Slashdot Mirror
EMV Technology In Credit and Debit Cards Reducing Counterfeit Fraud, Says Visa (usatoday.com)
An anonymous reader cites an article on USA Today: The new chip-enabled cards flowing into the U.S. marketplace have already made a dent in fraud, with some of the biggest merchants seeing a dip of more than 18% in counterfeit transactions, according to Visa. Among the 25 merchants who were suffering the most instances of counterfeit fraud at the end of 2014, five that began processing credit and debit cards equipped with the new EMV technology saw those infractions fall 18.3% as of the final quarter of 2015, says Stephanie Ericksen, vice president of risk products at Visa. Meanwhile, five of those merchants who were not yet equipped to handle chip-enabled cards saw an increase in fraudulent transactions of 11.4%. "We're seeing EMV is having a positive impact on counterfeit fraud," Ericksen says. "Merchants who implement chip, their counterfeit fraud is going down, while those still finalizing plans, their counterfeit fraud is going up."Also from the report, "Visa on Tuesday also announced a software upgrade that will shave the amount of time spent on chip card transactions. With 'Quick Chip,' consumers can dip their chip cards into the terminal and withdraw it in two seconds or less, instead of waiting until their purchase is authorized. The consumer can 'put the card in the terminal and put it right back in your wallet and . . . move to get their coffee, or hamburger or start bagging their groceries,' Ericksen says. Ars Technica has more details.
what does that translate into reduced fees for us????
oh wait....
have you seen my sig? there are many others like it but none that are the same
Chip+sign is more secure than swipe+sign. Here's why:
In order to process a card-present transaction with a magstripe card, the terminal must be able to read the CVV1. That's the Card Verification Value #1, which is embedded into the magstripe, but not seen anywhere else. (Note: This is not the CVV2! The CVV2 is a completely different value and is only printed on the card. That value is used to validate card-not-present transactions, not card-present ones.) If you clone the magstripe, you clone the CVV1 with it. Security was not even imagined when this was invented, as many stores still kept carbon-copy impressions of the raised numbers on the card at that time.
In order to process a card-present transaction with a chipped card, the terminal must be able to power the chip and run the CVV-generator algorithm that the chip provides. The generated card-present CVV will not be the same twice in a row. Thus, "cloning" the card is impossible, as there's no way to clone the exact algorithm the chip uses (it introduces a hardware randomization factor) when generating the card-present CVV. (Again, the CVV2 is unchanged on these cards, because it's for card-not-present transactions.)
The signature only provides a legal assurance that you acknowledge and accept the terms of the sale, not of the card transaction. The cardholder agreement that you accepted when you signed the back of the card is what governs the acceptance of any and all card transactions not fraudulently performed against the card/account. You did that, didn't you? Or did you put something moronic like "See ID" or "CID" (yes, really, I've seen that done) and invalidate that agreement, making the card invalid as well? That's not there for the cashier to check your signature against. The cashier does not give even a single shit. That signature is there so that when you go to court, you can legally say that, yes, you did accept the terms of the cardholder agreement, and you are the legal cardholder, and you are not committing fraud in your own name.
Chip+sign is secure enough. Chip+PIN is just annoying, inconvenient, and anti-cardholder.
"because you can't tip Chip & Pin unless they bring the mobile POS to the table and you enter the tip directly in it."
Bringing the POS to you is the point. It works perfectly fine for damned dirty communists in Europe.