Credit Cards That Think They Are Gadgets

holy_calamity writes "Pittsburgh startup Dynamics Inc has unveiled gadget-like credit cards with buttons, lights and even displays built into the same space as a conventional card. One card has two buttons on the front, which, when pressed, rewrite the data on the card's magnetic stripe, allowing it to act as multiple bank or credit cards in one. Another has several buttons and a display in place of the card's number. Only after entering a PIN is the magnetic stripe populated and the full card number revealed, and after a short time both go blank again for security." I wonder how long it'll be until somebody builds onboard biometrics into one of these things.

Comments

Biometrics?

[spun]

You mean, digital passwords you can never change? Sounds secure...

Re:Biometrics?

[snowraver1]

Why could it not be changed? Chip and pin cards store the pin on the chip, and they can be changed.

Re:Biometrics?

[Anonymous Coward]

Did you ever tried to change your fingerprints?

Re:Biometrics?

[snowraver1]

I didn't read the post title... I thought that this comment was referring to the part where you can enter a pin to make the mag strip work. My bad...

Re:Biometrics?

[Anonymous Coward]

Were sorry Sir :
Your a victim of Identify theft 24 times with the same card.

Re:Biometrics?

[slshwtw]

Three kinds of security:

• something you are (biometrics)
• something you have (card)
• something you know (pin)

As parent indicated, biometrics is the weakest of these, as if someone is able to 'break the code' you have no way of changing your fingerprints, etc. The best approach is a combination of having and knowing, such as an ATM card which a thief can't use without knowing the PIN, or a building access card that requires you to punch in a code. If you lose your card, no big deal, just issue a new one and assign it a new code just in case.

Re:Biometrics?

[Prune]

Revocable biometrics exist, and you don't have to chop off your fingertips either: for example, http://www.turbine-project.eu/ or http://vast.uccs.edu/biodistmet.html or http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4318487 and so on By the way, not to be a grammar nazi, just informative: did you ever tried -> did you ever try

Re:Biometrics?

[toastar]

Biometrics is also the weakest against the guy with a gun at the ATM scenario, You fingerprint is still there if he blows your brains out, Your Pin not so much

Re:Biometrics?

[Zerth]

Turbine just generates a non-reversible key from fingerprints. It does nothing to help you out if your fingerprint data gets out. Like by touching a car door.

Re:Biometrics?

[profplump]

Please don't conflate "biometerics as a stand-alone authenticator" with "biometrics as a second authentication factor". It's pretty reasonably to combine a physical token with biometrics, because you *can* deactivate/replace/rekey the physical token pretty easily. It's important that the authentication system includes some revokable factor, and ideally you'd also have a PIN or other knowledge-based authentication token, but physical + biometric is not a bad start, and can form a perfectly usable, revokable system.

And it's certainly not a bad system compared to the current "physical only" authentication currently in place.

Your fingerprints can't be changed, but they can't be as trivially reproduced as a password either. I agree, someone *could* steal your fingerprints and reproduce them in some useable way, though it would take a higher level sophistication than simply stealing your card or copying your password. And if someone stole your fingerprints and your card you could simply deactivate the stolen card and have a new one issued. The person with your fingerprints would then have a copy of your fingerprints and a useless credit card dongle. He'd need to steal your physical credit card all over again in order to use make use of his copy of your fingerprints.

Re:Biometrics?

[Prune]

There are two separate issues, physical and electronic compromises. Compromising the database is a much bigger problem and more likely scenario than compromising the actual physical feature. The schemes mentioned above solve the electronic issue. Physical security of oneself is fairly reasonable, and if compromised then one should switch to a different biometric ID or a password. Of course, I always believe the option has to be there to use a password. But revocable biometric IDs can still be useful for most cases where there has not been reason to suspect a physical compromise--these would be rare occurrences.

Re:Biometrics?

[Zixaphir]

Actually, the correct term in this instance would be "have you ever tried". "Did you ever try" would imply he had previously suggested you change your fingerprints.

~A real grammar nazi.

Re:Biometrics?

[Prune]

Think of it this way: it's just like with a computer--if physical security is breached, all bets are off regardless of what crypto you're using. Your whole hard drive can be encrypted with TrueCrypt, but there was an article posted here (months ago I think) where they can spray the RAM with a freeze spray as they cut power to the machine and then recover the plain text keys because there's still some charge. Protecting yourself from say retina scans by wearing glasses is a pain, so what we need for biometrics to be more reasonable is some biometric that is easy to conceal without effort. I'm thinking something along the lines of remote but near field EEG which can be affected by thinking along, without having to type in a password.

Re:Biometrics?

[Prune]

And looks like someone already thought of that http://www.newscientist.com/article/dn10963-brain-activity-provides-novel-biometric-key.html as is usually the case for most things.

Re:Biometrics?

[jeffmeden]

<Insert mythbusters episode reference here>

The current (and foreseeable future) crop of biometric systems are very difficult to "attack" by using lifted fingerprints due to the way they read the fingerprint from your skin. Creating a real-skin (or functional equivalent) duplicate is probably somewhere near the order of difficulty of brute-forcing a password for commonly accepted (read: flawed) password mechanisms. So; worry about one worry about the other, I guess.

Re:Biometrics?

[Anonymous Coward]

Have you ever tried?

Re:Biometrics?

[idontgno]

So, you're saying that fingerprint readers have beaten this attack? I hadn't heard that, but then I imagine "Now no longer vulnerable to Gummi Bear attack" isn't much of a marketing bullet point either.

Re:Biometrics?

[aliquis]

Biometrics? (Score:3, Insightful)
You mean, digital passwords you can never change? Sounds secure...

Did you ever tried to change your fingerprints?

I use different penis biometrics online and offline.

Re:Biometrics?

[Anonymous Coward]

but..you'd be dead and so the money wouldn't matter very much..

Re:Biometrics?

[moderatorrater]

Then they just need to check the temperature of the finger to make sure that it's still alive. It should work: criminals with microwaves can't run away very fast.

Re:Biometrics?

[Anonymous Coward]

Did you ever tried to change your fingerprints?

I've succeeded on multiple occasions... one was an accident with a knife, one was an accident with a grinder....

Retina scans, on the other hand....

Re:Biometrics?

[profplump]

Modern scanners require moving your finger across a static scan line rather than moving the scan line across a static panel. Besides being smaller and using less power and moving parts, this also removes and possibility of lifting prints from the scanner itself.

Re:Biometrics?

[Anonymous Coward]

Thermos full of hot water, one of those sodium acetate phase-change heating pads... the number of ways to get a severed finger back to body temperature is legion.

Re:Biometrics?

[WillDraven]

I doubt your finger would cool down much in the couple seconds it takes to shoot you and then stick your hand on the scanner. You could maybe check for a pulse, but I would think that that could potentially be defeated by massaging the dead hand.

Re:Biometrics?

[Red Flayer]

Thermos full of hot water, one of those sodium acetate phase-change heating pads... the number of ways to get a severed finger back to body temperature is legion.

Why bother with having to carry something around with you?

The thief's body has at least two accessible cavities that, when the severed finger is placed inside the cavity, will bring the finger up to room temperature. At least one of those cavities will not interfere with the ability to speak clearly.

Re:Biometrics?

[swillden]

There are two separate issues, physical and electronic compromises. Compromising the database is a much bigger problem and more likely scenario than compromising the actual physical feature.

Given that we tend to leave copies of our fingerprints everywhere we go, compromise of those physical features isn't just likely, it's a given.

I guess we could all take to wearing gloves all the time.

Re:Biometrics?

[Anonymous Coward]

Turbine just generates a non-reversible key from fingerprints. It does nothing to help you out if your fingerprint data gets out. Like by touching a car door.

Or if your finger gets lost. Like by the thief cutting it off, possibly killing you to do so, so he can use the credit card.

Re:Biometrics?

[Anonymous Coward]

You can't even tell the difference between an obvious mistake ("Have you ever tried/Did you ever try") and bad grammar? You're not a grammar Nazi, you're a douchebag. Quit giving grammar Nazis a bad name.

Re:Biometrics?

[Anonymous Coward]

The next step in biometrics is for the terminal to verify that this is a living piece of human flesh being pressed into the reader. At that point, the attacker either has to be there with the vic to force the transaction. The alternative would be to remotely force the vic, such as with a kidnapping, or with Nigerian trickery.

The hands on attack means the criminal is guaranteed to be on camera, and could leave forensics in a booth designed to collect them. Maybe the booth could blow an air shower when multiple users enter, and filter out particulates for later. The limited attack locations means easier police patrols, too.

Anyways, I imagine that once biometrics are clever enough to avoid the severed finger attack, and throw in enough sensors to avoid jello fingerprints, they will make impersonation pretty darn expensive. Of course, the terminal still has to maintain its own trustworthiness, such as using a deadman connection to the bank, which would damn the terminal if it goes quiet or detects tampering efforts. At which point, the next next concern is to protect against lots of expensive maintenance every time some kid scratches "Ben 3 Jill" on the terminal. At which point you just turn off the intrusion sensors, and maybe a fire alarm, too.

Never mind, it's cheaper to just lobby the burden of proof over into the depositor's lap.

Re:Biometrics?

[blackraven14250]

What? The guy has a reason to keep you alive when you have a PIN, but doesn't if he can just use your fingerprint.

Re:Biometrics?

[Anonymous Coward]

It's a good thing criminals won't have anything at body-temperature with them...

Re:Biometrics?

[GrumblyStuff]

Since your extremities cool before the rest of your body, I'd expect there to be a significant temperature swing in the fingers (depending on the weather of course).

Plus, there's those one-time, chemical hot packs.

Temperature is not a good condition to use.

Re:Biometrics?

[Anonymous Coward]

you just have to kill on premise

Re:Biometrics?

[Anonymous Coward]

(AC for obvious reasons).

I worked on a project a few years ago where we tried to crack heat sensitive fingerprint readers (using real, dead fingers) and I can tell you it isn't difficult at all to heat a finger up to the same temperature as a living body to pass the "alive" test that many biometric readers on the market implement.

Its slightly harder to simulate a pulse in a dead finger, but that is also entirely possible.

And yes, it was a gross project but if the only thing standing between you and millions of dollars worth of "stuff" is a dead finger, I'm pretty sure you'd spend some time trying to work out how to make it "alive". Well, SOMEONE will anyway.

Re:Biometrics?

[Zixaphir]

So people who are educated in philosophy, computer science, and math are modded up as informative, but being educated in the English language is trolling?

Re:Biometrics?

[Anonymous Coward]

The stupid criminals would hump microwaves around; the smart ones would just store the fingers in their asses.

Re:Biometrics?

[houghi]

Yeah. Knowing the password is much better, because you can decide not to give it. You will be dead, but at least they did not take your money.

Re:Biometrics?

[JimBobJoe]

Three kinds of security:

Some would make the argument that there are only two types. Biometrics is really something you have, and saying that it is something you are instead of something you have is a distinction without difference.

Re:Biometrics?

[unitron]

Did you ever tried to change your fingerprints?

I'm reasonably certain that some guy named "did you ever" did not try to change my fingerprints.

Re:Biometrics?

[unitron]

At least one of those cavities will not interfere with the ability to speak clearly.

Unless that's the sort of thing that gets him really excited.

Re:Biometrics?

[Anonymous Coward]

And the really smart ones would use their armpit.

Stick a dead finger up you ass just to keep it warm? Eww. I don't see why a smart criminal would do that unless it turned him/her on.

Re:Biometrics?

[Laser Dan]

Then they just need to check the temperature of the finger to make sure that it's still alive. It should work: criminals with microwaves can't run away very fast.

Criminals with warm armpits/pockets can still run fast. It only has to stay warm for a few seconds.

Checking for heartbeat/blood oxygen (like the finger clip sensors in hospitals) is more reliable and only needs an additional 2 LEDs.

But then they can still peel off your finger print skin and hold it under their finger in the sensor. You still end up with a sore finger at the minimum.

First

[genican1]

purchase? Though this seems like a much safer alternative to today's credit/debit cards, although like TFA says, what will this really do for security? How long until a flaw is discovered or it is cracked?

Re:First

[IndustrialComplex]

Though this seems like a much safer alternative to today's credit/debit cards, although like TFA says, what will this really do for security? How long until a flaw is discovered or it is cracked?

So I'm guessing you wrote that just so you could get in an early comment.

Or are you really concerned about security on an item which literally has all of its information printed right on its surface which you hand to strangers and gets stored in a third party database. Oh and I forgot that most of the printing is actually raised so it can be recorded with a simple piece of paper and a crayon.

You are worried that something could be less secure than THAT? Well I suppose adding a speaker for blind cashiers might be a bit less secure...

Re:First

[zombieChan51]

That's how the life cycle go, try to make something more secured, people will find exploit, product no long secure, loop back to beginning.

Re:First

[g0bshiTe]

I already have a flaw for the biometrics. Remove thumb or finger of person you swiped the card from.

Re:First

[DrgnDancer]

It's pretty much infinitely more secure than what we have now. Here's my suggestion to improve it further. You enter your pin, and rather than displaying your static credit card number, it displays a static identifier combined with an RSA style changing number. So say, the first 10 digits of the "card number" is a static identifier, then the last 6 digits are a code based on a shared secret between the card and your bank, changing every 5 minutes say. The magnetic strip can also have the same system. So if you enter the pin, then you can either swipe the card or enter the displayed number into a online system. Your card is approved based on the currently active code. 5 minutes later, that code is no longer valid so if someone gets the card database it doesn't matter.

Downside of course is that it will break any kind of storing your card number for monthly payments or stuff like Amazons One-click. It would be very secure though.

Re:First

[DarthVain]

I used my chip card at a store once, and they guy was like "Hi Steve!", and I was like "Er hi?", and the merchant was like "Your name is stored on the chip and when I plug it in, your name pops up on my screen!", he seemed so happy I didn't want to tell him that it is also printed on the card as well, that you can see what your eyeballs.

Re:First

[Anonymous Coward]

I'd rather a 30 minute or hour clock on it - some of the inefficient online checkout things would invalidate it by the time the sale finishes.

Re:First

[Coren22]

I know you are joking a bit here, but there is actually a dead finger test that is used now in many biometrics. Your finger actually changes some when there is no longer blood flowing through it, and even a simple temperature measurement can pick this up. Also, often they will include some kind of vein detection.

I was going to link to some articles but was unable to find them.

Re:First

[DrgnDancer]

Yeah, you'd want to play with the times. 1-5 minute expirations work well for RSA dongles and similar systems, but you might be right that a longer time frame would be better for these types of systems. Really even a solid day would probably be fine. The chances of someone stealing your credit card number from a database then immediately using it are relatively slim (and stealing the physical card wouldn't help them without your PIN).

Re:First

[GrumblyStuff]

Downside of course is that it will break any kind of storing your card number for monthly payments....

Well, I'm sold. Anything to fuck with companies that auto-renew and make it outrageously difficult to cancel is a plus in my book.

Re:First

[Belial6]

This is what amazes me about people. They don't get that credit cards are totally insecure by design. It gets worse when you look at 'Check Cards'. They are ATM cards with the security of a credit card. It's crazy. I don't want an ATM with credit card security. Give me a credit card with ATM security.

Even worse, when the 'Check Cards' came out, Visa ran commercials showing how easy it is to use illegally. The commercials basic premise was 'Don't want to prove it is really you trying to spend money out of this account? Use a Visa check card!"

boop, boop, boop ... your money's now gone.

[fkx]

boop, boop, boop ... your money's now gone.

bank bailouts enter the digital age.

Erm

[iONiUM]

Why don't they just tie this shit into your cell phone instead? They already have something similar in Japan with swipe phones for the JR line.

Why does every company have to try and put another gadget in your pocket. They should just integrate better with existing gadgets so I don't have to wear fucking cargo pants and have a wallet that is 3 feet big.

Re:Erm

[swanzilla]

They should just integrate better with existing gadgets so I don't have to wear fucking cargo pants and have a wallet that is 3 feet big.

That ain't a wallet. This is a wallet...

Re:Erm

[tekrat]

That's also why, when women hit you with their purse, the injury is now fatal.

Re:Erm

[antiparadigm]

Have to agree with ya there, iONiUM... Seriously, one more electronic device?

It would be nice if you could manually put your credit card info in there yourself so you only have 1 card to use and based on what button combo you want, it can take that profile. But you know it will only work for a specific bank, and you would end up with multiple digital CCs.

Re:Erm

[Anonymous Coward]

This is the same size and shape as a normal credit/debit card and it can work as multiple credit cards. How is it going to take up more space in your pocket?

Re:Erm

[oodaloop]

AS TFA points out, there are 16 million credit card readers out there. Instead of making them all RFID readers, just use the existing infrastructure. And this would potentially reduce the size of your wallet, not increase it, by allowing you to carry just one programmable card instead of many.

Re:Erm

[Anonymous Coward]

Co-stanza!

Re:Erm

[Microlith]

Why don't they just tie this shit into your cell phone instead? They already have something similar in Japan with swipe phones for the JR line.

Because in Japan the companies are far more tightly integrated, and it's much easier for NTT to work with JR East on what they want to do, and decree to handset makers that their next products will include the functionality. In the US, for instance, it's virtually guaranteed we'd have massive infighting and incompatibilities as vendors fought for dominance over all others. Verizon would work in some places, AT&T in others, and unless you bought your phone from them you couldn't use it at all.

Basically, there's a whole bunch of bullshit in the States that prevent solutions like Japan has from working.

Re:Erm

[D Ninja]

I don't have to wear fucking cargo pants and have a wallet that is 3 feet big.

...that's no wallet...

Re:Erm

[Anonymous Coward]

No, that's a spoon.

Re:Erm

[HAKdragon]

My spoon is too big.

Re:Erm

[strokerace]

They should just integrate better with existing gadgets so I don't have to wear fucking cargo pants and have a wallet that is 3 feet big.

Right and let's be honest: "No one's gotten a hand job in cargo shorts since 'nam." -Superbad

Re:Erm

[el3mentary]

I see you've played wallet-y spooney before

Re:Erm

[snspdaarf]

...it's a suitcase!

Re:Erm

[Anonymous Coward]

This is integration, with your credit card.

Re:Erm

[Ksevio]

I used to have a payment tag from citi that was just a sticker that could go on my phone. I used that to pay for things for a while until they "upgraded" my card to one that had it built in. Apparently they can't issue a separate tag for this card, so when I requested a new one, they just sent me a new card, then when I called customer support, they told me that could, but just sent a new card....

Anyways, it's possible to have just the rfid chip on your phone without having to interact with it, but it's not supported by many cards/merchants.

Re:Erm

[Anonymous Coward]

... then pack it in one chip, and embed it in your skull.

Re:Erm

[M8e]

I was in 'nam?

Re:Erm

[Firehed]

Did you even glance at the tech? This replaces your existing credit cards - it's not more crap to carry around. In theory, it can even reduce the number of cards you have to carry, since it can combine (at least) two cards into a single physical device of the same size and functionality.

It's not tied into your cell phone (something that, believe it or not, not everyone with a credit card has) because no POS terminals in the country allow you to pay with your cell phone, where all of them allow you to swipe a credit card. Replacing the nation's payment infrastructure isn't going to happen, and adding more stuff to it would require a MASSIVE benefit to both consumers and sellers - such as a great rewards program AND a 90% price drop in processing fees. I also trust a minimum-wage clerk to not break a credit card a lot more than I trust him to not break my phone (the chance of it being misused/mischarged is the same, and is thus irrelevant), and the company behind this tech claims their replacement is just as durable as a normal credit card.

Re:Erm

[LanMan04]

That ain't a wallet. This is a wallet...

Does it say "BAD MOTHERFUCKER" on it?

Re:Erm

[rwa2]

'sigh'

"I'm a banana"

http://en.wikipedia.org/wiki/Rejected

Re:Erm

[lwsimon]

I find it hard to believe that there are only 16m card readers. I have three, alone.

Re:Erm

[c6gunner]

Funny, I didn't realize 'nam was in Canada last week ...

Re:Erm

[Anonymous Coward]

Why have these cards on a network device? If a PW needs reset, require a PIN and a fingerprint scan, eliminate the potential for hacking and give the end user a way to avoid half hour queues to a customer support line. If the user does not have the PIN then issue them a new card (dependent upon the cost of each card). Networking a payment device makes it ripe for exploitation.

Magnetic Strips Suck

[Rockoon]

Perhaps finally we have here a magnetic strip that isn't prone to being stripped of its information?

The main use

[wirelessdreamer]

Scammers will love these, they'll find a flaw where they can reprogram any name and card number, swipe a card and clone it.

Re:The main use

[Anonymous Coward]

swipe a card and clone it

And how this is different from what we have now?

Re:The main use

[capnchicken]

Because one involves a material change using a specialized printer and card stock (unless you're just going to gamble that the clerk won't look at what is actually printed on the card) and one is an electronic change that can be presumably used with a magnetic card reader/writer and a general purpose computer.

Both are doable, the latter can conceivably be easier as well as easier to start up.

If there is a combination of permanent lettering on the new type of electronic card, then things just stay the same, as you have observed.

Re:The main use

[Firehed]

They can already do that with a $200 mag-stripe programmer. The hard part is getting the data to clone (which is not just the card number).

Re:The main use

[stonewallred]

Clerks around here never touch or see my CC card. I swipe it and there you go. Main reason I don't have a debit because the asswipes made it so that stores don't have to require PINs or IDs if debit use is under 50.00 bucks.

Re:The main use

[c6gunner]

Huh? AFAIK, the banks won't authorize a debit transaction without a PIN. They won't even let you look at the account details, let alone pull money. It's credit card purchases which can be made without a PIN, ID, or signature, if they're below a certain amount.

It Slices, It Dices...

[rakuen]

Pretty soon, our credit cards will even make Julienne fries!

Re:It Slices, It Dices...

[Anonymous Coward]

It will not break! It will not...

*card snaps in half*

It broke.

Sorry, could resist finishing the quote.

I can see some ideas for this...

[mlts]

I wonder how long a card like this will last in an average wallet, perhaps facing demagnetization, wear and tear, and other issues of being in a pocket and constantly jostled around.

However, it it can handle that, this could be a great thing to have, as not just a credit card, but as an authentication device. Punch your PIN, punch a challenge phrase, give the vendor the response, and that will do a lot to minimize credit card fraud.

Of course, skimmers with cameras will still be an issue -- just videotape the person typing on the card and not the PINpad, and if it uses an active cryptographic handshake, run a MITM attack.

Re:I can see some ideas for this...

[Bigjeff5]

And that's different from a normal credit card how?

These things are even more flexible and durable than credit cards. There is no reason to expect these cards will be more susceptible to demagnetization than the magnetic strip of any other card.

The electronics are in the plastic, it makes them pretty darn durable.

Punch your PIN, punch a challenge phrase, give the vendor the response, and that will do a lot to minimize credit card fraud.

Not really, most card theft these days happens in mass thefts of data, not individual credit card thefts.

biometrics? bah

[TheCreeep]

I wonder how long it'll be until somebody builds onboard biometrics into one of these things.

Screw that, I'm waiting for these guys to port Quake to a credit card.

on-card biometrics

[Anonymous Coward]

I wonder how long it'll be until somebody builds onboard biometrics into one of these things.

About 5 years ago.

Stop plagarizing

[Anonymous Coward]

They already had this system working PERFECTLY in monopoly. Hasbro should sue.

Near-field credit/identity cards.

[Anonymous Coward]

God, I just wish that they would put a simple on/off switch on/in them ...

How about just universal chip&pin?

[Anonymous Coward]

I know chip&pin isn't perfect, but it'd be a step in the right direction..

I just went on vacation and had no problem with my cards until the end, when someone cloned one of my cards and "swiped" it nearly ten days after I'd last used the card in that particular city.

Curiously the card was never out of my sight. They carried a machine to the table in restaurants and swipe on the spot, as is common in Europe.

Then, when my genius bank thought there might be fraud, they called me on my land line at home. This despite having told them my travel plans and they knew I wouldn't be home for another 24 hours. Since I didn't get back to them soon enough they let the fraudulent charges go through -- one of them for over $2000 -- and I had to deal with it the hard way when I got home.

Re:How about just universal chip&pin?

[Intron]

I know chip&pin isn't perfect, but it'd be a step in the right direction..

I just went on vacation and had no problem with my cards until the end, when someone cloned one of my cards and "swiped" it nearly ten days after I'd last used the card in that particular city.

Curiously the card was never out of my sight. They carried a machine to the table in restaurants and swipe on the spot, as is common in Europe.

Then, when my genius bank thought there might be fraud, they called me on my land line at home. This despite having told them my travel plans and they knew I wouldn't be home for another 24 hours. Since I didn't get back to them soon enough they let the fraudulent charges go through -- one of them for over $2000 -- and I had to deal with it the hard way when I got home.

You tell your bank your travel plans?

Re:How about just universal chip&pin?

[Dog-Cow]

It's not uncommon. It's done to prevent charges at the destination from being rejected due to automated fraud prevention.

Re:How about just universal chip&pin?

[Anonymous Coward]

I know chip&pin isn't perfect, but it'd be a step in the right direction..

I just went on vacation and had no problem with my cards until the end, when someone cloned one of my cards and "swiped" it nearly ten days after I'd last used the card in that particular city.

Curiously the card was never out of my sight. They carried a machine to the table in restaurants and swipe on the spot, as is common in Europe.

Then, when my genius bank thought there might be fraud, they called me on my land line at home. This despite having told them my travel plans and they knew I wouldn't be home for another 24 hours. Since I didn't get back to them soon enough they let the fraudulent charges go through -- one of them for over $2000 -- and I had to deal with it the hard way when I got home.

You tell your bank your travel plans?

Yes, when I'm traveling overseas and I want charges on my card to be accepted by my bank. Otherwise I risk having them reject the charge.

It can be annoying when I forget. When that happens, then I use one of my other cards from my other bank; but their fees are higher.

I do see this as a feature.

Re:How about just universal chip&pin?

[Anonymous Coward]

When I first saw this post it started out looking like another one of those "corepirate Illuminati nazi, lights coming up all over" posts due to the lower case and the & use

Re:How about just universal chip&pin?

[Intron]

How do you do it? Call the CC 800 number? If so, what prevents me from calling and saying I'm you and that I'm in Milan?

Re:How about just universal chip&pin?

[Anonymous Coward]

My bank calls me on my cellphone every time I use my card while traveling
1st call to verify, usually withing the hour, if I dont respond, the card gets blocked till I call back

Re:How about just universal chip&pin?

[Anonymous Coward]

If you've ever called your bank you'd know the answer to this!

Re:How about just universal chip&pin?

[Anonymous Coward]

I imagine it would involve the half-dozen authentication questions they ask whenever you call the bank. Or failing that, require the person to report their vacation in person?

Re:How about just universal chip&pin?

[MozeeToby]

If you want to use your bank issued cards you do. Sudden transactions thousands of miles away from your home area is a huge red flag for theft prevention algorithms. If they can't get a hold of you to verify the transaction (and if you're on vacation they probably won't be able to) they will cancel your card or at least put a hold on it until they can talk to you directly.

Re:How about just universal chip&pin?

[Anonymous Coward]

Generally they require this from a phone number associated with the account - i.e. the billing phone number. If they call from your house saying you are in Milan, that might be an issue. Even verifying the billing phone number is enough of a barrier to prevent 95% of that sort of thing.

Re:How about just universal chip&pin?

[freeweed]

How do you do it? Call the CC 800 number?

Basically, yes. Talk to a CSR at the CC company.

If so, what prevents me from calling and saying I'm you and that I'm in Milan?

The same way you're prevented from calling the CC company and changing my address, or calling my bank and wire transferring money into your account, or 300 other nasty things you could think up. They do have *some* security on your account that way - they ask you enough personal information that they're satisfied it's you.

You don't travel much and/or own a credit card, do you? This has been routine practice for decades.

Re:How about just universal chip&pin?

[Anonymous Coward]

Paranoid?

Hmm. The subject: was capitalized. Every sentence in the post was capitalized. One little & in chip&pin and you're looking for monsters under the bed and the boogieman in your closet.

But--- we are out to get you.

Re:How about just universal chip&pin?

[jeffmeden]

It is common for anyone who doesn't want their card frozen due to seemingly fraudulent use. You call the 800 number, do the usual authentication rigmarole (they check your source phone number, they ask you a number of security questions) and then amend your account details with the window you will be traveling and the destination. I have had a card deactivated even on a short road trip where I stopped too frequently at various gas stations and it auto-locked my card due to a pattern too far out of my normal routine.

Their algorithms are surprisingly sophisticated, to date I have had 1 false-positive (due to taking a trip I didn't notify the bank about) and 2 true-positives (due to two cards being stolen and used before I could call the bank) with banks using a properly implemented system (like Chase, Discover, BofA, etc). If you have a GEMB or other "bargain basement" card servicer, forget about it, they could care less.

Re:How about just universal chip&pin?

[clodney]

I've done it both ways, and never had an issue. I've wondered how good the fraud algorithms are - so if my Amex shows up in another country, do they look to see if you had recent transactions with an airline or an airport merchant? I would think that from a fraud perspective there is a big difference between my card showing up at a hotel in a tourist destination like Cancun, vs a grocery store in Roatan. It would be an interesting problem to work on.

Re:How about just universal chip&pin?

[Fulcrum of Evil]

If so, what prevents me from calling and saying I'm you and that I'm in Milan?

If it's a legitimate call, then you probably called well ahead of time.

Re:How about just universal chip&pin?

[Archwyrm]

Speaking of genius banks, I called mine up and gave them travel plans for the first time before my yearly trip to Europe. Somehow this was also the first year they decided to cut my card off while I was in Europe. And yes, they called my landline also. You would think they could send a damn e-mail too at least..

Re:How about just universal chip&pin?

[jonbryce]

You don't know his mother's maiden name and date of birth.

Re:How about just universal chip&pin?

[jonbryce]

For me the problem is that I tend to use my Amex for the airline transaction - for the cashback, and my Santander Zero Mastercard when I get their, as it has lower foreign currency fees.

Re:How about just universal chip&pin?

[Anonymous Coward]

Do you use bank of america by any chance? lol I used to work in the atm/debit fraud department and that sounds exactly like something that stupid bank would do.

Re:How about just universal chip&pin?

[Some Bitch]

My UK bank has a page on their internet banking site for letting them know when you'll be in a different country. If I suddenly start buying things in Amsterdam or Cologne the fraud detection rules might pick it up which could be problematic, if I've already told them "I'll be in Holland between the 16th and 19th" they can take that into account and not leave me stranded in the middle of nowhere with no money.

I'm waiting for transaction-specific codes

[mysidia]

Cards that will populate the mag-strip with transaction-specific codes each time. So you can type the code in, the guy at the restaurant can pick up the card with your ticket, and swipe it once.

But if he tries to scan the stripe and clone the card, the number he gets is useless, because it is transaction specific.

I would envision each CC being allocated a block of 200 random CC numbers, to be used in sequence, when it is printed, 200 random initial CVV2 numbers, and 1000 random CVV2 offsets in the form of a number between 0 and 999. For each transaction, pick a number, with no number re-used until 199 more transactions have been made.

Each time a number is used, the CVV2 is to be the initial CVV2 number plus the next CVV2 offset, modulo 999. CVV2 offsets are not re-used until 999 more transactions have been made.

Each time a number is used, the CC company can determine it is valid and compute exactly the right CC and CVV2 numbers that should be used by the next 10 transactions.

Unless there is delayed processing involved, they can also know to reject any number other than those 10.

Even if there is delayed transaction processing involved, the CC company can know a code 199 transactions ago is "too old", because there have been transactions made since then that are too old.

There should also be a way to enter a special PIN to generate a 'vendor specific' code that can be used for multiple transactions.

Possibly assigning card users larger pools of numbers, so expiration dates, and dollar limits can be encoded using the CC# and CVV2.

If multiple failures are detected with a CC# (e.g. someone tries to clone one number and try it with multiple CVVs), then that CC# is retired permanently, and the CC company sends the customer a new file to flash their credit card's memory with.

Re:I'm waiting for transaction-specific codes

[Mr_Silver]

Cards that will populate the mag-strip with transaction-specific codes each time. So you can type the code in, the guy at the restaurant can pick up the card with your ticket, and swipe it once.

It's called Dynamic Magstripe and is available now. One example of it is here.

In Europe, they are solving this problem by moving away from magstripe to chip-and-pin. This is for two reasons, you don't give your PIN out to anyone else and because the card never leaves your sight.

For example, when you pay for food at a restaurant, the server physically brings you the Point Of Sale terminal for you to insert your card, confirm the price and enter your PIN. This means that it's impossible for them to run off and make a copy of the card without you seeing it happen.

(I was in the US recently and did not like the fact that my credit card disappeared from my sight when I went to pay for the bill)

Re:I'm waiting for transaction-specific codes

[slshwtw]

Some providers offer "virtual" credit card numbers (scroll down halfway) for online transactions - pretty useful when dealing with merchants you don't trust 100%.

Re:I'm waiting for transaction-specific codes

[Anonymous Coward]

Cards that will populate the mag-strip with transaction-specific codes each time. So you can type the code in, the guy at the restaurant can pick up the card with your ticket, and swipe it once.

It's called Dynamic Magstripe and is available now. One example of it is here.

In Europe, they are solving this problem by moving away from magstripe to chip-and-pin. This is for two reasons, you don't give your PIN out to anyone else and because the card never leaves your sight.

For example, when you pay for food at a restaurant, the server physically brings you the Point Of Sale terminal for you to insert your card, confirm the price and enter your PIN. This means that it's impossible for them to run off and make a copy of the card without you seeing it happen.

(I was in the US recently and did not like the fact that my credit card disappeared from my sight when I went to pay for the bill)

You are assuming the point-of-sale terminal is not bugged or modified to record everything you enter and/or swipe.

Re:I'm waiting for transaction-specific codes

[kevinNCSU]

I find the dichotomy of trusting someone enough to provide clean and safe items to ingest into your body but not trusting them enough to handle your credit card for 3 minutes w/o stealing it (even though you'd get the money back) interesting. I'm not saying it's wrong or I don't often feel the same way, it's just when you step back and think about it that seems kind fo backwards doesn't it?

Re:I'm waiting for transaction-specific codes

[BitZtream]

In the end, the result is that you've made a protocol more complex trying to make it obscure ... but its an open protocol so obscuring it is pointless, anyone can tell you how to unobscure it ...

An added part of that is that you then what the CC clearing houses to deal with a much larger number of CC numbers so you can use them as one time numbers. They'd have to keep all those numbers stored if they are randomly generated, OR they have to use a clearly defined way to generate the numbers, in which case, again being an open protocol, you just need to get the right information to make the next step. Basically you want CCs to act something like key fobs for cars.

Storing all the extra data is of no value to the CC companies, they're going to make you pay them in most cases anyway so its just not worth the effort.

One time pad is the simplest and safest (currently anyway) solution to the problem if you're going to add electronics to the cards themselves.

The user swipes their card. Enters their pin ON THE CARD and the card gives them a one time pad to use with the clerk.

If you stop using magnetic cards and switch to some kind of smart card that can communicate back with the reader then you can actually make it in such a way that regardless of what the vendor you're buying stuff from wants to do, they can't change what you authorize because the card is required to generate the required validation code.

If you want something more secure than a credit card there are several ways to do it that are actually more secure, rather than just more complex.

Re:I'm waiting for transaction-specific codes

[mysidia]

An added part of that is that you then what the CC clearing houses to deal with a much larger number of CC numbers so you can use them as one time numbers. They'd have to keep all those numbers stored if they are randomly generated, OR they have to use a clearly defined way to generate the numbers

No... the bank determines what 'account number' the payment card number is associated with. The clearinghouse is only concerned about forwarding the details of each transaction, and it's up to the CC issuer to approve.

In the end, the result is that you've made a protocol more complex trying to make it obscure ... but its an open protocol so obscuring it is pointless, anyone can tell you how to unobscure it ...

Protocols should not be obscure. The point is to allow existing infrastructure to be used; schemes based on generating card numbers are compatible with existing infrastructure, which is designed to handle those numbers. With one time pads, the entire payment processing infrastructure from the credit card terminal to the bank would have to be replaced.

With a security scheme based on multiple CC numbers, and CVV numbers, existing infrastructure is capable of handling this without much modification.

Some banks already provide mechanisms to "generate virtual CC numbers" for use online.

You suggest banks store one time PADs, I suggest they store pre-generated batches of CC numbers, and pre-generated batches of security data (CVV numbers and offsets) for authenticating their use.

One time pads are definitely more secure, but they are also massively more expensive to implement, because the infrastructure is not in place to deal with those.

Just in the same way the processing infrastructure is not in place to be compatible with simply adding more digits to a credit card number for 'transaction number', 'date', 'dollar limit', and 'digital signature'

Re:I'm waiting for transaction-specific codes

[Kentari]

Not quite. You are assuming that the cook and/or owner of the restaurant are involved, which is very unlikely. Trusting a minimum wage waiter to carry food from the kitchen to my table is one thing. Trusting him with an easily copied card with thousands of dollars credit is another.

Re:I'm waiting for transaction-specific codes

[dj245]

I experienced table-top POS terminals during a recent trip to Nova Scotia. Apparently they are very popular there, and the waitress couldn't believe that I had never seen one in the US. The biggest problem is that in Europe, tipping is not expected or required. In the US, you can write the tip and walk away without the waitress watching you. If they go to table-top POS terminals like I saw in Canada, then you need to tip in front of your server. As an American, it was not very comfortable, although I suppose it is more profitable for the waitstaff. As an aside, when I was younger, tipping was commonly 10% and 15% for good service. Now my coworkers give me a hard time if I give any less than 20%. I think its time that we pay servers more and do away with the tip. The hidden cost of tipping is starting to be a substantial part of the restaurant bill.

Re:I'm waiting for transaction-specific codes

[stonewallred]

Cash, for one.

Re:I'm waiting for transaction-specific codes

[Anonymous Coward]

Not strictly true.....

The POS devices have no internal encryption, customs have found batch's of POS devices which contain the innards of a mobile phone. Every card number AND pin is recorded.

Chip and Pin is not safe at all. The introduction was all about the security theater, appearing to make you safer while changing the EU law of liability from the banks to you in the event of fraud because "you must have told someone your pin number".

Same with the 3dsecure verified by visa / mastercard securecode systems. If you read the TOS you will see that you agree to the liability of all on-line fraud because you must have revealed your account details in order to have lost money.

None of it is about security, its about making you pay for fraud.

In the UK the government ordered the Police to ignore credit card fraud, the credit card company's have to deal with it internally. If you call the police about your card being cloned, they will tell you to contact your card issuer. Now lets extrapolate.... is it in the card company's interest to report the true stats of fraud?

Re:I'm waiting for transaction-specific codes

[mentil]

The problem with this system is that many of these machines wirelessly transmit the CC# to the POS machine, cleartext. Sniffers in a van in the parking lot intercept the CC# and clone it anyways. A poster above you had exactly this happen to him (although he didn't realize how it was done.)

Re:I'm waiting for transaction-specific codes

[TomC2]

The biggest problem is that in Europe, tipping is not expected or required. In the US, you can write the tip and walk away without the waitress watching you. If they go to table-top POS terminals like I saw in Canada, then you need to tip in front of your server. As an American, it was not very comfortable, although I suppose it is more profitable for the waitstaff.

In the UK many of the card terminals also allow the user to add a tip onto the amount deducted from the credit card, as the user enters their PIN. Particularly at chain restaurants, I doubt the individual waiters get the tips - though I guess even tipping in cash it might be pooled.

Re:I'm waiting for transaction-specific codes

[St.Creed]

The biggest problem is that in Europe, tipping is not expected or required.

Ehm... not sure where you went to, but in most of Europe it's customary to give tips. Not sure about Greece and Italy, but in restaurants in Germany, France, Spain, as well as the smaller Northern European countries, tips are expected and appreciated. Size depends on country, with Spain avg being 5-10% and in some other countries 15% could be better. It has to do with how much of their income the staff makes off their tips. Anyway, with about 10% you'll probably do just fine.

As for tipping in front of the server: ofcourse you do that. Otherwise there's a chance the tip will never be seen by the server at all.

Re:I'm waiting for transaction-specific codes

[horigath]

You are assuming the point-of-sale terminal is not bugged or modified to record everything you enter and/or swipe.

The chip card uses challenge-and-response authentication to check your pin internally. It cannot easily be cloned even if the device is bugged. The system's biggest vulnerability is that magstripe cards are still accepted because they are still as easy to fake as ever. In Canada they are becoming less common and in Europe quite rare (except for American tourists).

The EMV chip-and-pin system may have other vulnerabilities but it's introduction has dramatically reduced card fraud rates everywhere that it's been introduced.

Something similar

[dsavi]

A major corporation that someone I know has worked for used to use what looked like a very thick credit card to log into what I believe was a VPN. You would input a PIN on the front, and it would display a code that would be valid for 30 seconds or so for logging into the VPN that it calculated itself, based on the current time and PIN. I think this card was made by RSA, now I think the same company uses a slightly different system.

Re:Something similar

[Demonantis]

The company I work for uses the same system. I think it has been around for years. WOW uses it now if you want the service. The concept is that the server and the card use the same algorithm to create the password which is time and parameter dependent. It changes every 30 seconds so a hacker can't brute force the password from the server.

What I think is neat is that they have managed to put the magnetizing mechanism in the card now. Imagine placing your credit card on the degausser at the market and instead of having to get a new card you just push a button and the card works again. No more getting a new one. Plus all the other possible things mentioned in the article.

Re:Something similar

[rickb928]

SecureID I think. Mine is the size of a care remote. The thin ones broke a lot. Old technology, but effective.

Re:Something similar

[toastar]

Kinda like the Battle.net authenticator

Re:Something similar

[natehoy]

Our company uses RSA SecureID units on our VPN, and I've used them in the past for other companies.

In our case, you don't actually enter a PIN into the unit - it displays a 6-digit number that changes every 60 seconds, and that number is part of your password (but not all of it - you have an 8-character code you have to choose yourself that forms the other part of your password). The main computer at work uses the same algorithm as the SecureID card to rotate numbers, so the password is always changing but always in sync.

I've never heard of an RSA unit that actually has you key in a PIN to access the rotating code. Generally the PIN is presented as part of the password along with the rotating code. Seems to me that putting a keyboard on those things would make them less portable, less durable, and more subject to hackery (if you enter the wrong PIN, does the system simply show a random number, or is it possible to "hack" the card by entering PINs until you see a number display, for example?). But that may either be a very different or much older RSA system.

Re:Something similar

[freeweed]

RSA's product is indeed SecureID. Several other companies produce similar products. I carry several on my keychain for various purposes, it's a pain in the ass. Thankfully the batteries last 3-5 years on them so at least you're not always replacing the damn things.

Re:Something similar

[dsavi]

I remember the way he input the code- A series of ten buttons on the front. I think it just didn't give you a code if you entered the PIN wrong, but I wouldn't be surprised if it would lock itself up after X number of wrong tries.

Re:Something similar

[TooMuchToDo]

You can even get a SecureID for your World of Warcraft account now.

Re:Something similar

[Anonymous Coward]

Blizzard and many banks have a similar system for their logins, where you get a small keychain, hit the button on it, and get a temporary code. In the case of Blizzard, you can use it as an app on certain phones, where that phone is tied to your account, or as a small keychain with a unique ID number, again, tied to your account. They're called "Battle.net authenticators", you can purchase them for about $5, free shipping. The one I have says "www.vasco.com", and "Digipass Go 6" on the back, and is about the size of 2 AA batteries side by side.

Re:Something similar

[natehoy]

Interesting. I never knew ones with keypads even existed, but Wikipedia to the rescue.

http://en.wikipedia.org/wiki/Security_token

You learn something new every day. :)

Re:Something similar

[ap7]

Yes, it ought to be SecurID by RSA. Mine displays a 6 digit number that changes every 30 odd seconds. You use your PIN and the running token number to login to the corporate VPN. They expire every three or four years. The previous token I had was black and the size of the car remote that you mention. The newer one is the size of a usual USB key.

What is this?

[nullifi]

You mean, people read titles?

One Time Use Cards

[Jason Levine]

This could make a long-time dream come true for me. I use one-time use numbers online but in brick-and-morter transactions (like paying at a restaurant), I still have to give my real credit card number. Perhaps these cards could be made to generate a one-time use number. Then, when I'm paying at the grocery store, they get one number while the pizza place gets a second number. I'm sure there would be some security hurdles to clear but it is a promising development.

Re:One Time Use Cards

[ad454]

Agreed, these cards would be invaluable if they had a one-time card number generator. But in practice, that is a lot harder to do then you would think.

Credit cards have 15-16 digits, but the top 6 reserved are for the BIN that identifies the issuer and corresponding VAP/MIP/... processing station in the credit card network that authorizations are sent to. The last digit is reserved for the mod10 checksum. So that means that you have only 7-8 digits available per BIN. Note that each BIN typically is used for 10's of thousands of individual cards.

When you use a one-time card number online, it is generated/provided by a centralize server and database in order to efficiently maximize that 7-8 digit pool for one-time use that is SHARED, coordinated, and distributed among the 10's of thousand of card holders.

But since these new computerized cards do not have any networking capabilities, and since of the 10's of thousand of card holders need to be identified individually, you would only have a 2-3 digital pool for the one-time use, which is not enough for security.

The only option for these new computerized cards would be to either add network capabilities, like a bluetooth connection to a mobile phone, or add a one-time passcode to another field in the magstripe, perhaps appended to the card holders name.

Use CASH

[aristotle-dude]

Don't buy any thing that you cannot afford. Use cash to pay for everything you can. I hate people who use plastic be it credit cards or debit cards for individual purchase of less than 10 dollars. If you cannot have at least 10 bucks in your wallet at all times then you do not deserve to call yourself an adult.

It often takes more time to use a debit card than using cash especially when the store's machines are acting up. Also consider that it costs a store money per transaction so you are actually being a jerk if you use our debit card for small purchases.

Re:Use CASH

[oodaloop]

It also costs me money to take out cash, but I don't get an extra fee for using a credit/check/debit card. Seems like a no-brainer to me. I use my check card for everything and check my balance daily to make sure I enough money. And I even call myself an adult.

Re:Use CASH

[nullifi]

What if I get mugged? I would lose my $10! I live perfectly within my means, and I work part time. I always use my debit card, using cash would be too inconvenient. First I would have to go to the ATM every week, or every few days, then I would need to get a bigger wallet. My current wallet only holds 4 cards and not a thing over. Now I would also have to keep track of not only my bank account balance, but also my current cash balance. Too much!

Re:Use CASH

[aristotle-dude]

It also costs me money to take out cash, but I don't get an extra fee for using a credit/check/debit card. Seems like a no-brainer to me. I use my check card for everything and check my balance daily to make sure I enough money. And I even call myself an adult.

If it costs you money to take out cash, maybe you should consider a different bank. It costs me nothing to use one of my bank's ATMs to get cash and it costs me nothing to make purchases with my debit card but I consider it bad form to use my debit card on a purchase of less than 20 bucks.

Re:Use CASH

[Dog-Cow]

I hope you fall over dead. I mean, really. If you're going to be absurd, I shall indulge as well.

Stores price goods so that they profit no matter how you pay. The exceptions are notable because you will see a sign to the effect that, for purchases under $X amount, a CC will not be accepted.

It is better for me to use a CC instead of carrying cash. If I am mugged, that cash is gone. If all the mugger gets is a CC, I can cancel it before it's used, or contest any charges, if I am too late.

Re:Use CASH

[rickb928]

Um, since the new rules have gone into effect, you have to LET your bank accept a debit transaction you don't have the funds to pay. While this embarassing when they decline the transaction, this avoids paying $37.90 for a latte at Starbucks. So turn off overdraft privilege at the bank and live on the balance you have. No problem. Credit union users, you may have to do this specifically with a rep.

And I have more than $10 in my pocket right now. It's on two debit cards. Work just like cash at stores.

But taking time is not usually a problem with debit cards. Fishing around for bills, counting them out, waiting for the clerk to recount them, waiting for the clerk to make change, this all takes time. If you're moderately competent, you can slam dunk a debit transaction faster than you can count out $37.90.

And while small purchases do hit retailers hard with fees, on the other side, retailers get impulse buying they might not otherwise, settlement is electronic and largely automatic so no carrying money to the bank and either waiting for it to be counted or waiting for the bag to be opened and counted later, and if you are paying attention, you might get competitive info on your customers. Good for retailer, not necessarily good for consumer, but privacy is pretty much gone anyways.

And of you want to be lass of a jerk, consider using it as debit and not as credit. Most signature transactions cost the merchant more than PIN transactions. Don't belive me? Visa is running some promotions along with issuing banks that you get entered into a drawing by signing for your transaction. This is NOT so they can collect less in fees. Trust me, they collect MORE. And this is how they fund the giveaway. Nice.

Re:Use CASH

[Waffle Iron]

Don't buy any thing that you cannot afford.

I don't. I pay off my credit card bills in full every month.

Use cash to pay for everything you can. I hate people who use plastic be it credit cards or debit cards for individual purchase of less than 10 dollars.

Too bad. I always swipe a credit card no matter how small the transaction, because it's faster than cash. A lot of stores don't even make you sign for small transactions these days. I also don't have to deal with bagfuls of loose change in my pockets. I hate waiting behind people in line while the cashier fumbles for and then doles out a dozen little physical tokens to each one of them. (Although I admit that's not nearly as infuriating as when I see someone start to pull out a checkbook after the final total gets rung up.)

This is the 21st century. The postal service is going down the tubes because electronic messaging is more efficient than physical paper. The Bureau of Printing and Engraving should follow suit.

Also consider that it costs a store money per transaction so you are actually being a jerk if you use our debit card for small purchases.

That issue is due to ineffective enforcement of antitrust laws. If the credit card cartels didn't have a near monopoly, transactions wouldn't cost more than a couple of cents, and credit cards would cost the store less than handling and securing paper money. (I'm sure that those armored car deliveries aren't cheap.)

I do my part to address this problem by generally voting for candidates who would tend to strengthen antitrust provisions.

Re:Use CASH

[Americano]

Use cash to pay for everything you can.

Why would I do that? Cash is quite liquid - other people can dispose of it easily, and there's nothing really to show that "this $20 is mine." In addition, the filth on most money is rather distasteful, from a purely hygienic standpoint. Instead of filling my pockets with other people's bacteria and other snot, why not just use my debit card or credit card (I pay off the balance in full every month)?

Cash also lends itself to being easily frittered away with a dollar or two here, a dollar or two there. Cards allow you to keep closer track of your transactions and balances.

As far as taking more or less time, by the time I haul out my wallet, count out bills & check to see if I have appropriate change, it's just as easy to have simply swiped a card and keyed in a pin. And if the store's machines are acting up, it's not uncommon for the cashier to be unable to (or very slow to) calculate what my change should be on a cash transaction, too.

If the store is concerned about price-per-transaction costs, that's their problem, not mine. Some stores impose minimum limits for use of cards, so if the owners are that concerned, they can impose the same limit. If they're not willing to, I guess they're not very concerned about the transaction fees.

So... tell us again why cash is so much better? As far as I can see, the only argument *for* using cash is that you feel it takes longer to use a card, and in my experience, the difference in time is so small as to be nonexistent.

Re:Use CASH

[oodaloop]

I have a great credit union, and they don't charge me. But many banks out there do. I also carry cash, but I don't plan out my purchases far ahead of time to ensure I have adequate cash at all times.

Re:Use CASH

[spidrw]

While I agree with most everything you say, I just want to point out that the minimum purchase requirements for card use are almost always not allowed based on the terms and conditions of the bank that is providing the swiping machine/software. It's a crap rule, but it is the rule.

Re:Use CASH

[Anonymous Coward]

Don't use a debit card. If stolen or mis-used you are liable for your entire balance (more if you have overdraft protection). Credit cards limit you liability to $50.

Re:Use CASH

[Americano]

That's very possible, but it doesn't change the overall dynamic a bit. If the shopkeeper feels that transaction fees are eating into his profits, then he's well within his rights to refuse to accept credit cards at all. If it was strictly a losing proposition, then they wouldn't offer the capability; They may lose a few cents on my $2 transaction, but clearly, the proportion of profitable transactions is enough to absorb that loss.

Re:Use CASH

[dgatwood]

It's not that debit card transactions cost less necessarily, but rather that VISA doesn't get a cut of the debit side at all. Debit card transactions (when used as debit cards) go through a EFT network like Star, Cirrus, PLUS, Interlink, etc. rather than through VISA.

Also, many businesses pass on the debit card overhead to you as an additional fee on the transaction total, whereas in general, VISA/MC/Amex won't let them do that. In that case, yeah, it is cheaper for the business, but you get screwed.

Finally, debit card transactions may or may not cost the business less, depending on the transaction amount and the merchant account agreement details. As I understand it, an ATM-style transaction with PIN costs the merchant a flat transaction fee in the ballpark of $0.35-$0.55. A CC transaction usually costs some base amount plus a percent, and the details vary widely. That base transaction fee is usually considerably less than the transaction fee for an ATM card. So for transactions under... say eight or ten dollars, the CC transaction probably costs the business less than the debit transaction. For larger transactions, it costs them more. And, of course, the details vary widely depending on what sort of merchant accounts the store has, so you can't really generalize that number. The break-even point could be $0 or it could be $50.

By using a debit card (or, for that matter, any credit card that doesn't pay cash back), you are only hurting yourself. The store builds those transaction fees into the costs of goods. Thus, if you don't cost them that transaction fee, you're still paying the higher cost as though you were, plus you're missing the opportunity to get some of those transaction fees back at the end of the month or whatever. Thus, in effect, you are subsidizing the meals of people who pay with methods that cost the store more and pay them cash back. Those extra few cents you gave to the restaurant go towards reducing the average cost paid, which means you get back a tiny fraction of what you put in. By contrast, if you use the cash back credit card, you get back a much larger chunk of what you put in.

No matter what payment method you choose, the transaction fees are not going to have a significant impact on the store's bottom line or on their prices, but getting cash back does make a significant impact on your finances, which you can then use to put more money into the economy. In the long run, it is best if stores make as close as possible to the minimum amount of money that they can survive on, thus concentrating the least amount of money in the hands of the people at the top of corporate food chains. Obviously this is less true when you're talking about sole proprietorships with single-digit employees. On the other hand, most of those sorts of shops are restaurants, and the average transactions at such shops are in a range ($5-10) that costs about the same amount of money for CC or PIN-based transactions anyway. Thus, you might as well take the cash back; it is effectively a way to take money out of your CC company's pocket, and it's hard to argue that this is a bad thing.

Re:Use CASH

[rickb928]

"It's not that debit card transactions cost less necessarily, but rather that VISA doesn't get a cut of the debit side at all. Debit card transactions (when used as debit cards) go through a EFT network like Star, Cirrus, PLUS, Interlink, etc. rather than through VISA."

Well, my point was rather generic, that Visa/MasterCard don't get the same cut on PIN transactions that the do with signature.

"Also, many businesses pass on the debit card overhead to you as an additional fee on the transaction total, whereas in general, VISA/MC/Amex won't let them do that. In that case, yeah, it is cheaper for the business, but you get screwed."

I haven't been surcharged for PIN in years. And it's unenforcable on both sides. Merchants already add in transaction fees, so it's the cash customer that is getting screwed. If I want the convenience of a non-cash transaction, I should be an adult and recognize the costs. The cash-payer, they should should be most upset. The market is winning this one, the holdouts are losing. I see no solution other than permitting diversion, and asking for different prices for cash. How about checks? Essentially similar transaction costs. Do merchants charge more for checks?

And fees are so different and complicated that we should not try to figure that out too closely. It doesn't much matter to me as a comsumer.

Cash back cards always cost merchants more. That's the value proposition, more sales but it costs more. It's actually more an enticement for merchants to accept one card over the other, diversion, than it is anything else, and a perfect storm of promotion. Cash back, reward points, whatever you call it, you pay for it somewhere. Let's remember, in the real world, you do in fact pay for it all.

"In the long run, it is best if stores make as close as possible to the minimum amount of money that they can survive on, thus concentrating the least amount of money in the hands of the people at the top of corporate food chains."

What? That's only true within a highly competitive market where price is the differentiator, like supermarkets. Wal-Mart claims they pay that game, but I don't think so. Marketing talk.

"Obviously this is less true when you're talking about sole proprietorships with single-digit employees. On the other hand, most of those sorts of shops are restaurants, and the average transactions at such shops are in a range ($5-10)"

Whoa. $5-$10 restaurants are probably QSRs (quick-service, Mcdonald's/Starbucks, etc), and they love non-cash transactions because they inspire impulse purchases. If you have to think if you have $5 for a Starbucks, some day you will realize you just paid $5+ for coffee, and not very much coffee at that. And if you show up at McD's with $4 in your pocket and realixe you have your debit card with you, well, you buy a $6 meal instead. Yep, you paid $2 more than you might have. Starbucks loves their prepaid and stored value cards because it decouples the purchase from the expense. Consumers often don't realize how much money they piss away each week in trivialities. I take out $x from my account on Fridays, and if it's gone on Monday, I know I just frittered it away. My goal is to reach Friday with some left. I budget that way for my Starbucks, Quik Trip, and such.

"that costs about the same amount of money for CC or PIN-based transactions anyway. Thus, you might as well take the cash back; it is effectively a way to take money out of your CC company's pocket, and it's hard to argue that this is a bad thing."

It's not money out of the CC companies' pockets, or your bank. It was YOUR money to start with. think of it as a discount on purchases. If you buy something you would not ordinarily buy because of the 'cash back', you lost. If you use a card instead of cash, you're making a decision AND enriching the CC companies. It's a choice, so lets be honest.

Overall, you have to think of and treat your debit card like CASH. It is. Don't get too bogged down in fees, promotions, and cash back. It's all your money. You spend it wisely, foolishly, or don't pay attention, your choice. Always.

Re:Use CASH

[Cro Magnon]

Too bad. I always swipe a credit card no matter how small the transaction, because it's faster than cash. A lot of stores don't even make you sign for small transactions these days. I also don't have to deal with bagfuls of loose change in my pockets. I hate waiting behind people in line while the cashier fumbles for and then doles out a dozen little physical tokens to each one of them. (Although I admit that's not nearly as infuriating as when I see someone start to pull out a checkbook after the final total gets rung up.)

Faster than cash? I don't think so! Usually, when I'm at the grocery store, and the line slows to a crawl, it's because of someone swiping their card. Best case, they have to hit "credit or debit", type the amount, and answer "Are you sure?", which is slower than pulling out the damn cash. More often, they don't know what to punch, or they try paying from an overdrawn account, or any of a thousand things that can go wrong.

Re:Use CASH

[Waffle Iron]

I don't think that I've ever had to type in an amount. Like I said, for small amounts, It's often swipe and go. No pushing buttons or using pens of any kind.

Unless the store has one of those automatic coin dispensers (which about 98% of them don't), cash transactions can't hope to compete with that on speed.

Re:Use CASH

[Red Flayer]

Don't buy any thing that you cannot afford. Use cash to pay for everything you can. I hate people who use plastic be it credit cards or debit cards for individual purchase of less than 10 dollars. If you cannot have at least 10 bucks in your wallet at all times then you do not deserve to call yourself an adult.

Using a credit card is being given free money, as long as you pay it off in full each month. You are getting an interest-free loan, and free money in the form of rewards programs. Why not make use of it?

Being stuck in the 1900s using cash only is ridiculous. You're wasting paper and ink, and you're spreading disease with your filthy currency.

Using cash for no reason is childish. People who refuse to change with the times are like little kids who won't give up their security blanket.

Re:Use CASH

[dgatwood]

Cash back cards always cost merchants more. That's the value proposition, more sales but it costs more. It's actually more an enticement for merchants to accept one card over the other, diversion, than it is anything else, and a perfect storm of promotion. Cash back, reward points, whatever you call it, you pay for it somewhere. Let's remember, in the real world, you do in fact pay for it all.

Actually, no, they don't cost the merchants more. The fee a merchant pays for taking credit cards is exactly the same whether it's a cash back card, a debit card used as a credit card, or any other type of card. That rate is defined by their merchant account agreement, and depends solely on A. the type of merchant, B. the volume of transactions that merchant performs, and C. which of at least a few dozen credit card processors they are using.

Whoa. $5-$10 restaurants are probably QSRs (quick-service, Mcdonald's/Starbucks, etc), and they love non-cash transactions because they inspire impulse purchases.

Depends. I was speaking from the perspective of a single person. The average price for a sit-down meal for me at any of dozens of decent restaurants is somewhere right around the $10 per person mark, sometimes including tip, sometimes not. If you expand that out to $5-15, it covers almost every restaurant out there. Obviously it's higher when you're paying for a family, but there are still far more people buying meals alone than buying meals as a family, particularly when you think about office workers at lunch. I maintain that the average payment at most restaurants is probably somewhere in the $5-15 range for this reason, with the exception of restaurants that refuse to split the check.

It's not money out of the CC companies' pockets, or your bank. It was YOUR money to start with. think of it as a discount on purchases. If you buy something you would not ordinarily buy because of the 'cash back', you lost. If you use a card instead of cash, you're making a decision AND enriching the CC companies. It's a choice, so lets be honest.

I am being honest. Yes, it is essentially a discount on purchases. My point was that the vast majority of people are going to pick the credit card whether you do or not. Therefore, your decision not to accept the discount is insignificant. In effect, your choices are:

• Pay cash. The money ends up in the pockets of the store. No matter how many times you choose to pay this way, you won't be a significant enough percentage of the store's transactions to lower your costs significantly.
• Pay by non-cash-back credit card. The money ends up in the pockets of the credit card company shareholders. No matter how many times you choose to pay this way, you won't be a significant enough percentage of the store's transactions to raise your costs significantly.
• Pay by cash-back credit card. Some of the money ends up in the pockets of the credit card company shareholders, some of it ends up in your pocket.

As for your argument that purchasing something because of cash back is a loss, let's be clear here. I'm not saying that it is a good idea to choose to purchase something to get cash back. That would be idiotic. I'm saying that by choosing to get cash back on a purchase you would have made anyway, you now have additional funds that you otherwise would not have had, and that this money will either be saved or spent. Some of it, statistically speaking, will be spent, and this helps drive our economy. More to the point, you, as a consumer, will statistically spend more of it than someone higher up in the food chain---a CEO of a restaurant chain, a shareholder of a credit card company, etc.---would spend, so the best thing you can do to drive our economy is to take the cash back.

The reality is that there's not a snowball's chance in you-know-where that we're going to get the vast majority of consumers to stop using

Re:Use CASH

[berberine]

Use cash to pay for everything you can.

Why would I do that? Cash is quite liquid - other people can dispose of it easily, and there's nothing really to show that "this $20 is mine." In addition, the filth on most money is rather distasteful, from a purely hygienic standpoint. Instead of filling my pockets with other people's bacteria and other snot, why not just use my debit card or credit card (I pay off the balance in full every month)?

Cash also lends itself to being easily frittered away with a dollar or two here, a dollar or two there. Cards allow you to keep closer track of your transactions and balances.

As far as taking more or less time, by the time I haul out my wallet, count out bills & check to see if I have appropriate change, it's just as easy to have simply swiped a card and keyed in a pin. And if the store's machines are acting up, it's not uncommon for the cashier to be unable to (or very slow to) calculate what my change should be on a cash transaction, too.

If the store is concerned about price-per-transaction costs, that's their problem, not mine. Some stores impose minimum limits for use of cards, so if the owners are that concerned, they can impose the same limit. If they're not willing to, I guess they're not very concerned about the transaction fees.

So... tell us again why cash is so much better? As far as I can see, the only argument *for* using cash is that you feel it takes longer to use a card, and in my experience, the difference in time is so small as to be nonexistent.

I have yet to be robbed of my cash in the last 40 years. I have had 4 different credit cards from 4 different companies have their databases broken in to and my accounts were affected.

If you use cash, once it's gone, there is no more money. I have 3 credit cards and a debit card. My debit card is rarely used as it does not offer the protections of a credit card and I cannot afford the 3-6 month waiting time to get my money back if anything is stolen from my account. My 3 credit cards have a total of $27,000 I could spend on it. Your credit card is actually easier than cash to fritter away. You think to yourself, "It's only a $3 latte," and, by the end of the month, you've put $200 worth of shit on your card. If you had the cash in your pocket and that was all the cash you had for the month, you'd think twice before spending it.

It doesn't take me more time to haul out my wallet as I know relatively close to what I've spent and have my money ready when I get to the cashier.

I work in the public schools and there is always a need for cash. You need it to pay to get into athletic games, the concessions, donations, fundraisers, etc. Right now, we are collecting money for a young man who is 13 and his mother died on Tuesday. He has no other family. It's cash or check only.

On the occasion that I eat out, I use cash as often as I can. I don't like the fact that your waitress is your cashier. They bring you the bill, you give them your credit card, and they disappear with it for a while. Then, you write in the tip and leave. They still have access to your credit card after you've left because they need to run it again to put the tip on.

Re:Use CASH

[omnichad]

Yeah. It's already worked into the price at most well-run stores, so you might as well use it. It's only a tiny bit of inflation.

Is it water proof?

[Openstandards.net]

That would be an essential requirement to replace plastic.

Re:Is it water proof?

[oodaloop]

Yes. Says it in TFA.

Re:Is it water proof?

[Openstandards.net]

LOL, just read it when I switched back to finish TFA. Should of searched TFA first before posting. SIGH.

Re:Is it water proof?

[Anonymous Coward]

LOL, just read it when I switched back to finish TFA. Should of searched TFA first before posting. SIGH.

"Should have"

Duh!

[Smivs]

Can it be programed to remind you of your PIN?

Re:Duh!

[Anonymous Coward]

Just write it on the card.

Re:Duh!

[lwsimon]

Then people will be able to read it.

Idiot.

Soo...

[dasdrewid]

When I get my credit card stolen, I'll lose a $20 gadget instead of giving the thieves access to my $0.20 bank account or my credit card with fraud protection where I simply click "Report" on any charges that weren't mine (and I have something like a week to report it stolen, so even if I don't notice it immediately I'm still not liable)?

Also, this in no way stops credit card skimmers at ATMs, gas stations, etc., nor RFID readers.

The positive thing I see about this is the ability to program multiple cards into one card. I kinda like that. Even compared to putting it in my cell phone. If it's cold enough out, I'll have my cell phone buried deep and answer with my headphones (either corded or bluetooth), especially since it's a touchscreen and I'll be damned if I'm gonna take my cell phone out *and* take-off my gloves. Having 1 credit card that I could keep in an outer pocket, alone (so as not to be a target), would be nice.

Also, if I'm at a restaurant, I really don't want to hand my waitress my cell phone to take back to the back...

Re:Soo...

[Dog-Cow]

This is fractionally more secure than current CCs, and it allows consolidation. As someone who carries his cards loose in his pocket, I only see this development as positive. I hope financial institutions start supporting it.

Re:Soo...

[butlerm]

When I get my credit card stolen,

How often does that happen? I must be in a low crime area, because I never had a card stolen, ever. If someone stole my wallet, replacing a twenty dollar item would be the last thing I would worry about. And of course in mass production these gadgets will probably be more like five dollars, not twenty.

Re:Soo...

[cynyr]

it may also allow single use numbers by using a sequence known to your card and the bank, like those FOB authenticators.

Credit Card Fraud is not due to Stealing The Card

[HockeyGuy]

You don't see a lot of Nigerian CC Theives pickpocketing cards

Credit Card Fraud is not due to Physically Stealing the Card. Maybe back in the 1960's when people were using 3 piece paper receipts that had to be run through a manual stamper this card could have made sense but it is a waste of time to try to protect accounts this way.

Does anyone remember TJMax had a few million card numbers stolen
There are about 20 big hacks where millions of card numbers were stolen.

In addition some people use their cards with un-reputable merchants

The idea of putting a password on your card is bogus when most thieves never need physical access to your card to steal from you...

And this does nothing about companies that release personal data about you and your account to their "AFFILIATES"

Or the fact that every college and High School sells your personal data to list companies. THATS RIGHT ... DIRECTLY FROM YOUR SCHOOL RECORDS
Name address, birth date, parents names and more

The card is one more level of stupid
however it may protect you from your kid ordering crap off tv.

Why not add some security

[nullman]

If they are doing all of this, and a main issue begging to be solved is credit card number theft, why not just add one simple layer of security? Have the security 3-4 digit PIN on the card change every 5 minutes or so? Similar to how SecureID works. If the ID given does not match the current, previous, or next one on the credit card computer the transaction fails. I would also make the security pin longer to prevent random guesses from working. Add an exponentially increasing lock-out period for failed attempts (and maybe send an email and/or phone message warning after a couple fails) and that should do the trick.

Smudges on card will reveal the PIN.

[Last_Available_Usern]

Even if the numbers/strip are obscured without a PIN the finger smudges on the card over the commonly used numbers will make the PIN a trivial matter to guess. What is the point of this security? Would you not call in the card missing/stolen just because it has better security?

Re:Smudges on card will reveal the PIN.

[Prune]

There's a simple solution here--use permutation instead of combination (have say six to eight buttons where the sequence uses all of them once, but the order varies). That necessitates a longer PIN, but I think it's a minor inconvenience.

Re:Smudges on card will reveal the PIN.

[kaiser423]

Do like what they've done on very secure military installations since the 50's: You have a 9-pin keypad and the numbers are in different locations every time you go to enter the PIN. That way the places you press are completely random. I mean, we're talking about 9 buttons, it woudn't break to bank to have a little numeric display below them, right? Especially if you just use touchscreen input for everything it's no added cost, right?

Re:Smudges on card will reveal the PIN.

[Local ID10T]

Even if the numbers/strip are obscured without a PIN the finger smudges on the card over the commonly used numbers will make the PIN a trivial matter to guess.

Solution....wash your damn hands once in a while. That is just disgusting.

Re:Smudges on card will reveal the PIN.

[Nadaka]

randomize the location of the numbers to even wear and make location based tracking useless.

Re:Smudges on card will reveal the PIN.

[BitZtream]

Make the 'buttons' display numbers on them electronically, then just make the numbers move around every use.

Next

Re:Smudges on card will reveal the PIN.

[Raptoer]

Assuming you know which numbers are pressed you don't know the order.
4 digit pin = 4 factorial -> 24 permutations
5 digit pin = 5 factorial -> 120 permutations
6 digit pin = 6 factorial -> 720 permutations ...
9 digit pin = 9 factorial ->362,880 permutations

It's pointless to bother brute forcing it beyond 5 digits, since you have to manually input the digits.

Re:Smudges on card will reveal the PIN.

[ShooterNeo]

Another easy solution : time delay lockouts. Get the PIN wrong twice, and there's a 5 second delay. Get it wrong within 24 hours after the 5 second delay, and it's a 10 second delay. And so on and so forth, making it take many hours to break the code by guesses even if there were a small number of permutations.

Yeah!

[Anonymous Coward]

This is a great idea let's do it! Maybe the card will run Windows too for even better security - far out!!! Put ie6 on it too so I can surf the web in complete safety from active exploits.

No thanks

[pavon]

Because cell phones are buggy pieces of shit, and I wouldn't trust them with my credit card number and PIN for anything. Especially as they become more and more tied to the web.

Re:No thanks

[TooMuchToDo]

Yet they're going to be used for your boarding pass:

http://www.google.com/search?q=phone+boarding+pass

Re:No thanks

[sexconker]

Yet they're going to be used for your boarding pass:

http://www.google.com/search?q=phone+boarding+pass

How about, fuck you?
They sure as hell won't be used for my boarding pass.

Re:No thanks

[TooMuchToDo]

Then what? Not going to fly? Good luck getting across an ocean via boat in a reasonable amount of time.

Re:No thanks

[JesseMcDonald]

You'll still have the option of printing out a paper boarding pass. The airlines aren't quite stupid enough to exclude the majority of customers without the expensive smart-phone or PDA required to use the new system.

Visa CodeSure

[Mr_Silver]

Another has several buttons and a display in place of the card's number. Only after entering a PIN is the magnetic stripe populated and the full card number revealed, and after a short time both go blank again for security

Another way to do this is use something like Visa CodeSure which gives you the ability to enter a PIN on the card so that dynamic passcodes can be created. Commercially available now too.

http://www.visaeurope.com/en/about_us/innovation/visa_codesure.aspx

Too late...

[rickb928]

- EMV cards are actually gadgets. Very limited, no blinky lights and such, but has a CPU, encryption is performed on the card, and it doesn't need a mag stripe. Many don't ever get swiped.

- Mag stripes will be obsolete not long from now. Already, if you travel to Europe, many retailers refuse US cards without a chip, even though the terminal will read the stripe. It's all about risk shifting. Anything the issuers can do to avoid risk is good for them, so they want to shift risk to merchants or card holders. Merchants want to shift risk also. Guess who doesn't have any good ways to shift the risk elsewhere... Yup, customers. So European merchants hate mag stripes, and won't accept signature transactions if they can help it.

EMV adoption in the US is slow. Costs.

Re:Too late...

[berberine]

This is good to know because the only card I have that has a chip on it is my American Express card, which can't be used in Europe. My MasterCard is supposed to be getting one when it expires in 2011, but, until then, I'm probably going to have to bring a lot of cash with me when I travel.

Re:Too late...

[rickb928]

The Amex card is contactless, something they called ExpressPay, not EMV which is a contact chip.

If you need to travel to Europe or the UK, your bank can issue you an EMV card for the trip.

Now more fraud can be blamed on you.

[tekrat]

This is all just a way to make you pay for more and more. Card companies/Banks have to write off fraud, usually, and they hate doing this, so every new card gimmick that comes along will be aimed at making fraud more your problem and less theirs.

But it will also be used to make you pay for everything big companies won't. Let's create an example: Say you walk into Walmart and buy a pair of Calvin Klein jeans. You pay for the Jeans at the checkout. However, Walmart never pays the supplier, Calvin Klein (or the distributor). Thanks to all these shared records, the databases can track everything and one day you get a bill from Calvin Klein for the jeans you purchased at Walmart.

Sounds implausible right? I'm right now fighting with Direct TV for services I purchased through Verizon. Verizon didn't pay Direct TV, so Direct TV is billing me instead, even though I paid Verizon. I never got a Direct TV bill before this one. I was never their customer (directly), I was a Verizon customer. And yet here I am, stuck with the bill.

Trust me, my above example at Walmart may be implausible now, but 5 years from now it'll be commonplace to see the average joes being shafted at both ends by large companies. This card is one more step towards that end.

Re:Now more fraud can be blamed on you.

[Anonymous Coward]

Would that work for physical goods? I was under the impression that brick-and-mortar locations such as Walmart bought product from a vendor then resold them. Calvin Klein wouldn't care if you bought them from walmart, as Walmart already paid CK for the items. The CK price would be included in the Walmart pricetag.

Re:Now more fraud can be blamed on you.

[Anonymous Coward]

I suggest you go back and read the agreement you signed with Verizon. We had similar cases around here, with several people writing to the newspapers and such complaining about how they were being ripped off. The local consumer protection bureau looked into it, and in each case it was the customer, not Verizon or DirectTV, who was at fault.

Here is what happened: Verizon was rolling out their FiOS system, and in order to compete with cable companies they wanted to offer TV. However, local laws and franchise agreements meant they couldn't do that immediately. So what they did was offer TV, but until such time as they were allowed to provide a TV signal they contracted with DirectTV. The agreements the customers signed said that DirectTV would be provided UNTIL Verizon was able to have it's own TV delivery. At that point, the customer must contact Verizon to arrange for the return of the DirectTV equipment, and the delivery of a Verizon 'cable' box. Regardless of whether or not the customer actually did this, Verizon would no longer pay DirectTV, as it was now providing it's own signal. Go back and look at the mailings you got from Verizon, and you will probably find this is what happened, and you did not take the action required.

As for your other scenario, that would just be plain old fraud. Take off the tin-foil hat please.

Re:Now more fraud can be blamed on you.

[BitZtream]

As silly as this sounds, Walmart isn't nearly as evil as Verizon and DirectTV. Verizon is a phone company, know for being evil. DirectTV is a failing business that pulls any scam it can trying to stay in business, much like XM/Sirius radio, who recently billed my CC after being told not to because I wanted an invoice and no automatic deduction ... then when I called to get that fixed, they told me they couldn't give me a refund because they didn't have my CC number ... and they couldnt' give me a full refund since I had the service 'activated' for a couple of days ... even though I have logged several calls complaining that the radio never re-authorized regardless of how long I left it on.

In your particular case, if verizon doesn't have something signed saying you'll pay them, then you can tell them to stuff off. If they put it on your credit, sue them in small claims.

If you just bend over and take it then yes, everyone that can get buy with it will fuck you in the ass.

Re:Now more fraud can be blamed on you.

[Anonymous Coward]

I feel your pain. I am in the process of fighting my wireless provider, who is billing me on behalf of some shady "content provider" I've never heard of, who claims we somehow opted in to a subscription (we haven't). The wireless provider happily bills for this, presumably taking a cut for itself, but disclaims all responsibility saying that it is up to me to contact this vendor and convince them to stop charging me.

The sad situation is that your mobile phone number is effectively a credit card, and anybody who learns your mobile number can pile fraudulent charges against your good name, with no consequence.

Re:Now more fraud can be blamed on you.

[Raptoer]

For physical products then wouldn't that be Walmart stealing? Or at least a breach of contract. If Walmart had a contract with the manufacturer saying that the manufacturer would be paid when the item is sold, and Walmart doesn't pay... The manufacturer doesn't have any right to ask you for money. You had an implied contract when you bought the item. Walmart has an contract with the manufacturer. You have no relation to the manufacturer.

Services are a little different as it's a continual transaction. At most when Verizon doesn't pay DirectTV it would cause a breach of contract between Verizon and DirectTV. DirectTV can then turn off your service causing another breach of contract between you and Verizon. DirectTV billing you should (in a rational world) be illegal, you never had a contract with DirectTV.

DirectTV can ask, but they have no right to demand payment. I'm not saying you weren't billed by them, but if I couldn't get them to withdraw the bill I'd just ignore it. Anything beyond that is stealing.

One Time Password Credit Card Numbers

[Doc Ruby]

The most useful change in credit cards would be giving buyers a stack of one time passwords, each one issued to the vendor tied to the specific parties and dollar amount of the transaction, with a short expiration date.

The best way to do it would be a smartphone app that took a token from the vendor, the vendor's ID (another onetime string from a vendor pool of onetime ID#s), encrypted it with the dollar amount and a onetime ID# from the buyer's pool, and sent it over the network to the credit corp. The credit corp would decrypt it and credit the vendor's account. That way no ID info is shared that can be reused.

If they want to make a physical credit card that does those things once connected to a network (like a chipcard), great. Let them put a fingerprint sensor and PIN on the card, along with a display of the available credit remaining and outstanding balance to date. But the one time passwords are by far the most value to deliver to the consumer, and therefore to the vendor, too.

Where Is the Business Case for This?

[tyen]

As long as merchants still pay for credit card fraud, where is the business case and incentive for the card issuers to adopt this technology as they are currently laying off the risk and the benefits for adopting do not accrue to them while they incur all the costs of adoption? As a consumer, I would purchase this just to collapse all my mag-stripe cards (not just credit/debit) to one card that was secured with a PIN that I could change myself, if it could be sold that way.

Re:Where Is the Business Case for This?

[allawalla]

Its always nice to have a reminder of how much cash you don't have in your wallet when you are using plastic. I would think a lot of people would be willing to spend a $ a month for a card that displayed their balances in real time on them

Re:Where Is the Business Case for This?

[CynicTheHedgehog]

I'd love it if my credit card stored a history of my transactions and I was able to bring it home and upload them to my accounting software. That way I could easily compare the transactions my bank thinks I made vs. the ones I know I made without having to use paper receipts. And all those coupons you get from the grocery store could be uploaded directly to the card and automatically applied on the next purchase (provided they haven't expired). The cost savings on printer ribbon would be huge and the time savings at the checkout queue could possibly lead to a reduction in manual labor (and an increase in overall customer satisfaction). Survey codes could be embedded into the receipt as well, and could open automatically in your browser when clicked on.

If I'm not using cash I don't see the need to deal with any paper at all, especially not a meter-long strip of paper folded fifty times.

Re:Where Is the Business Case for This?

[Anonymous Coward]

Nope, won't happen. The CC corps want us to spend money/go into debt. A convenient means to get to your real time bottom line is not in their best interest.

Re:Where Is the Business Case for This?

[CynicTheHedgehog]

But it is in the best interest of merchants (faster flowing queues, less money spent on ink and paper), so perhaps we can appeal to their greed. This is basically most useful on a debit card; generally banks like it when you keep a positive balance and get really ugly when you overdraft.

However, even credit card companies wouldn't be hit that hard. Ever notice how your balances from them always shows how much *more* you have to spend and how payments are the parenthetical/red items on your statements? Same thing applies here. If you're apt to go into debt then *how much* you are in debt doesn't really matter until you're close to your limit, in which case credit card companies are more than happy to shut you down.

I was idly thinking about this the other day

[CrazyJim1]

What if the US did away with cash, and instead we started using credits like scifi? Well at first you'd think you'd carry a credit card around, and maybe a device to transfer credits from one to another with an indicator of how many transfer so no one cheats? Then I figured the device could be on the card itself, and two cards interact in a certain method.

Wouldn't it be great to be able to look over how a politician obtains and spends his money? Public officials should lose their privacy while they're in office and all their money transactions should be able to be scrutinized.

Illegal sales like drugs would be more difficult to do because if someone gets caught by the police, the police could then scan the offender's device and see all of his contacts.

Of course you automatically upload to the IRS every tax season at least and FBI maybe more. I'm thinking with cell phone capabilities, it could auto network.

I guess there are a lot of downsides to this too that I'm not seeing, but since it has some good points its worth at least idly talking about. What are some downsides we'd have if we moved to an all credit system? I guess one would be the worry that the government could seize your money with a few clicks. Or maybe two would be hackers.

Re:I was idly thinking about this the other day

[CrazyJim1]

I guess people would just start doing illicit stuff with a different currency like pesos or something. I didn't think this through, I was just wondering.

Re:I was idly thinking about this the other day

[natoochtoniket]

The "cash" economy includes lots of activity, not just illegal sales. Lots of "unbanked" people conduct all of their transactions in cash, and many of them can't or don't keep records. Think, lawn service, tree trimmers, the guy who sells water mellons fro the back of a pickup truck, the immigrant laborers who re-roof your house. A surprising fraction of people are illiterate (unable to read or write). An even larger fraction of all people are innumerate (unable to use numbers).

Without "cash", your lawn doesn't get mowed, your car doesn't get detailed, your trees don't get trimmed, you cannot buy fresh food, and your roof will leak. It isn't because you can't pay for them. It's because the sellers of those services cannot receive payment in any other form.

Re:I was idly thinking about this the other day

[BitZtream]

The only advantage virtual currency has over physical non-traceable currency is that virtual currency can be used electronically.

Otherwise virtual currency is worse in every way and offers no other advantages.

The idea that 'fraud' can be prevented is simply bogus as there are plenty of people who loose money, through no fault of their own, every day when card companies refuse to handle it properly.

You can't take my cash without prying it out of my hands, and its relatively hard to trace my cash flow with physical currency.

You may not care, but I really don't want people knowing what I do, even if I don't do anything illegal.

Re:I was idly thinking about this the other day

[Anonymous Coward]

Most of your 'upsides' sound like downsides to me, actually.

Also, did you know that Siem Reap, Cambodia uses U.S. currency? Do they get sci-fi cards too? Can any country sign up, even if they can't pay for the cards or the system?

Now, doing away with the cash system And the credit system, maybe...

I just paid $2 for green tea (about 4 ounces tea + ice + water to top it off... in a reusable cup I also bought from them) at Starbucks.

Tomorrow I am going to pay them with about 4 ounces worth of sea shells and some beads.

Re:I was idly thinking about this the other day

[lwsimon]

I'll never, ever do this. It's a civil liberties issue.

Re:I was idly thinking about this the other day

[Anonymous Coward]

how do you drop a few coins in a beggars hand? How do I tip my paperboy/kid who mows the lawn. (under 16s generally don't get credit cards, debit cards what-have you. Though I admit that is slowly changing, but for now, most under 16s I know don't even have a bank account unless it's a savings account in thier name set up by older family)
How do I slip some cash into the strippers g-string? How do I buy porn, drugs, medication, pay a prostitute or play the slots anonymously?
The cash economy is vital for the "underground" economy and the underground economy not only isn't as illicit as you might think. It's bigger as well.

Re:I was idly thinking about this the other day

[GrumblyStuff]

Wouldn't it be great to be able to look over how a politician obtains and spends his money? Public officials should lose their privacy while they're in office and all their money transactions should be able to be scrutinized.

Certainly. ...but we all know that they won't be the ones being scrutinized.

Re:

[clint999]

I didn't read the post title... I thought that this comment was referring to the part where you can enter a pin to make the mag strip work. My bad...

woot

[Anonymous Coward]

cash, credit, or bioscan?

Old Skooool

[Fizzl]

Magnetic stripe huh?
I think I haven't used that part of my card ever. This was issued in ...2008.
It's secure chips and online verification all the way in scnadinavia now. Helpfully, it is hard to overrun your bank account with a debit card this way. I wonder if this was deployed for my or the banks safety?

Re:Old Skooool

[berberine]

It's still mostly magnetic strips in the USA. There are a few chip and pin uses and a few more RFID swipes, but magnetic strips still rule the land. When I visit Kmart or Sears, I use my magnetic strip and it asks for me to type in my zip code (post code) for verification. Staples (an office superstore) asks to see the card and they punch in the last 4 digits of the card for verification.

I don't see the magnetic strip changing any time soon. Most people I know don't even know what a secure chip is and probably wouldn't even understand why it's more secure even if I explained it to them.

walmart already does something similar

[Chirs]

According to an article I read, Walmart currently doesn't actually take ownership of their inventory until it is sold. That's right...they don't pay the manufacturer until they've already sold the item.

Brilliant way to leverage market dominance into increased interest earnings by holding onto their money a while longer.

Re:walmart already does something similar

[bws111]

It doesn't matter though. Walmart (not the consumer) is still on the hook to pay their suppliers. If they don't, the supplier will go after Walmart. The only way CK could possibly come after an individual consumer was if they claimed that Walmart never had the authority to sell the jeans in the first place (ie they were stolen from CK), and that the consumer had stolen goods. If that were the case, then Walmart would be criminally responsible for theft and would have pulled a massive fraud on the consumer and would be sued into oblivion. There is no way that sort of scenario is going to be commonplace.

Re:walmart already does something similar

[mentil]

It's called consignment and it's a common way for indie musicians to get their CDs into music stores, so that the store doesn't take a risk buying something that won't sell. For Walmart it means they don't have to bargain-bin overstock, an arrangement I'm sure every retailer would enjoy if they had enough power to demand it.

Built-in biometrics?

[sharkey]

We'll finally be able to "swipe" the card for tipping at the strip club now?

Re:Built-in biometrics?

[Locke2005]

Haven't you noticed that all the strippers already come equipped with a card slot?

Re:Built-in biometrics?

[sharkey]

Yeah, then I hit the sidewalk. At least I beat the 3 drink minimum!

Keypads are not secure in such cases.

[Arancaytar]

On a keypad that is used to enter only a single combination, wear patterns can leak information. That's one advantage the ATM's keypad has over one on your personal card.

An advantage of entering the PIN on the card's keypad, on the other hand, is that it cannot be gleaned by a fake ATM machine.

Interesting physics

[GerryHattrick]

'Populate the magstripe' - er, how's that done in accordance with international Standards for machine-readability of encoded digits on each track? And who cares, when the only half-good security nowadays is on a chip which is already there?

What if it gets wet?

[pkinetics]

Having run my wallet through the wash numerous times, will it still function?

Am glad I'm down to 1 credit card.

Biometrics in a credit card? Not for me.

[Anonymous Coward]

"Give me your wallet... and your eye" is not a phrase I'd like to hear.

Would the credit card companies go for it?

[bubblegoose]

Would some of the credit card companies go for something like this? I would guess they like having a piece of plastic in your wallet that you might look at on a fairly constant basis. Free advertising and a reminder to charge more on card XYZ.

I once read that is the reason that credit cards have a 2 or 3 year expiration date. They could last longer and they know they could save money shipping and producing, but the card refresh is a chance to get the card in front of you again in the hopes that you will use it more.

Imagine a Beowulf cluster of these

[Anonymous Coward]

But does it run Linux?

not gonna happen

[mentil]

Not with retail stores at least; you don't have to pay Calvin Klein because you never signed a contract with them. The only reason you have to pay Walmart is due to shoplifting laws, not contract law. Conversely, you signed a contract with Verizon and that presumably contained a contract with DirectTV as well buried in fine print, in another document they never sent you but you could've mailed to ask for, or was contained in those 'terms which we may change at our discretion without notifying you'.

Credit Cards don't think!

[dominious]

and they don't like anthropomorphizing either.

CASH is still king. Here is why.

[aristotle-dude]

1. CASH is always the same speed.

Think of those times when you were in a hurry and you were stuck behind some someone who enters in the wrong pin or chooses the wrong bank account type when they were buying items that cost less than 20 bucks. What if there was a network error? Had they used cash, you would have been out of there long before they finally got the transaction to work.

2. Cash is accepted everywhere.

Not every place accepts Visa or Mastercard and a lot of places do not accept Amex. Some places do not accept debit cards for logistical reasons (ferries, planes and many taxis). Cash is generally accepted everywhere.

3. Cash does not carry a per transaction fee when traveling in a foreign country.
  Most credit cards charge a fee per transaction on top of their poor currency exchange fees which is why I take cash with me when I travel to Europe, the States or Japan. In fact, Japan is still very much a cash based society outside of their PASMO/SUICIA system for convenience stores and trains/transit. Don't expect your North American credit or debit card to work over there.

4. Cash is easily transferable between people.

You can lend/give cash to anyone but you cannot do the same with a credit/debit card.

Bah...there's an app for the...

[jduhls]

oh...no there's not. Why, again?

Re:

[clint999]

Think of it this way: it's just like with a computer

credit cards that thing they are gadgets

[Anonymous Coward]

we had been brought as consultants to small client/server startup that wanted to do payment transactions on their server ... the startup had also invented this technology they called "SSL" they wanted to use; the result is now frequently called "electronic commerce"

somewhat as a result, in the mid-90s, we were asked to participate in the x9a10 financial standard working group which had been given the requirement to preserve the integrity of the financial infrastructure for all retail payments (aka debit, credit, stored-value, gift-card, face-to-face, point-of-sale, internet, high-value, low-value, contact, contactless, wireless, transit turnstyle, aka *ALL*) which resulted in the x9.59 financial transaction standard. Part of the standard was slightly tweaking the existing paradigm to eliminate skimming, evesdropping, data breach and other similar threats involving harvesting "static" data for performing fraudulent transactions (did nothing to prevent such activities, just eliminated threat that such activities could use the information for performing fraudulent transactions). Part of x9.59 is format agnostic and allowing authentication proportional to risk (i.e. possibly single-factor for low-value ... and exact some components also doing various levels of multi-factor authentication for higher values).

The cost for such components could be deployed in such away that the aggregate, overall infrastructure expense is less than current paradigm ... and has sufficient integrity that the cost to compromise would always be higher than any expected resulting fraud (standard is also format agnostic).

Part of the issue is in the current infrastructure, major portion of existing fraud is born by merchants (in the form of various fees and other charges). Raising the bar on existing retail payment fraud would likely drive the crooks to switching to attacks involving opening new accounts (rather than attacks on existing accounts) ... including using "synthetic ids" (no actual corresponding person) ... which would shift all of the burden to the financial institutions.

biometrics already done

[Anonymous Coward]

> I wonder how long it'll be until somebody builds onboard biometrics into one of these things.

We did it more than 5 years ago. Our company failed because the product was priced too high for the market. Our cost to PRODUCE it was an order of magnitude higher than current dumb cards.

Make it more fun: use a slide-toy-puzzle

[squidinkcalligraphy]

At least for RFID, this would be much more fun:

http://www.reddit.com/r/reddit.com/comments/cyeiz/reddit_i_present_to_you_my_superfun_idea_for_rfid/

Credit Cards That Think They Are Gadgets

[unitron]

Well, I remember hearing about the first ones being used as lock picks.