through my credit card make the card cheaper (lower or no annual fees and lower monthly interest rates)? It will be interesting to see how no fee and low interest rate Visa and MasterCard offerers adopt this.

Re:Hmm, So it's all about making it easier?

[jedidiah]

Yeah, sure.

The current regime doesn't discourage me from making small purchases with plastic. It doesn't discourage anyone I know. I don't think it discourages anyone else either.

H*LL, credit card readers were showing up in fast food restaurants in the early 90's. If that isn't a "casual credit card use", then what is?

It is likely that anyone who cares to is already using credit cards for small purchases and making the process more casual or less secure really isn't going to do much to alter the habits of people that are fixated with some other way of doing things.

Another Fine example of Slashdot "journalism"

[sQuEeDeN]

Seriously. IT DOES NOT MENTION RFID ANYWHERE IN THE ARTICLE. Just so y'all realize. Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode? It's just a longer range barcode. And the chipmaker can set the length. It's just a way to get small amounts of information in to a computer. Relax.

And, I'm inclined to listen to visa a little bit when they say their card is secure. I mean, they are not exactly a company that can win by skimping on security. If the system is hacked, they pay, not you.

Re:Another Fine example of Slashdot "journalism"

[drnlm]

Privacy freaks are anti RFID (and any similiar distance tagging method) for precisely two reasons:
It's passive (minimal activity required by anyone to get something scanned) and it's long range. While the ability to link identity to purchases (assuming no cash transactions) exists with bar-code readers, it's a much more active system, and the user has much more control over when and where this information is collected.

If with a few minutes thought, you can't construct a worst case scenerio for long-range (where long range is further than about 20cm) bar-codes, there no hope for you as a privacy freak :).

Re:Another Fine example of Slashdot "journalism"

[leonardluen]

the entire problem is that it is a contactless card...meaning the reader doesn't need to touch the card to read it.

so lets say they do limit the range to just a centimeter or two. then it would merely take a new type of pickpocket carrying around a reader for these new types of cards and just swipe it past the wallet in your pocket. they won't even need to touch you, and yet would be able to steal money from you. and because no signature is required for purchases up to $25, they could charge $25 to your card and the credit card company wouldn't complain.

Re:Another Fine example of Slashdot "journalism"

[Anonymous Coward]

It's just a way to get small amounts of information in to a computer. Relax.
---
everything counts in small amounts. lots of small amounts add up to big amounts. personally I kind of like to know, and have some control over, who gets information on me. Whether it be anonymous or not.

You can take lots of anonymous info, associated with an id, pin a name on the id, and know a lot about the person behind the id.

Even if people don't steal your money, I guarantee that card has an ID on it, that's not encrypted.

I, personally, don't like the idea or remote possibility that a credit card company can know every store I have frequented, every coffee shop, and literally draw a path that I have taken wherever I have carried it, whether I have bought something or not.

How long until the police subpoena this information? How long until it gets mixed up somehow? What's the range? Will I be tagged as visiting the porno shop I have to drive past every day on my way to work, on Route 40?

bad, bad, bad. Without the test gear to prove to me that these things don't have the range for this to happen, I have to assume it's a possibility.

With wands only the gas stations have the equipment to read them. With credit cards, it will be *everywhere*.

Re:Another Fine example of Slashdot "journalism"

[wcdw]

If the system is hacked, they pay, not you.

BZZZZZTTTTT! Thanks for playing, would you like to try again?

First of all, Visa doesn't pay for SQUAT. Chargebacks are funded by the merchants, who in most cases are forced to eat the fraud.

And even if that were NOT true, TAANSTAAFL. Regardless of who foots the bill for the losses, ultimately those costs are passed back to the consumer in the form of higher costs.

Trust me, I know. http://theboyz.biz/ ;)

Re:Another Fine example of Slashdot "journalism"

[isorox]

I mean, they are not exactly a company that can win by skimping on security. If the system is hacked, they pay, not you.

Used to be the case that either they, or the store, paid if someone stole your card and forged your signature.

Now it's the case you pay if someone steals your card and uses your pin.

Getting pin's is easy, most people are too timid to shield the pin from the cashier and the guy looking over their shoulder.

Re:Another Fine example of Slashdot "journalism"

[Leadhyena]

If the system is hacked, they pay, not you.

Actually, you'll end up paying, not them. If they can get away with "proving" that the charge was not fradulent, they won't refund your money, and then if you refuse to pay they sell the debt to a collection agency that hounds you until you pay the fee just to shut them up.

It is evident that you have never been in debt before.

Re:Another Fine example of Slashdot "journalism"

[swillden]

Now it's the case you pay if someone steals your card and uses your pin.

Not with credit card transactions. What you're saying is true for ATM transactions (and "debit" transactions at the point of sale, which are the same thing as ATM transactions).

For credit, US law (assuming that applies to you) limits your exposure to $50. In practice, you don't even pay that much because the credit card market is highly competitive and issuers don't want to take the chance of pissing you off.

Re:Another Fine example of Slashdot "journalism"

[NardofDoom]

RFID is great when it's a can of tomato sauce. It isn't great when it's my account number, password information, or medical history, has have been proposed in past /. stories.

Re:Another Fine example of Slashdot "journalism"

[caino59]

Not only that - but if this is more reliable than the current magnetic stripe, I can't see why this isn't an improvement.

Re:Another Fine example of Slashdot "journalism"

[perp]

Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode? It's just a longer range barcode.

Some people are very nervous about technology that lets information about a person be gathered without the person knowing about it. With an RFID passport in your purse or backback, someone with the right equipment can get your nationality and passport number just by standing behind you in a line and you will have no idea. With an RFID driver's licence, anyone at the mall could get your driver's licence number and whatever else is in the tag. Once you have a (non-tinfoil) wallet full of these things, anyone can get enough info about you to be worth selling, just by installing an inconspicuous reader under the counter at, say, an expensive jewelry store, or neo-nazi meeting, or S&M club, or AIDS clinic.

Paranoia? Perhaps, perhaps not.

Re:Another Fine example of Slashdot "journalism"

[drinkypoo]

A barcode cannot be read through your wallet at a distance. Personally I do not have a wallet with a mylar insert, though you may. RFID tags can be read at a significant distance with off the shelf (though perhaps not handheld) equipment. Bar Codes can be read at basically any distance if you have line of sight and the bar is more or less perpendicular to you. Can you see the difference now? Here's another one to mull over: There was an article here about putting RFID in the shoe soles, ostensibly to track sole inventory. Can you imagine a more ideal situation if you're trying to track pedestrians? Every floor mat, sidewalk segment, et cetera is a potential hiding place for an RFID antenna, and with a large antenna at close range like that, the potential for error is vastly reduced.

I am not inclined to believe anyone when they say they have a secure system. If it's not a OTP scheme then it's crackable.

Re:Another Fine example of Slashdot "journalism"

[scharkalvin]

Time for tin foil wallets.

Re:Another Fine example of Slashdot "journalism"

[Azghoul]

"BZZZZZTTTTT! Thanks for playing, would you like to try again?"

Is there any reason you have to act like a complete and utter asshole to someone else? Besides, wasn't that moronic "bzzt" bullshit the "in" thing about 10 years ago? Grow up.

Re:Another Fine example of Slashdot "journalism"

[Anonymous Coward]

Now it's the case you pay if someone steals your card and uses your pin.

You're thinking of debit cards. I've yet to hear one good reason for consumers or merchants to use Visa debit cards. Stick to cash or credit.

Re:Another Fine example of Slashdot "journalism"

[DaveJay]

Why is slashdot so anti-RFID, anyways?

I believe it is an issue of knowledge. Specifically, with RFID and RFID-like technologies that do not require physical contact or personal interaction (like a PIN or swipe) it is conceivable that your information can be read at a distance* without your knowledge.

Does that mean the VISA card in this article is going to allow someone to drain your bank account because you walked too close to a vendor's shop? Not necessarily. However, consider this:

1. The "secure" WiFi protocols have all been beaten;
2. The "close-range" of bluetooth has been increased to over 1/4 of a mile by use of a shotgun-style antenna;
3. In general, people continue to use these technologies even if they are informed of the flaws, because they do not want to lose the convenience (or believe that "if it was really insecure, they wouldn't be able to sell it" or "It won't happen to me").

So do I think that a card like this will eventually be cracked, and will eventually be used to spy or steal from people (successfully or not**)? Yes. Yes I do.

*Here, "a distance" could be a few feet, or could be across a street through a shop window using a shotgun antenna (see bluetooth example).

**Here, I refer to the idea that someone who did this in bulk would likely get caught, and if they got caught it would not be a successful theft; then again, people steal checks and forge transactions to pay their utility bills all the time, and are rarely prosecuted for this provided the dollar amounts are small.

Re:Another Fine example of Slashdot "journalism"

[Anonymous Coward]

Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode? It's just a longer range barcode.

Dear troll, it's different because (a) I know when a barcode is being read, and (b) I can remove a barcode from purchased items when I get home.

Re:Another Fine example of Slashdot "journalism"

[anethema]

Yeah I think most game shows use more of a *DING* now..get with the times..sheesh.

Re:Another Fine example of Slashdot "journalism"

[lgw]

The line was actually popularized by Robin Williams in the movie Dead Poets Society many years ago. It's been merely stupid for quite some time now.

Re:Another Fine example of Slashdot "journalism"

[Anonymous Coward]

IT DOES NOT MENTION RFID ANYWHERE IN THE ARTICLE.

It does not matter if it's RFID or not. It possesses the same characteristics. cost

Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode?

There are a couple big differences between barcodes and RFID.

1. Barcodes require line of sight to function. RFID works even though the tag is not visible.
2. Barcodes can be easily removed by the owner. RFID is often hidden in the product and can not be removed without damaging the product or voiding the warranty (in some cases the warranty is only good while the RFID tag is still functional).
3. Barcodes identity a type of product. RFID identifies a specific instance of a product. If two pairs of jeans from the same manufacturer, in the same size, color, etc have RFID, they will each have a different identifier. That will hold true for all products throughout the world.
4. Since every single instance of a product has a unique identifier, the identifier can be tied to a person.
5. RFID can be used to record someone's presence every time they walk through a door, past a counter, or board the subway.
6. One of the big selling points for RFID is that it allows a merchant to detect when unpurchased goods are walking out the door. To accomplish that, retailers will place RFID readers at every entrance and exit to their building. At this point it will essentially nothing for retailers to record every RFID that walks through the door. Companies like ChoicePoint will pay for that data.

When you look at the privacy implications, there is no comparison between barcodes and RFID. Barcodes are basically useless for tracking someone. Whereas RFID can uniquely identify you.

Re:Another Fine example of Slashdot "journalism"

[pipingguy]

...[people are]...rarely prosecuted for this provided the dollar amounts are small.

Doesn't this fit into the spam/sucker theory? I.E., "as a spammer (I am not one), I am only inconveniencing/annoying one person for a nanosecond of their time, so that's OK ethically".

[This reminds me of recently-received, since-deleted junk mail that exclaims "not ethically or morally wrong" in the subject line. If the unsolicited email message has to be prefaced with such a statement, well...]

Why not?

[Anonymous Coward]

The Magstripe on my card is constantly wearing out. so I think this is a good use of technology.

I would hope they sufficiently range-limit the devices, and send a security pamphlet along with the card recommending a foil-lined wallet. Even if the cryptography is sound (How do we know without peer review?) preventing access to the device is the first line of defense.

Making Fraud easy and fun!

[kbonapart]

So, when Wal-Mart incorporates this technology, can I just have the bag containing the stolen card near the reader to purchase my illicit goods? And *IF* I am questioned about it, I can say that I didn't know it was in there, and I thought it was going to read my REAL card.

Also, does this mean that around the holidays in the mall, I wont have to hand the card over along with my driver's liscence?

"No, you don't need my ID, maam. Don't you know those cards can't be faked? It's completely secure. Yeah, I heard about it on the news, too. Never need to see my ID again. Compleltly safe. Don't forget to put that $1,235.65 on "credit". okay?"

And while the article says there is a code that can't be re-used for other readers, wont a signal jumper (the ones used to grab car alarm frequencies) still be able to get the 16 digit card number, plus exp. date?

Yeah, sending important financial data through the air sounds like a great idea. To the tech savvy, this is the same as screaming the numbers to the woman behind the register. Would you do that?

Re:Making Fraud easy and fun!

[swillden]

Also, does this mean that around the holidays in the mall, I wont have to hand the card over along with my driver's liscence? "No, you don't need my ID, maam. Don't you know those cards can't be faked? It's completely secure."

No, it doesn't mean that. The ID isn't to make sure the card isn't faked (how could it?), it's to make sure that your name is on the card. Other technology is used to make sure the card isn't faked -- and it's fairly weak technology.

These new cards will be very, very difficult to fake, but you'll still have to have some way to prove that the card is, in fact, yours. I like PINs, but the US banks don't seem to be moving that direction, so you'll probably still have to show ID.

Re:Making Fraud easy and fun!

[kbonapart]

I'm not suggesting the card is impossible to fake, I'm suggesting that you suggest to the woman that it can't be faked.

Same way you scam people when a new bill comes out.
"This don't look like a fifty."
"Oh, I said that too, but I got them from the bank. Remember that story on the news about the new impossible to fake fifty? Looks like monopoly money to me, but..."
"Yeahs, I saw that there story. Crazy government, changin' the moneies. It's the liberal's fault."
"It sure is. Can I have change back in small bills? Thanks."

Zonk is the Games section editor

[John Harrison]

and something tells me that Zonk should stick to games and stay off the front page. This is classic FUD.

Re:Zonk is the Games section editor

[John Harrison]

Zonk,

Thanks for the edit! Too bad it came so late. Maybe the Slashdot editors should get some education on the subject of smart cards and RFID. This happens ALL THE TIME, and 50% of the articles that claim to be about RFID are not.

So this saves what, exactly?

[Anonymous Coward]

Tired of having to swipe and sign every time you use a credit card?

I haven't signed for a purchase in a long time, except once in a restaurant. Everything is chip and pin now. You can just stick your card in the reader, enter your pin, and be done. Something you have and something you know, at least it is two items of security.

Surely this contactless card will simply turn it to something you have being a requirement, making trivial theft very profitable.

Are Americans so lazy that they can't hand over the card to the cashier to swipe/insert into the chip reader?

Is this technology really necessary?!

[William_Lee]

All this looks like to me is credit card companies trying to generate a new revenue stream by getting existing merchants to pony up for the new technology required to use this system.

Is it really so hard to swipe your card through a reader as you checkout? Does Visa really think people are so lazy that swiping a card is too much work?

This is an example of technology being used simply because it exists. This adds ZERO value for the consumer and opens up huge security holes. Who believes for one second that this technology is actually 100% secure?

I guess we're supposed to be reassured by the quote from the Visa rep in the article reminding us that there is no consumer liability for fraud.

I can only imagine what is going to happen if they roll out debit/checkcards linked to actual bank accounts with this technology!

Re:Is this technology really necessary?!

[jacquesm]

what they forget to mention is that visa ALSO is usually not liable for fraud, they try everything they can to push it down the chain assuming they are never to blame. So, in cases of ID theft where visa could have known of this being the case based on weird purchase patterns they happily push the burden on to the merchant, who really has NO other way to figure out if a card is legit other than calling visa and getting an OK. Then 6 weeks later they have to pay it back or lose their merchant accounts... Especially in card not present situations this will happen easily enough (see my post above).

Re:Is this technology really necessary?!

[drinkypoo]

Magstrips are, while fairly reliable, not as reliable as RFID or a smart card. However I do not see any benefit to using this over using a smartcard. At least then you don't have the wireless problem.

Re:Is this technology really necessary?!

[John Harrison]

I work in the industry. I would be interested in knowing what your knowledge of it is. Visa is doing this to reduce fraud. If there are security holes they are small compared to the holes in the current magstripe system.

Visa isn't making money because of the infrastructure change, in fact they are investing. Companies such as ViVOtech are going to sell a lot of readers. Visa's motivation is to reduce fraud. They will save billions with this technology. If this weren't orders of magnitude more secure they wouldn't use it.

Re:Is this technology really necessary?!

[doorknobslayer]

This is an example of technology being used simply because it exists. This adds ZERO value for the consumer...

I have to disagree.

While it may not be the same technology, my campus switched from standard swipe cards to proximity-read cards for basically all their secure access things. Getting into my dorm was done with prox. cards, as was getting into the parking lots and campus buildings after hours.

It was *really* nice to only have to wave my wallet at the reader (or heck, with the wallet in the back pocket, jump up and slam my ass into it) to get in. When getting into the parking lot, sliding the card was always a pain (roll down window, make sure you're close enough, etc, etc). The reader they had there was large enough that, most times, I wouldn't even have to open the car window to get into the parking lot!

I have to testify that it does add value, and that laziness counts for a lot when delivering to consumers (e.g., remote controls, virtually all kitchen appliances, etc).

Now, if it's a good idea for things like bank accounts... I dunno.

Re:Is this technology really necessary?!

[Anonymous Coward]

Is it really so hard to swipe your card through a reader as you checkout? Does Visa really think people are so lazy that swiping a card is too much work?

Having worked in retail for many years now, I can tell you that there is a distinct advantage in doing away with modern card readers. To begin with, those magnetic strips on the back are not terribly durable. The number of dead cards we get in a given day is simply staggering. Each of those cards has to be run through manually, and then an impression made - all of which takes significantly longer than simply swiping the thing. Even if the strip itself isn't dead, grime accumulation can cause its own problems. We've got hundreds of people using these card readers in a given day, and grime builds up in them. We have to clean the readers about once a week, otherwise we start to get errors. Sure, the cleaners are only a few cents each...but it is wasted time and money nonetheless.

A contactless card would eliminate the grime buildup at the very least. It would probably also be somewhat more difficult to damage the electronics inside the card than it is to damage the stripe we've got now. I'm quite certain that a contactless design would, over time, save retailers quite a bit of time and money.

Re:Is this technology really necessary?!

[Richthofen80]

Who believes for one second that this technology is actually 100% secure?

The people at Visa.

Re:Is this technology really necessary?!

[Anonymous Coward]

Swipe isn't hard dude, its a speed thing - it's (so far) a much faster transaction - consumer gets out of line quicker (shorter lines == happy consumer, more throughput == happy merchant). In the MasterCard trials, consumers loved it just for speed/convenience. Maybe that's only a slight value... but for many people thats enough, and all those $25 purchases add up to a lot of air-miles over time. Oh sorry, I hoped for informed opinions on /.

Re:Is this technology really necessary?!

[John Harrison]

Actually Visa doesn't care if it is 100% secure. They want it to be more secure than the current mag stripe so that fraud drops. They also want it to appeal to consumers so that they use it more frequently. It needs to be quick and easy. It is a cash replacement strategy.

Re:Is this technology really necessary?!

[Anonymous Coward]

think about a cashless society. then think about "666". now think, how do you get from one to the other without getting people upset or afraid?

Obligatory....

[Anonymous Coward]

In Soviet Russia, credit cards wave you!

Re:Obligatory....

[Kredal]

In Korea, only old people swipe credit cards.

Re:Obligatory....

[Anonymous Coward]

I for one welcome our credit card waving overlords.

Dont even need to take the guys wallet anymore

[GatesGhost]

once someone figures out how to bypass the code, all they need to do is walk by you to steal your card. and besides, how lazy do you have to be not to take out your card and swipe it? seriously: 1) take card out 2) swipe. wow, that was so hard, i need to create an elaborate method so that i dont even need to move my fat ass anymore.

YES!

[Laurentiu]

Witness the return of the tinfoil wallets!

Fortunately I already had them patented. [insert maniacal laughter here]

theft

[SpongeBobLinuxPants]

So now instead of someone having to take my wallet to steal my credit card they can just walk by me with a contactless reader?

Re:theft

[BloodSprite]

Even better.

Wear a T-shirt saying "pencil $19.95", "ask for a refund if not satisfied" and walk around in a crowd handing out pencils whenever your battery powered and cellphone internet accessed credit processing system successfuly charges someones credit card for "pencil" at $19.95 bucks.

"Thank you, Here's your pencil sir"

they look at you funny and take your pencil cause your some crazy guy wearing a backpack with antennas sticking out all over and a tin foil hat and they don't want to mess with you.

You sold them a pencil, what crime was commited?

They can ask for a refund if not satisfied...

Re:theft

[lgw]

The card isn't just sending a CC# over the air. If Visa did it properly, the merchant won't even know the CC# until the transation acceptance comes back from Visa (or perhaps even then, the merchant really only needs a hash).

Lazy bastards

[Leroy_Brown242]

RFID and Visa, for when it's too much effort to slide your card, you can just wave it around!

Re:Lazy bastards

[Anita Coney]

This is just the first step. You've probably seen the IBM ads where we pick the stuff we want and simply walk out of the store. We never even have to stop and check out. That's the final step.

Visa has to get the first step to work well, and people used to it, before they move any furhter.

Better watch those monthly statements!

[AFCArchvile]

"Security is a question," Gillespie said. "How easy is it for someone to interact with a wireless communication and pick up a number?"

Hopefully not as easy as stopping payment on questionable charges to the account. The advantage of online progressively-updated statements becomes infinitely greater here; you'll have to check your statements every WEEK if it gets bad. Genuine cowhide is out, 100 mil thick aluminum is in!

Re:Better watch those monthly statements!

[Anonymous Coward]

If it's a credit card you should be ok as long as your credit limit doesn't get hit and you don't have an alternate credit card to use instead.

If it's a debit card you could be in trouble even if you catch it early. There's a really simple solution to debit card exposure but banks are unspeakably stupid with regards to technology and would rather stick it to their customers than make the least effort to protect them.

Re:Better watch those monthly statements!

[Anonymous Coward]

There's a really simple solution to debit card exposure but banks are unspeakably stupid with regards to technology and would rather stick it to their customers than make the least effort to protect them.

They're not only 'sticking' it to us, they're making money off of it.

wave the reader?

[sql_noob]

what if someone wave a reader a few inches behind my butt?

What's the point?

[Lemuel]

Why do I need a contactless transaction? What is so hard about running my card through the slot in the terminal?

Re:What's the point?

[Anonymous Coward]

Average Americans don't like doing that much exercise. Hell, next you'll make us get out of our cars to buy lunch, and that can only lead to socialism...

Re:What's the point?

[Anonymous Coward]

Personally, my cards get scuffed up from stacking and sliding in my wallet, and over a few months time work less and less. I would love not having to deal with sliding my card at varying speeds, or wrapping the card in a plastic bag first.

Signatures? How quaint...

[vidarh]

When I first moved to the UK from Norway five years ago, the first thing that annoyed the hell out of me was having to sign when I used my cards instead of just entering a PIN. Now signatures are rapidly being phased out here as well. I'd happily get rid of having to insert my card in the reader, as long as the PIN is still required.

Re:Signatures? How quaint...

[Tony Hoyle]

I prefer signatures... luckily none of my cards are PIN cards (they can't force you to use them, it's part of the legislation).

It's a hell of a lot easier for a criminal to forge a PIN than a signature - especially given the total lack of security on the card machines.. anyone within about 20 feet could find out your pin every time you use it.

Plus there's the little change in the law that means that if someone forges your PIN you are now 100% liable not the credit card companies (which is the real reason why they changed).

Re:Signatures? How quaint...

[BenjyD]

It's not that easy to see someone typing a PIN: just don't type the PIN with one finger, place your fingers on the keypad like you would with a computer keyboard and press the keys down gently.

It's certainly far more secure than signatures.

Re:Signatures? How quaint...

[xlv]

It's a hell of a lot easier for a criminal to forge a PIN than a signature

I don't agree with that. Except for a dumb criminal (and there are lots of those), nothing prevents you from practicing until you get the signature right.

If you lose your card, the person finding it has everything needed to make a purchase (card and signature). If it's pin based, the criminal has to make the effort of shoulder surfing to get the PIN. So it's not a crime of opportunity any longer...

Excuse me, sir...

[Colonel Panic]

Scammer: "Could you step over here and read this number for me, I need to get new glasses or something."
Unsuspecting stooge: "sure, your total is .... Yeah this is tiny print..."
Scammer: "maybe you can read it from a little closer"
Unsuspecting stooge: "...$598. And it looks like your credit card was just approved too."
Scammer: "Oh, thanks you very much."
Unsuspecting stooge: "You're welcome"

The Exact Moment...

[PseudoSchizo]

3DES is cracked. ;)

Tracking down criminals

[FuzzyDaddy]

My wife once had a charge for ~$600 appear on her card. It turns out a worker who had been in our house (don't know which one) got the card and ordered a bunch of bulk food. It was shipped to an address. For $600, no one (police, credit card company) was willing to investigate it to the point of actually checking out that address and seeing if someone lived there who worked in my house. The shipping company had the address but wouldn't give it to me.

Tracking down online transactions isn't necessarily so trivial or likely to happen.

Re:Tracking down criminals

[BenjyD]

This happened to me too - I had £400 (that's like $2000 or something these days, right ;) ) charged to my debit card for "Guard dog and security guard hire". One phone call to the bank and I had the money back within the week, subject to investigation.

Re:Tracking down criminals

[Ansonmont]

Actually it is even worse than that. I worked at an online computer vendor, and sometimes we would get defrauded. Even with the contact info, the address, etc. the police/FBI/Customes etc agents simply did not have the time to look into these things. We are talking up to $50K that they would not look into.

If there was no signature and physical presence then the merchant is out of luck. The customer doesn't pay, the credit card company doesn't pay, it is the merchant who pays.

However, one time a fraud tried to do it again, so we sent the police with the delivery person. That was stupid.

Re:Tracking down criminals

[ThaReetLad]

We have several advantages in the UK like consumer protection law and the data protection act. Mostly, if we report suspected card fraud promptly the CC provider will pay you back, and if they won't then the delivery address would be obtainable via a data protection act enquiry. Americans don't have that kind of protection, which they really need. I spotted a story (I think it was Wired) where some information broker SOLD personal information to identity theives. I don't think that kind of information trading is allowed in the UK and the rest of the EU without explicit customer authorisation. What we REALLY need is a law which makes selling personal information totally illegal, thus rendering databases of email addresses, SS numbers, credit details, purchasing habits etc, worthless,

Re:Tracking down criminals

[drinkypoo]

First of all, information brokers sell information to identity thieves every day. The only difference here was the scale of the information theft and the fact that they caught them. The person who got the information was probably entitled to use the service, but you are not supposed to look up anything not directly related to a business issue, and they track your usage just in case allegations are ever presented against them because of you. The information is typically used by debt collectors.

Re:Tracking down criminals

[Ucklak]

It's happened to me as well but that's what you pay insurance for.

Signatures

[Malc]

"And for purchases of less than $25, no signature is required."

Does anybody in N. America check signatures? They hardly seem to look at my cards. I have a friend who wrote "See ID" on the signature strip of their card and it took four months before she had a request. Having emmigrated from the UK, I really notice this. Over there they seem to make more of an effort, hold on to the card for longer and really compare it against the signed receipt. On many occasions in the UK I've been asked to resign things. In fact, I was once chastised by a cashier in Sainsburys in Norwich and told to stop being so lazy and make more of an effort! You see my signature had deteriorated in to a squiggly line that barely even resembled the signature on the card.

Besides, doesn't anybody else find those signature strips hard to sign? They don't have much height, and the surface seems to "writes differently". It's nigh on impossible to put a good approximation of my signature on it! Furthermore, I think the only way to tell a signature isn't faked is because every one is different so it shouldn't be identical to the one on the card! ;)

Re:Signatures

[melandy]

Does anybody in N. America check signatures?

Target does (at least in Indiana - USA, they do). One time in particular, I signed a little sloppy, and they asked for photo id because the sigs didn't match (normal on the back of the card, sloppy on the terminal).

But your observation is very astute. Target is the only retailer that I recall even *looking* at the back of the card.

Re:Signatures

[jcuervo]

Does anybody in N. America check signatures?

Y'know, the only time that actually happened to me was at BofA, years ago. My signature actually changed, and they said "could you please sign it again, like you used to?". Took me three or four tries.

Nowadays, I just sign it "Johnny was here" (generic), "Johnny got paid" (paycheck)", "Johnny hates you" (bills), etcetera. Sometimes just "Johnny", if I'm feeling lazy.

I've actually managed to get away signing with "X" sometimes. Probably something to do with the fact my face is on my BofA Visa debit card.

Re:Signatures

[Blakey Rat]

I don't know if I buy stories like this. You hear it all the time. So I tried it. I wrote "SEE ID" with a Sharpie pen on the back of my VISA card. The result? EVERY RETAILER asked for my ID when accepting the card. EVERY ONE over a period of 2 years asked for it. (Note, however, that restaurants do not, which is kind of scary.) I don't know if this is because Washington is better than other states, or if I shop at different stores than these people, but 4 months without any retailer asking? I just don't buy it.

Re:Signatures

[lgw]

I've noticed only new cashiers do this at Target. I suspect the get tired of it after a while.

It probably will reduce fraud

[Anonymous Coward]

Given that it is dead easy to forge a credit card now this probably will be better.

My newspaper still reports cases where an unscrupulous employee at a gas bar or cafe swipes your card twice; once for the transaction and once in his own reader to steal your number. Apparently there are still places where you can buy thousands of credit card numbers. This has to be better.

The 'encoding' scheme reminds me of a chip sold by the people who make the PIC (Microchip). I think it is called KeeLoq or something like that. It sends a different code every time it is used. I haven't heard that it has been seriously compromised.

Anything can be stolen and I'm sure we can all think up a way to get all the gold from Fort Knox but at some point the hassle involved keeps it from happening. Remember; locks are for honest people. (but we still use them because it makes life inconvenient for the crooks.)

Give them a few hours,

[Eternally optimistic]

It will be presented better in the dupe later today.

Re:Give them a few hours,

[Anonymous Coward]

Later, it will be presented as a dupe.

Vent my Credit Card/Check Card Pet Peeve

[Confessed Geek]

Please excuse me while I get this personal pet peeve off my chest.

WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?

I Don't sign my cards. I write in bold letters on the back MUST SEE ID. Still only about 1 in 20 times am I asked for an ID, even when makeing a $50+ purchase.

And the debit cards. The advertising on them is insane. They have some celebrity come out and get asked for ID then say - "With our Check Card, you Never need ID" And how is this supposed to be a good thing? I'm supposed to be happy that it is even easier for someone who has stolen a card to go and clear out my checking account? Who the heck goes out with their credit cards, but skips their ID? Who the heck runs around without an ID in the first place? What, your going to go into your wallet or purse, take out the debit card, and leave your licence/ID in there?

With all the credit card fraud and identity theft gong on, why would anyone make it even easier to ruin your credit rating and entangle you in hours upon hours of sometimes futile effort to get it set straight?

Mind you I will screem like hell if somebody REQUIRES me to carry an ID all the time - but cash spends fine without any verification.

Thanks.

Re:Vent my Credit Card/Check Card Pet Peeve

[graphicsguy]

Why not get a credit card with your photo on it?

Re:Vent my Credit Card/Check Card Pet Peeve

[cowscows]

A few years back I was working retail at a store where the manager told us to require ID for all credit card purchases. Some people would get so upset about it. I don't know if it was because they believed that we were accusing them of being dishonest, or if they were just lazy.

There's plenty to be said about not treating your customers like criminals (DRM, copy-protection), but it seems to me that, as a consumer, I have just as much to gain from protecting my credit card as a business does.

Interestingly enough, I've heard that part of some contracts that retail outlets and credit card companies make nowadays specifcally state that the credit card companies do not want you to check ID's. Apparently they want credit cards to be as convenient as possible so that consumers will ring up as much debt as possible, so the banks can collect interest and fees. I guess if that's true, the ratio of fraud to legit purposes isn't so bad.

I've got see-ID on the back of my cards too. Sometimes they'll flip the card over and pretend to look at it, then give it back without asking for ID. Amazing. If they do ask for ID, I make it a point to thank them.

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

Nobody looks at id. Nobody looks at signatures. My wife and I have a joint checking account. I lost my visa debit card recently, and had it cancelled, but haven't gotten the new one in the mail yet. So I borrowed my wife's card to buy some gas. I gave them her card, with her name on it, and her signature. When they gave me the slip to sign, I didn't forge her name - I signed my own name. I could have signed it: The Underpants Gnome and they wouldn't have cared. With the gas already in my tank they didn't want to have to deal with the prospect that I might not have an alternate meanse of paying and all the hassle that would entail for them. Better to just say: Oops.

I have used other people's credit cards to buy gas lots of times. ( with their permission ) Of course anyone could get away with it at an outdoor swipe and pump but if you go inside, you can get chips, beer and soda too.

I am more careful with debit cards than with credit cards anyway. I figure, I'll risk the 50 dollar max liability for charges against a credit card for the convenience of disregarding security completely. Although the same 50 dollar liability max exists for my debit card, they have MY money in that case and I have to wait for a fraud investigation to get it back. I can just choose not to pay the credit card company till they decide it was a fraudulent purchase.

Some credit cards advertise that they even waive the $50 in case of lost or stolen card fraud. In that case I would actually be rooting for the thief over the credit card company.

Re:Vent my Credit Card/Check Card Pet Peeve

[duffbeer703]

I Don't sign my cards. I write in bold letters on the back MUST SEE ID. Still only about 1 in 20 times am I asked for an ID, even when makeing a $50+ purchase.

You're an idiot. That signature panel is not there to identify you to the store clerk. Its there to prove that you have agreed to abide the provisions of the cardmember agreement. (ie pay your bill) Merchants are actually permitted to confiscate your card (which is the property of the issuing bank) if you refuse to sign it.

The purpose of checking your signature is to cover the merchant. If you don't sign your card the merchant is liable if you refuse to pay

PIN-based electronic transactions are actually considered digital signatures. The fact that you set or remembered your PIN signals your acceptance of the card agreement, and entering your PIN signs your transaction. Merchants prefer that you do a PIN transaction because it is cheaper and does not require them to store boxes of signed credit card drafts in the back for a year or more.

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

You don't think id can be forged?

Re:Vent my Credit Card/Check Card Pet Peeve

[EmagGeek]

I had one of those cards a while ago... I glued a picture of Chris Rock on the front of it, and not ONCE was I ever questioned (even though I'm a white guy)...

I work part time in retail and our store used to have a policy about asking for ID with every CC purchase, but Visa threatened to pull out of our store because of it...

The CC companies and orgs do not want under any circumstances for retailers to ask for ID, even if the card is not signed. They are also against any and all PIN initiatives, or any other thing that might prevent credit cards from being used.

Even if there is a fraudulent charge, the only people that lose money are consumers. Retailers and Credit Card companies have insurance against fraudulent charges, and the cost of those premiums is worked into the merchant rate, which is passed along to consumers.

This is why CC companies and retailers DON'T CARE ONE BIT if a CC is stolen. If the retailer gets charged back, they just claim on their insurance, and pass the premium costs along to the consumer. If the chargeback is denied and the CC has to write it off, they claim _their_ insurance and pass the cost along to merchants, who then pass it along to consumers. If the thief gets away with it, the consumer is stuck with the bill for the fraudulent charge.

So, in any case, it's the consumers that are screwed, as usual.

Re:Vent my Credit Card/Check Card Pet Peeve

[lamber45]

And the debit cards. The advertising on them is insane. They have some celebrity come out and get asked for ID then say - "With our Check Card, you Never need ID" And how is this supposed to be a good thing? I'm supposed to be happy that it is even easier for someone who has stolen a card to go and clear out my checking account?

I wonder if Visa is doing things like this to make the merchants happy -- after all, those are their actual customers (although consumers are the banks' customers, which may be why no bank wants to issue these cards.) Consider how checkout with a credit card is supposed to work now:

1. Comsumer approaches checkout with one or more items;
2. Cashier scans them;
3. Cashier states total;
4. Consumer hands card to cashier (who scans it), or scans it himself;
5. There may be a wait of a few seconds while the transaction is approved;
6. A sales slip is printed, and consumer signs it; OR an electronic screen is presented, which consumer is suppposed to sign;
7. (Apparently, only if the purchase amount is over some minimum) Cashier verifies that the signatures match;
8. If card says "see ID", Cashier requests ID;
9. Consumer presents ID, which cashier verifies;
10. Cashier hands card(s) back to customer, with reciept; customer mak now walk out with the goods.

I think Visa wants merchants to think about how they could make the process less labour-intensive; for instance, this could be combined with RFID on items as follows:

1. Customer picks up goods;
2. Customer walks out of store;
3. Profit!!!

(Customer recieves a charge on a random one of her several wireless-chip-based cards; that is her only reciept.)

This might be especially popular for souvenir shops at special events; I recently worked on the cleaning-crew for one, and they were doing several things to maximize customer flow, like putting the entrance and exit at opposite sides of the store, and pricing everything in whole dollars with sales tax included (to the sales personnel wouldn't have to make change). A bar might use this system to collect their cover-charge, too. As for myself, I stay away from such places.

Re:Vent my Credit Card/Check Card Pet Peeve

[Exocet]

I, too, have "SEE ID" written on the back. Whenever someone asks for my ID, I sincerely thank them for asking to see it.

I have ran into people who, after being thanked, gush about how other people have gotten really pissed when they were asked to show ID. Even when it said "SEE ID" on their card! This is the height of stupidity.

Sometimes I pull out my card and ID at the same time. Most of the time they don't bother looking at the ID. Never really understood that, seeing as how businesses take it in the ass when credit card fraud happens ...but get really pissy about someone being two minutes late or something that impacts profit at a miniscule level.

Re:Vent my Credit Card/Check Card Pet Peeve

[carcajou]

I like my bank card...it has my picture on it, in color. I was very suprised at the number of cashiers who actually look at the picture and compare it to me. This works well...my signature is not very good on the card, and after a couple of years in my wallet, it is worn away in places. I have run into some cashiers in places like Wal-Mart that were completely incapable of comparing signatures; I had to call a manager.
My major concern with these cards is not someone stealing money from it; rather when Wal-Mart gets their RFID system in place they will start flashing an LED under a product at me...now they can scan this card in my wallet and know who I am when I walk in the door...they cannot get money without a PIN or something, but they will be able to track me all over the store, offering me things to buy based on previous purchases...that would be an annoyance.

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

A few years back I was working retail at a store where the manager told us to require ID for all credit card purchases. Some people would get so upset about it. I don't know if it was because they believed that we were accusing them of being dishonest, or if they were just lazy.

I only get upset when some people's IDs are checked and other's aren't. I get even more upset when I'm told they check everyone's ID, but I can see they aren't. I've been checked for complaining and have black friends who are the only ones in line being carded.

So, you can see why some people get angry. Very angry. At places where they check all the time, I hand my ID over with my CC. I only get mad when it's clear I'm being singled out.

Re:Vent my Credit Card/Check Card Pet Peeve

[AK Marc]

Merchants are actually permitted to confiscate your card (which is the property of the issuing bank) if you refuse to sign it.

No, they are not. You further listed Mastercard rules, and it permits (or requires) that they refuse sales in certain circumstances. It does not state that they are allowed to confiscate cards for not being signed. I don't have a full agreement with me (or the hours necessary to read it), but the cards themselves do not identify themselves as the property of the bank.

And, if you were familiar with signature law (yes, there is a suprisingly large amount of law regarding signatures), "See ID" could be considered a signature. That would be a legal issue not fully explored by the courts, so it is pointless to guess what the outcome would officially be (other than my poining out that it is a possibility).

Re:Vent my Credit Card/Check Card Pet Peeve

[AK Marc]

"With our Check Card, you Never need ID" And how is this supposed to be a good thing?

It saves me time. I'm responsible for $0 if there is fraud. Aside from possible hassle (but no monetary loss) in the event of fraud, how is this supposed to be a bad thing? Fraud is kept down because you have to not only get the card, but the PIN as well. If you give anyone your PIN, it is your fault.

No, if you want to bring up a good pet peeve, stick to the people that say "PIN number."

Re:Vent my Credit Card/Check Card Pet Peeve

[rw2]

The CC companies and orgs do not want under any circumstances for retailers to ask for ID, even if the card is not signed.

Not quite right. You are absolutely correct in that the merchant isn't to ask for ID on the basis of a CC sale (they are, of course) allowed to ask for sales which require ID for other reasons (e.g. liquor, porn). However, when a card is not signed then the merchant is to ask for ID and then request that the customer sign the card.

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?

Why? In a free country, you are not asked for ID to buy bread.

Given the extent to which merchants will sell all of your info to any idiot with a few dollars, the only solution is to not give them the info in the first place.

If the store wants your id, they will take down all the info. And sell it.

That's why identity theft is so easy.

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

If the thief gets away with it, the consumer is stuck with the bill for the fraudulent charge.

No. Go read the fine print. Your maximum liability from a stolen credit card is $50. And even then, most banks will waive that.

Re:Vent my Credit Card/Check Card Pet Peeve

[EmagGeek]

We did that for a while until someone from Visa came in and read us the riot act. A customer had complained about being asked for ID and to sign her card. She raised hell about how she shouldn't have to sign her card blah blah blah. We had denied the sale because she wouldn't. We were told on no uncertain terms that we were not to deny visa sales unless the swipe came back declined. Period. We were told that it was not our job to enforce credit card rules or to make our own judgement call about whether the person presenting the card was the actual authorized user of that card. They were very clear about the issue.

Re:Vent my Credit Card/Check Card Pet Peeve

[EmagGeek]

There are circumstances under which you can be stuck with the charge. Go read the fine print. The special rule for credit card purchases only applies to purchases made in your home state, or out of state within X miles of your billing address, unless your credit card issuer solicited the sale.

Also, if you don't notice a charge on your statement, and don't report it within the required time, you are also stuck with the bill. People who use their CCs for everything can often have a hundred charges on every statement, and if the thief only uses it once or twice for something small, it's very likely it will go unnoticed.

Re:Vent my Credit Card/Check Card Pet Peeve

[Random832]

I thought it was the signature on the charge-slip that proves you agreed, and the one on the back of the card proves your identity

what's the point of making you sign the receipt [and/or touchscreen] if your signature on the card already proves you agreed?

Re:Vent my Credit Card/Check Card Pet Peeve

[SlayerofGods]

The one on the card means you agree to the account agreement.
The one on the receipt is to prove you agree to that transaction.
If the merchant doesn't have a copy of the receipt with your signature on it you can claim you never authorized them to charge you that amount.
Think of it is a minicontract.

Re:Vent my Credit Card/Check Card Pet Peeve

[radish]

If a store asks me for ID I will never shop there again. I dont carry ID with me all the time, and I don't want to. I'm not a criminal and I resent being made to feel like one to buy something.

So what if someone does steal my card? It's not my liability (assuming I report it stolen). It's SUCH a non-issue.

Re:Vent my Credit Card/Check Card Pet Peeve

[Belgand]

I agree entirely. There are a number of stores (Chipotle, Quiznos) that don't require me to sign my receipts and it really bugs me. Not quite as much as the ones where I have to twist their arm to get my copy, but I still dislike the idea of not having a printed copy somewhere stating that I authorized the purchase. The signature has never seemed to be as much about security and signature comparison as it has about disclosure. My signature is there as proof that I read the bill and the authorized charges and that I agreed to them. Thus preventing an unscrupulous (or merely careless) merchant from overcharging me. In this manner it's more like a contract and something I don't want to see go away. I suspect that other people such as myself who actually read the full text of any legally binding agreement (ok, ok software EULAs are the exception).

As for signing of cards I worked in retail while in college and was scrupulous about checking cards. I think I had one or two grumbles, but nobody ever got upset (the trick, I believe, is to be nice and state that you're doing this for their security). The people who specifically wrote "See ID" or left it intentionally unsigned were always most appreciative.

Convenience is all well and good, but a few simple steps towards greater security are almost always a good idea.

Re:Vent my Credit Card/Check Card Pet Peeve

[DirePickle]

I work retail. I usually ask customers for ID when they don't have the card signed, and especially when they write "see ID" or the equivalent on it. And... tons of people with un-signed cards get really peeved. Some say, "Oh, thanks for checking," but many others kvetch and complain and leave angrily.

Sure, they could all just be thieves... but there would be a lot of innocent-looking middle-aged mothers out there stealing credit cards, then.

Re:Vent my Credit Card/Check Card Pet Peeve

[Velocity44]

You know, legally, as in the credit card contract that YOU signed, you can't do that.

Your signature on the back of the card is meant to match what's on your driver's license, or valid ID. Nothing else. "See ID" is not okay!

I used to work at Nordstrom, where we DO check the signatures, we DO ask for ID (When it says See ID, even though....), but yet we DO offer good customer service. I've had several customers thank me for checking their ID, and only one REALLY freak out (she was crazy anyway).

Also, the under $25 is in action right now. California state law says that you don't need to sign for transactions under $25 (or maybe $20, I'm unsure). I learnt this while I was working at Starbucks, and you should notice that they rarely ask you for your signature.

Personally, I like the touchless system - On the london underground they have something similar, called Oyster, (www.oystercard.com) which works just fine, is pre pay, and honestly, because I rarely have to even take it out of my wallet, I am faster through the gates, don't have to buy a ticket, don't use any paper, can't lose the ticket (without losing my wallet at least) and use the underground easier, since I never have to worry about having change.

The cryptography will keep it secure, merchant IDs will prosecute phishers, and still Credit Card companies will protect you from fraud.

What are you all worried about?

Re:Vent my Credit Card/Check Card Pet Peeve

[SydShamino]

>> I've got see-ID on the back of my cards too. Sometimes they'll flip the card over and pretend to look at it, then give it back without asking for ID. Amazing.

Funny. My primary MasterCard check card was issued to me in 2000, and won't expire until late next year. After years of daily use (I rarely carry cash), there are a few chunks missing from the magnetic strip, and the bottom left corner has a 1/2 inch crack. More importantly, swipes through too many bad card readers has completely destroyed the signature box. Underneath where my signature used to be, under the writeable stuff, appears the word "VOID" repeatedly. That's all mine says: "VOID VOID VOID VOID VOID VOID VOID".

Like you, sometimes they'll flip the card over and pretend to look at it, then they'll give it back without asking for ID. Hehe.

My bank changed names two years ago, and let anyone get a free new card who wanted one. But, as long as this one still works, why bother?

Re:Vent my Credit Card/Check Card Pet Peeve

[thebatlab]

I can't tell if that's serious or sarcastic. Well done!

Re:Vent my Credit Card/Check Card Pet Peeve

[Anonymous Coward]

how do you get people duped enough so they wont be afraid or upset at a cashless society? how do you get people used to the idea of being tracked and monitered financially or actual physical location?
how do you combine the two (cashless+tracking) to become a part of a global system? what laws and treaties would you need to "protect" the system and remove any and all who would appose it or try to flee from it? what would you call such a plan so large and intrusive on a global scale? answer=
"666"......

Re:Vent my Credit Card/Check Card Pet Peeve

[ukyoCE]

Actually, you are completely 100% wrong. And rude too, calling someone an idiot, when you don't even know what you're talking about.

The credit card company is never going to see whether you signed the card or not. It wouldn't make any sense for that signature to be there for your credit card company.

Have you ever noticed that you sign a receipt for a credit card? Credit cards are NOT pin-based transactions. Your signature is your PIN in this case. What merchants are SUPPOSED to do, is check your signature when you sign the receipt, against your signature on the back of your credit card. If they match, then you are the rightful owner of that credit card. If they don't match, well, you're not going to leave with any merchandise.

I worked at a bank, and had to check signatures all the time for the same reason.

Credit cards are NOT the same transactions as debit cards.

Debit card verification == PIN
Credit card verification == SIGNATURE

Re:Vent my Credit Card/Check Card Pet Peeve

[ukyoCE]

Oh, and as for "not valid unless signed", that's really just warning you:

A) If you don't sign this, merchants can refuse to accept it
B) If you don't sign this (or write SEE ID), then any thief can sign the back of it, and then go around buying things, and have their receipt signature match the signature on the back of their card.

My school's bookstore always checked signatures, possibly because of how big most book purchases are ($300+). But it is pretty rare that merchants actually check the signature like they're supposed to :\

Are you guys anti-barcode?

[oliverthered]

Well, if their printing on my forehead then yes.

RFID isn't far of tagging everyone who walks into your shop. I'm also anti-creditcard, but I suppose if you die in debit then you've made money.

Re:Are you guys anti-barcode?

[Quiet_Desperation]

I'm also anti-creditcard, but I suppose if you die in debit then you've made money.

Whatever. I just pay it off completely each month, and use the card as a way to speed up purchases over $20. I want to throw these people writing their friggin' checks through the window of the store sometimes. There's always SOME irregularity with their precious check that holds everything up.

"Oh, let me write another one with more so I can get some cash."

(It's a grocery store, not a freaking bank, you blithering hag!) I think to myself. (There's an ATM right by the door. Waste your own time, not mine!)

"Oh, and a pack of Marlboro Extra Tar Unfiltered!"

(Tar made turn Superman evil, you crusty whore! Don't you read?) I think to myself.

"Oh, my pen is out of ink!"

(Arrrggghhhh! Exterminate! Exterminate!)

Re:Are you guys anti-barcode?

[oliverthered]

have you never seen a Debit card? it's just like a credit card without the 'credit' bit, maybe they never made it in the US?

Re:Are you guys anti-barcode?

[Quiet_Desperation]

Of course. I use my ATM card as a debit card at the grocery store, and more places are taking them at the little swiper. But the discussion was about credit cards, and then I went off on a rant against checks.

Re:Are you guys anti-barcode?

[oliverthered]

Yeh, get rid of checks in shops. I only use those for postal services.
Like I couldn't mug you for a check book any harder than I could for cash.

Credit cards are great, until you can't pay them off at the end of the month.

Re:Are you guys anti-barcode?

[lgw]

I don't like debit cards (or check cards) because I do different sorts accounting for my checking account and my credit card bill - it's easier for me to use the credit card. Plus it's faster not messing with entering my PIN number into poorly designed readers.

Nothing wrong with paying off a credit card fully each months, and there's often better consumer protection that way than with debit cards or check cards.

Re:Are you guys anti-barcode?

[CrayDrygu]

You don't have to enter your PIN for check card purchases, it's processed -- from the store's point of view -- just like a credit card. Besides, do you really think punching in 4-6 digits on a keypad is less convenient than having to sign a credit slip?

Also, check cards (at least Visa ones) provide the same protections as any other credit card. The only difference is that funds are withdrawn from your checking account, instead of adding to a negative balance elsewhere, which you're only going to pay off with money from your checking account anyway.

Re:Are you guys anti-barcode?

[RocketRainbow]

That's amazing. Most Australian shops won't take a cheque. They'll take cash, credit, debit or eftpos. Even market stalls usually take credit/debit cards - some even have eftpos.

In Australia you have to pay some stupid OTT government tax to even have the ability to write a cheque from your account. My account is just a normal one and hence has no cheque priveleges. Companies use them to create a stupid paper trail because they don't have enough people that know how to use a computer.

If we want the grocery shop to give us cash, they just punch $100 extra in the eftpos transaction. Instantly the money comes out of your account and goes into the shop's!

It never occured to me that people do it differently.

Re:Are you guys anti-barcode?

[lgw]

The minimum legal ptoection is the same, but that's not as useful as you might think. For a fraudulant credit charge, it may reduce your effective limit while it's contested, that's as bad as it gets (though often it stops affecting your limit as soon as you contest it, that's not a legal requirement).

For a check card, that money is gone from your account. That may cause checks to bounce, minimum balacne charges to be assessed, and so on, and the bank isn't required to give you your money back until the contested charge is settled. Many banks will treat you better than that, and reverse any charges and give you your money back quickly, but those checks still bounced and you still have that problem. Further, you may need to cancel your check card, which means you don't have an ATM card until you can get a new physical card, which can be a problem if you're travelling.

It's *far* safer to get a plain ATM card, plus a credit card from the same bank.

Re:Are you guys anti-barcode?

[CrayDrygu]

It's *far* safer to get a plain ATM card, plus a credit card from the same bank.

You're absolutely right, of course. Some people seem to be irrationally afraid of credit cards, as if they're inherently evil. (I think these people really just believe they don't have the self control to stay fiscally responsible with one.) For these people, it's at least nice to know there are some protections with a check card.

merchant credit card fees?

[whovian]

Why do I get the feeling that this new customer "convenience" is a push to encourage more sales, which translates into more fees collected by the credit card company? The merchant will just pass on this cost, too, I'm sure.

Re:merchant credit card fees?

[Anonymous Coward]

Don't forget that many states have laws against charging credit card customers more than cash/check customers (since taking credit cards are more expensive than handling cash or checks). This will mean that everyone will pay more!

Just use cards with Bar Codes

[wooferhound]

Why not just put a Bar Code on the card, and wave that at the little black box, cheaper too My grocery store has a discount card that operates that way, and it works great.

Re:Just use cards with Bar Codes

[steveMa]

In case you were serious: It would be way too easy to spoof the barcode. I could easily copy your code and put it on my card... Steve

and the next step will be...

[Anonymous Coward]

just get rid of the card and implant the RFID chip in to your forehead or hand, or any other part of the body...

i can hear the christians in a uproar about this...

Re:and the next step will be...

[Anonymous Coward]

exactly what I was thinking.

So go on M$, VISA, RIAA, governments you know want to implant a chip in everyone. You must have wet dreams over that idea. Think of how you could abuse it. 1 chip, with everything:

your sales preferences,
sales history,
web surfing history and cookies,
medical history,
employment status
criminal record
and loads of other juicy stuff

think how it would make life so simple, think how it could stop those nasty wasty terrorwists from strapping bombs to themselves.

Well fuck you because it's never going to happen. And people will die and kill before it does.

A major problem with your plan.

[way2trivial]

Ever go to the post office?
they flat out refuse to accept such.
(individual offices aside, they are all supposed to be doing this like gangbusters)

For that matter, most merchant agreements (I've read enough) also instruct merchants not to accept such, but instruct that the customer must sign the card, or be refused...

article leaves me with more questions than answers

[Anonymous Coward]

Somehow this article left me with more questions than answers, like:

How does Visa intend to make sure the card owner acknowledges the charge? PINs?

Is scanning a card so difficult that this is even very useful? I can see it being useful in certain limited cases, but overall... not so much. I've never gnashed my teeth over the difficulty I've had scanning a card and signing my name. I have nearly screamed at scanners and readers that are supposed to pick up signals and don't, however.

All in all, I'm left only with the information that Visa wants to implement a new "contactless" system. Wheeeeeee. Can we say fluff marketing piece?

Sometime in the distant future...

[Anonymous Coward]

Salesman: $30 please.

Fry: $30? I can't afford that. Unless...[He pulls out his wallet.] Do you take RFID Visa?

Salesman: RFID Visa hasn't existed for 500 years.

Fry: RFID American Express?

Salesman: 600 years.

Fry: RFID Discover card?

Salesman: Uh, sorry we don't take RFID Discover.

Re:Sometime in the distant future...

[Blakey Rat]

Good quote, but why the hell did you add "RFID" to it? That fucks up the timing of the humor.

Not really...

[niki9]

"isn't that very similar to how TI's car RFID system was made?"

According to Visa:

"Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted"

So... not really, no. Just because two products use the same base technology doesn't mean that one is as fallible as the other. All cars made of metal and fiberglass don't rate the same in crash tests.

Safe sex.

[dangitman]

if they could imbed one of these in my penis, I could complete sexual transactions without ever making physical contact. What's not to love?

AES WAS NOT AROUND IN 1977

[Anonymous Coward]

1977? AES wasn't around in 1977!

Faraday Wallet

[theparanoidcynic]

For those who are afraid of this technology's potential for abuse, I wouldn't worry too much. I'm sure that even before this thing gets released Thinkgeek will start selling a wallet which is also a Faraday Cage.

(Tinfoil would work too, yes, but that wouldn't be durable and would probably scratch the mag-stripes off your non-evil cards.)

It speeds things up greatly.

[rdunnell]

Doesn't sound like it would matter, but it does. In a lot of cases it speeds lines up which equals lots of savings. A few seconds here and there adds up when you've got a lot of people.

Re:It speeds things up greatly.

[Lemuel]

But the slow part involves getting out the card, answering the debit/credit question, printing the receipt, and signing it. If the goal is speed up the process the debit/credit question could be removed and the signature. I'm assuming people still want receipts, although I could be wrong there.

Re:It speeds things up greatly.

[digitac]

I'd rather have a digital receipt than a paper one. Right now my credit card or atm record just shows a (sometimes ambiguous) merchant name and amount. I'd like to have a full reciept available in the same place.
I know some people wouldn't like it; SO's or banks knowing what they buy. But think about it, Quicken or whatever you use could import the full reciept and you could tell exactly how much money you've spent on RedBull for the last year! ::Digitac

Re:It speeds things up greatly.

[Lemuel]

I don't use Quicken to pull in transactions on my cards or checking account because I want to make sure that their numbers match mine. I just don't trust the banks and other businesses on the way to get everything correct.

Sjeez, its not rfid!!

[Anonymous Coward]

People can NOT charge from your account simply by scanning your card.

Although the article doesn't give much information, the card sends a unique number along with its id with each purchase. The credit card company knows wich number to expect for each id and only allows the transaction if the two match.

If your card is stolen however, purchases can be made.

----------

A request to /.

Please use acurate headlines --> FFS !! --

A-ha! The missing second step!

[StandardDeviant]

1: Build battery-powered emulator for register, set to auto-charge on $24.99
2: Walk through a packed subway station with emulator in backpack
3: PROFIT! :D

American Express also starting to roll out RFID

[Cerlyn]

American Express is also starting to roll out an RFID solution, although seperate from their card and also available on a preload basis. Their national partner I am aware of seems to be CVS drugstores, which seems to have rolled out credit card terminals which can read these cards locally even through I know of no other place I could use their RFID tag.

Re:American Express also starting to roll out RFID

[pedrobinson]

You speak the truth. The AmEx website about it is located here. According to their website you can use it at CVS, and it appears that Fry's is on board as well (and mentions 6 other chains as being "Featured Merchants". From what I understand it was in a piloting phase for a while, and they are actively hunting partners. Being a user of their product, I like it quite a bit, but I probably spend more money with the thing than I would if I didn't have it.

Maybe

[Anonymous Coward]

But you should appreciate the fact that they shrink it from the size of a car to the size of a card.

What if I carry multiple VISA cards?

[lugar]

I could just see me pull out my wallet and have it just be in range of the reader. I intend it to charge to one card and...whoops, it charges to the card I'm almost over limit on.

Re:What if I carry multiple VISA cards?

[t_allardyce]

Maybe you just answered the question of 'why is visa doing this'...

Re:What if I carry multiple VISA cards?

[radish]

Wow - you're right - that's a huge problem. I'm sure the engineers who built this didn't think of it. I mean... a "which card do you want to use" menu would just be crazy difficult to implement.

Re:What if I carry multiple VISA cards?

[BP9]

Related issue: if conditions are 'just wrong' and it picks up someone standing next to you in line rather than yours there is basically no way to know.

Seems like this would only really be feasible if the range was very small and/or you had to put in a pin to make sure its yours.

Re:What if I carry multiple VISA cards?

[Anonymous Coward]

Yeah, the geniouses of the general public can really follow a menu. Most of the dolts in line in front of me at the grocery store are lucky to slide their debit card through the reader, let alone type in the PIN. The last thing we need is a menu!

Fraudulent readers are not the only issue

[pseudosocrates]

What happens when shopping malls decide they don't generate enough revenue by rent alone...

1)install reader in door frame
2)print EULA on doorstep stating there is a $5 charge to enter. "By stepping over this threshold you agree to the following terms...."
3)...
4)profit!!

or Blockbuster:

1)Take out advert at superbowl "THE END OF RENTAL FEES"
2)Place item at #296 in the website FAQ - "There will be a $15 charge for entering the store
3)...
4)profit!!

This is another attempt to fix something that...

[Slashdot Junky]

Here's the senario:
When a new card is issued, it's unique RF signature will have to be retrieved so that it can be linked to an account. The crooks will get this signature the same way the card issuer did. What will keep a crook from capturing this RF signature on the way from your table to the restaurant's POS just as they do a magnetic strip and then later cloning it using a special keychain fob? The crook would then position the fob at the reader as he waves a nonfunctioning card across the sensor. Bam! The victim just paid for what the crook will be taking home.

I suspect that this is really as way for Visa/Mastercard/Amex to make money from merchants buying the new readers.

Here's another thing...
With this new super secure RF technology, the cashier won't be looking at my card in order to compare the signature on it with the forge one provided by the crook? The cashier also won't be able to pick out obviously fake cards since she/he won't be looking at it up close.

This is just another attempt to fix something by replacing it with another broken system. How is the current "swipe card and sign on the line" method so inconvenient that it needs to be replaced? I just don't get it.

That's so insane

[photon317]

No signature needed for under $25, works from a few inches away?

I forsee myself building a better antenna for my visa charging device and running through a crowded area charging everyone 24.99 as I pass by.

Re:That's so insane

[Anonymous Coward]

You do realize that you will get your merchant account (not anyone can just charge to a credit card) pulled and all your money charged back and probably arrested and jailed, since its hardly anonymous?

Re:That's so insane

[Anonymous Coward]

"By standing near this sign, you agree to pay us $24.99."

Wonder if that'd hold up in court?

Re:That's so insane

[Anonymous Coward]

oh right, like no one has ever been able to open a bank or credit account with a stolen identity or under false pretenses.

Re:That's so insane

[KFury]

"By standing near this sign, you agree to pay us $24.99."

Wonder if that'd hold up in court?

I'm sure with a wooden stick and enough duct tape you'd have no problem. But they frown on signage in the galleys.

Or did you mean the judge would be the one charging people $24.99? Sorry I misunderstood.

great

[t_allardyce]

RFID is increasingly being used for things that have NO real advantage but do have a significant security risk, how lazy do you have to be to even risk compromising security just so you dont have to get your wallet out or just so you dont have to replace your worn out card every year or two?! Maybe this is secure, but is it really worth the effort of upgrading the credit card infrastructure? is there any other advantage to it or is it really just showing off? RFID is nice but good old swipe or smart-card technology has been tried and tested for decades, it works, and never once in my life have i thought "damnit getting cards out and swiping them is such a hassle i wish there was some other way of doing this!" - except the printing system at my uni, someone had the bright idea of buying card readers that don't work 90% of the time and have arrows pointing both ways but don't have any indication of which way or which side to swipe, but thats called cheap hardware.

visa better hope this works or theres going to be one hell of a class action suit.

Privacy Issues

[Anonymous Coward]

Being a certified privacy nut, this bothers me.

I mean, what about the uses that have nothing to do with money? What about every time you walk in a store they check who you are and how much you buy, or don't buy? And if it isn't technically RFID, it is the same thing in many regards.

Why don't we just put chips in the back of people's heads. (I said I was a privacy nut.)

How much time will this really save you?

[atomic_toaster]

Our hope is that the contactless payment feature will drive added convenience and speed to consumers...

The thing is, most of the time it's not the swiping of the card that takes the time when you're in the checkout line. The cashier has to scan every item you're purchasing into the computer (assuming they're not still working out the old SKU method or on an even older "just enter the cost on the price tag" kind of register), giving you lots of time to rummage through your purse or wallet to look for your credit card. The actual swiping of the card takes about a second. Then, because the information is transmitted over an old-fashioned phone line for approval by the bank, you have to wait for that to be processed at both ends. And then you have to sign for the purchase (because, come on, a good portion of your Visa purchases are probably over $25), at which time you're supposed to pass over your card to the cashier anyway so that they can compare signatures. So how much time will not having to stripe your credit card really save you?

So, if the lack of striping doesn't save you much (if any) time and it makes your credit card that much less secure (as so many other /.ers have pointed out), what is the advantage to the average credit card user of having this feature? Maybe, maybe if they took away the "no signature for under $25" feature, which would remove a massive theft risk, and made the credit cards pin-accessible only so that you never had to get your card out of your purse/wallet (and really, how often do people check your signature in the first place?), maybe then it might be worth the cost it would take to implement it, but only by a very small margin. And although it may be a "free" service on your card, don't forget that interest rates and yearly charges are affected by every new technology that Visa has to pay to put into place. They're also affected by how much credit card fraud the companies have to write off. You might not see the costs up front, but they are there, just waiting to take a sizeable chunk out of your hard-earned paycheck.

Re:How much time will this really save you?

[SmokeHalo]

and made the credit cards pin-accessible only so that you never had to get your card out of your purse/wallet

You'd still have to get your card out of your purse or wallet. Many people have more than one credit card, so how would the device know which one to use? Unless it scanned all your cards and you put in the pin for the one you want to use? But that way lies madness; I wouldn't want *all* my cards to be scanned, just the one I'm using for the purchase.

But that's just my personal preference -- there are serious security implications there as well. Imagine someone getting a hold of a reader and surreptitiously scanning a passerby's purse. In an instant, several different card numbers are stolen. Hell, I know people who carry around 7 or 8 cards! So, no thank you. I'll be swiping my card, and if the clerk wants to see my ID, I have no problem with that.

How long will it be ...

[Muad'Dave]

...until we have ISO 14443 readers on our PCs to validate online purchases? Having a crypto-enabled card would help cut down on online fraud by guaranteeing "card present", no?

I want to see credit cards with 4 little buttony things on them - maybe labeled 1-4 or different colors. (Not necessarily real pushbuttons - that'd be too expensive and fragile. Conductive pads would be enough). Every time the card is used you have to enter your PIN on the card - 1-2-1-3 or red-red-green-blue or whatever. That info would be used by the crypto processor to create a signed validation from the card. The old "something you have + something you know" routine, right?

Chip and PIN

[ThaReetLad]

For the past year or so all new credit/debit cards in the UK have been using a new chip and PIN system to reduce card fraud. Instead of signing a receipt you simply put your card in a reader and enter your PIN which is then verified by the microchip embedded into the card.

Seems fine until you get the silly people in stores not hiding the keypad as people look over their shoulder, or even worse, mouthing or even saying their PIN out loud!!

Some time next year, I believe, the credit card companies will make stores liable for credit card fraud where the signature has been used to verify identity.

Re:Chip and PIN

[snorklewacker]

My PIN is 4654. What are you going to do, mug me?

The new stepa aren't so bad.

[Anonymous Coward]

1.) Get out your wallet.
2.) Get out the card.
3.) remove the card from the tin foil pouch you made.
4.) wave it around.

RFID retail experience

[rdunnell]

Lose the receipt, put the RFID tag on a keychain or something, and no signature needed (low cost limit).

Fast food will love it.

Re:RFID retail experience

[Lemuel]

I won't buy from a place that won't give me a receipt. I want a written record of my transaction, and I want to have a reminder to enter the transaction into Quicken later on. I don't mind a no-receipt option like some ATM's have though, for people who don't want the paper. I should be bothered by the signature not being needed, but I'm used to paying at the pump so I can't say anything there.

Re:RFID retail experience

[rdunnell]

Well, sure, receipts are still optional. The machine can print them or not, the customer can request it or not, it's all up to the merchant (for the most part) and the customer (to a more limited extent).

But look at a fast food place. Some of them give you a receipt and some don't. You can get a receipt at the ones that don't, but for the most part (in my area anyway) you don't get one by default. You have to ask and they go grab it.

It's still the same cash register as before. :)

Re:RFID retail experience

[lgw]

I mostly use my card in person to buy meals at restaurants. For most people, calculating the tip is slower than signing the card, so I don't think this will speed things up much in that case.

I'm hard pressed to think of any place where I have to stand in line to spend less than $25. I guess I just don't see the benefit here.

Re:RFID retail experience

[rdunnell]

You don't see the benefit but the manager at your local convenience store or fast food restaurant might see the benefit.

(I don't eat fast food either, and I usually don't go to convenience stores, but there's always a crowd at McDonalds or Taco Bell...)

Re:RFID retail experience

[lgw]

Actually, that's a good point: cheap fast food places would benefit from this, since nobody tips. OTOH, that sounds like an argument *against* the plan to me ...

Real RFID

[Megamote]

The global credit card company will offer PayPass, its RFID-enabled contactless payment system, to fans at the Seattle Seahawks and Baltimore Ravens stadiums this fall. http://www.rfidjournal.com/article/articleview/142 0/1/1/

Not quite that easy

[A nonymous Coward]

This is a credit card. The funds have to be transferred somewhere. The pickpocket has to be registered as a merchant with some bank, and when they get chargebacks, they will simply throw him out and not send him the money. It's not as if he walks by you and suddenly has $20 in his account to buy a nice dinner. He has to wait to the end of the (day,week,month) to get his funds, they have contact info more than just a phone number, and too many people will complain for him to collect any of it.

Even if it were a debit card, I doubt he'd get any of it. You might have to wait a bit to get it back, but the pickpocket wouldn't get any of it.

It is what Visa and MasterCard want

[grouse]

What you want is irrelevant to them. Visa/MC want to make the most money possible, and they get a cut of every transaction made with your card. Requiring ID is just a barrier to use of the card, so Visa/MC doesn't want that. Since cardholders are indemnified against theft of more than $50 (and usually that is waived if the card is reported stolen promptly), it shouldn't matter to them. And Visa/MC have determined that the losses through theft to them are far outweighed by the extra money they get from transaction fees and finance charges.

Personally, we don't live in a police state YET, and I don't want to show ID every time I make a purchase. When I come to a store that requires this, I report them to MasterCard, who usually gets the merchant back into compliance with their agreement. Sorry if you don't like that.

Re:It is what Visa and MasterCard want

[MntlChaos]

Personally, we don't live in a police state YET, and I don't want to show ID every time I make a purchase. When I come to a store that requires this, I report them to MasterCard, who usually gets the merchant back into compliance with their agreement. Sorry if you don't like that.

and the card that you use doesn't identify you?

Re:It is what Visa and MasterCard want

[grouse]

Precisely, why bother having to show additional ID?

Re:It is what Visa and MasterCard want

[MntlChaos]

you misunderstand me. You were arguing that being required to carry a second form of ID invades your privacy. My point was that you are already identified by the credit card. The photo ID serves to verify this identification. The only time that it is actually an invasion of privacy is when someone other than the card holder tries to use the card.

Re:It is what Visa and MasterCard want

[grouse]

My driver's license contains a lot more information about me than my credit card, such as my home address, date of birth, driver's license number, and sundry medical information (which drugs I'm allergic to, living will information, whether)

You'll forgive me if I don't think a random store clerk should get access to any of that information. With that information and the numbers off the card they can then execute a card-not-present transaction with a mail order firm. Whereas when they check the card only, they are unlikely to be able to do anything without taking the card out of my presence.

No, you are ignorant

[A nonymous Coward]

I too sign my cards CHECK I.D. This is accepted practice. Some credit card companies have even recommended it. Stores are SUPPOSED to ask for ID in that case, the point being to see that the photo ID matches my face, and the names match.

I'd like to see some store manager so ignorant as to try to confiscate my credit card because it tells him to to ask for I.D.

Re:No, you are ignorant

[Anonymous Coward]

On the back of my Visa Check Card:

Authorized Signature
Not Valid Unless Signed

You're supposed to sign it, and then write "CHECK I.D." elsewhere on the back of the card.

Re:No, you are ignorant

[duffbeer703]

No, it isn't. You can write "Check ID" on your card, but the card isn't valid unless you sign it.

Before you label people ignorant, get familiar with the rules:
http://www.mastercardmerchant.com/docs/acc ept_mast ercard/merchant_rules.pdf

Pay particular attention to these sections:
2.1.1.3 "Unsigned Cards"
2.1.6.3 "Obtain Cardholder Signature"
2.1.6.3.4 "PIN As Substitute for Signature"

Re:No, you are ignorant

[Huogo]

I'm supprised cards like mine haven't become more popular - All of my credit cards from CitiBank have my face printed on the front of the card itself, and my signature is printed on the front of the card, in addition to me having to sign it on the back. If this were coupled with one of those "smart" cards that are hard to duplicate, it would be quite secure (right now, someone could steam my card and make a copy of it without my picture).

Re:No, you are ignorant

[omahajim]

What process did CitiBank go through to verify that the picture submitted to print on the card is the actual cardholder?

Re:No, you are ignorant

[Huogo]

I hadn't though of that - absolutely non. I sent them my picture and card number. Not saying its perfect, but its a step in the right direction.

Re:No, you are ignorant

[28481k]

They don't, they trust the cardholder to prove that the picture is indeed "a true likeliness of the said person". You might better suggest them to "refer" to the states driver's license database or the biometric passport database to check that.

Re:No, you are ignorant

[Suidae]

I'd also be interested to see how hard it is to sand off that picture, polish the surface and run it through a card printer to put the picture of the thief on it.

This technique, if it worked and while requiring access to a card printer and more effort, would be much harder to detect.

Now, if they used full-color holograms of the cardholders head...

No money would be lost by consumers

[A nonymous Coward]

The merchant does not add a $20 item and transfer money instantly. It has to go thru the issuing bank, and not instantly, and not without the possibility of chargebacks, and then that merchant will lose his VISA account and be out of business. If you dispute the matter, and they see a pattern of some merchant going bananas with $20 chargebacks, he will be in banana-skin city. The merchant will lose. This is credit cards.

A built-in PIN pad?

[jfengel]

In that mode, you provide your PIN to the card reader through a PIN pad, and that unlocks your card to perform the transaction.

Is that PIN pad on the card itself? If I enter my PIN into somebody else's device that's a great opportunity for them to steal it. Can that be made durable enough to live in my wallet?

It sounds like these cards are going to be pricey (several dollars each to manufacture). Fine with me, if they can improve the currently horrific security associated with credit cards.

Is there a way to extend that unique RFID chip to online transactions? Maybe a reader hooked to your computer? Right now there's no good way to authorize a transaction over the Internet without sending them your credit card number (along with the sooper-seekrit protection code on the back).

Re:A built-in PIN pad?

[swillden]

Is that PIN pad on the card itself?

Nope, it'll work the same way PIN pads at Wal-mart (and wherever else) work right now.

Can that be made durable enough to live in my wallet?

Durability isn't the problem with putting a PIN pad on the card. The problems are power (where do you get it?) and cost -- mostly for the increased manufacturing complexity.

It sounds like these cards are going to be pricey (several dollars each to manufacture).

About $3 each. Current cards cost about $0.25 each. Cards with a PIN pad would be closer to $10 each.

Is there a way to extend that unique RFID chip to online transactions? Maybe a reader hooked to your computer?

Sure. Contactless readers are still fairly expensive, though, the cheapest one I know of costs about $70. However, most of these cards will probably also have a contact plate, so you can use them with a contact reader attached to your PC. Those readers can be bought for along with the sooper-seekrit protection code on the back

Yeah, CVV and CVV2 are a joke.

Re:A built-in PIN pad?

[jfengel]

However, most of these cards will probably also have a contact plate, so you can use them with a contact reader attached to your PC.

But to my knowledge there's no protocol, web-based or otherwise, for actually doing the operation. If I go to amazon.com, for example, I'd really love to (say) tap my pin and the amount and the payee and get a little cryptographic check out that I can use to pay Amazon without the card number ever leaving my computer.

Getting those chips into people's hands will be a great start, though.

Re:A built-in PIN pad?

[swillden]

EMV transactions can be done over TCP. The problem is actually in transmitting PINs; the banks don't like a system that has you typing your PIN into a PC which may be trojaned (though lots of them do it for web banking -- go figure). There are some thoughts that TCPA chips might make it possible to enter PINs securely, but I don't think that's feasible.

However, even without any sort of cardholder authentication, using EMV over the web would at least help to ensure that the *card* is present, which is a big improvement in security over what we have now.

Re:A built-in PIN pad?

[jfengel]

I can conceive a challenge-response scheme inside the card with the PIN pad built directly into the card, or assuming a trusted reader (e.g. a sealed device that's a lot harder to trojan). But that's a lot of infrastructure.

The next trick would be getting the web merchants to agree on a protocol. You can do the EMV over TCP, but you're not generally opening your PC to TCP requests. You'd probably want some sort of browser tie-in that says, "Click here to send $194.43 to amazon.com to pay for transaction 3458234". The device can then either communicate with amazon directly or use that plugin as a tunnel.

The alternative would be some sort of display, "Type the following twelve-digit code displayed on your card into this text box" but that's error prone and inconvenient.

Re:A built-in PIN pad?

[swillden]

You'd probably want some sort of browser tie-in that says, "Click here to send $194.43 to amazon.com to pay for transaction 3458234". The device can then either communicate with amazon directly or use that plugin as a tunnel.

Exactly.

Addendum

[grouse]

Some merchant processing agreements contain language like this:

For VISA and MasterCard, a signature panel bearing the words "See I.D." or equivalent language shall be deemed to be blank.

This means that they cannot accept your card (procedure for accepting a blank card requires that it be signed, which you can't do if it already has text on it), and if they do, they won't get any money if the transaction later turns out to be fraudulent. Whereas they will if they check for a valid signature and don't check ID.

so that's how it'll be done...

[m2bord]

This must be how companies will be able to figure out exactly who we are and our available credit line the moment we walk through the door.

Can you imagine?

Walking through a store and no employee wants to wait on you.

Then when you go to make a purchase, the cashier immediately asks you for cash when you go to offer your credit card.

Re:so that's how it'll be done...

[Detritus]

That already happens, except that they judge you by your age, race, clothes, etc.

I'm used to being ignored when I go shopping.

Yes it is!

[Serious Simon]

I design readers for both ISO14443 and ISO15693 tags, so I should know.

ISO 14443 and ISO 15693 operate on the same principles, the essential difference is that the ISO14443 protocol allows a higher data bandwidth which results in shorter maximum range (ca. 10cm instead of ca 1m).

In general, ISO14443 chips are less low-cost, able to store more data and supporting cryptographic capabilities. But this has more to do with the market that they target than with technical issues.

More their risk than ours

[enkydu]

Remember, if you have a VISA credit card and someone make unauthorized transactions you have 30 days to dispute the charges. If dispute the charges the loss is VISA and the merchant's loss, not yours. (With Debit cards, however, you only have about 10 days to challenge the charge and are therefore a much higher risk to consumers.) Also, the problem with swiping cards is the wear and tear on the card. For example, I've had my VISA for about 10 months, but the signature field is already pretty much illegible. This makes it impossible for a merchant to verify your sig without asking for a second ID...something that rarely happens in most places. This sounds pretty secure...especially since VISA taking the big financial risk. Obviously, they're going to try to recoop most of this cost by getting merchants to fork out $$$ for new hardware.

Has Anyone Ever Thought...

[Anonymous Coward]

I'm sorry but most of the time I only carry a credit card in my wallet and cash is a commodity. If they make contactless transactions the next item they could release is a personal card reader or card reader in cell phones and allow me to give $10 to my friends without finding a cash machine.

What is the reason for this?

[SPYDER Web]

I understand things like having your picture on your credit card which I think is the best simple innovation yet and I can understand the mini-credit card on your keychain. But how many seconds are saved by taking a credit card out or wallet out of your pocket and waving it back and forth? We all know from experience credit cards start to wear down over time...I dont want to be the one in the store looking like I'm having a seizure when I try to purchase the product of my choice, especially a more embarrasing personal product. Yes the slide method will probably never go away but I, like a lot of people on here, see this as another security problem and not a solution to our high speed lives. You want to help us? Lets skip to biometrics please where it could be faster and more secure and not something that leaks information out of my own pocket.

No, this is different

[Anonymous Coward]

"It is secure." What if you just don't want to leave a trail of bread crumbs every where you go. This means everywhere you go someone will know you were there whether you want them to or not.

Merchant account not required

[BobPaul]

Well, there's a long way and a short way.

Shortway:
Steal someones card. Put it in your wallet, buy things. They won't ask for ID cause that will slow down the process (and they hardly ever do now anyway). If it's less than $25 there's no paper trail, either. This will work until the person realized their card is missing and reports it stolen. Esentially the same as the present, but at least now they're supposed to verify your identity by comparing signatures or checking for ID... at least there's SOME verification to prevent a stolen card that should occure.

Longway:
1) Use a small device about the size of a palm pilot to send someone's credit card a serious of a few hundred to a few thousand challanges and not the responce that's given back.
2) Go back to your computer and crunch the challange vs responce to determine the algorithm used to provide each.
3) Plug that algorithm into a generic battery powered tranciever about the size a palm pilot let the reader scan that rather than a wall encased credit card.

Steps 1 and 2 will be possible eventually (using the same methods that cracked TIs method, I'm sure) and eventually someone will make the nessicary hardware for step 3, or at least post instructions on the internet on how to build one with a PIC and some other cheap hardware.

The teller will never know if you're scanning a wallet with a credit card inside, or a wallet with a small battery powered tranciever inside.

The problem is not that this system is less secure than magstrips (it's about a million times more secure right now) The problem is that the teller never has to see your card to verify your identy. They won't know if it's your card in the wallet or purse you swing past the reader, or someone elses, or even a device that randomly picks 1 of 30 peoples identities you got off the subway the week before. I wouldn't be concerned, but since the TI thing just a few weeks ago, I'm not sure how much I can trust RFID based challange response systems. The TI solution cracked was supposedly one of the best out there.

Re:Merchant account not required

[Anonymous Coward]

Shortway: Steal someones card. Put it in your wallet, buy things. They won't ask for ID cause that will slow down the process (and they hardly ever do now anyway). If it's less than $25 there's no paper trail, either. This will work until the person realized their card is missing and reports it stolen. Esentially the same as the present, but at least now they're supposed to verify your identity by comparing signatures or checking for ID... at least there's SOME verification to prevent a stolen card that should occure.

Except most stores don't check anymore because it actually makes them more liable for fraudulent charges that do slip through. If there is a policy that you are supposed to check and they forget on one fraudulent transaction that store can be blamed. IF there is a policy to not check, then the store hasn't broken some unspoken obligation. Ask the next time someone doesn't even glance at the signature.

Re:Merchant account not required

[lgw]

Well, I haven't read the spec, but people are saying it's 3DES based, which would mean 128-bit. Good luck trying to listen to enough challenge/response pairs to be useful in a 128-bit keyspace.

Zero-information proofs of identity aren't really zero information, but they add substantially to the effective keyspace, and I suspect this system uses a zero-information proof. That would mean it's effectively a 192-bit or larger keyspace. Even 128 bits is probably enough that if you captured every credit card hadnshake that is every made on the whole planet, you'd be nowhere.

Signatures/ID are poor(ly implemented) security

[sjbe]

WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?

Generally as a customer I don't. Not that I think showing ID is bad idea but I generally find the signature and to a lesser extend ID security measures to be as pointless as most of the airline "security". They're half heartedly implemented, irritating, and as implemented don't really do much to stop crime. It's appearance of security without substance. I wouldn't mind people asking for ID except that almost no one does, so what's the point? And the signature matching is a stupid since any thief with half a brain (admitedly some lack even half) will just look at the card and make at least a half-hearted effort to copy it. It's not like he has to look hard for it...

Let me be clear. I have the mistfortune of being a man with a name that is very rarely associated with the masculine gender. As irritating as that is to me, I should get asked for my ID all the time. But I don't which tells me that the the store management and credit card companies don't really percieve it as a problem. And they have the data to know whether it is or isn't. It's not like they're guessing. Furthermore, when I do get asked for ID, it's almost always at places like an airport (where I've been asked for my ID 20 times) when buying a $4 magazine, never for the $1000 printer. As a customer, I'll admit that being asked for ID is irritating and I don't like being regarded as a potential criminal but if it were a widely implemented security measure, I could deal. But since the credit card companies and most retailers don't regard it as enough of a problem (actions speak louder than words) to ask for ID consistently, I'd rather they save me the irritation and not bother at all.

It gets repeated here ad-nauseum that authentication consists of some combination of what you have, what you are and what you know. The signature is worthless as a security measure because it is simply two instances of something you have in the same item. Someone who takes my credit card also has my signature. Asking for photo ID sort of gets at what you are, though it can be forged by an ambitious criminal. But it could slow down the smaller thefts were it actually used. A pin code is actually useful IMO because it is something you know but is not used (for cost reasons mostly) for credit cards here in the US. And unlike biometric ID, it can be changed if there is a mixup.

While I'm venting, what really irritates me is when they have those swipe-it-yourself pads but still ask to see the signature! I've already mentioned that I think signature comparison is worthless as a security measure, but this practice just wastes both my time and the clerk's time. Furthermore they don't physically have the card at the right time if the credit card company tells them to hold the card. If they want to see my signature, the clerk should swipe the card him/herself and check. By having me do it, they don't save any time and they don't improve security. If they are going to ask for something they should ask for ID at that point, not a signature.

Serious here

[Ucklak]

Should we use tin foil or aluminum foil to wrap our cards up?

Re:Serious here

[John Harrison]

I used Reynolds Wrap "Quality Aluminum Foil". Either should work. In all seriousness there is nothing to worry about, this is more secure than your magstripe card, but if you are paranoid foil works nicely. Of course if you are this paranoid you should not even have a credit card.

Re:Serious here

[Ucklak]

I lived in a town where someone put up a fake bank night drop box and some 'out of order' tape on the real night drop box over a weekend at a bank we used to use.

This same town was near another suburb where someone had a reader glued in front of the atm machine. That device was confiscated by the police.

My point is that someone could just put up a scanner and have it look like an outdoor speaker rock just to collect numbers somewhere, walk by with a wireless PDA and collect those numbers, go home and actually start to see if they can get any information from those results.
Or better yet, compile a list of results from location A. Place a rock in location B and correlate the results from the 2 to see trends, etc...

I don't mind the magnetic strips because I have to physically hand the card over. With RFID, that isn't neccessary. Just wait until RFID is part of your drivers license.

Re:Serious here

[John Harrison]

Again, this isn't RFID. Do you know what mutual authentication looks like? Also, all the scams getting mentioned in response to this article are easier with magstripe. Become a merchant, get a kiosk in the mall, and store all the magstripes you get. Then charge a bundle on them one day and move to Mexico, right? Now why doesn't that happen everyday? I'll leave that as an exercise for the reader.

Re:Serious here

[Ucklak]

Dunk.

I shoulda RTFA. I assumed it was RFID.

Re:Serious here

[Anonymous Coward]

Maybe for the same reason that it often takes several days for a decent sized check to clear after it is deposited in the bank? They actually check on that shit sometimes, it's not just a scam for them to not give you your interest due.

Smart Cards dead?

[new death barbie]

... at least in North America.

I mean, Visa and MC might be able to convince merchants to switch to contactless readers, OR smart card readers, but the chances of convincing them to do BOTH is effectively zero.

It'll be hard enough getting contactless technology out there. Chicken and egg: some large merchants will want them, like Walmart and the department stores, but the investment for each merchant will be on the order of millions of dollars -- and will be useless unless the cards are widely available.

But in order to make the cards widely available, the issuers will have to spend millions of dollars -- and there's zero return TO THE ISSUER on that investment.

And ma and pop won't upgrade their corner store just to pay Visa fees for selling packs of gum.

Re:Smart Cards dead?

[28481k]

There's a simple way to do that - if you really want to push through things like that, you need a national mandate from all the banks to upgrade the system. Heck, even the grocers in the UK are literally being forced to upgrade their system within 3 years due to the fraud problem. I know that the US is many times bigger, but I sure there's someway to do that - either upgrade or your merchant's account being cancelled.

Oh, and there are significant returns for the issuer, people are willing to spend more on it as they preceive the card is safer, and fraud will definitely come down. Do you seriously think that issuers don't suffer from all these fraud when they couldn't find someone to shoulder that?

"Security is at the core of our business"

[lildogie]

That's why we send your preapproved credit applications and your blank checks through the U.S. Mail.

Not funny

[Anonymous Coward]

OK, these "Soviet Russia" jokes were funny the first million or so times I read them. Now, it's just stupid. Please stop displaying your deficient IQ.

Fly by sales opportunity

[BubbaJonBoy]

So I own a stop and shop type store, I put a hidden reader under the counter and rack up bogus sales for piddly consumables on any accomodating VISA that wanders by. A lot of people place their wallets and purses down as they fish out their money or credit cards. As long as the sale is under $25 I require no signature, the person being charged vaguely remembers being there and does not challenge the charges. Wow! I need a small business loan so I can jump on this opportunity!

They should offer a client card reader

[mosb1000]

They should offer a client card reader for internet transactions. That way the encryption could afford you some protection from internet identity theft as well.

maybe it's just Starbucks in Seattle

[schuss42]

but even on credit cards they don't require a signature. barista swipes your card, gives it back to you, here's your receipt, have a nice day. i'm sure there's a cap, but coffee and a scone (est. $9) isn't enough to flag it.

maybe there are other merchants doing this, but this is the first large-scale policy i've encountered.

i could use anybody's card i wanted to buy coffee...

Re:maybe it's just Starbucks in Seattle

[Anonymous Coward]

Same deal with Starbucks in Buffalo, NY. But the CVS down the street requires a signature even for very small purchases. *shrug*
I've never ever had anyone look at the signature, so I too am reduced to putting a couple squiggles.

More security if

[__aamcgs2220]

If somebody could just embed the chip in our brains, that would be perfect! If you weren't going to buy anything for a while, you could just put your tin foil hat back on and presto, no more RF from the brain! Maybe it would be better to just tattoo a barcode on our foreheads that they could scan for a quick, no signature required purchase authorization. Those Visa people are always working so hard to improve our lives, I trust them implicitly!

No Fashion Trend

[pharhp]

Anyone else see the potnetial for Faraday cage handbags and wallets? Its the next geek/privacy advocate must have item!

Mobil speedpass

[backslashdot]

I have mobil speedpass (which was shown to be somewhat insecure cause they used low grade encryption btw) .. anyway .. it's super convenient. It doesnt seem like much .. but it really feels a lot more convenient to save the extra 15 seconds it takes to sign for stuff and swipe etc. I think the technology exists to use high grade encryption etc. now .. so I really look forward to these contactless credit cards.

And if you just walk by?

[Anonymous Coward]

Think about how many times you go to a store but don't buy anything and you walk out passing nearby the registers...

Actually it amounts to RFID and unique id is junk

[Anonymous Coward]

The unique number may or may not be usable once only; depends on how delayed authorize gets handled. There is nothing to keep your name, number, exp. date all from being read over the air while the device is read; IEEE Times reported a 30 foot detect radius. Also, Visa/MC "unique id" is an option, not a mandate. Some of this stuff CAN be done relatively securely, but it can also be very open to fault.

Now we all can stay home and get fatter!

[howlin_walleye]

As the range of these devices increases, we can stay focussed on Oprah and "they" can simply make purchases on our behalf, extracting payment from us via cell phone towers.

Removing the consumer's role in the decision making will do wonders for businesses, allowing them to smooth out demand and make themselves more efficient, increasing profits. Don't worry, the folks down at ChoicePoint can serve up your purchasing patterns and theres plenty of smart folks around who can decide much better than you or me what we REALLY need. So the consumer wins, business wins, everybody wins! And you'll never miss another minute of American Idol because you had to run to McDonald's for some large fries.

There! I needed to get that off my chest.

Actually, I *DO* see a use.

[AKosygin]

A good place for this would be at public transportation places. Examples: Subways, buses, etc.

Credit Card transaction can be pre-authorized, meaning that they don't actually charge you yet but reserves an amount of money on the credit to be charged later.

So.... in taking the subway, you can pass your wallet over the gate as you walk in and it will pre-authorize the card, then as you walk out and pass your wallet over the gate, it charges you the appropriate amount based on the distance you travel. All without the middle device of a train ticket or a special train pass to do the same thing. Quick, fast, efficient. Not only do you save time not having to fiddle with a ticket or card (and bypass the line in ticket purchasing), you don't even have to bloat your wallet with all the different ones. The same can be said of buses, shuttles, and most public transportation use.

Though I can imagine that there might be other uses, but this one would come in handy as a city with competing/disparate transportation companies then will automatically be unified in payment system, no more multiple stored value tickets or cards for different systems.

Re:Actually, I *DO* see a use.

[pommiekiwifruit]

You mean like an Oyster card?

This is not EMV warmed over.

[Anonymous Coward]

The specs are not EMV but hew rather closely to existing US messaging...which runs in the clear on many merchant LANs. Some of the semiconductor merchants describe 14443 RFIDs with crypto, are a better guide to what is available. Look at what is done at POS and you will see they mainly have the RFID supply data that would be on magnetic stripe and just feed it into the same terminals that would normally have a stripe reader.

Its hard sometimes

[hawk]

I tried that.

Then I went to buy gas.

I put the card in the machine, and waited.

"Beep," it said.

I showed it my ID.

"Beep."

"No, this is my ID. See?"

Still, it refused to look. "Beep."

The crowd got larger and larger, but it still refused to look at my id. "Beep."

Now I'm stuck on my bicycle.

hawk

Checking ID used to be illegal

[geneing]

WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?

Illegal is not the right word, but until recently it was against VISA rules -- merchants who accepted credit cards could not ask for an ID. It was probably good for cc marketing.

Settle Down and Enjoy the Benefits of Credit

[vortex2.71]

I've read the responses to this article and a large number of them express concerns over identity theft, cash sucking wands, no ID transactions, etc. Chill out people! The deal with credit cards is that the large credit companies try to promote their ease of use by reminding us that we can leave the house with only our credit card and paying for things won't be a problem. As a result they incure some liability for fraudulent transactions. I'll repeat that: THEY not you incure the liability. That means that if a fradulent charge is made then you download a form that says "I didn't make those charges", fax it to them and they erase the charges. Its as simple as that. People are so darn brain washed by other companies and people who promote the fear economy... fear identity theft: by our identity theft insurance, fear ffor your personal safety: buy a gun and bomb Iraq, fear that you are ugly: buy a bunch of crappy beauty prodcts... I know that Visa and Mastercard are big bad companies that are gaining power and wealth every day, but they sell a pretty damn usefull product. I love leaving the house with only my key chain with mini visa card atached and not worrying about anything else.

Re:Settle Down and Enjoy the Benefits of Credit

[Ulric]

I agree completely that this technology is useful and should be more secure than what we have today if it is used right. But it is surely a problem if someone can swipe your card without your knowledge while it is still sitting on your keychain. A small amount among a whole bunch of other small amounts in a month has a good chance to go unnoticed.

What signature?

[Anonymous Coward]

For a really long time, I didn't have a wallet. I just carried everything, including my debit card, around in my pockets. After a while, the little signature strip wore off. Nobody noticed.

(I caught a wallet at a skate demo a while back. Life has improved.)

Neat new theft opportunity

[Anonymous Coward]

This will be great, all you have to do is get within a few feet of someone's wallet and you can instantly "swipe" $25.00. Let's see, a wireless card reader and trip through a crowded park ought to be worth a few hundred dollars...

fuck VISA!

[Anonymous Coward]

My VISA credit card number got stolen last fall and they are still strying to hold me responsible for it! I had to take them to court and still didn't see a penny. After researching that issue I found out that I am not the only victim and that thousands of other people had their numbers stolen and have fallen victim to VISA and their well paid lawyers. Fuck VISA! No credit cards anymore, ever! Good old cash rules!

cash-sucking wand

[ThatsNotFunny]

Hey, that's what my ex-girlfriend used to call me...

Re:cash-sucking wand

[geminidomino]

As opposed to you calling her a wand-sucking... nevermind...

I'll get my coat...

You think that's bad?

[superultra]

It's worse. Way worse. This guy on zug.com experimented with some..."creative" signatures:

Next I tried the old standby, "X." I was kind of nervous about this one, and had a long story prepared about how I had recently been involved in a motorcycle accident, and during my sixteen months in traction had only been able to sign with an X, a signature which grew on me. At the last minute, I chickened out and added an additional squiggly. I don't know why I was concerned; I was just buying a beer at Jillian's.

Signing X, incidentally, is not a bad idea -- it's quick and easy, and if someone wants you to "sign on the X," it's already signed.

The Credit Card Prank
The Credit Card Prank II

Yes

[Hal The Computer]

Here in Alberta (Canada), everyone always checks the signature on my card. I am constanty impressed.

The plastic bag trick... but why?

[McFly777]

... wrapping the card in a plastic bag first.

I've heard, and witnessed, that the bag trick works to get a fussy card to read. I've also seen it done with a folded piece of paper around the card.

What I dont understand is why it works. Does anybody out there know?

Micro-Payments

[sbowles]

First, the hardware to support this technology is NOT developed by Visa. There are hundreds of companies that develop Point-of-Sale (PoS) devices. Each POS device must pass Visa compliance testing before it can be used for Visa transactions (beyond EMV see the Visa PIN site).

One of the biggest values of such a solution has to do with Micro-Payment. How many times have you turned away from a drive-through because the lineup is too long. This class of business needs to be able to process an order (including settlement) quickly. The more orders they can put through in an hour, the more revenue the business generates.

Typically, this sort of transaction will also be done offline. This will allow the business to batch process their transactions at the end of the day, saving on transaction fees.

Don't get me wrong, Visa isn't being altruistic in this. The more they can encourage people to move away from debit or cash, the more credit transactions they process and the bigger the interest earning bills.

Re:Micro-Payments

[Ritchie70]

I'm sorry, McD's and Burger King is not micropayments. They are small charges, but they probably average $5 - 10 on a credit-card paid order.

In general credit is a time saver for them, because it's easier to swipe a card than to fumble with real paper and coin money.

And, as you correctly pointed out, time is money in the fast food business.

Multiple cards in wallet....

[McFly777]

OK, I have several cards in my wallet (Mastercard, Discover, AmEx). Assuming they all follow Visa's lead and incorporate this contactless tech., what happens when I wave my wallet with all three cards in it? Which card responds? is there a race condition?

I assume the terminal will only charge one card, but if I have to take the card out to make sure the preferred one registers, I might as well swipe it.

Re:Multiple cards in wallet....

[maxwell demon]

Maybe a terminal could just ask which card to use?

Maybe bank officers are ignorant

[A nonymous Coward]

I have had bank officers tell me to write SEE I.D. on the cards. I have never had threats to confiscate them. I say the rules can't be that all fired important if bank officers, speaking officially for their bank, tell me to use SEE I.D.

Re:Great...now all we need...

[symbolic]

...is a way to protect the information associated with the transaction after it has been completed. That is, a way to keep corporate pimps from prostituting the information to anyone who will pay for it. I don't use credit cards, and until this - and the usurious interest rates - see some change for the better, I most likely never will.

Wireless Muggings

[dynamo]

Sweet! Now all I have to do is get a reader for these things, set it to auto-charge $20 when I get near a card, and go walking around a big city!

Forget worrying about bumping into someone on the street and having them take your wallet, they could just be getting close enough to scan and charge your card!

Now that's LAZY!

[saterdaies]

I would definitely count myself amoung the lazy, but this goes way above me. I mean, swiping is just such a pain that we need to be able to pay without touching things?

On a realistic note, I'm worried about the proximity thing. Radio doesn't have nice black and white cut-offs of how close something is. I like to have a tangible, physical connection when I'm paying just for the sake of knowing when I'm paying. When I'm spending money, I like it to be a tangible experience. Of course, Visa probably likes you to think of it as abstract as possible so that you spend more.

I really like the chip and pin combination that is being introduced in Europe. You put your card in the reader and enter a pin into the keypad. Now that's security. Right now, if someone steals my card, they have to fake my signature. Easy with the little checking that goes on, but still. With this, they won't have to fake anything should they get my card (and are purchasing under $25). Why not a nice pin code to keep us secure?

No signature for purchases less the 25!

[imrec]

If you REALLY meant business the shirt would say 24.99!!

or did you mean 19.95 +tax?

Old news?

[2078]

So what if VISA is going wireless now?

I thought this was old news - Master Card has been pushing Paypass for around two years now.

I still don't see why it's such a big deal.

Re:Micro-Payments - visa loosing market share

[Anonymous Coward]

Exactly.
Visa is loosing out (at least here in Canada) to companies like Dexit and EasyPass. Key-fob based systems that have declining balances. The $25 market is being owned by other systems that are easier and faster than credit and debit and cash. Those methods are too slow.
Their motivation in creating this is not security, or anything nearly so noble. It's profit. So they're jumping on the wagon.

Great, whats next?

[Hobadee]

How soon until a store makes it so that if you try and walk out withouth paying, it automatically debits your card? Then, when the dumbass clerk forgets to disable to RFID security tag, and you walk out, you get billed twice for the same item!

consider the CC company's insurance premiums

[ToastyKen]

The credit card companies have to PAY for their insurance, you know. It's not just some magical fountain of money. If credit card chargebacks go up too much, their insurance premiums will go up, too. The insurance companies need to make money. So credit card companies have every reason to keep fraud low, so their insurance premiums would be lower. (This is all assuming you're right about them using insurance companies for this in the first place. I kinda doubt that, because insurance is worthwhile to prevent something big from bankrupting you. For lots of small charges, it'd be more cost-effective for the CC companies to pay out-of-pocket, instead of letting insurance companies get a cut, no?)

Re:consider the CC company's insurance premiums

[EmagGeek]

The cost of premiums are passed along to the merchants. All businesses pass along their costs to consumers.

Re:consider the CC company's insurance premiums

[ToastyKen]

Yes, but higher prices mean lower sales, mean lower profits.

The relationship between cost and price is not that simple. It's why margins on different products can vary so widely.

How About Killing Legit Merchents?

[Anonymous Coward]

Obviously, it would be stupid to run through a crowd with your own merchant account, just so you can go to jail. Duh.

But what about trashing a merchant you don't like? Find a way to get a reader linked to their account, and then charge everyone in a crowd $25. The legit merchent would have MAJOR trouble even if they were able to keep their account at all, unless they were somehow able to prove one of their readers was used "elsewhere."

Very simple problem with this--multiple cards

[CrazyMik]

In a country where most people have multiple cards, how will any arms length system know which card to use? For instance, I use a different credit card for my petrol purchases than grocery purchases, so I can't just wave my wallet like I can when I am getting into my office. Sounds to me like a half baked idea, that probably needs a little more thought.

Flash Us Please

[Anonymous Coward]

Ok so now people won't ask you to "swipe your card" anymore, instead they will want you to "flash your card". I can see all kinds of potential for fun here. "Whip it out and flash me, please". "if you flash us, we'll take 10% off!". Yikes! 10% off!! I like it the size it is just fine, thanks.

security or convenience?

[dannannan]

All other things being equal, a contactless system is less secure, and not because of snooping. I find it disturbing that the only security question the article raised had to do with snooping.

Currently I enjoy the "contact-required" cards' security feature that lets you know anytime your card is being read. You know because you had to take it out of your pocket and swipe it. Contact-free takes away this feature, no matter how much crypto you throw at it.

If VISA is really trying to improve security, I'd rather see credit cards work more like how my smartcard already works. You still have to swipe it, but it uses crypto to prevent the key from being stolen.

I refuse to believe that crypto technology to prevent the card key from being stolen can only be used in a "contact-free" system.

Already available in Japan for a year so more

[greggman]

This is already available in Japan in 3 different forms.

The first was Edy by Sony(japanese). It was a card, you added money to the card. You can use it all around Tokyo. The second was JR's Suika card(japanese) (JR is the largest train company in Japan). First they used to as your train pass to make it even faster to go through the turn styles, then they started expanding it so you can make purchases.

Finally NTT teamed up with Edy (I think they teamed up) and now all NTT cell phones have the same chip(english, flash, click the "i-Mode FeliCa Debut!" link) in them so you can pass your cellphone near the censor instead of a card and you'll get build through the phone.

The cards basically need to be within like 1 mm of the sensor surface but they only need to be there for a spit second.

Alternative scenario

[einhverfr]

You find a way to get the relavent information from the card, and sell that information to organized crime. Now they charge less than $24 from a few thousand people every month but it is distributed and so it doesn't track back to one account.

This used to be a huge problem in Hong Kong for a long time.

Ass target!

[dot_borg]

So the new crime will be to swipe peoples asses at $20 a pop.

Close.... similar....

[AKosygin]

But the difference is that if it was a CREDIT CARD, then the function would be beyond the Oyster card (UK), or the Octopus Card (HK), or the iCard (Japan), etc. As if you are move from one system to another, it will (in theory) be accepted. Skipping that middleman.

Because it looks like the Oyster card is valid in London only. And also, you still have to go to a machine to put money in the Oyster card, while if you can just use the credit card, you skip that step also.

Remember the....

[Audacious]

Remember the guy who had an article on SlashDot a while back about how to create your own magnetic card reader?

Well, I was just sitting here reading the articles and replies and thought to myself:

"Myself," I said.

"Yes?" I replied.

"What if we took one of the new readers, set it up so it would charge anyone $20.00 who got near me with one of those new cards." I said.

"You might be on to something," I said to myself, "Like ten to twenty if you aren't careful!" :-)

Re:Remember the....

[jerunamuck]

Not sure about the cards but the NTT phones have a fingerprint scanner so they aren't acrivated by accident when the user walks by a Pepsi maching in the Tokyo train terminal. Swipe your finger and wave the phone within 10sec, RF broadcast of single use cypher, debit account. Now that I can live with. ( so long as the gang of thrasher punks don't cut my finger off when they steal my phone. At least they will leave my wallet and ID.)

Credit Card Prank

[Motherfucking Shit]

Does anybody in N. America check signatures? They hardly seem to look at my cards. I have a friend who wrote "See ID" on the signature strip of their card and it took four months before she had a request.

Someone signed his credit card receipts using all sorts of fake names, he even signed by drawing little pictures on the line. The best part is that he scanned the receipts and stuck them on the web:

Credit Card Prank from Zug.

To share my own experience, no, I rarely have anyone look at the signature on the receipt much less try to compare it with what's on the back of the card. Cashiers are either lazy or trusting; it's the South, so probably a little of both.

Blockbuster Late Fees

[SonicSpike]

I work at a Blockbuster in the Nashville area and we are not a corp store - we are owned by a franchisee holding company based out of Memphis; Southern Stores, INC.

The "No Late Fees Program" which has been heavily advertised across the us is not true for about 5% of the BBs in the US. The majority of the stores in the Tennessee area do not participate in this program.

If you want to see confused and pissed off customers, try hanging out at my store on a Fri/Sat night. People will return rental items days and weeks late expecting to NOT pay a late fee. Then when we tell them there is a late fee the get very upset because they saw an ad on TV that said there were no more late fees. I don't say that I blame them either but I am sure all of the commercials say something like "at participating locations only"

This is a PRIME example of large corps causing confusion on the market place and pissing off their customers.

Really?

[brakk]

Tell that to Choicepoint.

The Best of Both World

[Renaissance 2K]

To help in the phasing-out process of swipable cards, why not create cards that have the contactless chips inside them as well as magnetic stripes?