Will 'Chip and Pin' Credit Card Technology Really Increase Security? (Video)

Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 08:14 · Score: -1

Luddite credit cards are insecure and let you waste money on LUDDITE garbage like Windows 7.

App cards are super secure and let you app apps by spending apps!

Apps!

Re:Only if you use App Cards with APPS! by cayenne8 · 2015-09-30 08:23 · Score: 2

Hmm.
I've had most of my cards replacements come with a chip, but I've certainly not been offered or required to do any type of PIN number for it...I just call and activate it on the phone the usual way.
I think it is only Europe mostly that does the PIN part too?

--
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Re:Only if you use App Cards with APPS! by Carnivore · 2015-09-30 08:28 · Score: 2

Despite the physical similarity to the European chip&pin system, the US one is different. It's basically the same thing as a magstripe, but different form factor. It's security through obsurity, in that the fraudsters haven't figured it out yet and the equipment to skim and clone a chip card is not yet common. It's a jump ahead in the race, but does nothing to stop the race.
Re:Only if you use App Cards with APPS! by mark-t · 2015-09-30 08:35 · Score: 1

It's also used in Canada... it acts as a replacement for signature on CC purchases that take chip and pin.

--
File under 'M' for 'Manic ranting'
Re:Only if you use App Cards with APPS! by EvilSS · 2015-09-30 08:48 · Score: 5, Informative

Despite the physical similarity to the European chip&pin system, the US one is different. It's basically the same thing as a magstripe, but different form factor. It's security through obsurity, in that the fraudsters haven't figured it out yet and the equipment to skim and clone a chip card is not yet common. It's a jump ahead in the race, but does nothing to stop the race.
Not exactly. The new US cards use a one time token for the transaction like other PIN and chip cards, but MC/Visa have not required issuers to force PINs. So no 2-factor but still much safer for physical transactions than magstripe, provided you don't lose the card itself. Doesn't do shit if the card itself is stolen or for online transactions though.

--
I browse on +1 so AC's need not respond, I won't see it.
Re:Only if you use App Cards with APPS! by EndlessNameless · 2015-09-30 08:49 · Score: 4, Insightful

The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.

--

---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Re:Only if you use App Cards with APPS! by Nchantim · 2015-09-30 08:57 · Score: 1

The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.
Not only that, if I put my card in the chip reader rather than just swiping it, seems to take 10 seconds longer. Or twenty seconds, or thirty.... I think in many cases convenience will trump security.
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 08:59 · Score: 0

It's a jump back. Not everyone had a mag strip reader in their pockets and required special read heads to roll your own.
Smart card tech ain't new. Its the same tech we have had in the consumer space for decades in the form of cell SIMs, Cable/Sat set-top Box cards, PC terminal logins, etc. Its actually cheaper to get a reprogrammer for a smart card than a mag strip. Encryption you say? You tell me how long you expect hardware based encryption running off an induction powered IC will hold up to a mid-range PC creeping into multi peta-flop range.
Re:Only if you use App Cards with APPS! by random+coward · 2015-09-30 09:04 · Score: 3, Informative

The data on the chip is a signed certificate; but its not encrypted. So if you can do a bit for bit copy of the data to a new chip, viola the card is cloned and useable. IF the data was encrypted and required a pin to unlock, THEN you would have a little security because even if you clone the data, you don't have the key to unlock it to allow the transaction. HOWEVER the spec doesn't allow for that, the spec is basically half of Private Key cryptography.
Re:Only if you use App Cards with APPS! by mind21_98 · 2015-09-30 09:08 · Score: 4, Insightful

It's basically the same thing as a magstripe
Other than the unique one time code that's generated for every chip transaction, of course. And the extreme difficulty of retrieving the private encryption keys needed to generate those codes from the chip itself.

--
US businesses that currently accept chip and PIN/signature
Re:Only if you use App Cards with APPS! by TemporalBeing · 2015-09-30 09:41 · Score: 2

The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.
Not only that, if I put my card in the chip reader rather than just swiping it, seems to take 10 seconds longer. Or twenty seconds, or thirty.... I think in many cases convenience will trump security.
Problem is that the readers which support the chip will also detect that the card has a chip and force it to use the chip. Ran into that already; the mag stripe won't work with them - it's chip only. Or at least, retailers can configure it that way, which I'm pretty sure they'd be required to do under the mentioned requirements by MC/Visa/AMEX

--
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Re:Only if you use App Cards with APPS! by Harlequin80 · 2015-09-30 09:53 · Score: 2

Australia no longer accepts signatures at all. August last year it became chip & pin only
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 10:08 · Score: 3, Informative

The data on the chip is a signed certificate; but its not encrypted.

Most certificates aren't encrypted.

IF the data was encrypted and required a pin to unlock, THEN you would have a little security because even if you clone the data, you don't have the key to unlock it to allow the transaction. HOWEVER the spec doesn't allow for that, the spec is basically half of Private Key cryptography.
That wouldn't be private key cryptography, that would be shared secret cryptography.
In EMV theres a couple of modes, modern cards use what is called DDA. in DDA the card provides the unencrypted public certificate to the terminal, the terminal then provides 'random' data (and this is where the few attacks on emv happen if the terminal is broken and provides not truly random data). The emv chip in the card then uses its own internal private key to sign that random data and returns the signed random data. The terminal then uses the cards certificate it received earlier to validate the signature, then forwards the information on to the processing company. at no time does the private key ever leave the chip and touch the terminal.
Now some earlier chips did do SDA where it just had a pre-signed set of data on the card, that has not been the use case in EMV for about 5 years now. I just checked every card in my wallet and all of them in fact do use DDA.
Re:Only if you use App Cards with APPS! by TsuruchiBrian · 2015-09-30 10:13 · Score: 4, Informative

The whole point of the chip is that you can't skim it (e.g. you can't simply read the information and make a fake card that outputs the same info).
Sure there is no law of physics that says you can't copy the chip in theory, compared to magnetic stripes which are designed to be read to even work, their is currently no easy way to copy a computer chip.
Comparing the security of a magnetic stripe to a smart chip is like comparing the security of a paper document folded in half to an encrypted digital file. Sure there is no guarantee that the encryption can't be broken at some point in the future, but it is almost incalculably more secure than hoping no one unfolds the document and reads it.
Re:Only if you use App Cards with APPS! by TsuruchiBrian · 2015-09-30 10:19 · Score: 1

Until there is a way to feasibly copy the data on the chip, encryption doesn't really buy you anything. I think we should probably still do it, as it's probably not that expensive (we already know how to do it).
I'm just saying that this alone is pretty secure especially compared to magnetic strips.
Re:Only if you use App Cards with APPS! by TsuruchiBrian · 2015-09-30 10:22 · Score: 1

The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing
1000 years is still 12000 months, so your claim is basically unfalsifiable
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 10:33 · Score: 0

So I steal your card and use it, scribbling a sig if needed. Who cares about the unique one time code. If I had to enter a PIN then I'd not be able to use it.
Re:Only if you use App Cards with APPS! by reboot246 · 2015-09-30 10:40 · Score: 1

You could buy a new set of strings for your viola!!
Re:Only if you use App Cards with APPS! by unrtst · 2015-09-30 10:54 · Score: 4, Informative

...It's basically the same thing as a magstripe, but different form factor....
I'm 99.9999% sure you are absolutely wrong!
Granted, the chip&signature that the US is adopting is far weaker than the chip+pin used elsewhere (the pin is "something you know" which prevents the card from being used by others, whereas the signature is just a scribble of anything you want and doesn't technically lock/unlock anything).
However, you can swipe a mag stripe and read all the info from it via VERY cheap hardware (for example, a free square reader). Doing so will give you every piece of info that is printed on the front of the card. It's the same info you'd get if you did an old style carbon copy rubbing of the card like gas stations used to use, and that's the same info you'll get off the new chip+sig mag stripes and imprints. The chip isn't there to prevent theft of the physical card.
If, however, you use the chip, then the merchant does not get the actual card number. There's a two way communication from your card, to the terminal, to the bank, and back, all using crypto. You can think of it like an SSL handshake. Once that handshake is complete, the merchant has a one time use token to use for the purchase.
What does this solve? It ensures that the merchant can't log your card number and store it in their insecure database for thieves to later take, ala the Target breach**, because they'll never have that number. More importantly for the banks, it's "proof" that the card was there, and not some cheap copy.
** I think that's what happened at Target, but there have been mixed stories, and I'm not 100% certain... maybe it involved data they got from the web instead, but I doubt that. I'm pretty sure it was card numbers scanned locally.
Re:Only if you use App Cards with APPS! by TapeCutter · 2015-09-30 11:12 · Score: 1

I don't think the old cards have been used here in Oz for a while now, haven't seen one in years, my own cards have been chip and pin for over a decade. Doesn't matter if you swipe or insert the card, you still require a pin. "Pay wave" is the latest thing, you just wave the card over the reader like an office entry card no pin or signature required, works for purchases up to $100. If you have had a few drinks, don't let the bar staff wave it for you!!!! There is no phone call required to activate the card, it comes in the mail, pin comes separately in the mail on a different day, the card is automatically activated when the old one expires.

If the lights go out businesses can still use the old paper imprint method - at their own risk!

--
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 11:56 · Score: 0

Yall need to get your heads out of "the card" it doesn't matter the physical form factor or the auth mechanism. It's the pki infrastructure BEHIND the card that makes the transactions traceable and auditable. PCI compliance people couldn't care any less if your rent is stolen.
Re:Only if you use App Cards with APPS! by LiENUS · 2015-09-30 12:23 · Score: 2

So I steal your card and use it, scribbling a sig if needed.

My bank will reverse the charges provided I report it stolen and the card will stop working at that point. Thats how it works with both mag and chips, no difference there. What does change is you have to actually steal my card, whereas before all you had to do was get ahold of it for a few seconds to scan the mag strip so you could clone it later.
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 12:51 · Score: 0

Chip & Signature is an option in most EMV countries. Some quite notable people in the UK use Chip & Signature rather than Chip & PIN, for various reasons.
This is not a different system. It's still EMV, just it doesn't require a 4 digit PIN to be entered. The chips are almost identical. Terminals can be configured to reject Chip & Signature, but few are because it's turning away customers. So the only actual difference is that the US decided to ship Chip & Signature by default, whereas other countries selected Chip & PIN by default.
What is it that you suppose will be "cracked in a matter of a months" ? Cloning magstripe cards was easy because the readers and writers for magstripes are a commodity item needed for lots of purposes, a bored teenager could set up a card cloning factory in their basement. But getting the secrets out of the middle of an EMV card, whatever kind it is, is specialist semiconductor forensic work. The sort of people and equipment you need are used to steal multi-million dollar chip designs or break into foreign government security systems, not program a hotel card key or ride the subway for free. So they don't care about your stupid credit card, their machine cost more than your life earnings.
So, in practice nobody clones EMV cards, which means if you've still got your card, nobody else has the card. That's a huge improvement straight away.
Because EMV cards are smarter, when you do an offline transaction the card and terminal can figure out between them if there's a problem. Today in the US even if I stop a card, payments (fraudulent ones) will keep showing for days, even weeks, from offline transactions. They can be rejected, but somebody has to eat the cost of that. With EMV the card itself (which remember you can't clone) will eventually realise something is wrong when it keeps being used for offline transactions and never gets to go online & see everything is OK. So the fraud dries up more quickly after the card is stopped when e.g. it's stolen.
For example most people's cards might be set to do only $100 of transactions in no more than 5 transactions without going online. A midnight stop for gas at an unattended filling station on a highway may be offline, or a train ticket from some station miles from anywhere but your grocery shopping or morning coffee are almost certainly online and will reset the counter because they prove all is still well.
Re:Only if you use App Cards with APPS! by grim-one · 2015-09-30 14:16 · Score: 1

I think in many cases convenience will trump security
If you want convenience, you should check out PayPass or PayWave (one is Visa, the other Mastercard, I forget which). Here in Australia for purchases under $100 you can just tap your card on the payment terminal. No signature, no PIN, no buttons to press. It's also much faster than paying cash and/or getting change. If the purchase is $100 or over, then you tap and punch in your PIN, which is still pretty quick and no messing with cash.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 14:24 · Score: 0

Once, everyone has one, maybe, thirty days till the black hats will have found a way to defeat it. I'm betting on the cloned ATM, with mega-tries. You know the old add one to the results. After all the equation cannot be unsolvable.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 14:28 · Score: 0

Hey right. The sales point cannot notify security, and film the people in the sales area. Right. To see who is using the card.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 14:41 · Score: 0

I believe the target was a fishing plant. The target vendor should not had access to the other software in the system. Some MBA over rode the hired help and had a better way. The target system was basic, everyday internet. And like apple, they stored everything. Even their target friends. That lets you target the ads, and saving you much,for loyal shoppers. Now, here's the cute bit. The unique identifiers, per customer with card, means more cards per your pocket. Or on your phone. Meaning more and better backdoors. Remember, you have your health accounts numbers, ssn's, bdays, all kinds of stuff now identified. Who will need to hack your card, just clone your phone...
Re:Only if you use App Cards with APPS! by jrumney · 2015-09-30 14:52 · Score: 1

Not true. I used a chip and signature card in Melbourne in March this year.
Re: Only if you use App Cards with APPS! by LiENUS · 2015-09-30 14:58 · Score: 1

Hey right. The sales point cannot notify security, and film the people in the sales area. Right. To see who is using the card.
Notify security so they can do what? When a card gets reported stolen it just stops processing payments, it doesn't print out something on the terminal telling the cashier to arrest you and as soon as the card gets declined the offender is going to know the jig is up and make himself scarce asap. Filming the sales area is all good and well but the kind of criminals who steal cards go places they can avoid being filmed.
Re:Only if you use App Cards with APPS! by wagnerrp · 2015-09-30 15:22 · Score: 1

The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
How so? With chip and PIN, if your card is stolen, the attacker either has to accurately guess the PIN before the chip self destructs (unlikely, but not impossible), or disassemble the chip to extract the data. It buys you a small amount of time to contact your card issuer, and have your card key deactivated. With just chip, your card is stolen, and can be used immediately, so you potentially have a couple additional transactions that you would not have had were it protected with a PIN.
In either case, the card must be stolen. That's the real purpose. A stolen card with a PIN is only going to buy you a few extra hours. The real protection is that the private key stored on the card cannot be non-destructively accessed. It cannot be skimmed without the owner's knowledge. It cannot be stored by a retailer and compromised. The owner is expected to notice the loss of the card and report it to their issuer, deactivating the key.
Re:Only if you use App Cards with APPS! by Harlequin80 · 2015-09-30 16:10 · Score: 1

Clarification - it is only on Australian issued cards. If you are on foreign cards signatures are still accepted.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 16:22 · Score: 1

Doesn't matter. The purpose of this is to screw over merchants and customers and to try to make banks not liable for the horribly insecure mess that is our electronic payment system.
Any other effects are unimportant.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 16:32 · Score: 1

How so? Go check the European news. Chip and PIN was compromised years ago. The banks have been trying to cover it up and in doing so blaming the victim in fraudulent transaction cases. This provides no benefit to anyone except the banks which will claim infallibility where it doesn't exist just to avoid liability.
Just more bankster fraud at work here.
Re: Only if you use App Cards with APPS! by LiENUS · 2015-09-30 17:19 · Score: 1

Chip and PIN was compromised years ago.

Can you cite one instance of chip and pin being compromised?
Heres a tip, that chip and skim paper was about faulty terminals that allowed you to guess the nonce they would provide, the actual chip and pin design itself was and still is secure. Idiot manufacturers just didnt build to the chip and pin spec in their terminals.
Re: Only if you use App Cards with APPS! by shilly · 2015-09-30 19:11 · Score: 1

The paper
https://www.cl.cam.ac.uk/resea...
Re:Only if you use App Cards with APPS! by Dahan · 2015-09-30 20:27 · Score: 1

So if you can do a bit for bit copy of the data to a new chip
That's an awfully big "if". It's very impractical to copy the data; the chip on the card isn't simply some flash memory chip, it contains a microprocessor. And it has memory that's only accessible by that microprocessor. So if you can't read that memory, how are you going to write it to a new chip? Maybe you could remove the chip from its packaging and look at the silicon with an electron microscope, but nobody's going to go through that time and expense to copy a card that has a $5000 credit limit or whatever.
Chip cards have been around for over a decade in Europe. While there have been some attacks on them, none involve cloning the card. (There was a paper describing an attack that has "cloning EMV cards" in the title, but the flaw was actually in the card reader terminals. The card wasn't literally cloned... they just found a way to trick the terminal into thinking another card was the same as the original card).
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-09-30 20:31 · Score: 0

To "skim and clone" an EMV card, regardless of whether it uses Chip & PIN, Chip & Signature or some hypothetical new auth method using reserved bits in the protocol, you need to have the ability to open up a tiny integrated circuit and get the data inside its ROM, then manufacture a new IC with the same data inside.
You might think "Oh, I can open that up". Nope, what you did was bust open some big metal surface contacts, the trick needed to "skim" a chip card is to slice open the tiny little chip actually buried under those contacts, without damaging it. The slices are many times smaller than a human hair. Good luck doing it outside a specialist laboratory. And if you've got a specialist laboratory, you're either doing research at one of a handful of public universities with that sort of money, or using it to take apart stolen foreign technology so that your companies can use it - multi-billion dollar crimes, not credit card fraud.
Unlike with magstripes this is able to be hard because it is NEVER NECESSARY. Reading and writing a magstripe are essential elements of issuing and using the magstripe cards. But slicing the tiny chips in an EMV card open to read data out of their ROMs is completely unnecessary, the bank makes whole new cards, and if yours expires or is faulty they just ask you to destroy it. Nobody should ever need to read the ROM data, so it's OK that doing so costs millions of dollars. And thus fraud through cloning _evaporates_. Fraud hasn't gone away, but this particular _type_ of fraud doesn't happen in EMV countries.
And you might notice that while I jokingly called this "skimming" it's going to require stealing the card and destroying it, and will probably need days or weeks of effort by specialists. So, not going to happen when a restaurant employee disappears out the back with your card for a minute.
Re: Only if you use App Cards with APPS! by dave420 · 2015-09-30 22:08 · Score: 1

That paper outlines how a compromised reader can be used to perform a MITM attack, not that Chip and Pin is broken, regardless of the title of the paper. So we're still waiting...
Re:Only if you use App Cards with APPS! by Anonymous Coward · 2015-10-01 00:02 · Score: 0

The whole point of the chip is that you can't skim it (e.g. you can't simply read the information and make a fake card that outputs the same info).
Sure there is no law of physics that says you can't copy the chip in theory, compared to magnetic stripes which are designed to be read to even work, their is currently no easy way to copy a computer chip.
Comparing the security of a magnetic stripe to a smart chip is like comparing the security of a paper document folded in half to an encrypted digital file. Sure there is no guarantee that the encryption can't be broken at some point in the future, but it is almost incalculably more secure than hoping no one unfolds the document and reads it.
The chip cards still have the CC # printed in clear text on the front, they also still contain a magnetic strip. Lets say I go to a restaurant with my chip and pin card, whats to stop someone from just writing down the card number or skimming off the mag strip? Those won't require a pin to use for online purchases.
Re: Only if you use App Cards with APPS! by Anonymous Coward · 2015-10-01 01:10 · Score: 0

Why do I hear a moo-ing sound when I read this?
Re: Only if you use App Cards with APPS! by godefroi · 2015-10-01 02:28 · Score: 1

Indeed. When I had an ATM card cloned (I have no clue how), the criminal took the cloned card to one of the few ATMs in the area without a camera. They know where it's safe to use cloned cards, and where it isn't.

--
Karma: Poor (Mostly affected by lame karma-joke sigs)
Re:Only if you use App Cards with APPS! by random+coward · 2015-10-01 03:05 · Score: 1

Your in Europe, Aren't you? The spec the American card companies are using is SDA.
Re:Only if you use App Cards with APPS! by lsatenstein · 2015-10-01 06:46 · Score: 1

I am not sure this is common but... My Visa provider, for internet purchases where I present the code on the rear of the card, as part of their validation,
intercepts my transaction and asks me a personal question. I have to respond with a matching answer. And if I do, the transaction is allowed to pass through to the rest of the validation routines (amount balance under limit, etc.). If validated, the vendor gets an approval. With some vendors, the transaction times out, but it works fine with other vendors.
Is my Visa provider unique, or is it uncommon practice.

--
Leslie Satenstein Montreal Quebec Canada
Re:Only if you use App Cards with APPS! by TsuruchiBrian · 2015-10-01 12:47 · Score: 1

The fact that the cards still have a magstrip and numbers is not important. What the chip gives you is extra information.
If the credit card company sees that a purchase was made using the chip, they can be reasonably sure that whoever made that purchase was in physical access to the card.
If the credit card company sees that a purchase was made just using the printed info or the info on the mag strip, they know that people could have simply copied this information to make the purchase. At some point they may even refuse to accept those kinds of payments.
It is also probable that it will be common for consumers to own smart card readers to allow for safe online transactions. Even on a compromised computer, purchases will only be able to be made when the card is in the reader. This is analogous to giving your card to a waiter at a restaurant. They will only be able to charge the card when they are in physical possession of it. This is different than traditional cards where waiters can copy the information and make purchases in the future using that information.
The addition of a pin makes it hard for waiters and infected computers to make purchases even with physical access to the chip.

None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:17 · Score: 0

I'll just avoid the merchants that require it. My local Home Depot has a sign up saying that after tomorrow they will no longer swipe credit cards. Guess I'm going to Lowe's.

Re:None of my cards have a chip! by gweilo8888 · 2015-09-30 08:20 · Score: 3, Insightful

Good luck with that. No major retailer is going to stick with swipe cards only for any length of time, because they are now liable for any fraudulent transactions on swipe cards, rather than the credit card companies bearing the liability.
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:24 · Score: 0

I work for a company that makes POS software, and as of yesterday not a one of our customers has run a chipped transaction yet. This is going to be a disaster.
Re: None of my cards have a chip! by MBGMorden · 2015-09-30 08:27 · Score: 1

Walmart is doing it here as of the last few weeks, as well as Dollar General.
The supermarket that I shop at (BI-LO) was doing it two weeks ago but I'm guessing someone complained because the machines weren't asking you to insert chipped cards anymore as of a few days ago.
Personally I don't find the process THAT bad, but until everyone gets used to it it certainly does slow the line down.

--
"People who think they know everything are very annoying to those of us who do."-Mark Twain
Re: None of my cards have a chip! by ColdWetDog · 2015-09-30 08:33 · Score: 2, Funny

Punching in a four digit PIN is slowing things down?
I weep for humanity.

--
Faster! Faster! Faster would be better!
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:38 · Score: 0

That will only last a few months and you'll have nowhere to shop.
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:39 · Score: 0

People will close a youtube video if it takes longer than 2 seconds to load. When the things around us keep accelerating, our attention spans will suffer.
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:44 · Score: 2, Informative

They're only liable for magstripe transactions on cards that have a chip.
Magstripe-only cards still work the same way they always did, legally and functionally.
So basically his local Home Depot is just being a panicky bunch of dicks.
Re: None of my cards have a chip! by Martin+Blank · 2015-09-30 08:46 · Score: 1

I've asked dozens of stores in the last couple of months if I can use the chip reader, and they all say that they haven't enabled them (and some have said they don't have plans to enable them) because of problems with the activation of the chip readers. Two 7-Elevens told me that they had problems with double-charges, a big-box store (I don't remember which) said the cards didn't read properly all the time in tests, and several others have said as recently as last week that the required software hadn't been loaded yet because corporate was still testing upgrades. Many restaurants and stores don't even have chip readers yet.
If these are even partially accurate, then despite the long lead time, I suspect this is going to be a massive fiasco. Home Depot is the one place that I've been able to use the chip reader (and that was in July, IIRC) and it went flawlessly for the one or two transactions, but that's not to say that all of the tens of millions of other upgrades are going to work as well. I'm hoping the confusion dies down quickly, but I'm not counting on it.

--
You can never go home again... but I guess you can shop there.
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 08:56 · Score: 0

And merchants are always liable regardless of how the transaction is processed.
Re: None of my cards have a chip! by mind21_98 · 2015-09-30 08:57 · Score: 1

I don't think the low level cashiers, etc. at major retailers really know much other than any training materials they received from corporate. But it is looking like a lot fewer than everyone thought will be ready in time.

--
US businesses that currently accept chip and PIN/signature
Re: None of my cards have a chip! by mind21_98 · 2015-09-30 08:59 · Score: 2

US chipped (credit) cards generally don't have a PIN, or it's prioritized so low that it's never going to be used domestically. OP is likely referring to having to keep the card in the slot for multiple seconds vs. being able to put it away immediately after swiping.

--
US businesses that currently accept chip and PIN/signature
Re: None of my cards have a chip! by mind21_98 · 2015-09-30 09:02 · Score: 1

Walmart's been doing it for a while, actually. Close to a year at this point.
Re: Dollar General--I'll see if I can confirm whether any other of their stores have support turned on (none in my area) and if so, add them to the site in my signature. Do you know if they have NFC turned on as well?

--
US businesses that currently accept chip and PIN/signature
Re:None of my cards have a chip! by circletimessquare · 2015-09-30 09:06 · Score: 3, Interesting

his bank has already sent him a new card with a chip in july, august, or september
if he didn't activate the new card, some time in october he'll go to lowe's, try to use his old card, and his transaction will be declined
he'll call the bank and raise hell and they'll say "sir, we sent you a new card and you did not activate it"
he won't be able to use magstripe-only for very long because all major banks have replaced them or are replacing them
he may have a card with some oddball institution that continues with magstripe only. that institution will be pressured by continuing changes in technology and standards, or they will raise their eyebrows at the fraud they have to cover, then they will go to chips too
and this is all a good thing, increased security
is there some valid reason why top comment doesn't want the chip?
or is it "receiving the mark of the beast" level low intelligence paranoid mental vomit?

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 09:27 · Score: 0

My bank hasn't issued me a new card yet. My current one expires in just over a year. I bet I don't get a reissue until the month before it expires. And Home Depot had better not decline a perfectly valid card that the issuer still backs if they don't want a merchant complaint lodged against them with Visa.
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 09:28 · Score: 0

No major retailer is going to stick with swipe cards only for any length of time, because they are now liable for any fraudulent transactions on swipe cards, rather than the credit card companies bearing the liability.
This is simply not true. The liability shifts to the party that implements the least technology. So if the card issuer doesn't implement chips, the retailer does, the card issuer is liable. If the issuer has chips, the customer has a chip card, and the retailer doesn't have a chip reader, the retailer is liable.
It certainly won't eliminate the swipe cards for a long, long time. They've had chip and pin in Europe for a decade, and you can still swipe.
Re:None of my cards have a chip! by xaxa · 2015-09-30 09:35 · Score: 2

It certainly won't eliminate the swipe cards for a long, long time. They've had chip and pin in Europe for a decade, and you can still swipe.
Expect that to change.
Swipe readers have been absent in Europe on unsupervised machines (e.g. buying a train ticket) for years, and aren't available at some smaller shops — unless they expect American trade, it's not useful. Even if it does exist, the cashier would often be reluctant to use it.
Re:None of my cards have a chip! by circletimessquare · 2015-09-30 09:39 · Score: 1

they will give you a new card soon or you missed it in the mail (which should concern you). check with your bank

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re:None of my cards have a chip! by taustin · 2015-09-30 09:40 · Score: 1

The specs not only allow but require that merchants still be able to process mag strip only cards. If your card doesn't have a chip, they'll still accept it.
Only 70% of credit cards (and 25% of debit cards) in the US will be chip cards by the end of this year. Banks do not like losing money. It'll be a decade or more before mag strips are no longer usable.
Re:None of my cards have a chip! by taustin · 2015-09-30 09:43 · Score: 4, Informative

You've clearly never worked in retail. There are rules. If the merchant follows the rules, they are protected, and either the merchant service or the issuing bank eats the loss.
(Online companies, mail order companies, and other "card no present" merchants cannot follow the rules, so, yeah, they're hosed.)
EMV means the rules are changing, and they're more complicated, but if the car has no chip, the old rules still apply, and the merchant is protected if they follow the rules.
Re:None of my cards have a chip! by TemporalBeing · 2015-09-30 09:45 · Score: 1

his bank has already sent him a new card with a chip in july, august, or september
Of my 5 cards (2 business, 3 personal), only 2 (1 business, 1 personal) have chips in them. one is chip+pin, and the other is chip+signature.

--
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Re: None of my cards have a chip! by taustin · 2015-09-30 09:47 · Score: 1

No more a disaster than the last few years have been. Very few POS software vendors are actually ready, and at least some have delayed releasing EMV packages because of it. They'd be fools to release software that isn't ready just as the holiday shopping season starts, and the retailers would be fools to accept it.
So things continue the way they have, with the liability for that 1/10th of 1% of transactions that are fraudulent (or, more likely, half that, unless you sell consumer electronics) shifting, in some cases, to the merchant instead of the banks.
Re:None of my cards have a chip! by hawaiian717 · 2015-09-30 09:51 · Score: 2

Different banks are taking different approaches, with some proactively sending out new cards, most at minimum accepting a request for a new card with a chip, and some waiting until cards expire before sending out new chip cards. Stores like Home Depot will continue to accept your valid magnetic stripe card; the only time they'll decline the swipe is if you swipe a chip card, it will prompt you to insert the card into the chip reader.

--
End of Line.
Re: None of my cards have a chip! by Harlequin80 · 2015-09-30 09:55 · Score: 4, Insightful

Given Australia is 100% chip & pin with signatures not accepted since august last year I would hope the system manufacturers have the bugs ironed out.
Re:None of my cards have a chip! by circletimessquare · 2015-09-30 09:55 · Score: 1

the rest will probably be coming soon
the changeover is industry wide

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re: None of my cards have a chip! by TekPolitik · 2015-09-30 10:15 · Score: 1

In Australia, most transactions now are contactless (NFC) chip transactions, with PIN only required when the merchant hits a (merchant dependant) limit. With our without the PIN, it's faster than swipe plus signature. Without the PIN it's faster than cash. The US is basically a nation of paranoid luddites looking for an excuse not to move on.
Re:None of my cards have a chip! by Roblimo · 2015-09-30 10:35 · Score: 1

Our local credit union hasn't sent us new cards yet. As far as buying at Lowes, I'll go to the register, have them ring me up, and then I'll say, "I'll be right back. I'm going to the cash machine at Grow Financial across the parking lot."
Whatever they send us may still take a PIN; we use debit cards, not credit cards, for our day-to-day shopping.
- Rob
Re:None of my cards have a chip! by circletimessquare · 2015-09-30 10:38 · Score: 0

ah a credit union. yeah, they may be more relaxed about the transition. it's expensive

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re: None of my cards have a chip! by Tailhook · 2015-09-30 10:41 · Score: 0

You asked someone employed at 7-Eleven a question about financial transactions and company policy and you believed them?
Dude.
WTF?
I'll take credible information reported by verifiable sources over your human debris anecdotes. As for my own anecdotes, I've used a chip reader at three retailers in the past week and had no trouble at all. There were no double charges, confusion or failures. The grownups already have this deployed, trained their staff and tested their systems. It's done. The laggards will cut over after they start eating the cost of the fraud they're helping to perpetrate.
And stop talking to convenience store clerks FFS. Do that often enough and one of them will give you a case of TB.

--
Maw! Fire up the karma burner!
Re:None of my cards have a chip! by trollingaround · 2015-09-30 11:08 · Score: 1

I'll just avoid the merchants that require it. My local Home Depot has a sign up saying that after tomorrow they will no longer swipe credit cards. Guess I'm going to Lowe's.
What is the logic behind that? Why wouldn't you want to use a more secure way to make payments? What's the drawback?
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 11:29 · Score: 0

Which one is Chip & PIN?
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 11:39 · Score: 0

About 2-3 years ago I was in Sheffield at Tesco (huge supermarket chain) and there was much puzzlement when a slip of paper came out of the card reader. Better still was a grocer in Amsterdam, just off the tourist route, where only one person knew of credit cards without chips and had to go into the back room to get a dust covered machine which took an imprint of the card.
Re: None of my cards have a chip! by MBGMorden · 2015-09-30 11:42 · Score: 1

No - with debit cards you have to punch in the pin anyways (you always have).
The issue is with inserting the card - and then leaving it there. Many people who are used to the "swipe" system put in the card, then pull it back out when it need to stay in the reader the whole time. That starts the process over so that they have to reswipe, reinsert, reenter pin, etc.

--
"People who think they know everything are very annoying to those of us who do."-Mark Twain
Re: None of my cards have a chip! by MBGMorden · 2015-09-30 11:43 · Score: 1

I'm not sure about NFC. I don't have any payment method that supports this so I haven't tested it.

--
"People who think they know everything are very annoying to those of us who do."-Mark Twain
Re: None of my cards have a chip! by mind21_98 · 2015-09-30 11:46 · Score: 1

If you have a card that supports Android or Apple Pay you can add it to that and try tapping with your phone. It's supposed to say on the screen that NFC's accepted if it is but a lot of such places don't for some reason.

--
US businesses that currently accept chip and PIN/signature
Re: None of my cards have a chip! by Martin+Blank · 2015-09-30 11:53 · Score: 1

I realize the limited value of anecdotal evidence, especially from cashiers. Some just shrug and say they don't know when they'll work. But when I do get answers, they're remarkably consistent about reported problems.
Aside from Home Depot, none of the stores I've been to in the last couple of months have working chip readers. That includes Sprouts, Tom Thumb, Kroger, 7-Eleven, CVS, or any of the myriad small stores. My wife works in a small retail shop and has asked, and was told that even with the newly-deployed chip readers, they're not likely to be active for several weeks or months yet.
It's not happening as fast as it was supposed to, and that's going to be a problem come tomorrow.

--
You can never go home again... but I guess you can shop there.
Re: None of my cards have a chip! by compro01 · 2015-09-30 13:04 · Score: 1

Up here in Canada, the limit for contactless debit ("Interac flash") is a cumulative of $50 ($100 for gas stations), then it says "Nope. Stick the chip in.".

--
upon the advice of my lawyer, i have no sig at this time
Re:None of my cards have a chip! by Anonymous Coward · 2015-09-30 13:45 · Score: 0

I'll just avoid the merchants that require it. My local Home Depot has a sign up saying that after tomorrow they will no longer swipe credit cards. Guess I'm going to Lowe's.
What is the logic behind that? Why wouldn't you want to use a more secure way to make payments? What's the drawback?
Read the subject. It's because none of my cards have a chip.
Re: None of my cards have a chip! by labnet · 2015-09-30 14:05 · Score: 1

Australia is unsually used as a 'test bed' for new banking tech, as we are small but early adopters of technlogy.
Australia also has a nearfield RFID payment system called paywave.
For transactions under a certain value (normally $50), you can just tap you card on the POS machine. Higher value transactions require a 4 digit PIN.

--
46137
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 14:07 · Score: 0

It's not humanity. It's Americans, the rest of us haven't used a swipe card since 2005ish.
I've been trying to figure out what US is a holdout. I think I understand now, given the comments above (for instance the idiot who says he isn't going to shop at Home Depot because they will require a pin code)
Re: None of my cards have a chip! by Harlequin80 · 2015-09-30 14:33 · Score: 1

Love paywave (or paypass). Just makes it soooooo convenient.
The other one I miss when I go out of Australia is the "Select your account, Chq, Sav or Credit" all from the one card.
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 17:39 · Score: 0

To;dr
Re: None of my cards have a chip! by shilly · 2015-09-30 19:16 · Score: 2

The UK has the same. It's now implemented on London underground so you can use your credit card like an Oyster card and it will open the gates. (Apple Pay also works)
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 19:34 · Score: 0

And me. F*ck sake I can type my pin faster than I can pick up a pen and sign my signature.
Re: None of my cards have a chip! by rastos1 · 2015-09-30 19:42 · Score: 1

Actually Europe is moving to contactless cards (to the level that you are not even offered cards that are not contactless) - which means you don't even have to punch in the pin most of the time. That solves the complaint about "slowing things down". I personally do not trust that as far as I can throw the merchant.
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 19:45 · Score: 0

The whole world has been using chip + PIN for a decade, so there is nothing to test here really.
And while USA finally discovers the chip, everyone else is moving to RFID.
Re: None of my cards have a chip! by Anonymous Coward · 2015-09-30 20:47 · Score: 0

UK here. Must places here now use contactless (via card) payment for purchases sub £30. Touch your card to the reader and go, by far the fastest retail payment method I've come across.
Re: None of my cards have a chip! by hattig · 2015-09-30 23:13 · Score: 1

It's amazing that the rest of the world did this transition up to a decade ago, without any issues.
It's excuses for the sake of it. Or using poor software systems instead of proven systems as used elsewhere in the world.
Re:None of my cards have a chip! by Anonymous Coward · 2015-10-01 00:19 · Score: 0

My bank is USAA, we still have not had our DEBIT cards replaced. My family members who have CREDIT cards issued by USAA have the EMV chip.
Maybe don't talk out of your arse?
Re:None of my cards have a chip! by Anonymous Coward · 2015-10-01 00:21 · Score: 0

Ask them who their card processor is, then report them.
That's very incorrect. If the card is not EMV capable, the liability does not shift. The liability ONLY shifts when the card is EMV capable. Someone is clearly misinformed and/or has some reading comprehension issues.
Direct them to a site like this: https://www.elavon.com/securit...
Re: None of my cards have a chip! by Anonymous Coward · 2015-10-01 00:35 · Score: 0

Given Australia is 100% chip & pin with signatures not accepted since august last year I would hope the system manufacturers have the bugs ironed out.
No, Australia is mostly PayWave / PayPass with no PIN entered for purchases under $100
Re: None of my cards have a chip! by dinfinity · 2015-10-01 00:36 · Score: 2

Contactless is actually superconvenient, given a limit on the maximum amount for which it works. Over here that maximum is EUR 25, which allows you to be really fast for all small purchases (which are generally the purchases where that really matters).
I would support a system where you could authorize it to work for higher amounts at certain vendors (supermarkets, for instance).
Re:None of my cards have a chip! by circletimessquare · 2015-10-01 00:44 · Score: 1

where does the deranged anger come from? what you wrote does not contradict what i said

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re: None of my cards have a chip! by balbus000 · 2015-10-01 02:20 · Score: 2

I'm hoping it will be faster eventually, but right now it is slowing things down (American perspective, for other countries this might not be the case).
Almost all of the terminals I see now have both a slot of swiping and for the chip. Except some stores require you to swipe, the chip part doesn't work yet. And some stores require you to use the chip if your card has it. So you never know which one to use.
With swiping, you can usually do it while the cashier is scanning your items, which means my wallet is already back in my pocket and I just have to sign when they are done scanning. With chip, you have to insert your card and leave it there until the transaction is complete. The processing time before the card has been accepted is also noticeably longer than when swiping.
Most importantly though, I have never actually been prompted for a PIN when using the chip. It's always chip and sign.
Re:None of my cards have a chip! by Anonymous Coward · 2015-10-01 10:46 · Score: 0

USAA cards are chip & sig.
Re: None of my cards have a chip! by Harlequin80 · 2015-10-01 12:21 · Score: 1

This isn't actually any different to chip & pin because there are numerous terminals which wont ask for a pin even if you insert the card for transactions under $100. If you paywave an over $100 transaction you will need to enter a pin
Re: None of my cards have a chip! by swalve · 2015-10-01 13:29 · Score: 1

My fucking piece of shit bank had contactless cards that worked pretty good, and I was enjoying the future. Then they issued a new card with the moronic chip and took out the RFID.
Re:None of my cards have a chip! by swalve · 2015-10-01 13:34 · Score: 1

Because it is a stupid technology that takes longer and offers nothing in return.
Re:None of my cards have a chip! by TemporalBeing · 2015-10-02 01:27 · Score: 1

the rest will probably be coming soon
the changeover is industry wide
Probably not until they expire and are naturally replaced. I don't expect banks - especially smaller banks - to just dump cards; they'll just update them as part of their renewal cycle.

--
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Re: None of my cards have a chip! by Anonymous Coward · 2015-10-02 09:52 · Score: 0

Properly implemented, I understand that chip & pin credit card systems have essentially ended skimming as a fraud mechanism. And I believe that card skimming was a major, if not THE major, means of credit card fraud.
This isn't theory. This is on the ground fact, as experienced in multiple major markets around the world.
This is why it's disheartening to hear someone ramble on about how "chip & pin does nothing". When in reality, if you don't dink up the system, chip & pin is highly effective.

No.... by mysidia · 2015-09-30 08:18 · Score: 4, Insightful

date after which merchants are supposed to be liable for fraudulent purchases made with old-style cards, and are supposed to have point of sale terminals that accept "chip and PIN" cards.

It's the date after which merchants are supposed to be liable for fraudulent purchase made with New-style chip and PIN cards which are made as signature transactions (e.g. with an old terminal).

Their idea is: The bank will be liable for a fraudulent charge if the original bank/card doesn't support Chip and Pin but the merchant does, AND the Merchant will be liable if the Bank's issued card supports chip and pin, but the merchant doesn't support the feature.

Re:No.... by Anonymous Coward · 2015-09-30 08:24 · Score: 0

Exactamundo, really this is all about moving the insurance costs around
Re:No.... by mark-t · 2015-09-30 08:28 · Score: 1

And who is responsible for a fraudulent charge if both support chip and pin?

--
File under 'M' for 'Manic ranting'
Re:No.... by Anonymous Coward · 2015-09-30 08:36 · Score: 1

The card owner.
Clearly this new technology is unbreakable (the companies who make it told us so). Therefore, if anyone claims a fraudulent charge was made on their card, they must be lying and will be charged a libel fee by both the bank and store who are properly using the perfect technology.
Re:No.... by Sable+Drakon · 2015-09-30 08:40 · Score: 2

The bank/card issuer. If both support EMV, then fraudulent transactions are handled the same way as they are under Mag-Stripe.

--
The Amarri pray for god, the Caldari pray for profit. the Gallente pray for peace, but the Minmatar pray their ships hol
Re:No.... by EvilSS · 2015-09-30 08:53 · Score: 2

date after which merchants are supposed to be liable for fraudulent purchases made with old-style cards, and are supposed to have point of sale terminals that accept "chip and PIN" cards.
It's the date after which merchants are supposed to be liable for fraudulent purchase made with New-style chip and Signature cards which are made as swipe transactions (e.g. with an old terminal).
TFIFY. The new US cards are chip and signature, not chip and PIN. At least, they are not required to be chip and PIN. Which is very unfortunate.

--
I browse on +1 so AC's need not respond, I won't see it.
Re:No.... by internerdj · 2015-09-30 09:12 · Score: 1

From an article I read earlier, the best part is the manufacturers haven't been able to keep up with the demand for the new readers. So, many smaller retailers are going to be potentially on the hook for a couple of months for any card fraud while they wait for their machine.
Re:No.... by sensei+moreh · 2015-09-30 09:13 · Score: 1

My Visa card's got a chip, so I called the issuer regarding a PIN - no PIN available

--
Geology - it's not rocket science; it's rock science
Re:No.... by mark-t · 2015-09-30 09:23 · Score: 1

Even if it were true that the technology is unbreakable, if you are forced to surrender your PIN under duress, such as threat of harm or death to either oneself or to those that they would care for, the transactions that may ensue with the obtained PIN as a result are still considered fraudulent as long as the incident is reported as soon as practicable.

--
File under 'M' for 'Manic ranting'
Re:No.... by taustin · 2015-09-30 09:51 · Score: 2

Actually, cardholder rights aren't changing, and aren't technical, they're legal. No changes there at all.
If everybody follows the rules, either the merchant service or the issuing bank eat the loss. Same as it's always been.
Now adjust your tin foil hat. It's slipping down over your eyes.
Re:No.... by taustin · 2015-09-30 09:54 · Score: 1

Retailers are remarkably resistant to chip & PIN in the US, out of a (probably misguided) perception that consumers will be resistant. Merchant services are very, very practical, and are not going to shut down their bread and butter over the issue.
US banks have extremely sophisticated algorithms to spot fraudulent transactions (which is why we're a decade behind Europe on this), and those won't be going away. Fraud rates are about 1/10th of 1 percent overall, which isn't exactly the end of the world to begin with.
Re:No.... by LessThanObvious · 2015-09-30 10:15 · Score: 3, Informative

We are going Chip-and-Signature in the U.S., but if we were going Chip-and-PIN it could shift liability to the cardholder. Chip-and-PIN is thought to be secure, so the presumption of innocence may not hold as it does today.
See quote below from Jonathan E. Jaffe posted on Krebsonsecurity.com:
"Take a look under the May 2014 section of http://nc3.mobi/references/emv... on what is happening in Europe under EMV. That page has lots of links, but here is the relevant text.
Change in Presumption of Innocence
An article in The Register (whose slogan is Biting the hand that feeds IT) is rather critical of chip-and-pin citing established weaknesses and some new ones referred to in the new paper Chip and Skim: cloning EMV cards with the pre-play attack from the Computer Laboratory, University of Cambridge, UK (16 page PDF) presented at the 2014 IEEE Symposium on Security and Privacy in San Jose, California 5/19/2014.
In this paper paper it is worth looking at the change in what we call presumption of innocence as it describes the case of a Mr Gambin, "who was refused a refund for a series of transactions that were billed to his card and which HSBC [ his bank ] claimed must have been made with his card and PIN at an ATM in Palma, Majorca on the 29th June 2011. In such cases we advise the fraud victim to demand the transaction logs from the bank. In many cases the banks refuse, or even delete logs during the dispute process, leaving customers to argue about generalities." [ The bank deleted the evidence that would have shown the fraud. highlighting ours, see right column page one of the 16 page PDF -ed]"
Re:No.... by Archangel+Michael · 2015-09-30 10:53 · Score: 1

No, the merchants are opposed to them because all the fraud comes back to them, not the bank.
A merchant can do everything correctly, and still get nailed.

--
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Re:No.... by Anonymous Coward · 2015-09-30 11:16 · Score: 0

It would if the US was getting Chip and Pin, but what its getting is Chip and Signature, which does nothing about security.. you are tokenizing the card information, but so what.. its not difficult to replicate because the data is left open (stored, but not encrypted).. hence why Chip and Sig cards don't require pins. The data is not encrypted. In Europe, if you have a proper Chip and Pin card, if there is a problem with the PIN, you essentially chuck the card and replace it because they can't "fix" the pin without knowing it, and any "overwriting" of data would require the Card to start with. And if they use the correct Chips, its a write once process. But what the US has is a half solution so yes its marginally better.. sort of like being side struck by a car, vs. a head on collision. Both are likely to kill you, but the side strike is slightly better because you have a statistically greater chance of survival. (not good odds, but better than nothing)
Re:No.... by mysidia · 2015-09-30 12:01 · Score: 1

going to be potentially on the hook for a couple of months for any card fraud while they wait for their machine.
I get why that probably is, but I don't feel very sorry for them either.... terminals that can read EMV have been around since 2014. This move was publicized by banks 12 months in advance. They should not have waited until 90 days or less before the change.
Updating credit card processing equipment to current security standards is a vital part of the cost of doing business processing the cards.
If the retailers don't want that cost, then they should switch to cash-only or Bitcoins.
There are still plenty of options, I think, even if it might (I guess) be more expensive or have higher transaction fees or other challenges... where they could switch their payment processor and get an EMV capable terminal from a supplier that is prepared, even if their current payment processor is out of stock and can't sell them for a while.
Either that... or take the liability for months worth of transactions or suspend business until new terminal arrives. And either way, that's the cost of procrastination to implement security-related tech updates; I guess.
Re:No.... by Streetlight · 2015-09-30 12:06 · Score: 1

In the US we don't have chip and PIN. We have Chip and sign. When will credit card issuers provide required PINs?

--
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Re:No.... by Anonymous Coward · 2015-09-30 13:01 · Score: 0

the data is left open (stored, but not encrypted)..
Of course its not encrypted you nitwit, its stored in a secure area of the chip, the chip doesnt pass out the private key ever, it signs the challenge from the terminal and returns the signed challenge to the terminal.

In Europe, if you have a proper Chip and Pin card, if there is a problem with the PIN, you essentially chuck the card and replace it because they can't "fix" the pin without knowing it,

Do you even research this bullshit before you spout it out or do you just makeup whatever you can and try to pass it off as fact? Theres even solutions to rewrite the pin over the internet at home using a standard smart card reader and a challenge/response system from the issuer.
http://www.bellid.com/finance/emv-internet-pin-change/
The PIN has NOTHING to do with encryption, its used to unlock the cpu to access the secure area. all the bank needs is its SO code to reset the pin no need to rewrite anything other than the pin, and its easy to do, this is basic smart card shit
Re:No.... by mysidia · 2015-09-30 13:03 · Score: 1

In the US we don't have chip and PIN. We have Chip and sign.
That's a good point... they eschewed the PIN part, which I don't understand. I guess somebody considered it a little too inconvenient.
Or perhaps the signature system provides some plausible deniability or capability to lend your card to a child or associate with a letter of authorization, which somebody likes.
Re:No.... by Anonymous Coward · 2015-09-30 18:14 · Score: 0

We are going Chip-and-Signature in the U.S., but if we were going Chip-and-PIN it could shift liability to the cardholder. Chip-and-PIN is thought to be secure, so the presumption of innocence may not hold as it does today.
See quote below from Jonathan E. Jaffe posted on Krebsonsecurity.com:
"Take a look under the May 2014 section of http://nc3.mobi/references/emv... on what is happening in Europe under EMV. That page has lots of links, but here is the relevant text.
Change in Presumption of Innocence
An article in The Register (whose slogan is Biting the hand that feeds IT) is rather critical of chip-and-pin citing established weaknesses and some new ones referred to in the new paper Chip and Skim: cloning EMV cards with the pre-play attack from the Computer Laboratory, University of Cambridge, UK (16 page PDF) presented at the 2014 IEEE Symposium on Security and Privacy in San Jose, California 5/19/2014.
In this paper paper it is worth looking at the change in what we call presumption of innocence as it describes the case of a Mr Gambin, "who was refused a refund for a series of transactions that were billed to his card and which HSBC [ his bank ] claimed must have been made with his card and PIN at an ATM in Palma, Majorca on the 29th June 2011. In such cases we advise the fraud victim to demand the transaction logs from the bank. In many cases the banks refuse, or even delete logs during the dispute process, leaving customers to argue about generalities." [ The bank deleted the evidence that would have shown the fraud. highlighting ours, see right column page one of the 16 page PDF -ed]"
Get over it. Chip and PIN has been in use in both across Europe, including the UK, for a very long time. Consumers have not been impacted by it negatively. Sure you can find one offs, but you find one offs to prove any point.
The US is so fucking backwards at times it's like you want to be a third world country.
Re:No.... by jeremyp · 2015-09-30 22:13 · Score: 1

How do you get money out of an ATM without a PIN?

--
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
Re:No.... by Carewolf · 2015-10-01 00:35 · Score: 1

We are going Chip-and-Signature in the U.S., but if we were going Chip-and-PIN it could shift liability to the cardholder. Chip-and-PIN is thought to be secure, so the presumption of innocence may not hold as it does today.
If the PIN-code has been entered correctly, then you are liable for insecure handling of your pin-code, then only amounts over a certain size are covered. If no pin-code was entered and the money stolen some other way, then you are not liable for anything. Usually the shop that allowed signature instead is.
Also you need a police report for having your card stolen. Been there done that, got my money back.
The thing with chip, is that the bank can tell if the card was in machine, which machine and if pin-code was demanded by the shop or not. Even if somehow through a security hole, fraud comes in from machines without a card, they can block those and trace back to who did it (who received the money is an easy question).
Re:No.... by Fnord666 · 2015-10-01 01:43 · Score: 1

How do you get money out of an ATM without a PIN?
You use your ATM PIN which is different. Right now most card issuers in the US do not support an EMV PIN yet.

--
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
Re:No.... by dhaen · 2015-10-01 04:00 · Score: 1

The the same PINs work for ATM and chip-n-PIN transactions for the 4 cards I hold in the UK.
Re:No.... by guruevi · 2015-10-01 08:18 · Score: 1

Your card holder rights are different when you enter a pin/signing a slip vs. not doing so. The bank will assume your PIN == your valid signature and you'll get to eat the losses.
If you dispute a transaction and the merchant produces a signed slip with your valid signature, you will not be successful in disputing the transaction (unless you claim that the merchandize is faulty or wasn't delivered).
In the future, when you enter a PIN, you will not be successful in disputing the transaction even though modern skimmers are capable of grabbing both your card info and your PIN information. In most cases, your card information is still available in plain text on the chip for offline transactions unless explicitly disabled by your bank. And if your bank has explicitly disabled ALL plain text transaction (some European banks and on-request in the US) your card is currently useless at the following places: Wal Mart, Tim Hortons and most gas stations (except Exxon/Mobil) - at least they'll still allow you to mag-swipe in those cases.

--
Custom electronics and digital signage for your business: www.evcircuits.com
Re:No.... by swalve · 2015-10-01 13:43 · Score: 1

There are two different systems for credit card style transactions. First there was the good old credit card, swipe+signature (or imprint + signature) method. At the same time, you had another card in your wallet that was tied to your bank account, and those were processed through the ATM network, which is the swipe+PIN method. Over time, these technologies merged so that one card could do both, and people just used whatever they were used to. Those different methods also costed different amounts. The credit card way charged the merchant. The ATM network charged the bank, who likely charged you.
Re:No.... by swalve · 2015-10-01 13:44 · Score: 1

And we have the debit/atm network where you can do that now if you want. But you get charged more.
Re:No.... by mark-t · 2015-10-05 16:19 · Score: 1

Yeah... I did some research after posting the question, and apparently the intent is to shift liability to the cardholder. However, maximum liability for fraudulent use of chip and PIN is still capped, at various levels depending on how quickly you report that your PIN has been compromised, as long as it is apparent that you were not acting with intent to commit fraud or being willfully negligent with regards to deliberately sharing your PIN.

--
File under 'M' for 'Manic ranting'

Chip and PIN would, but... by gweilo8888 · 2015-09-30 08:18 · Score: 5, Informative

...that's not the system we're getting in the US, at least for the time being and at most retailers. We're getting Chip and Signature, which is much less secure. We're just calling it Chip and PIN, but most retailers aren't actually using PIN numbers to complete transactions...

Re:Chip and PIN would, but... by Anonymous Coward · 2015-09-30 08:28 · Score: 0

Yes but ... this system is still resistant to skimming, which is a primary method of card fraud right now. Yes, it's not resistant to "you got mugged or left your card somewhere" attacks, but those are a much, much lower volume than skimming attacks. I don't really understand why we're not requiring the PIN, but it's not that huge a deal, as long as you cancel your card as soon as you lose it.
Re:Chip and PIN would, but... by Anonymous Coward · 2015-09-30 08:28 · Score: 1

To do PIN you have to buy a terminal for the customer to use. My company has an electronic shopping cart used about about 3,000 companies with a point of sale module, and we've done a ton of integrations for readers on cash registers like the ones built into some keyboards or an external reader on a monitor, but as far as we know, none of our customers use a terminal where a customer can enter a PIN.
Re:Chip and PIN would, but... by Anonymous Coward · 2015-09-30 08:58 · Score: 0

All they want is card-present verification via something more complicated than CVV1.
Right now, magstripes have the CVV1 value, which is not printed on the card. The CVV2 is printed on the card and is not on the magstripe. These are essentially plaintext password storage in distributed form.
What the chip gets you is an on-card public key encryptor. This is produces a crypto signature that says "yes, this card was present, and we can verify this output against the private key". You don't need a PIN for this. The PIN is only to verify that the person with physical possession of the card is someone that also knows the PIN, presumably authorized by you.
Chip+Sign is a replacement and upgrade for the old CVVx values. Chip+PIN is a much more far-reaching replacement for the entire trust system.
The reason this makes a difference in the US vs. EU is due to how billing and invoicing laws work. In the EU, much more emphasis is placed on traditional invoices. All of the laws and case-law (where applicable) are built up around paying an invoice. Meanwhile, in the US, you get an account statement instead. The difference is that an invoice has charges tied directly to it, and age is tied to the invoice, not the charges themselves. An account statement, on the other hand, is a snapshot of an account and each individual charge against that account has its own age. The age is used to calculate interest, late fees, and other periodic fees that apply to any line of credit.
Chip+PIN goes well with batched invoices. A single fraudulent charge nullifies the whole invoice, forcing it to be reissued and resetting the age of everything on it. But in the US, where individual transactions can't affect others as easily, Chip+Sign is "good enough" and is a shit-ton less work.
So that's why. The US doesn't need Chip+PIN because its laws are structured differently.
Re:Chip and PIN would, but... by Spy+Handler · 2015-09-30 09:02 · Score: 1

We're getting Chip and Signature, which is much less secure.
No it isn't. The "chip" part is what provides most of the security. Pins are easy to skim or eyeball. Yes chip & pin is more secure than chip & signature.... but not by much.
Banks in US looked at the pros and cons, and decided that the slight additional security provided by a PIN was not worth the inconvenience to the customer and also the fact that a whole lot of merchants who do not have PIN pads will have to buy one. It was not a stupid decision, it was quite logical.
Re:Chip and PIN would, but... by radarskiy · 2015-09-30 11:14 · Score: 1

" most retailers aren't actually using PIN numbers to complete transactions."
Most retailers CAN'T, since most US banks are not putting PINs with the chips.
When I first got a chip and sig card, this caused me problems in Europe when I tried to buy train tickets from a ticket machine. They "solved" this by forcing European vendors to accept a chipped card without a PIN.
Re:Chip and PIN would, but... by guruevi · 2015-10-01 08:24 · Score: 1

NO, it is not in most cases because the chip is capable of holding your information in plain text or plain text + pin for offline transactions. A well-installed skimmer (with the keypad etc) can read that information (and are available for purchase): http://krebsonsecurity.com/201...

--
Custom electronics and digital signage for your business: www.evcircuits.com

Come on US by Anonymous Coward · 2015-09-30 08:18 · Score: 0

You guys don't have chip and pin yet?

What?

Re:Come on US by gweilo8888 · 2015-09-30 08:21 · Score: 1

Yep. I literally got my first Chip and PIN card within the last three weeks, and that's only for my credit card. My Chip and PIN debit card isn't here still, and is promised some time in the next month or two. And that's the first opportunity I've had to get either.
Re:Come on US by sexconker · 2015-09-30 08:35 · Score: 1

No, you got a card with a chip.
There's no PIN.
It's chip + sign in the US for the foreseeable future.
Re:Come on US by Martin+Blank · 2015-09-30 08:54 · Score: 1

It depends on one's bank. Most are going with chip and signature, but some (Barclay's comes to mind, and some banks that cater heavily to international travelers) are issuing chip and PIN cards.

--
You can never go home again... but I guess you can shop there.
Re:Come on US by Anonymous Coward · 2015-09-30 08:55 · Score: 0

indeed what. I have had a card with pin for more than 20 years.
Re:Come on US by mind21_98 · 2015-09-30 09:05 · Score: 1

Debit cards will ask for a PIN but only at places that have already accepted debit. And it's still optional, just like magstripe. Too bad I don't see that changing any time soon; might as well just never ask for a PIN on debit as well except for cash back if it's not going to be made mandatory.

--
US businesses that currently accept chip and PIN/signature
Re: Come on US by Anonymous Coward · 2015-09-30 09:10 · Score: 0

My Bank of America debit card has a Chip, and a mag stripe, and it supports both PIN and signature transactions.
Basically nothing has changed except the card has a "Chip" in it now that no retailer POS supports.
Re:Come on US by Anonymous Coward · 2015-09-30 09:15 · Score: -1

HEY, look at the fucking cow, everyone!
Re:Come on US by hawaiian717 · 2015-09-30 09:56 · Score: 1

Actually, Barclay's cards are still Chip and Signature, in that they are programmed to prefer the signature and will only prompt you for a PIN if the location is unable to accept a signature (like a European train ticket kiosk). But that's still better than some issuers (like Chase and Capital One), which don't support PIN at all (other than for cash advances like they always have).
There are a couple credit unions at least that are issuing PIN-peferring cards.

--
End of Line.
Re:Come on US by Anonymous Coward · 2015-09-30 11:52 · Score: 0

Where did you get the credit card from?

Online retailers by gQuigs · 2015-09-30 08:21 · Score: 1

How does this work for online retailers? How do I get my own time pin out of the card? Does this mean you can't save a credit card anymore?

Re:Online retailers by Carnivore · 2015-09-30 08:29 · Score: 1

This isn't chip and pin. It's a Different Magstripe. Online retialers will do a card-not-present transaction the same way they always have.
Re:Online retailers by Erik+Hensema · 2015-09-30 08:42 · Score: 1

Actually in europe we have 2FA for online banking and payment with online retailers. Everybody has got a little card reader which is required for signing transactions.

--
This is your sig. There are thousands more, but this one is yours.
Re:Online retailers by Ash+Vince · 2015-09-30 08:44 · Score: 1, Informative

How does this work for online retailers? How do I get my own time pin out of the card? Does this mean you can't save a credit card anymore?
As someone in the UK where we have had chip and pin for years it does not change online purchases one little bit.
All chip and pin does is replace the bullshit signature with entering a pin. This is important because it prevents two types of attacks that used to be commonplace:
1) Have a friendly guy in the shop who didn't look too closely at your signature in return for a couple of quid.
2) Have a moron in the shop who didn't look too closely at your signature.
Both of these are pretty common place when you realise that working in a shop is basically a McJob with no real future. done by kids mostly paid barely minimum wage. Even if you get fired for repeatedly not noticing you took a stolen card you will get another job in some other shop in no time.
The reality is that you guys in the states have to start using chip and pin, or you can forget ever travelling to Europe where most of our terminals and moving to PIN only. Within a few years most retailers over here will have blanket bans on signature transactions, quite a few do already.
Oh, and I know it is not actually that much more secure, if it is at all as now the pin is stored on the card in encrypted format and not sent to the bank but that does not change anything. The attacks you can mount it are fairly high tech ones, which will always be an issue and not the banks priority. Chip and Pin is designed to beat the low tech, commonplace attacks I describe above that are done en-masse by thousands of chancers that cost banks a fortune (here in the UK banks are liable for this sort of stuff, unless that can prove you were negligent).

--
I dont read /. to RTFA, I read /. to offend people in ignorance.
Re:Online retailers by war4peace · 2015-09-30 08:53 · Score: 1

In Europe, cards also have a CVV2 (or CIC, CID, CSC, CVC2, might be named differently in other countries).
That's what you use to pay online.
Example: https://www.coastpavementservi...

--
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Re:Online retailers by Blaskowicz · 2015-09-30 09:10 · Score: 1

I did or witnessed a signature transaction exactly once in my life, and that was for buying duty-free in the small moutain nation. The cashier didn't have a list of 50 million printed signatures to check against or something. It was funny and unexpected.
Here in France you now have adults that only know chip and pin for a good reason : there was chip and pin before they were born.
In fact if you're writing a signature and relying on that, why not write a cheque. That used to be very common, requires a pen but does not require a modem and power.
Anyway 90% of the debate is "we're using to doing things that way" and of course the way I've been doing things is the better, and you're weird if you think differently.
Re:Online retailers by mind21_98 · 2015-09-30 09:11 · Score: 1

We're getting every other part of the EMV system, just not the PIN part. That is a far cry from your characterization of chip and signature as a "different form of magstripe".

--
US businesses that currently accept chip and PIN/signature
Re:Online retailers by F.Ultra · 2015-09-30 09:12 · Score: 3, Interesting

While the PIN is stored on the card it cannot be read externally since you cannot read that part of memory using the pins on the card. AFAIK when you enter the pin on the terminal it sends it to the card together with the amount and then the card creates a one time key for that amount signed with the cards internal secret key if the pin matches what it has stored inside and this one time key is what it sends to the terminal and which it in turn sends to VISA/Mastercard/... so yes the chip+pin is way more secure than the old magstripe and the chip+signature.
Re:Online retailers by mind21_98 · 2015-09-30 09:13 · Score: 1

The reality is that you guys in the states have to start using chip and pin, or you can forget ever travelling to Europe where most of our terminals and moving to PIN only. Within a few years most retailers over here will have blanket bans on signature transactions, quite a few do already.
Considering that Visa and MasterCard regulations (and the UK's own laws) require that merchants still accept signatures, I don't see that going too well.

--
US businesses that currently accept chip and PIN/signature
Re:Online retailers by xaxa · 2015-09-30 09:42 · Score: 1

Considering that Visa and MasterCard regulations (and the UK's own laws) require that merchants still accept signatures, I don't see that going too well.
Isn't that only for special circumstances, e.g. a person with a disability that means they can't use a PIN?
Many merchants don't accept signatures: train ticket machines, cinema ticket machines, self-checkout at supermarkets, etc.
Re:Online retailers by mind21_98 · 2015-09-30 09:47 · Score: 1

They're supposed to accept cards requiring signatures regardless of where the card's from. The disability requirement is to get such a card issued by a UK bank. Oh, and the Visa/MC rules also say that ticket machines, etc. are supposed to accept cards that don't a PIN. (Self-checkouts are considered "attended" so the person watching them still needs to get a signature.)

--
US businesses that currently accept chip and PIN/signature
Re:Online retailers by mrbester · 2015-09-30 09:49 · Score: 1

And also swipe readers, as chips can fail to be read by a terminal filled with gunk, it got damaged, etc.. However, contactless is gaining traction so at least you can still pay for your latte without all that tedious mucking around with legal tender...

--
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
Re:Online retailers by Harlequin80 · 2015-09-30 10:06 · Score: 1

http://www.cnet.com/au/news/au...
Aug last year cards went pin only here is Aus
Re:Online retailers by mind21_98 · 2015-09-30 10:11 · Score: 1

Just for cards issued by Australian banks. Chip and signature cards from other countries still work there.

--
US businesses that currently accept chip and PIN/signature
Re:Online retailers by Harlequin80 · 2015-09-30 10:45 · Score: 1

Yes correct - sorry should have clarified that.
Re:Online retailers by Harlequin80 · 2015-09-30 10:46 · Score: 1

Also they fail over to mag swipe if the chip doesn't work after 3 attempts.
Re:Online retailers by Anonymous Coward · 2015-09-30 11:01 · Score: 0

I've had that discussion a few times with US credit card companies - them saying that a shopkeeper must accept a signature isn't much value when you're actually in a shop trying to buy things and nobody there knows how to do it.
Re:Online retailers by jrumney · 2015-09-30 14:46 · Score: 1

1) Have a friendly guy in the shop who didn't look too closely at your signature in return for a couple of quid.
2) Have a moron in the shop who didn't look too closely at your signature.
Both of these are pretty common place

If you actually find someone working in retail who cares enough to not fall under 2, it'd probably take a bit more than a couple of quid to turn them into 1.
Re:Online retailers by jrumney · 2015-09-30 14:50 · Score: 2

What sort of disability must one have to not be capable of pressing some buttons on a keypad, but still be capable of signing your name?
Re:Online retailers by mind21_98 · 2015-09-30 14:52 · Score: 1

Possibly something like Parkinson's disease. Or maybe even something that prevents you from memorizing the PIN, like dementia.

--
US businesses that currently accept chip and PIN/signature
Re:Online retailers by Anonymous Coward · 2015-09-30 21:17 · Score: 0

Not everyone in Europe. I don't have this in the UK, and we are still in Europe (just about!)
Re:Online retailers by hattig · 2015-09-30 23:24 · Score: 1

The cashier should have checked the signature on the paper, against the signature on the card. It's to prevent card theft purchases.
Something the contactless payment system completely bypasses, unless you are unlucky enough to get asked for a pin on your contactless purchase. However as there is a limit (£30 UK) you might get a free lunch, some beers and a couple of movies before the card is cancelled, but not much more.
At least chip and pin is something you have (the card) and something you know (the pin), which is fairly reasonable. Since introduction, card fraud has dropped massively in countries using it. I don't know what contactless has done for these figures however.
Re:Online retailers by damnbunni · 2015-10-01 01:16 · Score: 1

Some forms of dyslexia cause a real problem with PINs.

It does increase security a bit if used correctly by dskoll · 2015-09-30 08:23 · Score: 1

It does increase security a little bit. Don't forget: What really protects you, the consumer, is that fact that you're almost never responsible for fraudulent charges on your card unless you were grossly negligent.

The credit card companies don't want to (and cannot) completely prevent fraud. All they need is something to keep it at a manageable level so their high profits remain high. And chip-and-PIN is a little better than mag-stripe.

It's Chip and Signature, Not Chip and PIN? by Anonymous Coward · 2015-09-30 08:25 · Score: 0

There's no PIN. I thought the "industry" decided we Americans were too stupid to remember a PIN so they went with sig only.

Isn't that correct?

-Lee

Re:It's Chip and Signature, Not Chip and PIN? by sims+2 · 2015-09-30 08:31 · Score: 1

Fun fact the signature is not checked by anyone and it does not have to match as most of the pos card readers are worn and do not correctly record the signature.

--
Minimum threshold fixed. Thanks!
Re:It's Chip and Signature, Not Chip and PIN? by ColdWetDog · 2015-09-30 08:37 · Score: 2

When I write anything recognizable at all, I put "Zaphod B". No one even looks at it.

--
Faster! Faster! Faster would be better!
Re:It's Chip and Signature, Not Chip and PIN? by xenotransplant · 2015-09-30 08:43 · Score: 1

This. Every time I sign my name it looks different anyway. I've never developed a "signature" I just scrawl out a vague cursive representation of my name. Works every time.
Re:It's Chip and Signature, Not Chip and PIN? by mind21_98 · 2015-09-30 09:14 · Score: 1

It's a rationalization made by some in the media. While it might have a bit of basis in fact, the real reason is that banks don't really consider PIN a worthwhile investment of time or money.

--
US businesses that currently accept chip and PIN/signature
Re:It's Chip and Signature, Not Chip and PIN? by viperidaenz · 2015-09-30 10:37 · Score: 3, Informative

Better than magstrip and signature.
When I worked in retail 15 years ago I had someone pay with a credit card, and while checking the signature, which matched perfectly, I saw the card number on the receipt didn't match the card. I only paid attention because they were suspiciously easy to up-sell to.
They had written someone else's magstrip data on to their own card.
All you need to do is buy a $100 device from ebay, sneakily swipe customer cards while you're working your low paying gas station job and write the data to your own card.
You can then go on a spending spree, writing a new stolen card number for every purchase so the automated fraud detection algorithms don't catch you and block the stolen card.
You can't do that with a chip card, since you can't clone the card.
It's even harder with NFC, since the customer never lets go of their card.
Re:It's Chip and Signature, Not Chip and PIN? by Anonymous Coward · 2015-09-30 11:54 · Score: 0

If we checked signatures properly (in person) CC transactions would drop by half. So many have "see ID" or no sig on them at all, so we couldn't verify it if we tried.
I assume it was meant to amuse us, like the machine asking me to 'imprint the card' when I enter a # by hand when so many of them are no longer even embossed .
Re:It's Chip and Signature, Not Chip and PIN? by Moridineas · 2015-09-30 12:31 · Score: 1

When I worked in retail 15 years ago I had someone pay with a credit card, and while checking the signature, which matched perfectly, I saw the card number on the receipt didn't match the card. I only paid attention because they were suspiciously easy to up-sell to.
So what did you do?
Re:It's Chip and Signature, Not Chip and PIN? by mjwx · 2015-09-30 12:48 · Score: 1

Better than magstrip and signature.
Even though signature is the main problem there (chip or magstripe, signatures are easy to fake and PIN's are not easy to guess) new cards in Australia are not being issued with Magstripes any more. Europe/UK have probably been like this for years.

It's even harder with NFC, since the customer never lets go of their card.
Actually, NFC is what is making card skimming even easier.

NFC transmits the card number, expiry date and name to any device that asks for it. This is all you need to start making transactions online.

Chip and PIN reduced in store card fraud to nil in Europe, however the fraudsters just switched to making online transactions instead.

--
Calling someone a "hater" only means you can not rationally rebut their argument.
Re:It's Chip and Signature, Not Chip and PIN? by dj245 · 2015-09-30 13:24 · Score: 1

Way to leave us hanging on the ending of the cool story, bro.

--
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Re:It's Chip and Signature, Not Chip and PIN? by viperidaenz · 2015-09-30 14:55 · Score: 1

The security code isn't stored on the card. Can't remember the last time I saw an online payment gateway that didn't ask for that. I would be surprised if that didn't trigger a fraud detection alert at the bank.
Nothing you can't get by looking at the front of the card
Re:It's Chip and Signature, Not Chip and PIN? by viperidaenz · 2015-09-30 14:57 · Score: 1

Told him I had to go check something out back, got the manager
By the time I got back he had left with nothing, I still had the card.
Not a very exciting ending.
Re:It's Chip and Signature, Not Chip and PIN? by Anonymous Coward · 2015-09-30 22:21 · Score: 0

"It's even harder with NFC, since the customer never lets go of their card."
Not sure about this one. Depends on if the customer has to take some action (type in a PIN for example). If not, you can just walk around communicating with their cards, or even relaying the data realtime to some other place. Just like with some car keys that only require the keys to be close by. Just relay the signal and voila.
Re:It's Chip and Signature, Not Chip and PIN? by hattig · 2015-09-30 23:31 · Score: 1

We still get the magstripe on cards in the UK. Presumably so we can still use them when we travel to America.
Chip and signature sounds really odd though - how does the card match the signatures?

"Will"? by Anonymous Coward · 2015-09-30 08:27 · Score: 0

What the hell kind of "security" have you been using the whole time?

Fuck SlashtardTV by Anonymous Coward · 2015-09-30 08:27 · Score: 0

Always some fat neckbeard running his mouth about some shit. It's hard to watch because you can hardly stop laughing because their neck-fat flaps around like a bowl of jello during an earthquake.

Total fucking fail.

yeah yeah yeah slashwaste by Anonymous Coward · 2015-09-30 08:27 · Score: 0

"Will 'Chip and Pin' Credit Card Technology Really Increase Security? (Video)"
" sort of, a little, but not a whole lot, according to Jerry Irvine, w"

yeah i am the same stupid as slashdot. yeah yeah yeah yeah, yeahs it will increase security, yeah , yeahs a little, and a sort of and, yeah yeah yeah, am I slashdot or what ????

Open-source tool to read Chip and Pin cards by L-One-L-One · 2015-09-30 08:28 · Score: 1

These Chip and Pin cards are called "EMV" cards.

For those who are curious about what's inside those chips, check out Cardpeek, an open-source tool to read the contents of smart cards.

http://pannetrat.com/Cardpeek/

Lots of stuff in there.

Re:Open-source tool to read Chip and Pin cards by Erik+Hensema · 2015-09-30 08:45 · Score: 1

I'm not entirely sure on how the chip works, but I imagine the chip contains a keypair for the customer and a certificate for the bank. The customer's key is protected with a password (AKA the pin) and used to encrypt messages to the bank. The customer's certificate is used to sign the messages. The bank's certificate is used to establish a secure channel between chip and bank. Am I anywhere close to reality?

--
This is your sig. There are thousands more, but this one is yours.
Re:Open-source tool to read Chip and Pin cards by Anonymous Coward · 2015-09-30 09:13 · Score: 0

Sort of, it is (inevitably) more complicated but yes the central trick is that chip contains a secret that is used to calculate the transmitted data but is not itself sent.
With magstripe cards a bad guy swipes your card (looks exactly like any other transaction) and keeps the data. Then they write the same magstripe data to another card and instantly they've got a clone they can use to buy whatever they like. The reader and writer are both cheap devices that are needed for lots of legitimate purposes. So a bored middle class teenager can start cloning credit cards, never mind serious criminals.
With EMV the legitimate readers only talk to the chip about a specific transaction. So the data sent can't be used to clone the card. To clone the chip you'd probably need the sort of industrial semiconductor espionage / research gear that wouldn't be found outside of a handful of specialist research facilities and maybe a few sites owned by bank contractors. These facilities could knock off a multi-million dollar product design just as well as they can find the secret value inside your VISA, so even if they're crooked (and with so few of them it would be easy to inspect) they're not going to steal your credit card.
The gear needed to make a card isn't enough, and the gear used in a shop to make a purchase with the card isn't anywhere close to the ballpark of enough. So the risk of fraud through cloning evaporates with EMV.
However lots of other risks are still present. All the tricks that don't involve computers and data still work. You can still be mugged for the card. Bank employees can lie and issue a card to their accomplice but say it was posted to you. A retailer can tell you they're charging $10 but actually bill $1000.
And there are some places EMV can't save you but the layman wouldn't know. One that's been demonstrated but hasn't been proven to be in use by criminals goes like this. Bad guy A gets a job at, say, Starbucks. They alter the card payment terminal, in a subtle way, using parts they bought online. Bad guy B goes into a local jewellery store with a weird but legitimate looking EMV card that in fact has a wireless transceiver hidden in it.
You come into Starbucks, want to pay $20 for some coffees and pastries for you and friends. A secretly signals wirelessly to B. B goes to the counter at the store and asks to buy a $1500 ring. Meanwhile A hands you the altered terminal, and at the same time B is being handed a legitimate terminal in the jewellery store. You put your card in, and wait a moment. B puts his card into the other terminal. Now the altered terminal says enter PIN please. You enter your PIN unlocking your card. It receives the transaction data... from the jewellery store, and uses your PIN to authorise a $1500 payment for a ring. B walks out of the store, having apparently legally purchased a ring, with your card. But your card is still in your hand, in a Starbucks across town.
Re: Open-source tool to read Chip and Pin cards by Anonymous Coward · 2015-09-30 09:15 · Score: 0

I think it is just there for security theatre. I've yet to even find a retailer in the US that actually uses the chip (unless it is some magical thing that happens when they swipe the mag strip on the back of the card).
Re:Open-source tool to read Chip and Pin cards by hattig · 2015-09-30 23:37 · Score: 1

You can still be mugged for the card.
But the mugger will have to force the pin out of you. And hope you don't cancel the card before they get to use it.
Or forge a signature, as this system appears to be implemented in this case - I presume the signature is encoded on the card chip and only visible to the cashier? Dunno how that's meant to work if the user can forge the signature from a physical signature on the card.
A retailer can tell you they're charging $10 but actually bill $1000.
How hard is it to verify the amount on the screen when tapping in your pin? Or is the American system done by the cashier entirely, because it's too hard for typical Americans to cope with?

Short sighted and wrong. by plover · 2015-09-30 08:30 · Score: 1

The problem is that there are six million merchants out there with mag stripe readers, and nobody can force them all to change to EMV overnight. It took Europe four years to get even to 90% adoption rates. Until such time as most all retailers take them, the crappy mag stripes are required for backward compatibility. And if we say "this does nothing", that's wrong. It takes us one step further down a path we need to fully traverse.

--
John

Re:Short sighted and wrong. by hawguy · 2015-09-30 08:42 · Score: 1

The problem is that there are six million merchants out there with mag stripe readers, and nobody can force them all to change to EMV overnight. It took Europe four years to get even to 90% adoption rates. Until such time as most all retailers take them, the crappy mag stripes are required for backward compatibility. And if we say "this does nothing", that's wrong. It takes us one step further down a path we need to fully traverse.
The big credit card companies announced their migration plans 3 years ago, that's hardly overnight.
But no merchant will be forced to accept chip cards, they will just have to accept liability for any fraud that results from transactions on systems that are not EMV capable.
Re:Short sighted and wrong. by emj · 2015-09-30 08:53 · Score: 1

The merchants here change readers every three years or so.
Re:Short sighted and wrong. by circletimessquare · 2015-09-30 09:10 · Score: 1

that the right thing is hard to do is no argument against doing the right thing
that it takes a long time to drain the swamp is no argument against doing the right thing and draining the fucking swamp
(metaphorically speaking of course, actual wetlands are vital aspects of the ecosystem)

--
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Re:Short sighted and wrong. by mind21_98 · 2015-09-30 09:16 · Score: 1

Unfortunately a lot of retailers bet wrongly that Visa and MasterCard would change their minds and now everyone's rushing.

--
US businesses that currently accept chip and PIN/signature
Re:Short sighted and wrong. by viperidaenz · 2015-09-30 10:25 · Score: 1

They can force the change of terminals here in New Zealand. Pretty much all the merchants lease them. It's a device that only works with one provider and you're not allowed to tamper with it in any way. It should never be something you have to buy.
It would be like buying a cellphone from your carrier, not being able to change any settings, it won't work with another carrier and if they detect any tampering, having your service suspended until you pay them to service it.
The only ones left without NFC are those who don't want to pay the slightly higher merchant fees associated with it. They've all got NFC capable terminals but NFC is turned off.
Re:Short sighted and wrong. by plover · 2015-10-01 01:57 · Score: 1

The merchants here change readers every three years or so.
That's because the terminals are required to be more and more secure to protect the mag stripe data, and their older terminals were out of compliance with the standards. This has been a massive exercise in kicking the can down the road.
With chip cards, the game changes fundamentally when security moves into the chip. But until the whole ecosystem of cards, mag stripes, and web entry of account numbers gets fully converted to EMV, the data passed out of the chip can still be stolen and abused at some of the weakest links. Hopefully the "liability shift" will convince these weakest links they need to convert to chip readers before they get stung with crippling losses because they allowed their systems to be used for fraud.

--
John

Why speculate? We have numbers! by 91degrees · 2015-09-30 08:33 · Score: 1

Chip-and-PIN is not a new idea! We've had it for over a decade in Britain and we weren't the first to implement it! One of the reasons the banks pushed it here was because other countries that have tried it saw substantial reductions in fraud!

It works!

it's not the retailers, it's the cards by YesIAmAScript · 2015-09-30 08:34 · Score: 1

US chip cards are set to "prefer signature". Many of them don't have PINs at all.

It's less secure, but likely it doesn't matter. Part of chip and PIN was designed to blame the customer for all in-person fraudulent charges on the idea that if your PIN was entered, you must have been there (and not just your card). This does not pass muster with US consumer protection laws, so there isn't a lot of reason to go to chip and PIN in the US.

Not that chip and PIN wouldn't work, I think the retailers just saw it as too much hassle to make all merchants put in card readers which face the customer instead of the employees.

Chip and sign cards cannot be cloned. That's what adds the most protection anyway. Especially since much stolen credit card info from around the world has been used in the US since you could make a cloned stripe card from account info for chip and PIN cards and then use it in the US.

--
http://lkml.org/lkml/2005/8/20/95

Re:it's not the retailers, it's the cards by mattack2 · 2015-09-30 08:42 · Score: 2

so there isn't a lot of reason to go to chip and PIN in the US.
Isn't eliminating some of the hassle of "oh I lost my card, someone can be charging on it right now" a good reason?
I know the consumer isn't responsible (directly) for the fraud, but we all are, in higher prices, even if one is smart and fully pays off credit cards and thus pays no interest. So preventing fraud is useful.
Vaguely similar to how the Apple ID lock on iPhones supposedly has lowered theft rates.
Re:it's not the retailers, it's the cards by Anonymous Coward · 2015-09-30 09:09 · Score: 0

Chip and sign cards cannot be cloned. That's what adds the most protection anyway.
Keep in mind Chip and sign method only detect Point of sale fraud if the card is being cloned, still doesn't prevent physically stolen credit card to be used. Unless the cashier is smart enough to check the signature against the photo ID of the person who signed.
It all boils down the merchant education and the point of sales systems being more cautious about cyber security. The only way to reduce fraud is the merchant and all its Point of Sales vendors are diligent on protecting their system against fraud.
Re:it's not the retailers, it's the cards by j2.718ff · 2015-09-30 09:21 · Score: 1

I think the retailers just saw it as too much hassle to make all merchants put in card readers which face the customer instead of the employees.
Nearly every retailer I use has a customer-facing credit card reader. At least that's been the case for the past decade or so anyway.
Re:it's not the retailers, it's the cards by Anonymous Coward · 2015-09-30 09:43 · Score: 0

Fraud isn't even 1%.
Re: it's not the retailers, it's the cards by TekPolitik · 2015-09-30 10:21 · Score: 1

The liability on PIN versus chip is mostly an evidentiary issue, notwithstanding the contractual starting position.
Re:it's not the retailers, it's the cards by JSG · 2015-09-30 12:30 · Score: 1

Err actually it might be the retailers.
I am an EU (UK) citizen and we have had Chip and Pin for years. To the point that we generally don't even bother signing the back of our cards (no need)
I have bought quite a few things (non trivial amounts in some cases) in the US and signed for them on those digitiser things. Not once have I been challenged, despite not having a sig on my card and my bank could not possibly somehow verify my sig - they don't have it in digital form.
Perhaps I simply have an honest face: who wouldn't trust that?
Re:it's not the retailers, it's the cards by Anonymous Coward · 2015-09-30 15:37 · Score: 0

I don't know about cards in the EU, but here, the card should always be signed, or the merchant can refuse it. The signature was never about comparing it. The signature is you agreement to the card contract. Without it, it's not actually valid. That most people ignore that doesn't change that fact. All of my cards say that they are not valid if not signed.
Re:it's not the retailers, it's the cards by whoever57 · 2015-09-30 16:50 · Score: 1

US chip cards are set to "prefer signature". Many of them don't have PINs at all.
I have had a chip-and-signature card for over a year now. I don't think it is "prefer signature", I think that it is "signature only".

Shortly after I got the card, during a trip to the UK, it surprised a few people, when the card was inserted into the reader and the reader printed out a paper slip for signature, instead of waiting for a PIN to be entered. There was no option to enter a PIN. On a more recent trip, people in the UK were used to this type of card..

--
The real "Libtards" are the Libertarians!
Re:it's not the retailers, it's the cards by swb · 2015-09-30 22:03 · Score: 1

I have ATM cards (ATM-only, not Visa check cards) and have NOT FOR RETAIL PURCHASE written in the signing box. It saved me once when I handed the card to a clerk for a purchase by mistake, although I think I would have had to enter my pin number on the terminal since it was not a Visa check card, ATM only.
I think I've also done something similar on a credit card -- written CHECK PHOTO ID where the signature is supposed to go. I think I only showed my photo ID once.
Re:it's not the retailers, it's the cards by Anonymous Coward · 2015-09-30 22:06 · Score: 0

The one around can just be turned around as they are rotating mounts anyway. But hey, it's IMPOSSIBLE to turn the thing other way around.
Re:it's not the retailers, it's the cards by Frederic54 · 2015-10-01 04:50 · Score: 1

> US chip cards are set to "prefer signature"

It makes sense, I am Canadian and when I tried to use the magnetic strip at a US merchant (WalMart) the terminal wanted me to insert card and type my PIN instead. And it wrote all messages in French :)

--
"Science will win because it works." - Stephen Hawking

Will? by danbob999 · 2015-09-30 08:35 · Score: 1

Outside of the US, everyone already has it.

Re:Will? by fahrbot-bot · 2015-09-30 09:02 · Score: 1

Outside of the US, everyone already has it.
These new cards are obviously some sort of "metric" credit cards hence the hold up here in 'Merica.

--
It must have been something you assimilated. . . .

You are right for the wrong reason by goombah99 · 2015-09-30 08:36 · Score: 4, Insightful

Studies in europe showed that when chip and pin nearly eliminated point-of-sale (in store) fraud, that within a year or so the fraud moved to card-not-present sales (that is, the fraud occured by european cards used on the internet, phone, and also countries where the Pin network was not integrated back to europes clearinghouses like brazil, the US, and off-the-grid stores). The total amount of fraud was roughly the same as it had been (one can argue about details or if it's less than it would have been).

For in-store (card present) sales, It isn't lost cards that are the biggest problem. It's stolen card numbers being either cloned onto forged plastic. Stolen card numbers are easily transmitted faster and also can be replicated many times, which is better than the original card itself. Just having the chip there can shut this down. You don't have to have the pin. thus card+signature is just as good as chip and pin for practical purposes. The pin just shuts down people using the original stolen card which is a small slice of the problem.

So no this isn't going to do much about fraud since card-not-present is actually goging to become the dominant mode of sales (internet). But the pin doesn't help much.

--
Some drink at the fountain of knowledge. Others just gargle.

Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 08:50 · Score: 0

So no this isn't going to do much about fraud since card-not-present is actually goging to become the dominant mode of sales (internet). But the pin doesn't help much.
Not always true. With the heavy use of digipasses in which you insert your (European-issue) cards when you shop online, this becomes a card-is-present transaction.
The digipass validates it with an extra online handshake with the bank servers or payment processors -- and prompts for your PIN, which the CHIP on the card verifies, and generates a signature challenge, which the bank servers verify. This is card-is-present and bank-is-present-too.
Re:You are right for the wrong reason by Kjella · 2015-09-30 09:00 · Score: 1

So no this isn't going to do much about fraud since card-not-present is actually goging to become the dominant mode of sales (internet). But the pin doesn't help much.
Is that still a big thing? All my online purchases I get a text from "Verified by VISA" with a one-time authentication code. So it's no good online, in stores I use a PIN so it's no good offline either. My impression was that almost all the fraud was either theft of card + PIN (camera, shoulder surfing) alternatively card + cell phone if it will display texts on screen or duplicating the magnetic strip and using it in backwards countries. Either that or somebody got my info on file for recurring/convenient billing and they lose control of it.

--
Live today, because you never know what tomorrow brings
Re:You are right for the wrong reason by goombah99 · 2015-09-30 09:02 · Score: 2

So no this isn't going to do much about fraud since card-not-present is actually goging to become the dominant mode of sales (internet). But the pin doesn't help much.
Not always true. With the heavy use of digipasses in which you insert your (European-issue) cards when you shop online, this becomes a card-is-present transaction.
The digipass validates it with an extra online handshake with the bank servers or payment processors -- and prompts for your PIN, which the CHIP on the card verifies, and generates a signature challenge, which the bank servers verify. This is card-is-present and bank-is-present-too.
My expectation is that merchants are not going limit themselves to only the few customers with a card reader. On the otherhand, they obviously could limit themselves to customers with internet so apple-pay or similar to generate a transaction token would be easy

--
Some drink at the fountain of knowledge. Others just gargle.
Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 09:09 · Score: 0

Technically the PIN can be used for online transactions as well. The PIN can be used to unlock a private key which can then be used to sign the transaction. Without the physical card and correct PIN, it would be impossible to forge a transaction even online.
I'm not sure what these VISA/Mastercard smartcards are capable of though. They very well may not have generated PKI keys (and possibly certificates) which could be used in the way I describe. Especially in the US, the technology of credit cards is at least 15 years behind the times.
Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 09:09 · Score: 0

Considering that they're not bothering with card-present sales thefts and are relying on other means, if they have your card number, expiry date, and at least the CVV (another stupid notion to "secure" things...sigh...) then they can purchase to their heart's content without being caught out for a bit. Even the premise you propose isn't a major problem- they don't run with forged cards much anymore because of the risk-to-payoff ratio. They do mail/phone/internet purchasing off of places like NewEgg, Amazon, and eBay.
Re:You are right for the wrong reason by Anonymice · 2015-09-30 09:13 · Score: 1

I'm afraid you're *very* misinformed. That might possibly have been the case for a short time after the cards were introduced, however for over a decade now online purchases have required part of an online password that is processed & authorised through a direct connection with your bank. If you don't know the requested characters of your online password, you can't complete the transaction.
South America has also had support for the system for the best part of a decade - even fucking Bolivia has it as standard. Seriously, the US seems to be one of the last places in the world still dragging their feet in catching up with modern civilisation.
It means today, pretty much the only way fraudsters are able to get into your bank account are by filming you entering your PIN at an ATM, piecing your password together via a keylogger on your computer (your password is never requested in full), ir simply conning people the old-fashioned way.
Re:You are right for the wrong reason by goombah99 · 2015-09-30 09:21 · Score: 0

I'm afraid you're *very* misinformed.
Well I'd disagree. There's lots of studies and google is your friend if you want to leard the actual fraud rates for card not present with chip and pin. One of the many loopholes is that the chip and pins from europe can easily be used in the US without a password or a pin.

--
Some drink at the fountain of knowledge. Others just gargle.
Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 09:25 · Score: 0

Before you call someone misinfomred please review page 7 of this report from chase bank on Card not present fraud in europe.
https://www.frbatlanta.org/-/m...
Re:You are right for the wrong reason by hawaiian717 · 2015-09-30 09:41 · Score: 1

Verified by Visa isn't widely used among US online merchants. The only time I can recall running into it was with Ticketmaster, and at the time it was a hassle (some redirect to my bank's web site, not a code via text) such that I cancelled out of it, let the authorization decline, and tried again using Amex which didn't have an equivalent to Verified by Visa.

--
End of Line.
Re:You are right for the wrong reason by misexistentialist · 2015-09-30 09:49 · Score: 1

PayPal sounds like a more convenient method than that, and has been around for the better part of 2 decades. I'm guessing in your "advanced civilization" online transaction cost ends up being high, with internet retailers selling products at prices that are higher compared to your standard of living than in the USA
Re:You are right for the wrong reason by Soluzar · 2015-09-30 09:51 · Score: 1

My bank have a device for home use which (when the PIN is entered) can generate a single use code. I believe this is what you're referring to? It is used for transactions through their own online banking service, but sadly not for anything else.
Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 11:22 · Score: 0

"Verified by Visa" is the same thing as "your charge won't go through", at least in my case. I had a card setup with Verified by Visa and the password would not work anymore once the card was replaced the first time by my bank. I was quite confident of what that password was for the previous card, and I knew I never set it up for the replacement card.
So I contacted my bank, who pretty much said "we don't know anything, contact Visa", so I contacted Visa, who said "you have to contact your bank", so I stopped using that card anywhere that required "Verified by Visa". The only place I remember asking for it was NewEgg, but NewEgg also takes PayPal, which comes from... that same card, only it worked.
My new card is not and will not be setup using "Verified by Visa". Ever.
Re:You are right for the wrong reason by mjwx · 2015-09-30 12:43 · Score: 1

Studies in europe showed that when chip and pin nearly eliminated point-of-sale (in store) fraud, that within a year or so the fraud moved to card-not-present sales (that is, the fraud occured by european cards used on the internet, phone, and also countries where the Pin network was not integrated back to europes clearinghouses like brazil, the US, and off-the-grid stores). The total amount of fraud was roughly the same as it had been (one can argue about details or if it's less than it would have been).
Basically came here to say this.

Chip and PIN has decreased fraud. However people are still stupid and put their cards into anything that looks like a slot, so they still get skimmed (this is even easier with NFC transmitting everything you need to do an online transaction to anything that asks for it).

Credit card fraud will be a growing problem until we start enforcing security rules onto end users. However banks are reluctant to do that because people will just start using cash because it's easier and safer. They'd lose more in the reduction of merchant fees (yes, the bank charges the merchant for accepting cards) than it currently costs to put up with the fraud.

--
Calling someone a "hater" only means you can not rationally rebut their argument.
Re:You are right for the wrong reason by JSG · 2015-09-30 12:47 · Score: 1

"One of the many loopholes is that the chip and pins from europe can easily be used in the US without a password or a pin."
Or even a signature. I haven't bothered to sign my cards for years and US retailers don't seem too bothered.
Re:You are right for the wrong reason by compro01 · 2015-09-30 13:10 · Score: 1

Then you push chip authentication program to secure card-not-present transactions.

--
upon the advice of my lawyer, i have no sig at this time
Re:You are right for the wrong reason by tepples · 2015-09-30 13:46 · Score: 1

All my online purchases I get a text from "Verified by VISA" with a one-time authentication code.
Which hurts in countries whose cellular carriers charge subscribers to receive SMS text messages. Slashdot's home country (USA) is one of them.
Re:You are right for the wrong reason by Anonymice · 2015-09-30 17:13 · Score: 1

That supports Chip & PIN!
Keeping in mind this document is 5 years old, even it already shows that all areas of card fraud (including cloning) have dropped drastically & that the abuse facilitated by the States' lack of the technology has shot up to account for nearly 1/4 of the fraudulent transactions across the entire globe.
Re:You are right for the wrong reason by shilly · 2015-09-30 19:34 · Score: 1

"Studies in europe showed that when chip and pin nearly eliminated point-of-sale (in store) fraud, that within a year or so the fraud moved to card-not-present sales (that is, the fraud occured by european cards used on the internet, phone, and also countries where the Pin network was not integrated back to europes clearinghouses like brazil, the US, and off-the-grid stores). The total amount of fraud was roughly the same as it had been (one can argue about details or if it's less than it would have been)."
Are you sure this is still true? Most online merchants ask for the billing address for a credit card. So there is still a combination of something you have and something you know for CNP transactions. If someone nicked my card, they wouldn't be able to use it online without knowing my billing address too.
Re:You are right for the wrong reason by Dahan · 2015-09-30 20:36 · Score: 1

Which hurts in countries whose cellular carriers charge subscribers to receive SMS text messages. Slashdot's home country (USA) is one of them.
Whether a cellular carrier charges extra to receive an SMS isn't a country-dependent thing. Or even carrier-dependent. It depends on which plan you have purchased. All major providers in the US (and probably all providers, even the minor ones, but I haven't actually looked) offer plans with unlimited SMS--i.e., you pay a flat monthly fee and you can send/receive as many texts as you want for no additional charge.
Re:You are right for the wrong reason by Anonymous Coward · 2015-09-30 22:08 · Score: 0

Whatever, I can control my cards settings. Usually I have them so tight it can't be used outside my country at all. SOmeone might accept it, but they won't be getting my money.
Re:You are right for the wrong reason by Pinky's+Brain · 2015-10-01 01:53 · Score: 1

I can't use my card for out of EU pin transactions without turning it on.
If I make a payment on the internet I always had to use a calculator like device to sign my transaction, this was vulnerable and widely abused by MitM attacks originating on a compromised PC of the user though (which I saw coming a decade ago, but it took the banks a while to wake up). So now I have a calculator which uses a bar code on the screen to allow the device to show the amount payable and the bank account for the transaction I'm signing (for accounts trusted by the bank it will even give me a name instead of a number).
The only viable attack left other than social engineering is card+pin theft and compromising the card reader to make you overpay, which requires significantly more collusion than a skimmer. If they put a LCD on the card which shows you the amount you are paying the latter would be prevented to (they could have done this for cents years ago, banks are so reactive instead of proactive regarding to fraud). Apple pay fixes it too, much as I hate to admit it.
Re:You are right for the wrong reason by balbus000 · 2015-10-01 02:34 · Score: 1

So how long until card-not-present sales require two-factor authentication?

What about online? System fatally flawed anyway... by Anonymous Coward · 2015-09-30 08:36 · Score: 0

The *user* should never trust the merchant to begin with. We have this flaw that is unbelievably obvious that has been exploited by criminals in Europe. The criminals bug the merchants terminals. The user should never have to enter a pin into a terminal in the first place. The way the system should work is every user's card should have a number pad on it where they enter there pin. It should display the merchant's name, an amount of the transaction, and a transaction ID (ie the receipt). The card should then encrypt a message with GPG that is then transmitted to the card holders bank authorizing the bank to release the funds to the merchant. The system would work with both merchants on the internet and in the real world. The merchant would need not ever be liable for fraudulent transactions.

If you have a gun to your head and someone steals the card and forces your pin out of you then you need to file a police report. You might lose money, but it'll be a *major* crime and the police *would certainly* investigate.

The description isn't quite right reg old cards by Timmy+D+Programmer · 2015-09-30 08:36 · Score: 2

Merchants are on the hook when a fraudulent purchase is made, with a NEW style card, but the merchant hasn't updated to a new style reader. Issuers are on the hook when a fraudulent purchase is made with an OLD style card.

--

(If at first you don't succeed, do it different next time!)

US are so retarded.. by Anonymous Coward · 2015-09-30 08:38 · Score: 0

In sweden we have had 4digit pincodes for our credit/debit card for at least 20years, the reasons US don't is that americans are to stupid to remember 4digits (at least that was why it was postponed last time).
The chip was introduced some 10years ago to prevent cardtheft.
If you buy online you have to enter a second code with a technique accepted by your bank (usually using a app in the phone to generate a code)..

It's always amusing hearing americans describe there bank system, it's like sweden in the 60th's

Re:US are so retarded.. by mind21_98 · 2015-09-30 09:18 · Score: 1

It's because we have the best banking system money can buy (aka the banks want to spend as little money as possible). That's why PIN's not being bothered with, even though retailers basically have to buy terminals that support it anyway.

--
US businesses that currently accept chip and PIN/signature

So tired by jdavidb · 2015-09-30 08:44 · Score: 1

It hasn't stopped my boss from cracking the whip the last three months to get us to get EMV implemented.

--
Secession is the right of all sentient beings.

apple pay and paypal versus samsung pay by goombah99 · 2015-09-30 08:46 · Score: 1

So following up my own post, notice that paypal and apple pay both have the means to verify the user of the transaction for card-not-present transactions. Other card methods like say samsung-pay are just wrappers around the card right now and emulate the old swipe system. Thus samsung pay is actually obsolete before it even happened. Chip and Pin now forces you to carry your credit card not just the credit card number. Thus you will already have the credit card in your wallet making samsung pay replace exactly nothing you would have carried anyhow. Apple pay and pay-pal don't have that problem because they can conduct secure transactions through the stores payment mechanism.

--
Some drink at the fountain of knowledge. Others just gargle.

Re:apple pay and paypal versus samsung pay by mind21_98 · 2015-09-30 08:50 · Score: 1

Samsung Pay still provides a virtual card number, so there's some benefit to it. And it can be used now, unlike Apple/Android Pay (which may very well never have anywhere near 100% acceptance if most retailers choose to keep NFC support on their brand new terminals turned off).

--
US businesses that currently accept chip and PIN/signature

Is this obsolete already? by Anonymous Coward · 2015-09-30 08:54 · Score: 0

Sorry, UK guy here. Somebody seems to have a made a repost from the early 2000s...

We're just in the process over here of replacing chip and pin with 'contactless', thus removing the security that the PIN afforded us.

Besides, as long as the merchant and the bank are responsible then the card provider can choose how little or much security they provide without it really being my problem. Though I'll wait for everyone else to test the PIN-less 'contactless' system first to see what the problems are...

Re:Is this obsolete already? by MyNameIsJohn · 2015-09-30 09:25 · Score: 1

Canadian here:
We have not had Chip and Pin for too long, just about a decade I think. Along with Chip and Pin came the contact-less system that was limited to a certain amount of dollars per transaction. Of course that is some form of security, the contact-less (or 'tap') method is also used with gift cards, but up until a year or two ago most of the readers and in fact the chips on the cards themselves would be faulty after some use.
I know my first chip and pin card did not work with contact-less, but then when it did it only worked for about a year until it stopped (not sure if it was the chip or the reader), now with a new card its working again, but I know if you have an older reader you most likely have to go back to the chip and pin method.
I went to the states for skiing last winter and found it interesting that I hesitated when the waiter/ess asked for the credit card to bring it to the machine and swipe it. It has been so long since the vendor has had to take my credit card away from my sitelines that it just felt differently, even though I was used to it in Canada up until the mid 2000's.
Re:Is this obsolete already? by Anonymous Coward · 2015-09-30 09:34 · Score: 0

We've had 'contactless' cards in Canada for years. Though contactless is kind of a misnomer since you tap the card on a reader to make a payment although I guess you could technically just hold it a few millimeters above the reader. My bank card as well as my Visa and Mastercard are all Chip and Pin as well as Contactless and I use them all the time.
In Canada anyways, contactless payments are generally restricted to $100 or less and will randomly require you to use the chip and pin anyways. The card holder is not held responsible for any fraud though I can't say if its the issuer or the business that gets stuck with the bill when it happens.
The only problem I've found so far with contactless payments is for some reason most restaurants don't set up their card readers properly and if you use the tap method vs chip and pin you aren't offered the option of giving a tip. I thought this was just a single manager not knowing how to set up his card readers when I first noticed it at a gourmet burger place but since then I've only seen 1 place where the tap option let you enter a tip amount.
Re:Is this obsolete already? by xaxa · 2015-09-30 09:48 · Score: 1

Contactless has been widespread in London for about three years, and very common in the last 18 months (since it became possible to pay for buses and the tube with it).
It's only for transactions under £20 (and transport), and if you do too many in a row you need to enter a PIN.
Re:Is this obsolete already? by mrbester · 2015-09-30 09:56 · Score: 1

They didn't even have a wireless terminal that you could swipe a card with? What a backward country. I'm surprised they didn't have a racking machine lying around...

--
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
Re:Is this obsolete already? by Harlequin80 · 2015-09-30 10:15 · Score: 1

Contactless in Aus is limited at $100 or about 50GBP. You are insured for any contactless transactions for 48hrs if you lose your card.
Re:Is this obsolete already? by Applehu+Akbar · 2015-09-30 10:31 · Score: 1

For NFC ("contactless") payments to be secure, some reviled company would have to come up with a scheme whereby your credit cards would be tokenized into a device which, when used for NFC transactions, would transmit a single-use virtual card number that changed with every transaction. But such a scheme would not be acceptable to the twitterariat unless it were open source and crammed with malware.
Re:Is this obsolete already? by Anonymous Coward · 2015-09-30 10:36 · Score: 0

£30 now, but yes.
Re:Is this obsolete already? by Anonymous Coward · 2015-09-30 14:40 · Score: 0

For NFC ("contactless") payments to be secure, some reviled company would have to come up with a scheme whereby your credit cards would be tokenized into a device which, when used for NFC transactions, would transmit a single-use virtual card number that changed with every transaction.
So you mean exactly how contactless payments work now? Only instead of your stupid idea of making new credit card numbers its a transaction signed by the private key in the secure area of the chip?
Re:Is this obsolete already? by Applehu+Akbar · 2015-09-30 16:44 · Score: 1

The default way that NFC "contactless payments work now" is with no security. In Europe, the pickpockets are already carrying around little devices that skim cash from peoples' credit cards as they brush past on the street.
But if some Silicon Valley company known for its cultlike fan base were to tokenize credit cards instead of relying on the card's EMV chip, in a transaction cycle authorized by the user's thumbprint, this would give us a secure NFC that would totally eclipse chip-and-no-PIN EMV.
Re:Is this obsolete already? by shilly · 2015-09-30 19:57 · Score: 1

He's referring to ApplePay. Which does not work the same way as contactless.
Re:Is this obsolete already? by Dahan · 2015-09-30 21:01 · Score: 1

Sorry, UK guy here. Somebody seems to have a made a repost from the early 2000s...
We're just in the process over here of replacing chip and pin with 'contactless', thus removing the security that the PIN afforded us.
We have that in the US too (e.g., Visa payWave, Mastercard Paypass, Discover Zip. EMV can use either a contact smart card (ISO/IEC 7816) or a contactless smart card (ISO/IEC 14443). They both have chips; the difference is whether the reader communicates with the chip via electrical contacts or via radio waves.
Also, what's happening today is that US banks are changing who has to eat the cost of fraudulent transactions... it's not that the US is just getting EMV cards (or contactless cards) today. They've been around for years... Discover Zip was out in 2011 (however, it still hasn't become popular... probably because there weren't many terminals that could do contactless back then. Now that merchants are being forced by the banks to upgrade their terminals to support EMV, a lot are getting terminals that take both contact and contactless).
Re:Is this obsolete already? by hattig · 2015-09-30 23:44 · Score: 1

Contactless is great in use ... but yeah, if someone nicks your card they can go on a contactless spree until they get the very low frequency pin code confirmation security check.
Re:Is this obsolete already? by hattig · 2015-09-30 23:50 · Score: 1

Referring to something like this? http://www.thisismoney.co.uk/m...
Which is odd, because for Cardholder Not Present, you need to know the card's house number and postcode, as well as the CVV, for the transaction to be approved. That was put in place in the UK about 12 years ago. I know many online retailers only require the CVV once when registering the card (Amazon, Paypal, etc), but you would then also need to access the attackee's amazon account, change the delivery address ...
And for cloned cards, you need to know the pin.
Something isn't right with the story.

Re:apple pay and paypal versus samsung pay by goombah99 · 2015-09-30 08:59 · Score: 1

Samsung Pay still provides a virtual card number, so there's some benefit to it. And it can be used now, unlike Apple/Android Pay (which may very well never have anywhere near 100% acceptance if most retailers choose to keep NFC support on their brand new terminals turned off).

Why would they turn it off?

--
Some drink at the fountain of knowledge. Others just gargle.

The answer is a RESOUNDING **NO**! by Anonymous Coward · 2015-09-30 09:06 · Score: 0

Chip And Spin

I'd honestly have thought they'd have given up on this stupidity already, having known that the damn stuff flatly doesn't work.

Some of the CLEAR problems with Chip and PIN

This shit was brought up to have real and serious issues and shown to be a farce back in 2006(!)- which means they should be goddamn ashamed of themselves to FORCE this because now they're going to blindly follow what the EMV system tells them and YOU are going to be the one to eat the fraud not the bank. I'm limiting how much I spend on my card from here on out- because they're going forward with this joke. Just because you use crypto and "smart card" tech does NOT magicially make it secure, sound, or even sane.

Re:The answer is a RESOUNDING **NO**! by viperidaenz · 2015-09-30 10:00 · Score: 1

My bank still covers me for fraud, no matter how it's done.
The difference here is the liability of the merchants, not the users of the card. If a merchant accepts a fraudulent mag strip payment, they're liable. If they accept a chip-and-pin fraudulent payment, they are not liable, the bank/issuer is.
Re:The answer is a RESOUNDING **NO**! by hattig · 2015-09-30 23:58 · Score: 1

Fact is that chip and pin has fraud at around 0.7p per £100, and other methods have about 7.5p per £100. It's far far safer.
Just because someone doesn't understand how it works and rants online doesn't make it a valid resource to link to.
If you write your pin on your card, you are a stupid idiot and deserve to lose your money.

Re:apple pay and paypal versus samsung pay by PRMan · 2015-09-30 09:10 · Score: 2

CVS told me they have to do it for HIPAA reasons in their pharmacy.

--
Peter predicted that you would "deliberately forget" creation 2000 years ago...

Re:apple pay and paypal versus samsung pay by goombah99 · 2015-09-30 09:17 · Score: 1

interesting. News reports said CVS and Walmart didn't do it because they are launching a competitor.

--
Some drink at the fountain of knowledge. Others just gargle.

Re:apple pay and paypal versus samsung pay by mind21_98 · 2015-09-30 09:20 · Score: 1

A large number of US retailers actually rely on non-consensual tracking/data mining as part of their business models. NFC would really interfere with that. Not to mention there are a few (like Walmart) who really hate Visa/MC and at best want all of the benefits card acceptance brings without paying anything.

--
US businesses that currently accept chip and PIN/signature

Re:apple pay and paypal versus samsung pay by mind21_98 · 2015-09-30 09:22 · Score: 1

Yep, CurrentC. Which is basically a usability and security/privacy disaster. It'll probably fail (and some retailers such as Best Buy already have abandoned it), but there will still be holdouts.

--
US businesses that currently accept chip and PIN/signature

Banks want to give anyone else the costs of fraud by niks42 · 2015-09-30 09:23 · Score: 2

.. so, if there are some disputed charges on your account, the bank can either 1) chase the retailer to get the lost money back - assuming the retailer has not given you the opportunity to use Chip and PIN or 2) chase you, since clearly if there is a transaction on your account, and your card is a Chip and PIN card, either you have given someone your card and PIN (in which case it's your fault) or someone has stolen your card, and found out your PIN (in which case you failed to keep it secure, and bugger me, it's YOUR FAULT again).

I was a victim of an early fraud about five years ago, at a coffee shop at Paddington Station. I bought a coffee using my chip and pin from my business account (well, there were lots of us having coffee, and I decided for once it was a business expense). A few days later, I noticed some charges on my account I couldn't identify, and I contacted the bank. Their immediate reaction was that I must have let someone have my PIN. It took six weeks to have the money returned to me by the bank - and then only when they could displace the blame on to the retailer (apparently I wasn't alone, and an investigation by the police turned up a hacked card reader which stored PINs on an SD card).

Done with e-banking by DrYak · 2015-09-30 09:38 · Score: 1

The way the system should work is every user's card should have a number pad on it where they enter there pin. It should display the merchant's name, an amount of the transaction, and a transaction ID (ie the receipt). The card should then encrypt a message with GPG that is then transmitted to the card holders bank authorizing the bank to release the funds to the merchant.

...and that's how it works with lots of European banks' e-banking interface:
a completely offline device (either chip-card in a small calculator-like device, or card with keypad directly on them) are used to sign transaction (or simply the numbers they display. But you get to see the numbers).

European banks do it because:
- it's really the best possible security at this level of conveniance, thus less risk for their customer and thus less possible liabilities for the banks themselves.
- it's their own e-banking infrastructure, they get to do what pleases them (see point above for what pleases them).

That would be completely different with credit card payment:
- because the bank themselves don't get to decide. Instead they have to abide to whatever Visa and MasterCard imposes on them, and Visa and MasterCard are interested in a different point of balance on the security vs. conveniance scale (they need the credit card usage to be as easy as possible because they need as much transaction as possible to happen, which makes more money flow, which gives them more earnings from the percentages)

What some european banks have introduced is complete out-of-bound confirmation of transaction:
you get an SMS asking you to confirm the transaction that you do with the credit card. Even if the terminal is rigged/bugged, the SMS will show you that that the transaction amount isn't what its supposed to be.
Currently, that's not very convenient (slows down the procedure a lot), it's not very secure (all it takes is a rigged/bugged picocell spoofing the SMS), but at least it helps discover and intercept fraud much faster (wait, why am I receiving a confirmation SMS when I'm just sitting at work ?!?) and is a first baby step in the right direction (the user should rely on an external non-trusty device for displaying info about the transaction and asking PIN to sign the transaction).

-----

Sadly, for the sake of convenience, some of these separate e-banking authentication are replaced... by smartphone apps.
Yup. Software running on *always online* devices that can be hacked.

All this because the user have already a phone in the pocket, and because the smartphone has a camera which is convenient for reading data from QR codes.

-----

For the record: Bitcoin protocole also relies on the user signing a transaction that they see on their side.
Except that instead of getting checked by on single authority (that might have some sort of privacy policy), the check is distributed and each transaction is publicly broadcast for the whole network to store it in its distributed ledger (no true anonymity trades for no single point of failure).

--
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]

Wow by Anonymous Coward · 2015-09-30 09:42 · Score: 0

You guys are only just getting chip and pin? ... I forget how far behind the rest of the world the USA is sometimes...

Re:Wow by Anonymous Coward · 2015-09-30 09:56 · Score: 0

You're just jealous because we invented the internet and you didn't. Don't feel bad, you invented psychotherapy to help you overcome your problems.
Re:Wow by PPH · 2015-09-30 10:20 · Score: 1

how far behind
Miles behind. Wait while I convert that to kilometers.

--
Have gnu, will travel.

Retailers can ignore chip and sig completely by PraiseBob · 2015-09-30 09:47 · Score: 1

Most Brick and Mortar Merchants are already liable for the vast majority of fraudulent transactions. Chargebacks for identity fraud (ie, a stolen credit card) currently hit the merchant, not the issuing bank.

That liability will shift temporarily to the bank, IF the merchant has the new technology, AND the bank does not. Once both have the tech, the liability falls back on the merchant, because anybody with a stolen card, has also stolen the chip.

This is primarily a stick for the banks, since they will have to eat a larger percentage of chargebacks until they issue new cards. There is very little carrot for merchants. The best incentive is for early adopters to defray some of their equipment costs, as the money drops off very quickly, as banks issue new cards.

In six months to a years time, there is going to be almost zero incentive for any merchant to buy new chip & sig equipment, until it becomes part of PCI rules. The US implementation is ridiculously stupid without the pin, and this entire transition will prevent exactly one type of fraud- when organized crime manufactures fake cards with real numbers. The more common types of fraud (stolen physical cards & stolen card numbers used online) will not be impacted one bit, and merchants will continue to eat the costs.

two factor by ubergeek65536 · 2015-09-30 09:53 · Score: 1

For online purchased why doesn't the bank issue two factor codes like I use to log into AWS?

Re:two factor by tepples · 2015-09-30 13:52 · Score: 1

I think two-factor authentication hasn't caught on because there are a lot of people in the United States who either can't receive text messages at all (landline) or have to pay 10 to 40 cents for each received message (prepaid cell phone).

Meanwhile... by viperidaenz · 2015-09-30 09:57 · Score: 1

While the USA are getting on board with Chip and Pin, the rest of the world has already moved on to NFC.

I don't recall the last time I used a magnetic strip.

Re:Meanwhile... by ubergeek65536 · 2015-09-30 10:17 · Score: 1

In Canada I don't know of any retailers, other than gas stations, that accept NFC payments over $50. It's still chip + PIN
Re:Meanwhile... by viperidaenz · 2015-09-30 10:51 · Score: 1

I don't think retailers here are allowed to do that.
They either accept NFC or they don't. They're not allowed to put a limit on it.
The cards are set up to require a PIN for NFC transactions over $80
Re:Meanwhile... by Straif · 2015-09-30 11:25 · Score: 1

It used to be between $50-80 but it's been $100 for a while now. I believe it's even mentioned in the Interac commercials that play every now and then.
My grocery bills are routinely in the $90 range and I always tap to pay. It's amazing how annoying it is when you just go over the limit and have to take the 10 seconds to insert your card and type the pin.

--
Of course that's just my opinion...... you could be wrong!
Re:Meanwhile... by Anonymous Coward · 2015-09-30 18:32 · Score: 0

Most places are getting it now, Safeway is up to $100 for NFC. Petland too. It's just taking upgrade cycles for the terminals for places to get it.

Re:Banks want to give anyone else the costs of fra by mrbester · 2015-09-30 09:57 · Score: 1

There was a petrol station near me that did exactly the same. Bonus was it was the cheapest in the area so loads of people used it...

--
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"

Re:It does increase security a bit if used correct by Anonymous Coward · 2015-09-30 09:58 · Score: 0

It prevents card cloning, nothing else. The PIN makes an additional step required for cloning (which shouldn't be possible in the first place).

With mag stripe only, you can clone a card in about a minute with minimal equipment and the original card in hand for about 2 seconds.

Chip & PIN in the US? by Anonymous Coward · 2015-09-30 10:14 · Score: 0

Are there any mainstream Chip & PIN credit cards in the US? The only ones I've found are either Chip & Signature ("so you don't have to remember another PIN" was how a support drone explained it to me), or default to that even if they have a PIN. So not that useful in the civilised world.

Yes, chip and PIN would be more secure by Applehu+Akbar · 2015-09-30 10:24 · Score: 1

Which is why the US banking system, in its infinite wisdom, went for chip and signature, which is worthless as a security measure. The one advantage of the system is that when we go to Europe, our credit cards will at least work in European machines, rather than eliciting hapless giggles.

Re:Yes, chip and PIN would be more secure by hyades1 · 2015-09-30 13:11 · Score: 1

They'll also work in Canada, which has had chip-and-pin for years.

--
I've calculated my velocity with such exquisite precision that I have no idea where I am.

Untrue by Controlio · 2015-09-30 10:44 · Score: 1

Australia no longer accepts signatures at all. August last year it became chip & pin only

Untrue. I was there in March of this year, and made north of 35 signature transactions up and down the entire east coast on at least two different cards. For cards without chips, Visa tells you specifically that all merchants that accept their cards are REQUIRED to accept signatures. Their travel department goes as far as to tell you that if you are refused a transaction because a merchant refuses to accept a signature as verification, to call Visa collect from the store and they will straighten things out for you.

I imagine that policy will now change starting tomorrow, but until that point - including early this year - they accepted signatures.

Re:Untrue by sectokia · 2015-09-30 11:39 · Score: 1

Australian banks had to not accept Australian signatures for Australian cards. Foreign credit cards on visa and MasterCard would still work with signature. Today it's very very rare to see signature and ibn most places they won't even have a pen any more.
Re:Untrue by Harlequin80 · 2015-09-30 13:11 · Score: 1

I should have clarified it is only Australian issued cards that no longer allow signatures. Because other countries are not at the same level their cards are honoured by signature. It is also the case that if the chip fails 3 times the machine will fail over to accepting the mag strip with a pin.

Debit vs Credit by PPH · 2015-09-30 10:45 · Score: 1

I've had a chipped card (issued by a US bank) for years now. But I've never seen a reader in the USA capable of using it. Some years ago, I was preparing for a trip to Europe and I figured I'd better get the PIN part of the card activated. One more interesting fact: This card was issued to me by a bank that I don not have an account with. Credit is the only business I do through them. So I call the service number and ask about the PIN. According to them, in order to have a PIN, I'd have to 'attach' the card to a bank account, effectively making it a debit card.

Other accounts I have also seem to be pushing their debit card products. The problem (as I understand it) with debit cards is that the liability for fraud falls harder on the consumer. Charge my credit card fraudulently and laws protect me and minimize my losses. Charge my debit card and someone can empty my bank account. And it's my problem.

So, whatever happens tomorrow, I'm going to watch my card agreement information very carefully. To make sure that my credit card doesn't magically turn into a debit card.

--
Have gnu, will travel.

Irvine is wrong on most counts by robindch · 2015-09-30 11:37 · Score: 1

Jerry Irvine is wrong on most of the points he makes. Just to correct some of them:

1. The PAN (the primary account number) is not enciphered on a chip card.

2. If you have a chip reader and easily-found software, you can recover the card PAN easily and quickly.

3. Cards do not provide support for "unlimited number of transactions" - as almost all cards have amount and velocity limits.

4. Most transactions will go online to the card issuing bank for authorization - allowing for lost and stolen cards to be blocked.

5. Each purchase with a chip card does not "create a separate token". He appears to be confusing tokenization with cryptography, though it's hard to know exactly what he means.

6. Issuing banks do not create tokens. Instead, they are created by a Token Service Provider, usually an independent third-party.

7. A partial EMV implementation would have mitigated against certain segments of the Target fraud. A full implementation, with PCI, industry-wide, would have mitigated against much more.

8. Mobile payment systems, in general, today, do not provide higher levels of security than chip cards.

Documentation on most of the above is freely available from EMVCo's website at http://www.emvco.com/

Mr Irvine's four minutes are, as a whole, inaccurate and unhelpful.

True Purpose by Capt.Albatross · 2015-09-30 11:49 · Score: 1

The true purpose of chip cards is to transfer the cost of fraud away from the issuers.

Both claims are "true" by TapeCutter · 2015-09-30 12:01 · Score: 1

I've lived in Oz for over 50yrs, I had to google the question out of sheer curiosity, turns out you and the GP are both correct, the law only affects cards issued in Australia, I assume yours were issued in the US?

BTW: Hope you enjoyed your visit, Melbourne to Brisbane via the coast is still one of the world's great road trips, I've lost count of the number of times I've done it, first time was 1966 in the back seat of Dad's bright red VW beetle, it's changed quite a bit since then, hell of a lot more people and cars now. For any tourist, Oz is a hell of a long plane trip away, I don't understand (english speaking) tourists who come all the way to Oz and then don't leave the city they landed in??

--
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.

It's half a solution by mysidia · 2015-09-30 12:04 · Score: 1

This still does nothing about internet transactions which are always "signature"; actually, there's not even a real signature involved.

Timely.. by Anonymous Coward · 2015-09-30 13:55 · Score: 0

Ok...I guess if no one else is going to...

https://www.youtube.com/watch?v=B80SyRmtbdI

Thank you by execthis · 2015-09-30 14:10 · Score: 1

Thank you guys for this video. I love these videos about banking and other security.

tokenization is wrong by Anonymous Coward · 2015-09-30 15:06 · Score: 0

im amazed by all the wrong information out there on EMV cards.

They track data is still present in Tag 57 and in most cases this still goes up to the credit processor in the track 2 field (either encrypted or plaintext but over an SSL connection). the "tokenization" he is talking about is an additional EMV data field called the Issuer Application Data (among many other data elements) that gets passed to the issuer to verify the card is authentic.

he is correct in any online purchase will not have this extra EMV data so any database breach is still possible because you have to type in your card number and exp date.

you never eat in restaurants? by YesIAmAScript · 2015-09-30 15:57 · Score: 3, Informative

In the US, table service restaurants virtually NEVER have customer-facing credit card readers.

Bars don't either.

In both you give them your card.

Really the places that do reliably have them facing customers are retail checkouts and anything with a self-serve kiosk.

--
http://lkml.org/lkml/2005/8/20/95

Re:you never eat in restaurants? by shilly · 2015-09-30 19:30 · Score: 4, Informative

Which is another reason why restaurants in the UK feel a shitload more secure than in the US....here, the waiters bring a wireless card reader over to the table. They don't wander off with your card to some back room where they can copy down the details. (It also speeds things up, as it involves fewer waiter back-and-forths)
Re:you never eat in restaurants? by Anonymous Coward · 2015-10-01 03:43 · Score: 0

Yes, wireless terminal with chip+PIN is quite a standard all across Europe for more than a decade. Or more recently PayPass (chip with RF), and no PIN is required for small transactions.

we pay, but changing it isn't free by YesIAmAScript · 2015-09-30 16:10 · Score: 1

Stolen card fraud is something we all pay for. But requiring PINs would require making all CC readers face the customer. That costs money. The CC companies also surely worry people won't remember their PINs and will thus not use their CCs. And then there's that chip and PIN is even slower than chip and sign which is already slower than swipe and sign.

There are a lot of different factors in a lot of different directions. This is the decision they came up with, it hardly seems terrible.

Frankly, given that clearing fees are being jacked so companies can take a bigger cut just to give "cash back" I don't know we'll notice the fraud rate difference between chip and PIN and chip and sign.

--
http://lkml.org/lkml/2005/8/20/95

Re:we pay, but changing it isn't free by mattack2 · 2015-10-01 12:16 · Score: 1

Frankly, given that clearing fees are being jacked so companies can take a bigger cut just to give "cash back"
Yeah, I guess that sucks from the store's point of view... But as I've said before, at each of my individual purchases, I'm paying either $X or .98*$X (due to 2% cash back on my most used card). PLUS, using the card is MORE convenient to me than paying cash (faster, I don't have to then carry the change). So it's easier AND cheaper at the individual sale, even if it is indirectly causing all prices to go up. (And as I said in my other message, of course I pay in full automatically every month, so I pay no interest.)

Far behind times by Anonymous Coward · 2015-09-30 19:35 · Score: 0

You guys are far behind times. Over here in Europe, we are just starting to switch AWAY from chip and pin, to the next fad in credit cards: Contact less credit cards. RFID cards which can be read from quite a distance with the right equipment (involving high-tech hardware like a Pringles can), and no pin required for purchases up to $50.

No pin, no signature, and you don't even have to have the card in your hand (could be in another customers pocket).

Now, THAT's progress. For criminals.

For me, that means I'd keep my card at home, except when going to the ATM to pick up some cash.

Re:Banks want to give anyone else the costs of fra by Anonymous Coward · 2015-09-30 22:13 · Score: 0

" chase you, since clearly if there is a transaction on your account, and your card is a Chip and PIN card, either you have given someone your card and PIN (in which case it's your fault) or someone has stolen your card, and found out your PIN (in which case you failed to keep it secure, and bugger me, it's YOUR FAULT again). "

So horrible to be resposible for your own belongings instead of pushing the cost to everyone else. Regarding your example.. the perp got caught, with magstripe & signature it could have been anyone, and never gottten caught.

Of course it increases security by DrXym · 2015-09-30 22:20 · Score: 1

Chip and pin devices are more secure than magnetic stripes in a number of ways.

Buying something with a magstripe normally involves swiping the card in a reader and scrawling a signature onto a screen. Theoretically the cashier might ask for ID or compare the signature to the card but they rarely do. And the cashier might even be cahoots with the thief, knowing the card is stolen and not do any check at all. On top of that the merchant might store transaction details insecurely, or their software may be hacked. And in some scenarios such as bars & restaurants, the card might be taken from the sight of the customer which increases the risk of it being skimmed. All of these are major vulnerabilities that thieves have been known to exploit.

A chip and pin reader means that the card holder must authenticate themselves before proceeding. That stops someone from picking up a card, or cloning one and being able to use it without the pin. And authentication is to the payment processor and not to the store or cashier so it's not possible to bypass this check. It also means the store never captures the credit card info (they only get partial info and some payment authorization code) so hacking the store does not put details at risk. And chip & pin devices are portable so payments in bars & restaurants can be made in the presence of the customer so they are less likely to be swiped.

So yes it closes some very obvious security flaws. Is it perfect? Of course not, but it's a hell of a lot better than a magnetic stripe. It's a damned shame that it's taken the US so long to even switch to chip and pin. The next step would be to get rid of the magnetic stripe altogether but I expect we can look forward to years of lobbying by ATMs and banks how this couldn't possibly be done.

Re:US are so stupid by Anonymous Coward · 2015-09-30 23:41 · Score: 0

Please don't insult people that once would have been called 'retarded' by comparing them with Americans. That's really unfair and rude to them.

Thats true by Anonymous Coward · 2015-10-01 00:10 · Score: 0

The European chip&pin system is same but the US one is different.
It's basically the same thing as a magstripe..

Ev arkadasi ara

Dave420 "eats his words" (again) by Anonymous Coward · 2015-10-01 00:47 · Score: -1

"it patently clear no-one else agrees with your position" - by dave420 (699308) on Friday September 25, 2015 @04:44AM (#50595241)

Here's some that are QUITE contrary to yours from /. users + experts in the field:

MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...

"I like your host file system." - by Karmashock (2415832) on Wednesday September 09, 2015 @03:57PM (#50489401)

&

"his hosts program is actually pretty good" - by xenotransplant (4179011) on Monday August 10, 2015 @03:34PM (#50287195)

---

* Let's see - a TOP antimalware company hosts AND RECOMMENDS my ware, & real users here like it - you're outnumbered, outthought, & OUTSMARTED, easily as usual, by "yours truly"...

APK

P.S.=> To top all THAT off? Better people that a "ne'er-do-well" MORON troll who's never accomplished a thing of good note in computing in yourself AGREE with me hosts are good security:

Quote of Aryeh Goretsky of NOD32/ESET doing so in fact -> http://it.slashdot.org/comment...

You UTTER blowhard do nothing "ne'er-do-well" troll... "eat your words" & tell us:

HOW DID THEY TASTE?

Flavored with the "bitter taste of SELF-defeat" since your mouth wrote checks your dimwit brain can't cash? Rammed down YOUR THROAT since you stuck your FOOT IN YOUR MOUTH too?? LMAO...

... apk

Just more back doors. by skoony · 2015-10-01 01:19 · Score: 0

As the security gets more complex it creates more points of attack. Future hacker buzz word,"Token Spoofer".

Unlimited SMS plans are more expensive by tepples · 2015-10-01 01:25 · Score: 1

Whether a cellular carrier charges extra to receive an SMS isn't a country-dependent thing. Or even carrier-dependent. It depends on which plan you have purchased.

Whether low-end cellular plans include charges for receiving is certainly country-dependent. They have been commonplace in the United States. In the United States, the tradition has been to offer plans that charge both the sender and the receiver. They have not been commonplace in European countries. In European countries, the tradition has been to offer plans that charge only the sender.

All major providers in the US (and probably all providers, even the minor ones, but I haven't actually looked) offer plans with unlimited SMS

Which then means you have to consider the cost of upgrading from your current plan to a plan with unlimited SMS. These plans cost plenty of extra dollars per month compared to an occasional-use pay-as-you-go plan only for urgent calls. If you use services with 2-factor authentication to make money, then perhaps unlimited SMS is worth $120 per year. And if you don't share a house with someone with a landline, then your landline-replacement plan may already include SMS. But for someone who mostly uses cellular to arrange an occasional ride and currently pays less than $10 per month to begin with, the cost of multiple incoming texts per day, one for each service that uses 2-factor authentication, can add up.

But what about online purchases by kilodelta · 2015-10-01 03:30 · Score: 1

Will they still be using the card number as not all devices and pc's have a smart card reader on them.

They could have solved the whole thing using two factor with magstripe, pin plus second factor - could be an RSA token, Google Authenticator, or what have you. It would make pretty much all card fraud impossible.

Security a red herring--it's about accountability by Anonymous Coward · 2015-10-01 05:01 · Score: 0

The chip-pin setup really secures the credit card industry from all the lawsuits currently, no one can identify who's responsible and the gov't points the finger at the card industry to pick up the loss.

This just clearly helps the card industry by pushing some of the fraudulent claims back to consumers. And I'm sure they get to pass on the new infrastructure costs to consumers and business as well.

yep, but that's not necessary in the US by YesIAmAScript · 2015-10-01 06:32 · Score: 1

Consumer fraud protection in the US means you're not liable if they copy down your details. And the companies seemingly would rather do it this way, it saves money in the end, even though any fraud that happens raises their clearing fees. Remember, there is nothing stopping US restaurants from bringing a portable transactor to your table. Those things read swipe cards and PIN cards just fine. So if they aren't doing it by choice, there could be a good reason.

It does reduce waiter back-and-forths, but is that really the limiting issue? The waiter bringing the reader and waiting while you use it increases waiter time spent which costs money.

If you want to go fast, ask your waiter to do the job fast. Otherwise, the restaurant can save money by having a pile of those little trays/folders and waiters picking up and running 3 at a time.

--
http://lkml.org/lkml/2005/8/20/95

Re:yep, but that's not necessary in the US by shilly · 2015-10-01 13:02 · Score: 1

Well sure, you're protected by law if the card is skimmed -- and the same is true in the UK, by the way. But who wants the hassle of ripping up the card, ordering a new one, etc etc? Not me, that's for sure. So a system that engineers out or reduces the chances of that attack is preferable in my eyes.
I'm pretty sure a Lean analysis would show that typically more time is lost by the restaurant in back-and-forth (=transportation in Muda terminology) than is lost through waiting.

Chip-based credit cards is step in right direction by venkatv · 2015-10-01 07:40 · Score: 1

I completely disagree with the arguments prematurely concluding chip-based credit cards are insecure. For that matter any system is insecure if you consider a super strong adversary, there will be security problems in any system. Magnetic strip based credits cards should have been replaced long time ago! And, the chip-based cards are better and step in the right direction even without a user supplied pin. Why? 1. To the best of my knowledge, the chips themselves are tamper proof and its internal logic cannot be replicated easily -- very much so compared to magenetic strips. So you can't steal a card without "actually" and physically stealing the only card. This is much better as it is not hard for one to notice a lost card and immediately report it, making the stolen card invalid and useless. Note that it does not have any information to replicate or steal any identifiable information. 2. Chip's OTP based token transactions are much better than communicating the account number and password. Much of the burden on the POS system being secure is lifted any stored transaction information (which could potentially be stolen) is useless as the information can be used only for one-time use. And, the reference to Target breach seems to be inaccurate. It is true that a flaw in the backend enabled installing a malware on the POS systems, but the attack did rely on magnetic strip based credit cards and the POS systems had access to all the necessary account credentials for a future cardless transaction.

Chip and Pin is not more secure by rhyous · 2015-10-02 07:25 · Score: 1

How does chip and pin work?

If you have to enter the data into the vendors system, it is not secure. You have to swipe the card. You have to use their equipment at their Point of Sale to enter the pin. So if they add software that stores the card data and stores the pin, the card has just been compromised. Perhaps the chip is harder to fake than a strip?

To really make this more secure, you should swipe the card/insert card to have chip read, and then receive an instant request from the bank, not the vendor, to approve the expense. This could be done with phone call, text message, email, or app push notification. Of course the vendor could wait for you to approve before letting you out of the store with their goods.

That way, the pin is never delivered to the vendor.

I am still waiting for photo recognition. If you buy something with a card, it should take a picture of your face and send that in with the transaction request. People will cry privacy, which is a silly argument. If you want privacy, pay with cash.

Dave420 "eats his words" (again) by Anonymous Coward · 2015-10-06 01:37 · Score: 0

"it patently clear no-one else agrees with your position" - by dave420 (699308) on Friday September 25, 2015 @04:44AM (#50595241)

Here's some that are QUITE contrary to yours from /. users + experts in the field:

MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...

"I like your host file system." - by Karmashock (2415832) on Wednesday September 09, 2015 @03:57PM (#50489401)

&

"his hosts program is actually pretty good" - by xenotransplant (4179011) on Monday August 10, 2015 @03:34PM (#50287195)

---

* Let's see - a TOP antimalware company hosts AND RECOMMENDS my ware, & real users here like it - you're outnumbered, outthought, & OUTSMARTED, easily as usual, by "yours truly"...

APK

P.S.=> To top all THAT off? Better people that a "ne'er-do-well" MORON troll who's never accomplished a thing of good note in computing in yourself AGREE with me hosts are good security:

Quote of Aryeh Goretsky of NOD32/ESET doing so in fact -> http://it.slashdot.org/comment...

You UTTER blowhard do nothing "ne'er-do-well" troll... "eat your words" & tell us:

HOW DID THEY TASTE?

Flavored with the "bitter taste of SELF-defeat" since your mouth wrote checks your dimwit brain can't cash? Rammed down YOUR THROAT since you stuck your FOOT IN YOUR MOUTH too?? LMAO...

... apk

Slashdot Mirror

Will 'Chip and Pin' Credit Card Technology Really Increase Security? (Video)

317 comments