Slashdot Mirror
The Chip Card Transition In the US Has Been a Disaster (qz.com)
Ian Kar, writing for Quartz: Over the last year or so in the U.S., a lot of the plastic credit cards we carry around every day have been replaced by new one with chips embedded in them. The chips are supposed to make your credit and debit cards more secure -- a good thing! -- but there's one little secret no one wants to admit: The U.S.'s transition to chip cards has been an utter disaster. They're confusing to use, painstakingly slow, less secure than the alternatives, and aren't even the best solution for consumers. If you've shopped in a store and used a credit card, you've noticed the change. Retailers have likely asked you to insert the chip into the card reader, instead of swiping. But reading the chip seems to take much longer than just swiping. And on top of that, even though many retailers now have chip reading machines, some of them ask us just the opposite -- they say not to insert the card, and just swipe. It seems like there's no rhyme or reason to the whole thing.
As a Canadian I really don't get this. We've had chip and pin here for awhile, and while the initial adoption was a bit rough, it generally works fine.
Confusing
Reader says "insert chip in the bottom".
You insert chip in the bottom.
Reader says "enter pin".
You enter pin.
Painstakingly slow
I've noticed some readers are slow, but this probably has nothing to do with the chip, the merchant just has a shitty system. If you're talking about the process being slower, ok yeah, by about 10 to 15 seconds or so.
Less secure than the alternatives
What alternatives? Getting a signature that no teller ever verifies or checking the name against your ID (which again, never actually happens)?
Not saying chip and pin is perfect, but I really don't get why this is such a big "disaster".
First of all, "But reading the chip seems to take much longer than just swiping." Big fucking whoop? That's the time it takes for the card to obtain authentication from the bank server instead of the terminal just blindly accepting the transaction. That's already more secure, so stop whining.
But more importantly, chip and PIN is known to be more secure than swipe and sign. That's not up for debate, it's a fact. Unfortunately, the US, in their wise ways, decided to bastardize the system into chip and sign, removing the vast majority of the additional security for no real benefit. Oh, you can't remember a 4-digit PIN? Tough fucking luck. Instead, you'll probably have to switch to chip and PIN at some point in the future, causing another confusing transition.
Furthermore, the partial transition, various fuckups and all have largely been isolated to the US. Sure, Europe, Canada and others have also had a few hiccups when moving to the new system, but they had clear, strict deadlines that all providers followed. The US basically let the monkeys run the show, and so it's been a mess of delays.
You guys fucked up, now you get to live with the consequences. This isn't a failing of the chip system, it's a failing of the US thinking they could half-adopt it. That entire article sounds like entitled whining.
It's not that there's "no rhyme or reason" to the experience at the register - it's that the purchase of chip-capable readers doesn't mean that the retailer's point of sale system, back end accounting platform, security reviews, and everything else that comes in the wake of this have been completed. Getting chip-capable devices at the register is the easy part - they're often leased anyway, and the processing companies are simply replacing older units, as they fail, with newer units that meet the new specs. But there is a lot of behind the scenes work to do. It's easiest for mom-and-pop retailers who don't have a lot of integration, and it's relatively easy for the very large chains that have big IT departments. But the mid-sized operations, owner-operated gas stations, etc., have to take on considerable expense. And it cannot break, or they're expensively down and out.
I have indeed noticed the significant increase in processing time. Even at a bank-owned ATM, where I know the branch has a nice fast pipe back to the mothership, it's pretty shocking how long it takes the ATM to complete the extra crypto dance before it even gets down to business with you on the user interface. If nothing else, they need to have the ATMs give a better sign of life as that handshake is taking place - many users will be baffled by what doesn't appear to happening.
Don't disappoint your bird dog. Go to the range.
Last October, I spent some time in the US again and I noticed the few places that had started using chip readers had a person standing by to help people. They seemed a bit surprised when I just inserted my card and typed my pin code in a few seconds. :D They didn't even finish their line about being sorry about me having to remember the pin code. But I have been using it for years now.
We had a few problems in the beginning too both with speed of the approval process and the people using the card. but it is really not a problem more.
Now both my VISA and Mastercards have NFC( I'm guessing it is?) so I just hold the card over the reader.
The local 7-11 store taped over the slot and have a note to swipe the card instead. The chip reader is too slow to move a long line at a faster pace. With limited parking out in front, the clerks want to turn over as many customers as fast as possible to avoid losing sales.
America is a higher trust society than Europe (so the extra security wasn't cost-effective). I think it's because we all speak the same language and don't have to deal with gypsys here.
The whole article just smacks of fear of change frankly. We in the 21st century part of the Western hemisphere have long since done this, and reaped the fraud prevention benefits (read: no significant retail chip and pin fraud, fraudsters forced to try Cardholder not Present fraud, to which there are also pretty effective countermeasures).
I suspect those retailers still asking for magswipe will be transitioned to chip usage by their card service provider as the fraudsters will increasingly target those that still insist on swipe. The money will talk in this case, however the idea of chip and sign is a bit silly in that it will only stop coounterfeit cards, not stolen cards.
A number of the stores I go to have a solution to that. They just switch off the functionality.
Completely at the feet of the banks. They needed to get off their asses and spend a tiny bit of their immense profits to fucking switch over. The banks could send every retailler a new chip reader for every register for free and STILL make record profits every quarter.
So blame the Banks and the Greedy assholes that run those banks.
I'm for bringing back all the heavy handed bank regulation from before 1980. Fuck the bankers.
Do not look at laser with remaining good eye.
For a disaster, it's been pretty mild for my employer.
Several points to consider, from my personal observations (as the IT guy in charge of deploying and training on this):
1) Chip & PIN vs. Chip & signature. Yeah, chip and PIN is more secure for the consumer, but EMV isn't about security for the consumer. That's not at all the point of EMV. The point of EMV is to protect the banks, who eat the loss, when somebody breaks into a big retailer and steals 120 million credit card numbers at the same time, because PCI compliance hasn't been enough, and never could be. EMV is the half of the new system that gets the news coverage, but the other half, point-to-point encryption, is more important. The transaction gets encrypted in the credit card pad, and the merchant never sees the card information. So if you break into their network, there's nothing there to steal. The benefit to the merchant is that PCI compliance is a hell of a lot easier (and less expensive). The benefit to the consumer is that their cards are, in fact, less likely to be compromised (because that kind of break-in is a huge part of credit card fraud these days), so less hassle waiting for a new card.
But in the US, the consumer isn't protected by the technology, they're protected by the law. If your card is stolen, you're never responsible for more than the first $50 (and if you're bank gives you static about that, file a complaint and open an account with a bank that isn't crooked).
2)It's not confusing, it's just different. The process isn't any more complicated, it's just a different process. So the cashiers need about one minute of training, mainly by me buying a soft drink so they could see the new screens, and then they had it down (because we don't hire idiots as cashiers, and we train them), and the customers will need a few reminders for a while. The only two actual issues we've had (both very minor) are that we used to not need a signature for transactions under a certain amount, and we need a signature on every transaction now (because it's chip & signature, not chip & sometimes signature - but I expect that to be relaxed very soon), and we have to remind the customers to remove the card when it's all done (and our system actually helps on that, because it won't let them sign until the card is removed, which reminds the cashier to remind the customer). The pads could beep a little louder, but it's not a problem.
3) It's only slower if you bought shitty equipment. I've seen very slow chip card transactions. They're pretty much always the cheap-ass little standalone terminals that small merchants get on a lease from their merchant service (who don't care how slow it is). The reason for this is that the pad is doing the encryption, and that requires a certain amount of processing horsepower. Ours are new, expensive, and high quality. The difference in time processing a chip card and a mag strip card is less than one second. Barely enough to notice. Other big chain stores I've been in that do EMV also have new, expensive, high quality pads, and they, too, are basically just as fast either way.
So no, it's not the end of the world. Just more hysteria mongering from somebody who has a book to sell, or just hates all change, even for the better. In other words, it's a day that ends in "y."
"But, for the less digitally inclined, plastic cards and those tiny metal chips will probably still be pretty cumbersome for the foreseeable future."
My mom has 70+ years and can shop the any local store with her card just fine. We use chip & pin over here. She can remember her card pin just fine. She's also not digitally or technically inclined. The whole thing takes a few seconds until the transaction is authorized by the bank.
What exactly is your excuse there, over the pond?
Banks have been issuing new cards (or replacing older ones) with NFC versions for at least a year. Just bonk and pay.
We were suppose to move to chip & pin in 2008. We didn't (what with our whole economy imploding around then nobody had any money to do crap like that). So there's tons of old hardware businesses were sold in 2005-2008 that never got used. The businesses are pissed that they spent hundreds (thousands?) on new terminals and readers that did nothing. So it's like pulling teeth to get them onboard. Imagine spending $800 on something that offered you little value but you have to, then you never use it and now you've got to spend another $400 (prices have dropped to be fair).
Oh, and we only do chip & signature, no pins, so the businesses are nervous they'll be made to buy even more hardware when chip & pin rolls out.
Now, I don't know about Canada but in Europe if your pin gets stolen you the consumer are liable (which is hilarious, because chip & pin has been broken before). In the US we have a law that keeps consumers blameless for any credit card transaction. That's because everytime you use your card you're borrowing money. Legally It's a loan (with 0% interest if paid off by the next billing cycle and if you pretend merchant fees don't exist). If somebody fraudulently borrows money in your name you're not on the hook in the US and it would take a major change in law that's not likely to happen (it would be tremendously unpopular and it would affect our upper middle class, and you don't screw with those guys).
Basically, one of the best parts of chip & pin (a major liability shift to the consumer) doesn't fly in the states. The businesses taking the cards get some liability shift but the Card companies themselves don't. So it's not as big a win for the various players here in the States as it was elsewhere. Add to that America's traditional aversion to infrastructure spending and you've got a product dead in the water.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
And then screwing up the implementation.
Maybe Trump can make paying with credit cards great again?
What hardship! Here is something faster than swiping or other electronic means: cash.
As a mostly cash paying customer, the new system is noticeably slower. I know this because I have to wait in line so long behind people using it. The learning curve slowing things down, I get that, however even someone that appears to be practiced in using chip and pin it is obviously slower. Often times slower than cash, which I find a little funny.
My bank recently replaced its ATM cards with chip/pin. Where I used to step up to an ATM, swipe the card, and put it and my wallet away while the machine woke up. The rest of the transaction, I have my hands free, and I'm gone in 30 seconds.
if you put your wallet away after swiping your card, what did you do with the cash (which certainly doesn't come out before "the machine wakes up")? Put it in a gold clip so you can stylishly flip out one bill at a time at the strip club?
lucm, indeed.
Wrong. There are some US banks offering Chip+PIN CREDIT cards. And some issuing Chip+Signature DEBIT cards. It all depends on which authentication methods the issuing bank coded into the card's chip, and which priority order they set them.
People saying "PIN is for Debit and signature is for credit" are taking anecdote as if it's industry-wide rule. Or are non-USAians who never knew how it works here.
The "Debit or Credit?" question that US Debit card users often are asked at Point of sale when making a purchase on a Debit card has nothing to do with whether it's a chip card or not, nor even whether it's a credit card or a debit card. It really means, "Process this like an ATM Bank card doing a checking account withdrawal? Which will require your ATM withdrawal PIN. Or, Process this like a credit card charge through the Visa (or MC) network, which will put a credit-card-style authorization on your account but not actually post the charge for hours or days?"
Not, "Is this a Debit card or a Credit Card?"
For the matter, you could always choose "Debit" with a real Credit card too, if you happened to know your "cash advance at ATM" PIN for your magstripe no-PIN credit card. Though most people didn't know that PIN, some Credit cards didn't have one unless you asked, and because at your credit card account it became a usually more-costly cash advance rather than a charge. But fundamentally, "Debit or Credit" is "act as if it's a bank ATM card or act as if it's a credit card", regardless of whether it's really a Credit IRS a Debit card.
"Act as if it's a bank ATM card" always required a PIN, ever since decades ago long before EMV chip cards reached USA.
"Act as if it's a credit card" never required a PIN, in USA.
What is new, and apparently confusing to Muricans, is that with EMV in most of the world, "Act as if it's a credit card" now also requires a PIN.
In USA, if your new EMV chip Credit card is done to world standards, "Act as if it's a credit card" does require a PIN, when in the past, "credit" never did. And too many US banks issued Chip+Signature (only, or Chip+Signature as priority 1 authentication method) cards, so that "credit" still would not require a PIN. Plus they even did the same for Debit Cards, so that when using the Debit card for a purchase as "act like a credit card" it does not use a PIN.
Which leads to confusion by cardholders and merchants alike, and the errors in so many of the posts here too.
My primary credit union's Visa Debit/ATM card requires the PIN for purchases even as "credit" if the POS terminal hardware, software, and merchant account are capable of following the card's EMV commands. Yet my other credit union issued Chip+Signature Debit MasterCard ATM cards. My bank issued a Chip+PIN priority Visa Debit, and the "checking alternative" account at my brokerage issued a Chip+Signature Visa Debit.
Of course all require a PIN when doing an actual ATM cash withdrawal. Or when doing a purchase through the "debit" ATM network.
I will stop now, before explaining how the Dodd-Frank Bill makes US-ussued chip Debit cards even more screwed up and globally non-standard even if they are true Chip+PIN. But it's all kinds of hilarity ensuing.