Startup Touts All-in-One Digital Credit Card

First time accepted submitter NoImNotNineVolt writes "Coin, a Y Combinator-backed startup, has started accepting pre-orders for a device as slim as a standard piece of payment plastic that can hold eight credit, debit, and gift cards in its dynamic magnetic stripe. Paired with the Coin smartphone app via Bluetooth low energy, card details can easily be swapped in and out of the device. A minimalist user interface on the device itself allows the owner to toggle between the loaded cards and then swipe just as they would their ordinary card. All card details are encrypted (both on the device and in the smartphone app), and the device's on-board battery is expected to last for two years of typical usage. No support for chip&pin (EMV) yet, so this may have limited utility outside of the USA. They expect to start shipping in summer of 2014."

Comments

Cool.

[Anonymous Coward]

One thing to steal to be someone else!

Thats awesome.

Re:Cool.

[Joe_Dragon]

my precious

Great for CC scammers

[hsmith]

Now an all in one solution to skim and use credit cards.

But, I don't see this catching on. Tapping to pay with your device is "new" so people don't think much of it. Paying with an "all in one" credit card isn't something most will be used to. Plus, I'd expect pushback from Visa/AMEX on this.

Re:Great for CC scammers

[NoImNotNineVolt]

Can't skim cards [easily] with this. Apparently to "load" a new card, you've gotta snap some pictures of it and swipe it through the [included] card reader. And the card has to be in your name.

I suppose you can create an account in the name of the victim, then snap pictures of their card, then swipe it... But that's not exactly the best skimming solution I've heard of.

Re:Great for CC scammers

[fuzzyfuzzyfungus]

Is there any established precedent(either in law or in contract dickery that has come to light) about using cloned cards for transactions?

Obviously, cloned cards can be a fraud tool, and fraud is illegal; and obviously most people have neither the tech nor the interest to clone mag stripe cards; but does Visa give a damn if I clone my card and swipe the clone, instead of the one they mailed me, at the point of sale? Do they claim some sort of 'despite all appearances to the contrary, card remains property of issuer, etc, etc, yadda, just shut up and swipe' clause? Have they ever been tried on that point?

There has never been anything magic (aside from convenience, getting a full-color printed, shiny holograms, embossed characters, encoded mag stripe, card in quantity 1 costs a hell of a lot more than quantity 1 zillion) about the card itself, nor do mag-stripe cards have any secrets embedded (unlike chip-and-pin, which theoretically, like a SIM, contains values that should never leave the IC under any circumstances short of silicon-level attack), and a lot of transactions occur with nothing more than the card number, since they go over the web.

I assume that if they do care, their easiest point of attack would just be to be enormous rules-lawyering dickheads about every last detail of PCI compliance, which would likely make the server/app side of things virtually impossible; but would the card-cloning itself, if not used for already illegal fraud of some kind, be an issue?

Re:Great for CC scammers

[cheater512]

Quick little dive in to the code with a debugger and watch those limitations vanish in front of your eyes......

Re:Great for CC scammers

[NoImNotNineVolt]

That's a very valid point. Hopefully not valid enough for my pre-order to be worthless :(

Re:Great for CC scammers

[i kan reed]

Sure, but with those skills, you could program the skimmer drivers in the first place.

Re:Great for CC scammers

[fuzzyfuzzyfungus]

What I don't know, and a secondary question to what I was asking about the history of non-fraud card cloning, would be "Will Visa/AMEX see this thing as a threat, or an ally?"

They likely have the power to seriously derail it(at least the software side); but if they are more worried about non-CC-based competitors cutting in on their action, with phone-based payments, or paypal QR code scanning, or some such nonsense, a different variant seems to pop up about once a week, they might actually welcome somebody stepping up to make mag-stripe cards more pleasant and convenient at no cost or risk to them.

If they are in a purely defensive/reactionary mode, for its own sake, or suspect that this is just step 1 to the creation of some alternate payment scheme that cuts them out of the equation but is backwards compatible with mag stripe hardware, they might decide to play hardball, and if they do, the PCI compliance guy for this company had better stock up on vodka and valium now; because he'll need them. If not, though, these guys aren't obviously more dangerous, just more sophisticated, than leather companies that produce wallets with lots of little card pockets.

Re:Great for CC scammers

[cayenne8]

What exactly is Chip & Pin?? It was mentioned in the article..something about it being used outside the US...

Re:Great for CC scammers

[wiredlogic]

Vendors are not supposed to accept card without a valid signature on them. That alone would place them in breach of contract with the credit issuers and card processors if they accepted a cloned card.

Re:Great for CC scammers

[viperidaenz]

If Visa find out you cloned your card and someone uses that clone to defraud you, you'll can bet your ass Visa will make you liable for their fraudulent charges.

Re:Great for CC scammers

[swimboy]

http://lmgtfy.com/?q=Chip+and+Pin

Re:Great for CC scammers

[NoImNotNineVolt]

I never understood the reasoning behind that. I have never signed any of the card I've ever had.

If someone happens to gain possession of your card, do you also want to give them a template of your signature so they could practice their forgery?

Good luck getting a chargeback when the charge receipt has your signature on it. Fuck that.

Re:Great for CC scammers

[Anonymous Coward]

I was thinking of the other way, now when I give my card to the waiter, they have access to 8 credit card numbers instead of 1.

Re:Great for CC scammers

[fatphil]

Are you being ironic? I'm guessing you are. If so, your implications are that others (in the US) might not be aware of it - in which case, they can work down this checklist, and identify where the confusion kicks in:

- You know what a chip is (in the context of IT)?
- You know what a PIN is (likewise)?
- You've seen cards (e.g. payment or identity cards) with chips in?
- You've seen people type in their PINs in order to use those cards with chips in?
- If you've made it here, then you know what chip and pin is.

It's technology from last decade (though it was growing steadily during the decade before too).

Unlike magstripe, which is 80s technology (and which too was growing steadily the decade before that).

You've got my mind wandering now - I've just persuaded myself that the dimensions of magnetic stripes must be specified in imperial units... ;-)

Re:Great for CC scammers

[fuzzyfuzzyfungus]

What if it were a signed clone?

I don't doubt that getting a real person to accept a blank, white, cheap 'n nasty 'n barely ISO 7813-compliant card as a "real credit card" would be a difficult task; but what I don't know is what history, backed by legal or contractual force, there is (if any) concerning not-otherwise-criminal use of cloned cards.

Do merchant contracts also require Visa/Amex logos/trademarks on accepted cards? Do the feds or any states consider cloned cards to be presumptively instruments of fraud? That sort of thing.

Re:Great for CC scammers

[fatphil]

Aaaaaaargh, I was right!!!!!!!

"""
Tracks one and three are typically recorded at 210 bits per inch (8.27 bits per mm), while track two typically has a recording density of 75 bits per inch (2.95 bits per mm).
""" :-(

Re:Great for CC scammers

[Anonymous Coward]

does Visa give a damn if I clone my card and swipe the clone, instead of the one they mailed me, at the point of sale?

Yes, it's called card not present.

Re:Great for CC scammers

[khellendros1984]

The cards have a smart-chip in them. The data on the chip is encrypted, which makes it much more difficult to counterfeit with a credit card skimmer. As a second authentication factor, the cardholder punches in a PIN. This style of card is becoming more common in Europe right now, and a lot of automated terminals won't take a card that only has a magnetic stripe, apparently.

Re:Great for CC scammers

[WaffleMonster]

I assume that if they do care, their easiest point of attack would just be to be enormous rules-lawyering dickheads about every last detail of PCI compliance,

With regards to PCI why would these guys have to care? PCI is not law and the only teeth PCI compliance has comes in the form of merchant relationships issuers/card vendors. If your not in that path industry can make all the rules it wants and you are free to ignore them because they can't touch you.

Re:Great for CC scammers

[c0lo]

What exactly is Chip & Pin?? It was mentioned in the article..something about it being used outside the US...

It's a colonial contraption meant to do something nasty to America. Don't use it.

Re:Great for CC scammers

[xaxa]

This style of card is becoming more common in Europe right now, and a lot of automated terminals won't take a card that only has a magnetic stripe, apparently.

It is almost universal in Europe (95% of terminals, 85% of cards, two years ago), and plenty of other countries. A card with a chip is almost essential if you travel to Europe -- I can't remember the last time I saw a ticket machine (or similar) accept a magstripe.

http://www.creditcards.com/credit-card-news/american-travelers-guide-emv-chip-cards-1271.php is informative. I'm not convinced by '"In fact, as a late adopter of EMV, there's a great upside for the industry in the U.S. because we can avoid much of the cost and complexity involved in deploying older-generation chip cards, while still reaping all of the benefits of reduced counterfeit fraud,"' -- the US industry has had 10 extra years of fraud! (I have to phone my bank before using my card in the US, and give them the dates I will be travelling. Numbers are stolen in Europe, and used on fake cards in the US.)

Re:Great for CC scammers

[Anonymous Coward]

I would hope they'd see it as an ally and an eventual way to drastically cut back on mailing out cards. Imagine how cool it would be to be able to get one of the devices at the local Wal*Mart and then download your credit cards directly from your bank's online banking interface. No insecure mail followed by an IVR call to verify that you've received the card.

It would also be significantly easier to implement more expensive security features with a single card. Sure, the fingerprint scanner on the iPhone isn't entirely secure, but if it could be added as an additional security element to the card such that you needed both your phone plus a fingerprint to use the card, it would make it that much harder to use a lost card. Consumers might pay $5 for a card that allowed them to carry only that card, was more secure.

There's a ton of possibilities that are opened up by a card like this.

Re:Great for CC scammers

[mrchaotica]

My credit card signature is "See Photo ID."

Occasionally, the cashiers even check it!

Re:Great for CC scammers

[tlhIngan]

I never understood the reasoning behind that. I have never signed any of the card I've ever had.

  If someone happens to gain possession of your card, do you also want to give them a template of your signature so they could practice their forgery?

  Good luck getting a chargeback when the charge receipt has your signature on it. Fuck that.

Technically, it's not a comparison template.

The signature on the card signifies you agree to the terms and conditions of your cardholder agreement. I.e., it's the acceptance of those terms between you and the issuer.

The signature on the slip signifies you agree to pay the amount shown on the slip. It's a contract between you and the issuer that you agree to pay the amount shown on the slip.

If one or the other isn't signed, the merchant bank could easily not pay, since the card was not valid at the time of transaction.

Of course, over time it got perverted to people thinking it was a comparison template.

Legally, if it doesn't have a signature, or if it has anything other than a valid signature, the merchant has a right to destroy the card as it's invalid.

And in theory, if your card wasn't signed, you could chargeback all the charges on it since it was invalid. But good luck finding a court who'll agree to it on technicality terms.

Re:Great for CC scammers

[Amouth]

I don't think the issue is so much with having a skimmer. Right now if i show up with a card that doesn't look like an actual CC the person at the counter will think something is up. But if this gets going and has blessings of the CC makers, and looks official the teller will just say "hey he has that neat new card" and not care that you are no infact using a skimmer.

Re:Great for CC scammers

[Anonymous Coward]

A card with a chip is almost essential if you travel to Europe -- I can't remember the last time I saw a ticket machine (or similar) accept a magstripe.

Reality check about "almost essential" – I travel to Europe quite frequently. This year alone I've been to London, Brussels, Geneva, Zurich, Vienna, Brno, plus Bangalore and Tokyo. (Not bragging, just saying'. And yeah, I'm sure lots of people have been to even more places than I have.)

I've never (never, ever, ever) had an issue paying for things with my non-chip-and-pin American credit cards. Hotels, train tickets, cab rides, meals in restaurants, buying souvenirs, food in grocery stores, and withdrawing cash from ATMs. I don't know where people get this idea that you have to have a chip-and-pin CC to get by in Europe. It's just not true.

Re:Great for CC scammers

[xaxa]

I don't know where people get this idea that you have to have a chip-and-pin CC to get by in Europe. It's just not true.

I live in the UK, so examples of things you wouldn't be able to buy with a card include:
- train tickets (you'll need cash, or else a long queue if there's a human option)
- car parking (sometimes cash won't be an option, though that's rare)
- occasional smaller businesses (shops, restaurants) who will want cash instead due to the fraud risk
- any other ticket machine (e.g. cinema)

OK, it's more of an inconvenience than a necessity. It's ridiculous that the US has barely started to use the system though -- it's almost 10 years old.

(I don't think Brno is much to brag about...)

Re:Great for CC scammers

[geekoid]

something invented in America in the 70's use imperial? shocking.

Re:Great for CC scammers

[Anonymous Coward]

In my experience it's:

Reality check about "almost essential" – I travel to England quite frequently. I've often (often, often, often) had an issue paying for things with my non-chip-and-pin American credit cards. Hotels, train tickets, cab rides, meals in restaurants, buying souvenirs, food in grocery stores. I know where people get this idea that you have to have a chip-and-pin CC to get by in Europe. It's true.

I've had people refuse to access a card without a chip, had places where only one person knew how to deal with a mag strip card, had places where the only mag strip reader was tucked away in a disused corner. It may be that if you only go to places that are expecting a large amount of trade from Americans then you'll not see a proble, but if you go to other areas you're in for a surprise.

Re:Great for CC scammers

[tirerim]

I just spent two weeks in Italy, plus a couple of days in Ireland, and did not encounter a single place where my magstripe cards were not accepted. This included several ATMs, a couple of train ticket vending machines, and a few retail point-of-sale terminals. I did use cash for a lot of transactions, but unless I was just lucky every single time, I am not very convinced of the supposed universality of chip and pin.

Re:Great for CC scammers

[jrumney]

and obviously most people have neither the tech nor the interest to clone mag stripe cards;

I'd be very surprised if the criminals couldn't get their hands on the equipment. It is widely available and not particularly expensive.

Re:Great for CC scammers

[Just Some Guy]

Your card is invalid. If and when some clerk refuses to accept your unsigned card, please understand that you're in the wrong and he's just doing his job.

Re:Great for CC scammers

[Anonymous Coward]

Legally, if it doesn't have a signature, or if it has anything other than a valid signature, the merchant has a right to destroy the card as it's invalid.

I don't buy that one. It's not the merchant's property to destroy.

Re:Great for CC scammers

[DarwinSurvivor]

With all the personalizable cards out there (email them a picture and they make it the background of the card), many credit cards don't look like "regular" cards anyways. About the only thing that would give it away (and be difficult to change on-the-fly) would be the embossed numbers. Since the numbers on the front are never presented electronically at any time to the cashier would never know if you simply used fake numbers and only changed the electronic part.

So basically, the CC companies have already destroyed the "fishing looking card" reflex. This is just new (potentially cheaper) hardware that you don't have to solder together yourelf.

Re:Great for CC scammers

[DarwinSurvivor]

No, but the merchants would be in danger and could potentially refuse to let you use it.

Re:Great for CC scammers

[adolf]

Meh. It's his signature, and he can draw it any way he wants to.

Re:Great for CC scammers

[quacking duck]

OK, it's more of an inconvenience than a necessity. It's ridiculous that the US has barely started to use the system though -- it's almost 10 years old.

The US hasn't switched to metric system or dollar coins yet. Partly due to cost, partly due to "things works fine the way they are," and I suspect partly because they must be "leaders" in everything and can't be seen as "following the rest of the world."

I predict that the US still won't have fully (or at least 99%) converted to chip&pin credit card terminals (even with magstripe fallback) by 2020.

Re:Great for CC scammers

[peragrin]

I don't ,chip and pin have known flaws, are barely more secure than regular cards, and new the majority of new terminals aren't even the NFC swipe it over type after 10 years.

Let alone at the end of the day each transaction takes longer than magnetic strip ones. I have yet to see a compelling reason.

I had a card that used NFC to tap and go. in general the average transaction took just as long to do as handing my card over or swiping the card myself.

Re:Great for CC scammers

[mishehu]

Here they tend to not even look at the signature and go straight to the "show me id" stage. I do have a problem with that, and it usually involves me getting delayed while they have to call a manager over to give them permission to check my signature. They like to claim it's because they can't understand what is written on my signature... since when is that a requirement?

Re:Great for CC scammers

[aaronb1138]

Skimming will be easy. Listen for the RF or similar EMF when the card remags the stripe. I pointed this out about the Geode back when that was the hot POS (http://www.kickstarter.com/projects/1404403369/geode-from-icache). Hell, you should be able to do it from dozens of feet away, no more need to get close to someone's wallet.

Hey, can I be a famous hack (the older academic definition) like Ang Cui if I can demonstrate a simple means to listen from 10-20 feet away to the amplifier circuits on iPhones / iPads / Droids when reading from a Square or PayPal scanner... keep in mind the audio circuits in a phone are not made to be shielded the way an ATM card reader or similar is.

Re:Great for CC scammers

[richlv]

it depends on the card. if you have a card w/o chip (haven't seen them in europe... for a long time), it might work. if your card has both, there are almost no places where magstripe will work. can't recall a single place that was not using chip in the last couple of years

Re:Great for CC scammers

[Eugene]

*barely more secure*? EMV cards can't be copied, modified, or counterfeited if the Card Authentication Method (SDA/DDA/CDA) are implemented propertly. The Application Cryptogram generated by the card and host also means the transaction itself is secure (assume proper card and host implmentation).

Magnetic stripes has no protection at all. US is probably the last major country that hasn't go full chip technology.

Re:Great for CC scammers

[Anonymous Coward]

Signing the back of the card is your presented legal acceptance of the terms and conditions of the card itself, as the cardholder. Without that, the business that charges your card may have no legal claim to the funds you promised, since in their eyes you did not clearly and visibly accept the terms of the card. Legalese is more precise than you'd think, can vary by country/state/county/city/district, and you're naive to believe otherwise. If you ever decide to pursue an American law education, in any capacity, you will quickly learn that proof of expressed agreement means a lot in a courtroom, and that's all that really matters for most transactional disputes.

Re:Great for CC scammers

[swillden]

I predict that the US still won't have fully (or at least 99%) converted to chip&pin credit card terminals (even with magstripe fallback) by 2020.

The US is going to contactless chip & signature, and it's going to happen a lot faster than you think. Visa and MasterCard have announced they're imposing the liability shift in 2015, which will give merchants a huge incentive to deploy the new technology. Meanwhile, Google has finally figured out how to stop carriers from blocking Google Wallet, and opened up NFC on (new) Android devices to other players by offering open APIs, Apple has been quietly doing something with NFC for about two years now, ISIS has rolled out nationally (though barely making a splash as yet). Both sides of the tech are just 1-2 years from ubiquity.

Re:Great for CC scammers

[Anonymous Coward]

I live in Germany and I use my Amex with magnetic stripe almost every day. I have two Visa's with EMV chips (but no pin) that I am forced to use (with magnetic stripe) the same frequency that I would if I lived in the US. There's no real reason to move to a pin and chip solution because it's no more secure than a magnetic stripe. It's laughable to assume that the data can't be swiped and written to another card (something you have), so it then comes down to something you know (the pin). People already install skimmers, it's no more difficult to install a pinhole camera, an overlay keypad, or just watch someone punch it in to grab the pin too.

Re:Great for CC scammers

[bloodhawk]

I also travel to Europe a lot, I have a swipe card and a chip and pin one. much to my frustration I left my chipped card in my hotel safe one day and wouldn't you know it that was the day I had 2 instances of not being able to pay with my magstripe card. maybe it isn't common, but it does happen. For me it was on a ferry in Norway and also in a shop that very same day. Now I think about it a shop in Copenhagen also refused it but I had my chipped card with me at the time then.

Re:Great for CC scammers

[Anonymous Coward]

> Do the feds or any states consider cloned cards to be presumptively instruments of fraud?

Of course, and why not? It is certainly breach of contract, and there are many ways it could be used to defraud. It is hard to imagine a legitimate use, and even then it remains breach of contract. If you want a second card, just ask your bank, they are usually happy to help.

Re:Great for CC scammers

[xaxa]

The UK has seen a 66% drop in retail (point of sale) fraud since C+P was introduced in 2004. Lost and stolen fraud is at the lowest level in 20 years. Is that a compelling reason? I have to telephone my bank in advance if I want to use my cards in the USA -- they're blocked by default there, as the systems are insecure. I can use my card in Poland, Romania etc with no problems.

The PIN transaction doesn't take longer. I put the card into the machine (it doesn't leave my possession), read the display to confirm the amount I'm being charged, type my PIN, press OK, wait 1-2s, remove card. That's about the same time as handing the card over, waiting for the transaction to complete, being handed the receipt, signing it, the cashier checking the signature, handing the card back.

Contactless payment is almost instant. Two years ago the terminals weren't very widespread, but I've seen lots of "we now accept contactless payments" in the last six months or so in places with low-value transactions (coffee shops, convenience stores, bars etc). Paying this way is faster than cash.

Re:Great for CC scammers

[Anonymous Coward]

Do you get your signature checked? Cashiers in the UK have been quite emphatically trained to check for signatures, as part of fraud prevention. This device doesn't support signature verification.

Re:Great for CC scammers

[fuzzyfuzzyfungus]

> Do the feds or any states consider cloned cards to be presumptively instruments of fraud?

Of course, and why not? It is certainly breach of contract, and there are many ways it could be used to defraud. It is hard to imagine a legitimate use, and even then it remains breach of contract. If you want a second card, just ask your bank, they are usually happy to help.

I'm sure that others differ a bit; and there are, no doubt, 2,634 pages of fine print and a mandatory binding arbitration process if they feel the need; but I grovelled through this sample contract, and the only references to the card concerned a demand to destroy it upon involuntary termination of the contract, the ability of the issuer to issue a new card (superseding the old) at any time and for any reason, and the possibility of incurring liability if an 'authorized user' of the account retains possession of the card and you are unable to retrieve it. Absolutely nothing about cloning, or even any broader references to not making 'card not present' transactions when it would be possible to present the card, or anything of that nature.

Re:Great for CC scammers

[gl4ss]

it's not your property either and the cc company has given the authority - and requirement !!!! - to do so.

Re:Great for CC scammers

[davesag]

Here in oz tap-to-pay is the latest thing. You just tap your card on the device and the payment happens - no signature, no nothing. It's valid for purchases up to $100 and it's brilliant. Paying for your cab is just a quick tap and you are gone, none of this printing receipts for you to sign, or having to member PINs.

Of course it's susceptible to theft etc, but clearly it's not such an issue for the banks or they'd not all be tripping over themselves to roll it out everywhere.

Re:Great for CC scammers

[Anonymous Coward]

That is because the terminals have a fallback to magstrip ... so if the chip is blocked or unavailable on the card it uses the magstrip .... the only security feature in addition to the us cards is that you have to input the pin when you pay but i believe that depends on the entity that emits the card and also i believe that there are some cards that don't require pin input.

Re:Great for CC scammers

[peragrin]

contactless systems are not instant. you still have to wait for the system to access the network, verify the transaction. not printing a receipt saves a little time, but not much. I have timed it just for fun at various retailers. 70% of retailers in the US still can't take contact less cards.

Also for most credit cards, purchases under $25-$50 depending on card/retailer you don't sign for. also my credit cards don't work in the UK unless I call and ask for them to be used there(which I have when traveling)

I never said pin transactions take longer, I said they are not faster.

Re:Great for CC scammers

[fatphil]

We're just beginning to roll that out here. I know it's supposed to be near field and secure, but everything else that has claimed either of those attributes has been proved to be wrong.

Incidentally, when I was in Korea earlier this year, I paid for a few tinnies in a convenience store using magstripe - and wasn't asked to even sign the slip, or show any ID. The first thought that went through my mind was "yikes, if I lose my wallet, I'm screwed". Immediately afterwards came the counter-point "but if this is such an honest and crime-free society that there's such blind trust, I'm not screwed".

Re:Great for CC scammers

[coolmadsi]

I don't know where people get this idea that you have to have a chip-and-pin CC to get by in Europe. It's just not true.

I live in the UK, so examples of things you wouldn't be able to buy with a card include:
- train tickets (you'll need cash, or else a long queue if there's a human option)
- car parking (sometimes cash won't be an option, though that's rare)
- occasional smaller businesses (shops, restaurants) who will want cash instead due to the fraud risk
- any other ticket machine (e.g. cinema)

OK, it's more of an inconvenience than a necessity. It's ridiculous that the US has barely started to use the system though -- it's almost 10 years old.

(I don't think Brno is much to brag about...)

I live in the UK and almost always get train tickets using a card, both at the counter and using the machines. This is from train stations an hour or so away from London, so maybe they don't have them further away.

I have seen some smaller businesses in the village near me only accept cash, however that was mainly because there was an ATM across the road and it would cost them to process cards themselves.

Re:Great for CC scammers

[NoImNotNineVolt]

The signature on the card signifies you agree to the terms and conditions of your cardholder agreement. I.e., it's the acceptance of those terms between you and the issuer.

I understand that the issuer needs to ensure that I agree to the terms and conditions of my cardholder agreement. But I too need to ensure that someone who steals my card doesn't have ready access to a template of my signature.

If the issuer wants my signature, they're gonna need to get it in a way that doesn't compromise my own security.

Re:Great for CC scammers

[NoImNotNineVolt]

I think we'll have to agree to disagree on the meaning of the word "easy". I'm an electrical engineer by training, and what you describe does not sound easy in any way.

We don't even know how the stripe on this card works. I'd imagine that the card never "remags the stripe". I'd expect that the stripe here is actually a series of weak electromagnets which are controlled to simulate a strip of magnetized iron. If this is in fact the case, then what you propose is equivalent to reading a standard card's magnetic stripe from a distance of 10-20 feet. If that were an easy task, all skimmers would work this way.

Re:Great for CC scammers

[Anonymous Coward]

No, you won't have an issue in most places in Europe, because most retailers want to be able to take American's money.

But having worked for a payment processing software company, we regularly cursed the US for having to continue to support this ancient and insecure technology.

Apparently the reason the US never switched to chip & pin is because there is a different liability model over there between customers, retailers and the banks, so the incentives to use it to drive down fraud don't (or didn't) exist.

Re:Great for CC scammers

[Oceanplexian]

More secure for the Bank that is. In the US we see so much fraud because merchants are negligent. I'm not sure if you've heard the horror stories, but in Europe banks will refuse to admit that fraud has occurred because they consider the system unhackable.

When someone uses a rigged terminal to capture your pin AND card data, you're up shit creek and the stuck picking up the pieces. The credit card company will not do a chargeback.

Re:Great for CC scammers

[dwillden]

And the numbers on the cards are no longer embossed anymore but just printed flat to make it so that dishonest persons can't just do a quick pencil rubbing to get the card number for later dishonest use.

Re:Great for CC scammers

[dwillden]

Funny thing is many US cards are blocked by default outside the US due to extensive fraud. You have to call the bank and let them know where you are going so they can white list you in those countries.

Re:Great for CC scammers

[dwillden]

When the card remags the stripe. It can hold up to eight active cards. I have one card I use for 99% of my transactions. Why would it need to ever remag the stripe? And how close do you really have to be to read such a low level pulse of emf in our highly EMF rich environment.

Possible, maybe. Easy, very very doubtful. Easy and discrete highly unlikely.

Re:Great for CC scammers

[dwillden]

See the comment above about what constitutes a signature. You can sign however you want and call it a signature. Historically those who couldn't write would just make an X for their signature and it was and is still legal. So a signature of Check ID is a valid signature. You are right in that some kind of mark needs to be made on the strip, but what exactly is up to the card holder.

Re:Great for CC scammers

[xaxa]

Funny thing is many US cards are blocked by default outside the US due to extensive fraud. You have to call the bank and let them know where you are going so they can white list you in those countries.

That's because they have no security.

My card might still be blocked from suspicious transactions that don't use the chip (e.g. a purchase from Russian website), but in-person transactions using the chip are OK.

Re:Great for CC scammers

[dwillden]

No argument about the shoddy security with US cards. My point was simply that the point about cards being automatically blocked in the US unless the card holder calls the bank first is far from a unique situation and that in fact it is usually the same going from the US to other countries.

In other words it's a standard practice, leaving your country to travel means you should probably notify your card issuer first. Regardless of where you live or where you are heading.

Re:Great for CC scammers

[i kan reed]

That's dumb. Cameras are everywhere and easier to use than pencil rubbings.

Re:Great for CC scammers

[dwillden]

But a taking a picture is rather obvious act, holding the camera device (phone or camera above the card long enough for the lens to focus and the ccd to record it. Whereas setting a slip of receipt paper on top of a cc lying on a desk or a serving tray or a payment folder (whatever they call those folders they bring your bill in) and rubbing a pencil over it a couple times can be done very discretely and very quickly especially in a crowded restaurant surrounded by other wait staff who might notice what you are doing and turn you in. It's actually been a very popular method of stealing cards as it gets the name, number and the exp date very quickly, leaving only the security code on the back which as a simple three digit number can be grabbed with a quick glance and jotted on the slip of paper next to the pencil rubbing.

It's not dumb, it's been going on for years and is why all new cards no longer have the info embossed as raised text. Yes a camera is still a viable option, but making this change did eliminate one very popular and discrete option for cc number theft.

Re:Great for CC scammers

[cayenne8]

I also travel to Europe a lot, I have a swipe card and a chip and pin one. much to my frustration I left my chipped card in my hotel safe one day and wouldn't you know it that was the day I had 2 instances of not being able to pay with my magstripe card. maybe it isn't common, but it does happen. For me it was on a ferry in Norway and also in a shop that very same day. Now I think about it a shop in Copenhagen also refused it but I had my chipped card with me at the time then.

If you don't have a chipped card, can the merchant not do the card the old fashioned way...and manually type in the number at the terminal??

Re:Great for CC scammers

[Anonymous Coward]

It is almost universal in Europe (95% of terminals, 85% of cards, two years ago), and plenty of other countries. A card with a chip is almost essential if you travel to Europe -- I can't remember the last time I saw a ticket machine (or similar) accept a magstripe.

From my observations, in the US the issue is (almost) no one issues chip and pin cards. More than half of card terminals I've seen in the US have support for chip+pin or NFC cards (often both), but so far very few companies issue either type of card in the US. American Express has done some experimentation with them, but haven't pushed them very heavily (never for their primary charge cards, just a few specialty ones, "Blue" and "Air" specifically).

Re:Great for CC scammers

[cayenne8]

Not being ironic...just that I've never heard of of seen a credit card labeled chip and pin...

I've never ever had to type in a PIN number for a credit card purchase, nor had I heard about such till this thread. It just isn't something done in the US, or if done..it isn't common. You just swipe a normal CC and your good to go...

If you didn't have a Chip and Pin card in Europe..could they not just do the transaction the old fashioned way, and manually type in the CC number in the terminal? They still do that here in the US if the mag stripe isn't readable....

Re:Great for CC scammers

[Xicor]

it isnt really skimming if you need access to the cards to get it. if you had the cards in your wallet and your wallet got stolen... they would have access to all your cards. if anything, this might make it easier, because you could cancel the account for your device, and they wouldnt have access to it anymore.

Re:Great for CC scammers

[quacking duck]

To be fair, it *is* slower when paying individually at restaurants, since the server can't take all the bills and cards and run it through a magstripe terminal, then bring them all back for signing. Now, a single wireless POS machine (very rarely two) has to make its way to every person at the table.

Contactless or tap payments, while convenient, ironically seems to contradict the entire point of having chip & PIN by skipping both authentication methods. Though as long as tap payments are limited to a per-transaction amount ($25? $50?), thieves will get get less POS mileage out of stolen cards.

Re:Great for CC scammers

[RockDoctor]

If you didn't have a Chip and Pin card in Europe..could they not just do the transaction the old fashioned way, and manually type in the CC number in the terminal? They still do that here in the US if the mag stripe isn't readable....

The Chip'n'PIN readers do generally (but not exclusively) have magnetic stripe readers in them, so if your chip has died, then you can do a magnetic swipe ...

... When the manager has come down to the check out to authorise the transaction. I can't remember the time that I last saw regular check-out staff authorised to take a payment like this. It was probably during the 3-4 year roll-out of Chip'n'PIN, back in the 2005 era.

If your magnetic stripe has gone too, then the manager will probably have to go back to his office to find the mechanical swiping machine. Then he'll need to go back to see if he can find some of the carbon paper foils to go with it. That should buy enough time for the police to arrive, because he'd have called them when he went to the office the first time.

Actually, I completed a carbon paper transaction just a few months ago - I cleared the counterfoil out of my wallet last week. It was for entry to a visitor attraction which didn't have a phone line, and couldn't have one installed (at a credible price) because it was a Grade 3 Listed building. So that system does still work. Unless you've got one of those cards without the embossed numbers.

Oh, sorry, mis-read you . Yes, typing in the numbers works too. The details vary, but yes, that does work. Also used for "Customer Not Present" transactions too, i.e. mail order.

Re:Great for CC scammers

[Anonymous Coward]

Not all terminals permit it. The whole point of chip and pin requirements is to remove scammers and fraud which if you allowed the old fashioned way is completely defeated.

Re:Great for CC scammers

[fatphil]

Yikes. Given that the two companies pushing C&P tech in Europe are the credit card companies, which are both US companies, I had presumed it had at least some traction in the US. Clearly I'm mistaken.

Almost all C&P terminals will have a legacy magstripe reader, so an American *should* be fine in Europe. However, there are some countries where even the big name branded international networks seem disconnected from the rest of the world - I was unable to use both Visa and Mastercard (C&P and magstripe both) issued in UK, Finland, and Estonia, it mattered not, while in Denmark - only Danish-issued Visa/Mastercard cards were accepted. So take care, and do your groundwork before arriving... (I've been to a dozen other countries in Europe, everywhere else apart from Denmark was fine.)

Re:Great for CC scammers

[Anonymous Coward]

It is all about who (which party) is responsible for covering loss from fraud, and/or if the merchants transaction insurance covers the scenario.

The various systems you use understand that your card and its issuer do not use C+P so still allow you to use it. It may well be the card issuers problem if any fraud occurs in the scenario. i.e. your card issuer has a contract somewhere to ensure you the customer can travel and use the card around the world, but the responsibility for fraud is upto your card issuer to cover (not the merchant at point of sales), since it is the issuer that gets to authroize your transaction in realtime. When the merchant is not liable for fraud, the merchant never cares.

The main concern for a merchant in accepting a non-C+P card is that of transaction insurance for card present transaction, if they are not covered, and there is high risk or loss they will decline to accept the transaction.

Now compare this to having a UK issued valid and working C+P card and breaking the chip so only the magstripe works. You will find many outlets and automater systems will reject the card (even through your USA magstripe only card) works fine if presented for the same transaction. This is because the issuer knows the card supports C+P but that mechanism of authentication was not used, in this scenario in the UK it is generally merchant beware, so the issuer declines the transaction. That is if a C+P card is presented to a merchant but no pin authorisation was provided it if the merchant that needs to cover the cost of fraud.

Re:Great for CC scammers

[aaronb1138]

You two below understand that there are pocket readers that can pull your CC mag stripes through your pants. Not sure what kind of electrical engineer you are, I am a physicist with a good amount of EE, both academically and vocationally, and listening for the RF from an inductive reader is really easy. Most physical readers are lightly shielded and that is usually enough to stop reads at a distance (i.e. more than 1 ft). How exactly is this card concurrently holding 8 cards... oh that's right, it dynamically writes the stripe each time you go to use it. This means a very clear RF signal as it writes the stripe with an inductor array. A simple tuned antenna for the speed that the bits are written at and some simple gear will grab the bits right out of the air as the write occurs.

There is one way to prevent easy reading, that is to write multiple bits concurrently and at randomized positions in the stripe. Somehow, I think the odds that they did this pretty low. If by chance they claim they write the whole stripe at one time, there will still at some stage be a serialized signal or some other method to serialize the RF spatially. Might need two antennas at most.

Seriously, someone could prove the vulnerability in about 5 minutes with an oscilloscope just to show the RF leakage. It has to leak RF because the stripe is exposed.

Re:Great for CC scammers

[DarwinSurvivor]

Where? Since when? My card is fairly new and still has the information embossed (I'm in Canada).

It should be called OneCard

[foma84]

To rule them all.

Re:It should be called OneCard

[foma84]

Oh wait, it does.

Re: It should be called OneCard

[Anonymous Coward]

Yes, it is a "master card".

At last

[csnydermvpsoft]

Finally - a "smart wallet" that would actually be more convenient to use (or at least no less convenient) than the credit cards I already have in my wallet.

Re:At last

[viperidaenz]

Why do you have more than two credit cards?

Re:At last

[NoImNotNineVolt]

Rewards programs.

United-branded VISA, free checked bags, free priority boarding.
Marriott-branded VISA, free rooms, free Silver status.
etc.

Re:At last

[jtownatpunk.net]

Because I travel a lot (full time vagrant) and sometimes my bank will put a hold on my primary card. I think I finally convinced them to call me before putting a hold if they start to get suspicious of my spending activity but it's good to have a backup to use immediately so I'm not standing there like a chump, trying to get the hold lifted, people in line behind me getting angry. Also, my backup card is my oldest revolving line of credit. I wouldn't want to carry a balance on it because of the absurd interest rate but it's good to have a long, positive history on my credit report.

Re:At last

[viperidaenz]

Why do you have more than two credit cards?

Re:At last

[johnlcallaway]

I have in my wallet, 12 different credit/debit cards:

1. A debit card that is used mostly at the ATM, but sometimes for small purchases. If I didn't need it for ATM access I would get rid of it because debit cards have very poor protection from fraud and mistakes. We were once double charged for groceries and it took almost a week to get $200 back. I don't use it for any large purchases anymore. Or shop at that store.
2. Amex because I think they have the best fraud division and customer service in my opinion. I also get points and use it for some of my monthly bills. Regardless, it's the one I use most often and has an absurd credit limit in my mind, one that I should never need. But it's good to know it's there if I need it. It gets paid off every month, although I don't have to. I have often considered getting rid of the rest except my debit card because I don't really need them
3. One Visa card because the account is 20 years old; long standing accounts improve credit scores. I use it once in a while just to keep it active. It has the highest interest rate and a pretty good limit. It gets paid off every month.
4. Two Mastercard cards because they have very low interest rates that I use whenever I buy something that might take a few months to pay off. The limits are pretty good, but lower than the other two above.
5. Cards for Lowes and Home Depot, because they both offer 'x months same as cash'. I use them for things around the house that are expensive that I can budget and pay off in the next 3-6 months. And I never pay any interest charges because I always pay them off on time.
6. A card for my FSA that I use to charge medical expenses to. No interest rate, and I get a tax break.
7. Four gas cards, because I like to use them to get gas. They have small credit limits and get paid off every month. I have four because that means that wherever I go in the US, the odds are that there will be one of those gas stations. Reduces fraud since the limits are very low and can only be used at limited places, and not online. I also play a game where I don't use a card the last two weeks of it's billing cycle. This lets me push off paying for gas a little bit more. Doesn't really save me any money, I just like to do it. It feels like I'm winning something.

I don't have any store credit cards, like Kohls or Macys, simply because I never buy anything there that I either pay cash for, or that I can't use my other cards for.

I keep all of the actual credit cards because it allows me to have a higher credit balance without impacting my credit score. Yet no single card, if stolen (other than the Amex) has that high a limit. Having $4000 outstanding on a $5000 card brings your score down less than having $5000 outstanding on several cards with a total limit over $15K. And if I'm hardly paying any interest on the $5000, because most of it is either paid off every month or on a 3-6 months same-as-cash incentive, why not??? Your credit score is based on how you handle credit, not whether or not you've ever been late. Keeping it as high as possible means lower rates on cars, houses, and credit cards. I usually qualify for the 0% rates on cars and most of my credit cards are in the sub-12% range. Which is irrelevant since I rarely pay interest anyway.

Just relating why someone might have lots of cards even if they pay them off every month. This may not work for many people, but I manage my money and it doesn't cause me any problems. If someone is willing to give me money for free (i.e. I don't have to pay to use it), why not take advantage of it if I can manage my ability to pay it back?

But ... back on topic ... as many times as I've been asked for my card at a store, I doubt if this would enable me to leave my cards at home anyway. So other than gas stations and self-service kiosks, I don't see it catching on until that issue is resolved.

However .. if this thing would work for rewards programs .. I'm in!!!! I'd love to get those things off my key chain.

Cute; but why?

[fuzzyfuzzyfungus]

Cramming a UI and the electromagnetics required to spoof a mag stripe into something small enough to make it through a card reader is pretty impressive; but I just don't see the point.

I need another intermediary in my payment system like I need a hole in the head(and I certainly don't need any credit card details stashed in yet another OMGTOTALLY SECURE!!! server or app), and I'd need a hell of a lot of plastic infesting my wallet before a $100 piece of hardware, and BTLE-compatible smartphone become the lower-hassle alternative.

Along with a card reader, it'd probably be great fun as a tool for duplicating low security cards(eg. copier stored value cards, which commonly actually store their value in the stripe, rather than just encoding an ID that gets looked up by the payment processor), and generally fucking around with mag stripe readers; but for actual real-world financial transactions? How many credit cards do you carry on a daily basis?

Re:Cute; but why?

[NoImNotNineVolt]

For me, it's more an issue of how many cards I don't carry on a daily basis.

I have accounts with three different banks. I have four credit cards on top of that. That's already seven cards, a stack over 5mm thick, which fits in my wallet without giving me scoliosis.

I also have various hotel, airline, and car rental rewards program cards (if you travel for work and don't have these, you're seriously missing out). Store loyalty cards. Occasionally even gift cards. This is all shit that I can't be troubled to carry, because my tri-fold would explode.

With this Coin thing, I expect to have them all, right there in my wallet, at 1/7th the size of the card stack I'm currently lugging around.

Re:Cute; but why?

[NoImNotNineVolt]

Also, it doesn't look like they'll be acting as an intermediary. The actual payment stuff doesn't go through Coin. The device merely stores and provides card details and is compatible with existing magstripe infrastructure.

And pre-order is only $50 (+$5 shipping).

Re:Cute; but why?

[Anonymous Coward]

I certainly don't need any credit card details stashed in yet another OMGTOTALLY SECURE!!! server or app

As far as I can tell, if I were a user, this would not be my problem. As you can call up Visa or MasterCard to cancel transactions that are not yours -- if this actually catches on, either the security will be good enough, or the credit card companies will come down on this like a ton of bricks, even if it means lobbying to get a law to make these things illegal -- they would have to.

Re:Cute; but why?

[Anonymous Coward]

Eight. I carry exactly eight.

Re:Cute; but why?

[Anonymous Coward]

I'm sure you have a good reason for it, but I just can't figure it out. Why would you need to carry 4 different credit cards with you everywhere you go?

Re:Cute; but why?

[viperidaenz]

Visa or Mastercard can tell you to fuck off if someone made the transactions on a card you cloned.

Re:Cute; but why?

[NoImNotNineVolt]

To keep them all in active status without having to remember to rotate them in/out of my wallet.

Re:Cute; but why?

[khellendros1984]

I don't know their exact circumstances, of course, but it's possible that the different cards have different rewards programs, and each one will gain them different benefits under different circumstances. Either that, or 2 are less-commonly-accepted cards that have lower interest rates, or something.

Re:Cute; but why?

[jtownatpunk.net]

I've got a crap-ton of mag-stripe cards. Debit card, credit card, backup credit card, and AAA card are always in my wallet. I have about 10 different "loyalty" cards and I rarely remember to grab the ones I need when I run errands. It'd be nice to have all of my mag-stripe cards available in a single card. Then I could carry more cash in my wallet. MrBurnsStuffingWallet.jpg

Re:Cute; but why?

[adolf]

Really?

Where is that written in the Cardholder Agreement?

Re:Cute; but why?

[viperidaenz]

Probably something about making unauthorised copies of your card
Like this

You have failed to reasonably safeguard your Card.

Re:Cute; but why?

[adolf]

I didn't ask for a "probably something."

Re:Cute; but why?

[viperidaenz]

Copying your card is not safe guarding it. It's not even your card to copy.

It's not much different from going up to a crook and offering to run your card through their skimmer.

Re:Cute; but why?

[adolf]

Where is that stated?

Re:Cute; but why?

[viperidaenz]

I had a look at another terms and conditions

33. Who owns your card?
Your card is our property. Your card must not be copied or
reproduced in any circumstances. You must return to us or destroy
your card if asked to do so by us.

http://www.kiwibank.co.nz/downloads/personal-banking/general-terms-conditions-combined.pdf?nocache=1

Is that explicit enough for you?

Re:Cute; but why?

[adolf]

No.

Because still no party (and you don't count as a party) is saying that all bets are off if you dupe a card, except for you.

This verbiage is, at very best, very vague when it comes to what might happen when a person's copied card is compromised.

Which is to say: It does not match your original assertion of (paraphrasing) "Yer fucked."

Re:Cute; but why?

[viperidaenz]

Liability
You will be liable for all transactions made on your account by
anyone that you or the law authorises to use your account. You
will also be liable for any breach of these terms (or any specific
terms and conditions) by anyone that you or the law authorises
to use your account.

19. What if you breach these terms?
If, in our opinion, you breach these terms (or any specific terms
and conditions), we may:
  require that you fix the breach;
  close or suspend your accounts or any services we provide you;
  require that you return to us or destroy all unused cheques
and any cards you may have;
  suspend or cancel your use of any electronic banking service;
  require you to pay us immediately all amounts owing to us,
whether or not they would otherwise be repayable on demand;
  list you as a defaulter with any credit reporting agency;
  place any debt you owe us with any debt collection agency; and
  exercise any of our rights under any contract (including these
terms and any specific terms and conditions) between you and
us or at law.
You must tell us immediately of a breach of these terms
(or any specific terms and conditions) or any change affecting
your relationship with us.

Those two bold sections say you're fucked.
Since you violated the terms before they were given to a third party, the issuer can demand all money owing to them immediately and list you as a defaulter if you don't pay up and send the debt collectors after you.

Not saying they would, since it might get them bad press, but as soon as you violate that contract, all bets are off, as stated here

Your liability
You are responsible for all liabilities relating to your accounts or
services we provide you and your relationship with us and except
to the extent these terms (or any specific terms and conditions)
or the law otherwise requires, you agree to fully indemnify us
against these liabilities, including those liabilities that arise as a
result of a breach by you of these terms (or any specific terms and
conditions) unless the liability results directly from fraudulent
or negligent conduct by us (or our employees or agents or parties
involved in the provision of electronic banking services).

A simpler solution...

[Anonymous Coward]

Just use one card. Who needs 8?

Re:A simpler solution...

[bensyverson]

People who have separate business and personal debit cards, to start.

Re:A simpler solution...

[_merlin]

I wouldn't want to go there. I prefer to have three cards - it would be too easy to forget to switch to the correct account, or fuck it up when you're half drunk. Also you'll never be able to use this with ICC/Chip&Pin as the systems are designed to make it impractically difficult to extract the keys.

Re:A simpler solution...

[Anonymous Coward]

The reason often is store branded credit cards that give you more points when used in-store than generic ones.

Re:A simpler solution...

[bensyverson]

Well, I have four debit cards from the same bank (my account, joint account with my wife, and cards for two businesses), and they all look identical (the CC lettering is emboss-only). So Coin would be an improvement in a half-drunk scenario. :)

Sadly, none of my cards have chips, which is a bit of a hassle when traveling to Europe.

Security

[Isomorphic]

I've read the articles, watched the video on their site, and read the FAQ. It is unclear whether the app actually sends your card information to their servers. As I posted over on Hacker News:

No, Coin, I'm not going to store all of my credit and debit cards in a single spot on the Internet.

Your app has to work without Internet, or it's a security risk.

Re:Security

[bensyverson]

I doubt they would send the CC#s to the server, since it's not needed for the Coin to function. You swipe a card, it stores it locally, then sends it to the Coin via Bluetooth. Why would you need the internet for that?

Re:Security

[NoImNotNineVolt]

On the other hand, the CNET article states "On the security side, Coin uses 128-bit and 256-bit encryption on both its server and mobile app, as well as on the card itself."

Encryption... on its server... ehhhhh...

Well, that's what chargebacks are for, right?

To bad it's way less secure than chip and PIN

[seifried]

To bad it's way less secure than chip and PIN. Mag stripes can be trivially copied and then used. In Canada a lot of the payment terminals are configured to not allow mag stripe usage if the card has a chip (I disabled the chip on one of my cards to see what happens, only place that would let me swipe is Home Depot, and even then the machine wouldn't accept it, they had to pull out an old physical ka-chunker machine and do it manually, haven't seen those in ages).

Re:To bad it's way less secure than chip and PIN

[NoImNotNineVolt]

Every time I travel abroad, I'm reminded by how outdated the USA's financial shit is.

We use paper checks for everything.
We hand credit cards to waiters/waitresses, who then carry them off to the card skimming room, I mean the cash register, to pay for meals at restaurants.
Chip&pin does not exist.

Just a few months ago, one of my credit cards finally moved to chip&pin. In my social circle, I'm the first to have a chip&pin card. It's fucking 2013.

That being said, this card seems no less secure than any other common credit card in the USA. Which isn't saying much, but still.

Re:To bad it's way less secure than chip and PIN

[Saethan]

We use paper checks for everything.

Really? I've had the same check book since I first opened my account, 10 years ago. It still has around 10 checks left... might actually have to order another sometime in the next few years.

Re:To bad it's way less secure than chip and PIN

[NoImNotNineVolt]

Same. I didn't buy this fancy 101 key keyboard just to bust out the Bic.

But let's say you wanted to send me some money and we shared a mutual hatred of paypal. I suppose you could use your bank's online billpay feature, add me as a payee, and then shoot over some money. But on my end, since I'm not a major corporation with all sorts of electronic banking shit, all I get is a nicely printed check, mailed from your bank.

Same ol' paper check, it's just that you didn't have to bust out the ol' pen to write it.

Re:To bad it's way less secure than chip and PIN

[michelcolman]

I couldn't agree more. It's actually funny to see how with this new 8-in-1 card, the US now has the latest and greatest in obsolete financial technology.

Re: To bad it's way less secure than chip and PIN

[Anonymous Coward]

Exactly, can't even remember the last time I used the magnet stripe. Everything is chip here as well (Sweden).

Re:To bad it's way less secure than chip and PIN

[TangoMargarine]

A lot of places don't accept paper checks anymore.

Re:To bad it's way less secure than chip and PIN

[mrchaotica]

I use paper checks to transfer funds between my and my wife's accounts. Using a cellphone to photograph and deposit a check actually makes the funds available faster than any of the various other transfer money mechanisms would. Ridiculous, but true.

Re:To bad it's way less secure than chip and PIN

[Anonymous Coward]

It sounds awesome, something along the lines of "print, put on a wooden table, photograph, print, scan". I have read about Americans using checks for sending money, but I cannot imagine how it can be easier than regular wire transfer. Can you elaborate on it? Does it take that long in the US, or cost a lot?

The last time I saw a paper check was in 2005. Here in the EU when I forget cash for lunch I borrow from a colleague and return it by wire transfer, depending on the bank it can take from 5 seconds to several hours. Even international transfers usually arrive within two working days.

Re:To bad it's way less secure than chip and PIN

[Anonymous Coward]

Where did you get a Chip & PIN card from? I've not been able to get one.

Re:To bad it's way less secure than chip and PIN

[Macman408]

When I travelled to New Zealand, where chip & PIN is common, I was amazed that absolutely every store asked to see the signature on my card. In the US, nobody cares, apart from perhaps one or two very rare merchants that have probably been burned by not checking the signature.

That said, I've never had my card stolen (though I've had it replaced after a possible threat of being skimmed), so as long as my bank is willing to still take the liability if it's stolen, I don't care if the number is written across my forehead. I'm all for ease of use, and signature or PIN verification is an extra step that I don't terribly mind skipping...

Speaking of extra steps, what's the point of the terminals that ask the user to verify the amount? Most of them are tied to the register (so there's no manually keying in the amount), so they're never wrong. (And any situation where something is wrong - an item is scanned twice, or the register's price differs from the label - is usually not obvious from the total amount shown.) I'd be happier if they just skipped the "is this the right amount?" screen and went to "sign here to pay " - the number would still be there for confirmation, and I'd be out of there 2 seconds faster.

Re:To bad it's way less secure than chip and PIN

[jrumney]

Speaking of extra steps, what's the point of the terminals that ask the user to verify the amount?

The display on the terminal is coming from your bank. It is the amount that you are actually being charged. The display on the cash register is showing whatever the shop wants it to show, and may not necessarily equate with what they are requesting from the bank.

Re:To bad it's way less secure than chip and PIN

[Macman408]

I'm fine with the terminal showing me the amount; it's just the extra step of pressing "Yes" or "No" that seems superfluous to me. How about just going straight to the signature (or PIN) stage, and giving me an "Accept" or "Cancel" button, and show the amount on that screen as well?

Re:To bad it's way less secure than chip and PIN

[Cochonou]

That's how all terminals work in Europe. You see the amount while you enter your PIN.

Re:To bad it's way less secure than chip and PIN

[Radak]

...or you could live in a country where it's absolutely commonplace to use BIC/IBAN to transfer money for all payments, both for bills and for individual-to-individual, and the banks don't charge a cent to do it. The concept of a cheque simply doesn't exist here.

If a friend asks me to loan him 20 bucks, and I don't happen to have it in cash, and don't want to tell him to fuck off, I'll say, "sure, just give me your account number" and it'll be in his account in seconds. Easy peasy, no charges, no Bic to bust out.

Of course, this wouldn't have been so easy before ubiquitous smartphones, but what with the majority of people here having smartphones and dataplans (and my bank having a pretty kickass mobile app so I don't have to use a clunky phone browser), it's really the way to go.

Re:To bad it's way less secure than chip and PIN

[Shinobi]

When I want to transfer money to my girlfriend, I just login to the bank, choose direct transfer, and since her account is with the same bank, the money will be available instantly.

Re:To bad it's way less secure than chip and PIN

[NoImNotNineVolt]

The Marriott Rewards VISA from Chase for me. It's possible that other Chase cards are doing chip&pin now also.

Re:To bad it's way less secure than chip and PIN

[NoImNotNineVolt]

While I envy the rest of the developed world for having progressed out of the financial stone age, improved banking service is hardly enough to tempt me to expatriate.

The police/surveillance state bullshit, though...

Re:To bad it's way less secure than chip and PIN

[QBasicer]

In Canada we have interac e-Transfers - which you email a link to somebody and they click on it and log into their bank account and it deposits the money into their account.

Re:To bad it's way less secure than chip and PIN

[mrchaotica]

My wife and I have accounts at different banks. (Mine is at bank A because it started out as a joint account with my dad who used to work there and is therefore a special employee account. Hers is at bank B because that bank holds the mortgage note so the account has no fees.) Because they're different banks, direct transfers don't post on the same day.

Re:To bad it's way less secure than chip and PIN

[Anonymous Coward]

The medium sized print for that reads "And enjoy global acceptance with Chip and Signature technology."

Re:To bad it's way less secure than chip and PIN

[Shinobi]

OK, here a transfer between banks can vary from a minute or two up to maybe an hour..

idiots paying by check were bad?

[alen]

imagine idiots using this contraption trying to show themselves off and changing out credit cards at the register or setting their phone up to pay

I already have something that holds 8 credit cards

[JoeyRox]

My wallet.

Going to be a bummer. . .

[Anonymous Coward]

. . .when your credit is declined and the clerk whips out the scissors.

Re:Going to be a bummer. . .

[c0lo]

. . .when your credit is declined and the clerk whips out the scissors.

In what parts of this worlds somebody can destroy my card without my permission?

Re:Going to be a bummer. . .

[Anonymous Coward]

The card remains the property of the company which issued it to you, and if you break certain terms of the agreement they can instruct anyone to destroy it.

Re:Going to be a bummer. . .

[Anonymous Coward]

It's not your card. It's the bank's card. They can order it destroyed any time they like under any circumstances whatsoever.

Hard to say what would happen with this. Since it's a clone they might call the cops instead of destroying it, especially if you were being "difficult" about its destruction.

Why not just use the app

[Gothmolly]

If you load all that stuff into your card via the phone, why not just use NFC in the phone to pay? Oh wait, because people won't do that either.

Re:Why not just use the app

[NoImNotNineVolt]

I don't know where you live, but out here in the boonies of NJ, magstripe readers are commonplace but I have yet to see a single vendor that does NFC payment processing.

Re:Why not just use the app

[viperidaenz]

It's getting more and more common.
Visa call is "Paywave" and Mastercard call it "Paypass".
When the rentals on the terminals expire, the merchants will have no choice but to get an NFC compatable terminal.

Re:Why not just use the app

[Choad Namath]

The hardware may be getting out there for accepting payments, but as far as using your phone to pay, in the US the cell phone carriers are doing everything they can to screw things up for everyone. I bought a phone with NFC and foolishly assumed that I'd be able to use Google Wallet with it. I didn't realize that most of the major carriers (pretty much everyone but Sprint) are working on their own so-far stillborn alternative (http://en.wikipedia.org/wiki/Isis_%28mobile_payment_system%29), so they don't allow Google Wallet to function.

Re:Why not just use the app

[drinkypoo]

I didn't realize that most of the major carriers (pretty much everyone but Sprint) are working on their own so-far stillborn alternative (http://en.wikipedia.org/wiki/Isis_%28mobile_payment_system%29), so they don't allow Google Wallet to function.

That's OK, this is fixed in Kitkat.

No EMV, not going to be useful by 2015

[noc007]

I hear they're working on one that's EMV compatible, but there's no point in releasing sometime in 2014 what they've proposed now as Chip+PIN/EMV will be rolled out en-mass in the US. The networks (Visa, MC, AMEX, Discover) are starting a liability shift and most will go into effect in Oct 2015: http://en.wikipedia.org/wiki/EMV#United_States
What this means is the liability of any card fraud that occurs after that date with be moved to the entity that hasn't implemented EMV. That includes the card issuing bank, the merchant acquirer (the entity that the merchant uses to process cards), and even the merchant itself if they refused to update their terminals or POS systems. If fraud does occur and everyone is up to date with EMV, the procedure is the same as it is today supposedly.

I personally have my reservations about the system since there have been a string of compromised terminals in the past and the banks incorrectly blamed the card holder because the system was "fraud-proof" according to them. Hopefully those shenanigans don't happen in with US banks as this rolls out.

Re:No EMV, not going to be useful by 2015

[Anonymous Coward]

I don't think EMV support will be as easy as they think. That is sorta the promise of EMV.

Re:No EMV, not going to be useful by 2015

[radarskiy]

EMV is not necessarily Chip+PIN. Chip+Signature Prefered and even Chip+Signature Only still complies.

My card from Bank of America is Chip + Signature Only, so I can't buy train tickets from kiosks in Euopre bu I can use ATMs in Europe because they fall back to mag stripe + PIN.

Re:No EMV, not going to be useful by 2015

[rickb928]

EMV (Chip + PIN) should be EASIER than the kludge stripe simulation. EMV uses a standardized connector, is essentially just a processor and storage with that EMV firmware, and all they will need is membership and licensing in the EMV infrastructure organizations.

Of course that licensing will be the doom of this.

BTW, EMV's ultimate risk-shift is to the cardholder. If you claim fraudulent use, all the rest will claim you must have lost your card and not reported it (magically reappearing in your possession, gee, you are a liar too) and gave out your PIN. In the UK, stories abound of sweet older women being shoulder surfed at the ATM, card nicked, account emptied, and the bank telling them they must have written down their PIN or given it to someone, sorry, no recourse. I hear this is diminishing some, but expect this to be the early experience with EMV card fraud here.

Oh, and terminals have been shimmed and card scammed. Take it to offline mode, capture the crypto and re-write the transaction for whatever amount you like, faking the rest. Next time you try to use the card it is out of sync and you can't get an approval anyways. In the rest of the world, this scam relies on poor identity confirmation of the business, which in the US is less of a problem, but not zero.

EMV is supposedly the Holy Grail of card fraud prevention. I'm not at all sure of this, but the industry is going there. I can hardly wait for those problems to hit my queue. Fun times. I have a job for life.

Re:No EMV, not going to be useful by 2015

[swillden]

The US is going chip + signature, not chip + PIN.

Pointless without EMV

[taustin]

No support for chip&pin (EMV) yet, so this may have limited utility outside of the USA. They expect to start shipping in summer of 2014."

Considering that all US merchants have to be capable of using EMV[1] by October of 2015, perhaps that two year battery life is about right, because that's all the longer they will be useful. And most merchant services are pushing hard to have everyone capable of taking EMV by the middle of 2014.

Mag strip cards will be around for as long as the current ones out there last, but most new cards being issued now are EMV capable, and very soon, all of them will have to be. Without EMV support, this is, at best, a short term fad. And eventually, mag strip cards will just disappear, and merchants will have no reason to be able to take them.

[1]Technically, not required to stop taking mag strip only, but those who don't become 100% responsible for all fraud, automatically, regardless of the circumstances. As a carrot to go with the stick, those who get EMV up and going are not longer resopnsible for the sometimes pain-in-the-ass (and often expensive for small operations) requirements for PCI compliance.

Re:Pointless without EMV

[rickb928]

Don't count on US merchants being ready any sooner than mid-1015. Virtually EVERY terminal in the US needs to be replaced, EVERY ATM machine updated with hardware and software, and EVERY POS system.

In fact, I suspect some POS vendors will fail.

I predict the US will finally be 80% EMV by the end of 2015, most likely around Halloween. In time for the Christmas shopping season, but no later or it willb e put off until Q2 2016. This is a big deal.

Re:I already have something that holds 8 credit ca

[Anonymous Coward]

And if you drive a lot, probably a kinked back from the fat wallet.

$100 for two years of life?

[danudwary]

Q. How long does a Coin last? Do I recharge it? What happens when my Coin’s battery dies?
A. Coins are designed to last for 2 years under normal usage and do not need to be recharged. Once the battery dies you will need to replace your Coin.

For $100? I don't think so.

Re:$100 for two years of life?

[NoImNotNineVolt]

How about for $50? That's what I paid to pre-order it. (+$5 shipping)

Re:$100 for two years of life?

[viperidaenz]

In 2 years they will be obsolete. Since mag strips won't be mandatory and every terminal will accept chip cards. Those that do accept a mag strip will be liable for fraud.

Re:$100 for two years of life?

[omnichad]

$4/mo. isn't insane, but it's way too much for me. On the other hand, I'm tired of having so many cards. Is it worth $4/mo. to not have to carry them all? No. $1/mo., maybe.

Maybe the second generation will be under $20.

Re:$100 for two years of life?

[geekoid]

Google Wallet is free app for your smart phone.

Re:$100 for two years of life?

[omnichad]

I can't seem to fit my phone into the slot to swipe it.

Re:$100 for two years of life?

[Anonymous Coward]

What a waste. If you have more than two credit cards you need to pull your head out of consumer credit.

Re:$100 for two years of life?

[NoImNotNineVolt]

Believe it or not, some people can have many credit cards and not carry a balance on any of them.

If you travel for work and don't have more than two credit cards, you need to pull your head out of missing out on free shit.

A few years ago I got myself a Canon EOS Rebel T2i (550D outside of USA), for free.
Earlier this year I went on a 6 night Caribbean cruise (extended balcony room) with my girlfriend, for free.
I still have enough Marriott points for a week long stay at a resort in Hawaii, for free.

Over a third of these benefits were accrued solely due to my Marriott Rewards VISA from Chase. That's not even getting into the airline rewards stuff.

Re:$100 for two years of life?

[Anonymous Coward]

I've got a company credit card and have to use it for anything work related. If I use any other means of payment it comes out of my own pocket. So any rewards are claimed by my employer.

Too late.

[viperidaenz]

Cards are moving to chips and NFC.
If I swipe my credit card in a terminal with a chip reader, it rejects and tells me to insert the card.

This isn't new...

[mlts]

A few years back, I remember a startup which had a card that was programmable with any magstripe ID, but instead of Bluetooth, it had a few small wires between the main handheld apparatus and the card itself.

It went over like a lead balloon, and I don't even remember the name of the contraption maker.

Intead, I'd much rather see the smartphone itself be the payment device using Bluetooth between it and the register [1]. The register sends a signed transaction, the device validates the signature and asks if you want to pay it, you tap a fingerprint or PIN code on your device, payment is confirmed, and one is on their merry way. Of course, there are still security loopholes (someone copies the app with the card repository, etc.) However, it isn't that much worse than an average piece of plastic with an easily forged magstrip.

[1]: Of course, the weakness would be the same as any CA based system... compromise the head CA, and all hell breaks loose, but it does get rid of skimmers as a potential attack, and those are far cheaper to make than hacking a SSL private key.

EMV is designed so you CAN'T copy it.

[Ungrounded Lightning]

Pointless without EMV

Don't expect it soon. The whole point of EMV is to be IMPOSSIBLE to clone. To the credit card chip designers, this thing is exactly the same as a clone-and-spoof attack.

They put a little computer on the card and run encrypted protocols with the store terminal.

The details of the computer are closely held. (I was once asked to work on hardware for one, but it would have required a major security clearance investigation and a contract that, IMHO, would have made it difficult to work on anything else cryptographic afterward.)

They also do their best to avoid designing in things that might make its operation or storage subject to tapping or observation by electrical or mechanical means.

Re:EMV is designed so you CAN'T copy it.

[rickb928]

The details of the computer are not so secret. The details of the crypto software are more closely guarded. The private keys, obviously, are where the real problems are, and these are held very closely.

After all, this is based on public-key crypto. The main feature being that the public key is not so secret, the private keys are crucial. Once you understand the data, you know enough to program a frikkin Arduino to masquerade as an EMV card. It isn't the hardware.

Re:EMV is designed so you CAN'T copy it.

[Anonymous Coward]

The whole point of EMV is to be IMPOSSIBLE to clone

Ha ha ha ha ha.

You're ...

Ha ha ha ha ha.

You're funny though.

Re:EMV is designed so you CAN'T copy it.

[Ungrounded Lightning]

The details of the computer are not so secret.

At the time these were being designed the PHBs were TRYING to keep those secret, too.

After all, the card contains the key information you need to clone it. Cloning it is EXACTLY the what the crook needs to do and the design is trying to prevent. So they make getting into the card's "vault", without destroying its contents, as hard as possible.

Part of that, from their viewpoint, is keeping the details of the design closed in order to raise the bar on engineering ways to defeat it and extract the keys.

If these guys find a way to defeat the security and clone the card, expect the card manufacturers to immediately try to find ways to block their crack, before it's used by crooks. This, of course, will break it again for the "legitimate" card cloners.

Card Not Present

[TheSpoom]

Wouldn't retailers be required to treat these transactions as "Card Not Present" transactions, meaning that far fewer would accept them?

I believe the liability is increased to the merchant if they just accept a CC number + expiration + CVV, to which accepting this would be functionally equivalent.

Re:Card Not Present

[hurfy]

Can you do a real 'card-not-present' transaction with it?

So i loaded all my cards into this thing and i want to buy something online. It looks like it displays part of the CC # so can it scroll the whole number to enter? What about the CCV on the back of trhe card? Most online stuff won't process without it and it isn't stored or is it?

PS, OK slashdot I'll change systems or browsers already. God, this site runs slower than my XT. Actually feels like I am typing on a 300 baud modem with the display half a line behind. Need more memory but other forums aren't nearly as bad.

Re:Card Not Present

[rickb928]

Merchants that do mostly card-not-present also do AVS to minimize fraud. Since an address or name match aren't required by most acquirers for an approval, this is the merchant's own risk tolerance at work.

There are third-party risk outfits that will take data such as AVS, location, IP address, and using both their own data and decisioning system give the merchant a score for the risk.

Too late?

[Anonymous Coward]

I believe that CC is dying so I really don't understand why create a new technology to solve a "problem" (ie have a couple of cards in your wallet) for something that seems it's not going to be in the market for much longer.
I think that only people who can't afford buying an smartphone will keep using CC in the near future, but at the same time these people usually hold only one CC...
Virtual currencies looks much prominent that this product imho.

Re:Too late?

[viperidaenz]

I use a credit card to save money.
I get over a month interest free. That's over a month of interest I don't have to pay on my mortgage if I used cash.
The cash back rewards also pays for the annual fee several times over.

Re:Too late?

[glitch0]

Those cash back rewards come from the credit card processing fees that merchants charge. The merchants must raise their prices to include those fees and still make the same profit, so really, you're paying extra every time you make a purchase and then you're waiting for them to give it back to you in the form of a "reward".

Re:Too late?

[Anonymous Coward]

You're paying MORE if you don't have the reward program, silly.

Or do they only raise the prices for cards that are enrolled in such programs? ;)

Re:Too late?

[viperidaenz]

I'm not paying extra. If I didn't use the card, I'd pay the same amount.
It's only low margin online stores that add credit card processing fees to transactions, where it's a hassle to pay by any other method.

Re:Too late?

[rickb928]

And merchants know this. Some that are very sensitive to fees try to guess the card BIN and if it's a 'rewards' card they may not offer free shipping, disqualify the transaction for discounts, or reject outright.

Many of the fees merchants are being charged are actually thinly disguised recovery of what used to be cardholder fees. MasterCard/Visa particularly do this so the issuers regain some of the revenue the government is trying to protect consumers from.

No one is protecting merchants from such gouging and outright scammage.

Re:Too late?

[Anonymous Coward]

No, you don't get it. You are paying extra. They're just building it into the price so you aren't aware you're being charged extra. Suppose I charge $10 for something, and I'm paying $5 for it. Then, people want to use credit cards, which charge me a 3% fee. I'm not going to lose 3% on every sale, so I'll just raise my price 3% so that I make the same profit. Now, you're paying $10.30 for the same item. Since I charge that same price to both cash and credit card customers, I now get an extra $0.3 for every cash sale, and I make the same amount as before on credit card sales.

Only an idiot would keep charging $10 and take the 3% loss on every sale. And people that think like that don't stay in business long.

Everything you buy costs you a little bit more money due to the prevalence of credit cards. So you are paying extra, not vs someone paying cash, but vs a world with no credit cards at all.

Limited outside USA?

[houghi]

How about unusable outside the USA? In many stores in Belgium the staff does not even know how swiping works. If it doesn't accept the chip and pin, the are lost and will not be able to complete the purchase. Or they just not accept swiping, because they do not trust it.

The whole world that uses the metric system also uses chip instead of the magnetic strip. Perhaps it is related?

Some pre-paid cards just have a chip and the numbers are not even embossed anymore or in the standard landscape form http://s1.djyimg.com/i6/1202131251562133.jpg

Re:Limited outside USA?

[Compholio]

How about unusable outside the USA? In many stores in Belgium the staff does not even know how swiping works.

Really? I was in Belgium in February and I didn't have a single problem with it. Everyone took one look at me, knew they had an American on their hands, and did everything properly without hassling me one bit.

Swiping?

[CanadianMacFan]

Can't remember the last time I swiped a credit card. It's been the chip and pin system for years or the RFID system where you just tap your card against the reader. Next thing you'll tell me that you have to sign your credit card transactions too!

EMV IC Cards

[Steve Newall]

As most of the world has moved to EMV smart cards to reduce fraud (the US still has to move), this is a "solution" to a problem that doesn't exist for most of us. Also, the EMV standard already supports multiple applications on a chip card.

Looking suspicious?

[ndrix]

I'm not sure how clerks will look when, instead of me showing a credit card; I whop out an electronic device that is my mode of payment and swipe it. Wouldn't they feel "hacked"?

Re:I already have something that holds 8 credit ca

[TangoMargarine]

First World Problems

Great security feature...

[viperidaenz]

If it loses contact with your phone for a self-designated amount of time, Coin will deactivate itself.

So when you phone battery goes flat (and it will go flat quicker, with this app in the background waking up periodically and communicating with the card), you can't buy a new charger to charge it.

AMEX and DISCOVER would probably love this

[slew]

Some establishments actually do accept AMEX and DISC cards but swipe subtly attempt to dissuade customers from using them because of their higher swipe fees. With this device and the way most bill are handled, the cashier would probably need to swipe this generic card and now it's generally too late to go back to the customer to change negating this specific fee avoidance strategy***

***I suppose they could swipe the generic card charge, note that the charge was AMEX, reverse the charge, return the card back to the customer and have them switch the card to be VISA/MC and then reswipe, but I'm sure the POS terminals won't make that very easy for the overworked cashiers.

Re:AMEX and DISCOVER would probably love this

[rickb928]

"because of their higher swipe fees."

I dunno about Discover, but if you're a merchant, and you're thinking Amex is noticeably more expensive to accept, I dare you to challenge your processor or bank to break out all of your fees.

You will not be happy. The other cards have caught up.

Re:AMEX and DISCOVER would probably love this

[slew]

As it turns out, I helped to research and select merchant agreements for 2 businesses I consult for.

Agreements today are quite complicated. For small volume all-in-one agreements with aggregating processors with an average charge amount from $50-$100, although AMEX might be on par with MC/VISA rewards-style cards, AMEX is quite a bit more expensive than both debit-as-credit and vanilla MC/VISA. Usually, you can same some money on AMEX by going a-la-carte (direct w/ AMEX), but even then AMEX is still quite a bit more expensive than the cheapest low-volume vanilla MC/VISA. Of course some banks actually charge more for rewards-style MC/VISA than a-la-carte AMEX, but they usually aren't the cheapest MC/VISA processors you can pick. Also, most small merchant do such low Discover volume that their best a-la-carte bet is to be on a pay-as-you-go (swipe + percentage) bank plan that includes Discover which is quite a bit more expensive than a typical low cost MC/VISA plan (which is also generally swipe + percentage in the $ range of the typical agreement). The aggregators sometimes have plans that just toss in Discover at a reasonable rate (because they know there won't be many of them).

Depending on the mix of cards you see at your business (e.g., mostly rich middle class people with rewards cards, or working class people with vanilla cards, or no-pin-debit-as-credit, etc), and the average charge amounts your business generates, your mileage may vary, but I haven't ever seen a case where AMEX is anywhere near as cheap as vanilla MC/VISA for the situations I was looking at.

Actually, before I did this exercise, I figured money for credit-card rewards programs were a kick-back to the customer from the issuing bank's share of the profit. Now I know that money to pay those rewards is mostly collected from the merchants you use. Something you might think twice about when you purchase something less than $10 and pull out your rewards card for the small vendor just trying to make ends meet because you don't like carrying cash around (or not, depending if you actually worry about the health of your favorite mom/pop establishments)...

Good idea, wrong approach.

[dgatwood]

This would be a great thing for cloning all those obnoxious loyalty cards that clog your billfold, if it could clone those, but I'm guessing it is only for credit cards.

IMO, the right solution for credit cards is entirely different. What someone needs to do is work with Visa/MC/Amex to create a card that serves as a proxy card for multiple cards. It should have its own number, and each charge is treated as a preauthorization on your default card. Then, at any time before midnight on the day you make a purchase (possibly longer), you should be able to route the actual charge to the card of your choice.

Because the proxying would be handled by a real server with real compute power, you could even specify that, for example, all purchases made at a gas station during the months of May, June, and July should be routed to your Chase card (for example) because that's the bonus category for that period. You could automatically make Amazon purchases go to your Amazon card, make Amtrak purchases go to your Amtrak card, make air travel purchases go to your airline miles card, etc.

And because it would be a real card in its own right instead of a clone of an existing card, it could even have its own chip (or even chip and pin). You could assign an arbitrary billing ZIP code to make it far less likely for anyone to be able to use it to make significant purchases if it gets stolen. You could instantly cancel it from your mobile phone if it gets stolen without causing you to lose access to any actual credit. And so on.

Re:Good idea, wrong approach.

[drinkypoo]

This would be a great thing for cloning all those obnoxious loyalty cards that clog your billfold, if it could clone those, but I'm guessing it is only for credit cards.

If you have a transflective, decently high-resolution display, you can display barcodes on your screen and the scanner can read them. Most loyalty cards have barcodes even if they have magstrips.

Re:Good idea, wrong approach.

[rickb928]

...and thereby allow using that proxy card to empty out all the other accounts in one grand gesture.

Nice.

Amazon already lets you choose different payment methods, as do most big online stores.

A better idea is perhaps based on 3DS and one-time card accounts. But your idea is clearly not a fraud prevention scheme, so that's pointless to you.

Re:Good idea, wrong approach.

[dgatwood]

...and thereby allow using that proxy card to empty out all the other accounts in one grand gesture.

Actually, no, quite the opposite. Because the proxy card I described would do preauthorizations for every transaction against your default card, it would not be possible for a thief to exceed the credit limit of your default card unless you were stupid enough to then log in online and redirect some of those charges to a different card after your card got stolen. Thus, the proxy card solution would significantly reduce the amount of damage that a thief could do when compared with carrying around the individual cards.

In fact, because you would be in control over what the proxy card did and did not authorize, you could even ostensibly configure the proxy card with a typical spending limit of $30 per day, and only open it up temporarily with your cell phone right before making a large purchase, which would pretty dramatically reduce fraud if used in that way. Of course, if the credit card companies actually cared about fraud, they would stop using a pseudo-secret number as their sole means of authentication and authorization....

By contrast, the device described in this article would allow somebody to empty out all eight accounts in one grand gesture, unless I'm missing something (assuming the thief also stole your phone and popped out the SIM card so that it would never go out of range but would not be trackable). And that would also be equally true if you were carrying around all eight physical cards.

Amazon already lets you choose different payment methods, as do most big online stores.

Um, we're not talking about online purchases here. There's no good reason to use something like this for online payments. That would be pretty silly, because online merchants usually store your credit card information anyway, so you don't need the actual card or even the card number when you're shopping. Devices like these are for brick-and-mortar purchases, so that you don't have to carry around multiple cards.

Sounds sketchy to me

[mcmonkey]

Can't skim cards [easily] with this. Apparently to "load" a new card, you've gotta snap some pictures of it and swipe it through the [included] card reader. And the card has to be in your name.

Why does it need a picture of the card? That seems strange. RTFA, but it doesn't have any more detail than your comment. I did like this nugget:
"If it loses contact with your phone for a self-designated amount of time, Coin will deactivate itself."

Nice security feature. Until my phone runs out of charge, and suddenly I can make a call and I can't use my credit cards.

I have the same thought from all the proposed smart phone-as-wallet apps. Great, let me put all my eggs in one easy to lose, easy to break basket. This one was interesting until they made it dependant on keeping a live phone near by.

Re:Sounds sketchy to me

[NoImNotNineVolt]

This feature seems to be optional. That is, you can configure the duration of time before the Coin will deactivate itself, even disabling this feature entirely if you're concerned about being financially stranded when your phone dies.

That being said, it's really not hard to find a phone charger these days.

Re:Sounds sketchy to me

[dwillden]

Easy to lose but also easy to deactivate. This device can have up to 8 cards actively loaded at a time. Google Wallet can have several (no idea on how many). My leather wallet can carry about 15 cards of all types (ID, CC etc) before it gets too fat to be comfortable. Now what happens when these carry systems are lost?

Coin: can I just go to a single website and cancel all access to the cards, will that work without an active data conenction to the device, is it even necessary (with the phone connection system probably not depending on how frequent you set the check-in,) otherwise is there a pin I need to enter into the device before each use? If I do have the phone contact frequency set to a longer term, is their anyway short of digging out the original cards to get the 800#'s to call and cancel the cards to prevent their use? How long does a charge last on it, I keep multiple charge options avail to keep my phone topped off will I have to make sure I plug it in every night as well?

Google Wallet: The would be thief would have to guess my PIN to make any purchases, and all I need to do to deactivate fully is get web access anywhere I can (a friends phone, work, home etc.) and log in to my Google wallet account. Deactivate the service and it's totally deactivated until I get a new device and reactivate. Yes I'm out my phone but however that loss occurred it still happened and is not really relevant to the security of my payment systems. Any object can be stolen by a pickpocket.

Old Leather Wallet (aka the old style easy to lose basket all our eggs are currently kept in): It gets lost or stolen, lets assume I have 14 cc's and one DL in the wallet, I now have to find the numbers for and call to cancel every one of those cards individually, until I do they can be used online or for purchases under $25 with near impunity. If I act within 2 days my liability is limited to $50 or even less, But the money still gets spent and any losses above that $50 may not come directly out of my pockets but they come out of our pockets as the finance companies have to charge higher interest rates to cover those losses (only slightly higher but the losses to have to be accounted for).

Coin and GWallet are both far better than Old Leather Wallet. I'll go with GWallet as it's one less device, although the prevalence of mag readers to NFC readers currently makes that a weaker choice, but NFC readers are appearing in more and more POS terminals and so that drawback is fading faster and faster.

Coin looks good, but adds yet one more fragile electronic device to keep charged and to get broken or lost. Whereas GWallet or Isis combines that same capability with the device I already make every effort to keep charged, and keep with me. Yes loss of phone due to loss, theft or just a dead battery is a risk, but so is losing your wallet so as an argument it's weak at best.

Re:Sounds sketchy to me

[dwillden]

Oops just realized that I'd missed the fact that these have a long life internal battery and evidently won't need to be charged. So at least that's one less potential drawback.

Tout

[Anonymous Coward]

Tout is such an annoying word.

Wasn't there a kick starter project doing this exa

[Anonymous Coward]

But with an iPhone case for the card as well? Seems like they would own the patents to this...

No C&P!

[Anonymous Coward]

Of what use is a credit card without Chip and PIN?

Useful with virtual credit card numbers

[bakaorg]

Marry this to Citibank's virtual credit card numbers (or similar offerings from other companies) and now you can use one-time credit card numbers for all transactions, bonus points if you can punch in a dollar amount too like citibank offers. Who *cares* if you card # is skimmed or not. At most one person will get the amount of money you wanted to pay. Otherwise, I would stay far away from the service.

Apparently good enough for Americans...

[Moskit]

"All in one"? ALL?
Those 'inventors' live in 80's or what? Unless you provide proper modern card functionality, you can't claim ALL. Heck, your card does not support anything mildly innovative, such as displaying your account balance.

This questionable invention seems to be limited to markets with no security (USA) which want to remain in Dark Ages, or to scammers who want to impersonate people from those countries.

This is even worse than UK card terminals that attempt offline PIN authorisation, yet another security risk.

Loyalty Cards

[brunes69]

I just pre-ordered a Coin. I live in Canada where 100% of my credit cards and debit cards are Chip & PIN so this is of zero use to me from that angle. The whole reason I am getting it is so I can ditch all the damn loyalty cards. Day to day, I only carry around 1 credit card and 1 debit card - I have no need for more. But I have currently in my wally 4 different loyalty cards AND a gift card that I need to use. If Coin can take 4 loyalty cards and turn them into 1, then it is worth $50 to me. And this whole security discussion is thus a non issue because I really don't care if someone decides to steal my Aeroplan card... more points for me!

Google Wallet.

[geekoid]

Is what I use. I don't see why , at this point, we need another thing to carry.

Stupidest pre-order ever?

[Anonymous Coward]

Pre-ordering is stupid enough as it is; but pre-ordering something that facilitates spending? Some people really need remedial home economics.

Didn't work for iCache Geode...

[irregular_hero]

Been there done that. This was the same thing touted by the folks at "iCache" who released a few test units of the "Geode" -- an iPhone jacket and universal card combo that could do this as well as provide support for barcodes using an e-ink window on the back of the case.

Unfortunately, the company -- after a successful Kickstarter and infusion of venture cash, crashed and burned. HARD.

http://www.zdnet.com/icache-geodes-spectacular-crash-and-burn-7000014801/

As it turns out, there were huge limitations on where this type of "cloned" card could be used -- no ATMs, no "pull through" swipers like at gas pumps... It all fell apart quite noisily with accusations of fraud and deceit on the part of the company's founders.

The bottom line is this: Payment card providers require three things: 1) the card should be signed, 2) the card should be present so the merchant can verify the expiration and CVV (or pay a CNP fee), and 3) the card provider's logo must be visible on the card. Failure to comply with any of the three means a merchant may lose his ability to accept cards to the provider. The Geode could do ONE of those things; the same goes for this card, as technically interesting as it may be.

And of course this goes out the window as NFC or chip-and-pin cards eventually come into fashion in the US (as chip-and-pin already is in Europe).

Re:Didn't work for iCache Geode...

[mishehu]

And if you ask me, this is the wrong solution to a trivial problem. Should having to carry around a few pieces of lightweight plastic in my pocket be the biggest inconvenience to me in my life. The solution here sounds waaaay more complex than just having one single piece of plastic with a switch on it that flips it between card a to card b to card n... or just carrying 6+ pieces of plastic.

Re:Didn't work for iCache Geode...

[Anonymous Coward]

And of course this goes out the window as NFC or chip-and-pin cards eventually come into fashion in the US (as chip-and-pin already is in Europe).

s/Europe/The Rest of The Civilized World/

If you have more than one credit card...

[macraig]

... then either you're possessed of very poor financial skills or you're one of the Ten Percent that the other Ninety secretly wants to lynch (or be).

Re:If you have more than one credit card...

[Anonymous Coward]

Or maybe you have debit cards from multiple bank accounts (business account, joint account with wife, personal account, mortgage-connected account) plus one or two credit cards (one of which is just for the free interest period but might be useful in an emergency).

Sometimes it's hard to distinguish poor financial skills from simply being in possession of a life.

Interesting hardware experiment but

[aiadot]

but CC really don't take that much space and most people only have two or three of them. Plus the redundancy is great if you need to temporary share the CC with the wife in case she lost her or similar situations.

Does this solve a problem?

[Taylor123456789]

I have 5 credit cards and I have never thought, gee, these take up too much room in my wallet.

Four credit cards?

[Anonymous Coward]

I carry seven. One for each day of the week. That way if a charge is posted on the wrong day (after factoring in any potential delay), I can figure out if it was fraudulent. Of course, maybe I should just get 31 credit cards, one for each day of any given month. Then I will truly know if something goes wrong, unless the person who stole my card happened to use it on the right day.

The above is a joke. I have two cards. Originally one credit card, which I will only use twice a year now. I got annoyed when my card was being transitioned to a new service provider.

No support for chip and pin yet?

[home-electro.com]

YET????

I wonder how they are planning on supporting it. Apparently chip-and-pin was created specifically to prevent cloning. Here in Canada chip and pin are everywhere, I think all of my cards are chipped now.I can't imaging USA being too far behind.

The project is stillborn

Completely blocked in Switzerland

[DrYak]

I don't know where people get this idea that you have to have a chip-and-pin CC to get by in Europe. It's just not true.

I live in the UK, so examples of things you wouldn't be able to buy with a card include:

In Switzerland you can still see machine that have a mag-stripe reader. But that is disabled in the firmware.
A few years ago, it was the last-resort fall-back mode when the chip couldn't be used.
Recently, allmost all shop refuse to swipe card and it's disabled on almost all firmware (swiping a card is either ignore, or triggers a screen asking to place the card into the chip reader instead).

Shops are currently slowly rolling out new generation of terminals, without any mag-stripe reader, but with a NFC/RFID antenna instead (Which opens a whole new can of worms as a problem - like relay attacks - as PIN confirmation isn't required for small amount contactless payment).

MOST OBVIOUS ISSUE

[Anonymous Coward]

I was working on similar idea a year and a half ago (I'm in Canada)
This method relies on storing the contents of mag-stripe.
The obvious issue with this is that all credit cards, and now debit cards too, have migrated to PIN chip technology.
When you try to pay using the swipe method, it will ask you like 6 times to use the chip.
Naturally, I stopped the development as there was limited use for a tech like this.

Instead of NFC - bump?

[Anonymous Coward]

I'm a non technical lurker but instead of NFC (or in addition to) why not something like Bump to pay?

Yay!

[Anonymous Coward]

Now you can lose all your Cards at once!