Slashdot Mirror
Startup Touts All-in-One Digital Credit Card
First time accepted submitter NoImNotNineVolt writes "Coin, a Y Combinator-backed startup, has started accepting pre-orders for a device as slim as a standard piece of payment plastic that can hold eight credit, debit, and gift cards in its dynamic magnetic stripe. Paired with the Coin smartphone app via Bluetooth low energy, card details can easily be swapped in and out of the device. A minimalist user interface on the device itself allows the owner to toggle between the loaded cards and then swipe just as they would their ordinary card. All card details are encrypted (both on the device and in the smartphone app), and the device's on-board battery is expected to last for two years of typical usage. No support for chip&pin (EMV) yet, so this may have limited utility outside of the USA. They expect to start shipping in summer of 2014."
Now an all in one solution to skim and use credit cards.
But, I don't see this catching on. Tapping to pay with your device is "new" so people don't think much of it. Paying with an "all in one" credit card isn't something most will be used to. Plus, I'd expect pushback from Visa/AMEX on this.
To rule them all.
Cramming a UI and the electromagnetics required to spoof a mag stripe into something small enough to make it through a card reader is pretty impressive; but I just don't see the point.
I need another intermediary in my payment system like I need a hole in the head(and I certainly don't need any credit card details stashed in yet another OMGTOTALLY SECURE!!! server or app), and I'd need a hell of a lot of plastic infesting my wallet before a $100 piece of hardware, and BTLE-compatible smartphone become the lower-hassle alternative.
Along with a card reader, it'd probably be great fun as a tool for duplicating low security cards(eg. copier stored value cards, which commonly actually store their value in the stripe, rather than just encoding an ID that gets looked up by the payment processor), and generally fucking around with mag stripe readers; but for actual real-world financial transactions? How many credit cards do you carry on a daily basis?
I've read the articles, watched the video on their site, and read the FAQ. It is unclear whether the app actually sends your card information to their servers. As I posted over on Hacker News:
No, Coin, I'm not going to store all of my credit and debit cards in a single spot on the Internet.
Your app has to work without Internet, or it's a security risk.
To bad it's way less secure than chip and PIN. Mag stripes can be trivially copied and then used. In Canada a lot of the payment terminals are configured to not allow mag stripe usage if the card has a chip (I disabled the chip on one of my cards to see what happens, only place that would let me swipe is Home Depot, and even then the machine wouldn't accept it, they had to pull out an old physical ka-chunker machine and do it manually, haven't seen those in ages).
If you load all that stuff into your card via the phone, why not just use NFC in the phone to pay? Oh wait, because people won't do that either.
I want to delete my account but Slashdot doesn't allow it.
I hear they're working on one that's EMV compatible, but there's no point in releasing sometime in 2014 what they've proposed now as Chip+PIN/EMV will be rolled out en-mass in the US. The networks (Visa, MC, AMEX, Discover) are starting a liability shift and most will go into effect in Oct 2015: http://en.wikipedia.org/wiki/EMV#United_States
What this means is the liability of any card fraud that occurs after that date with be moved to the entity that hasn't implemented EMV. That includes the card issuing bank, the merchant acquirer (the entity that the merchant uses to process cards), and even the merchant itself if they refused to update their terminals or POS systems. If fraud does occur and everyone is up to date with EMV, the procedure is the same as it is today supposedly.
I personally have my reservations about the system since there have been a string of compromised terminals in the past and the banks incorrectly blamed the card holder because the system was "fraud-proof" according to them. Hopefully those shenanigans don't happen in with US banks as this rolls out.
No support for chip&pin (EMV) yet, so this may have limited utility outside of the USA. They expect to start shipping in summer of 2014."
Considering that all US merchants have to be capable of using EMV[1] by October of 2015, perhaps that two year battery life is about right, because that's all the longer they will be useful. And most merchant services are pushing hard to have everyone capable of taking EMV by the middle of 2014.
Mag strip cards will be around for as long as the current ones out there last, but most new cards being issued now are EMV capable, and very soon, all of them will have to be. Without EMV support, this is, at best, a short term fad. And eventually, mag strip cards will just disappear, and merchants will have no reason to be able to take them.
[1]Technically, not required to stop taking mag strip only, but those who don't become 100% responsible for all fraud, automatically, regardless of the circumstances. As a carrot to go with the stick, those who get EMV up and going are not longer resopnsible for the sometimes pain-in-the-ass (and often expensive for small operations) requirements for PCI compliance.
Wouldn't retailers be required to treat these transactions as "Card Not Present" transactions, meaning that far fewer would accept them?
I believe the liability is increased to the merchant if they just accept a CC number + expiration + CVV, to which accepting this would be functionally equivalent.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Been there done that. This was the same thing touted by the folks at "iCache" who released a few test units of the "Geode" -- an iPhone jacket and universal card combo that could do this as well as provide support for barcodes using an e-ink window on the back of the case.
Unfortunately, the company -- after a successful Kickstarter and infusion of venture cash, crashed and burned. HARD.
http://www.zdnet.com/icache-geodes-spectacular-crash-and-burn-7000014801/
As it turns out, there were huge limitations on where this type of "cloned" card could be used -- no ATMs, no "pull through" swipers like at gas pumps... It all fell apart quite noisily with accusations of fraud and deceit on the part of the company's founders.
The bottom line is this: Payment card providers require three things: 1) the card should be signed, 2) the card should be present so the merchant can verify the expiration and CVV (or pay a CNP fee), and 3) the card provider's logo must be visible on the card. Failure to comply with any of the three means a merchant may lose his ability to accept cards to the provider. The Geode could do ONE of those things; the same goes for this card, as technically interesting as it may be.
And of course this goes out the window as NFC or chip-and-pin cards eventually come into fashion in the US (as chip-and-pin already is in Europe).
"because of their higher swipe fees."
I dunno about Discover, but if you're a merchant, and you're thinking Amex is noticeably more expensive to accept, I dare you to challenge your processor or bank to break out all of your fees.
You will not be happy. The other cards have caught up.
deleting the extra space after periods so i can stay relevant, yeah.