Slashdot Mirror
Following Other Credit Cards, Visa Will Also Stop Requiring Signatures (siliconbeat.com)
An anonymous reader quotes SiliconBeat:
Visa, the largest U.S. credit card issuer, became the last of the major credit card companies to announce its plan to make signatures optional... Visa joined American Express, Discover, and Mastercard in the phase-out. Mastercard was the first one to announce the move in October, and American Express and Discover followed suit in December... However, this change does not apply to every credit card in circulation; older credit cards without EMV chips will still require signatures for authentication... Since 2011, Visa has deployed more than 460 million EMV chip cards and EMV chip-enabled readers at more than 2.5 million locations.
"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment," the article notes -- suggesting a future where fewer shoppers are signing their receipts.
"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment," the article notes -- suggesting a future where fewer shoppers are signing their receipts.
"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
Does this also apply to merchants who won't turn on their damn chip readers?
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
N/t
From TFA:
That sentence is missing the word "require": "and require a PIN" . This changes the meaning, since in most of Europe the signature requirement has not been dropped, it has been (mostly) replaced with a PIN. I believe banks in Europe will still issue chip-and-signature cards to elderly people on request.
[I now await the replies pointing out the grammar errors in my post. Also, my recent experience is limited to the UK -- perhaps it is different in other European countries, but I don't think so].
The real "Libtards" are the Libertarians!
Europe has this right: Any in-person transaction requires you to enter your chosen PIN. It's simple, it's fast, and it protects your card from unauthorized use if it's stolen.
www.gaiageek.com
That I can think of, is to discourage a housemate from borrowing and using a card in a store, with or w/o permission of the card holder. The housemate wouldn't be able to talk their way out of fraud charges in that case.
Yep the US is still in the dark ages of signatures compared to the rest of the world.
That would be true is they werenâ(TM)t useless and peopleâs signature didnâ(TM)t change.
From TFA, for those asking instead of reading, April 2018 is when the signature requirement will cease.
Most supermarkets already have some sort of deal where signature is only required on purchases larger than $50 anyway.
No, the signature is not a form of verification, so there's nothing to "defeat". If the customer never inputs the correct pin, ultimately the transaction will be declined. No cashier is going to put up with you trying 10,000 possible combinations until you brute force the right one.
Signatures are a holdover from the old days, and serve no more than to give the retailer a way to prove that both the card and a person were present at the time of sale (say, if a transaction were disputed). Note I said a person and not necessarily an authorized person; back in the signature days the burden of proof was on the retailer to determine that the person using the card was actually the authorized user, but this was rarely done in practice. basically, a signature was proof that a purchase was not a "card not present" transaction.
Case in point, many years ago I was at a register and had swiped my card a second before noticing that an item had been rung up wrong (double charged), so I asked if I could just refuse to sign the electronic pad and "decline" the transaction. The answer from a manager was no, the lack of a signature would make no difference as the transaction happened automatically as soon as the card was read.
The card's chip locks after 3 incorrect tries, even if across different card readers. Then you have to contact your bank.
>Fraud declined, mugging did not change a bit.
We had a problem (maybe still do???) with card cloners being installed over gas station pumps, with the criminals picking up card data and PINs wirelessly. I'm not sure how the tech worked to clone the cards, but an interesting problem.
I think the carjackings and home invasions died down when the criminals learned how to circumvent the computer lockouts. It takes a bit more than crossing a couple of wires now, but they can still steal your car without you.
>why go through the hassle of having to spy on someone's PIN when you can simply forge a signature?
I think the point is that the PIN replaces the signature and there's no option anymore. Of course, you can still order stuff online with just a few numbers memorized off a card. I imagine that still happens quite a bit.
Chip and pin is still around in Canada, but the vast majority of the time we just tap the card.
>"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
We never needed a "chip" in the first place. Many millions of dollars wasted to overhaul everything- replacing readers, putting in chips, replacing all cards, updating interfaces and software- and still no PIN! A PIN code is a password. If required, without it, a card would be useless (at least in physical transactions, which is all we are really talking about anyway, since on-line can't use "chip readers"). Doesn't matter if it is a valid card, a stolen card, or a "made up" (cloned) card- put in the wrong PIN too many times and POOF, the account is frozen.
A password/PIN is required for my phone, my Email, my work account, Slashdot, my bank card, voicemail, calling to discuss my cable TV account, just about everything.... except credit cards??? Do they REALLY think people can't handle at least a freaking 4 digit number password in 2018?
>"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment,"
Add a PIN, and then get a 99% decline in in-person fraud. Again, chip security does NOTHING for online security. Develop a PIN for use online and watch fraud drop tremendously there, too.
Except all the signature does today is give you that warm fuzzy feeling that you're authorizing something, without it actually being used for a single thing.
I'd like to thank Visa / MasterCard / American Express for committing to not waste my time asking for something they don't use, and the terminals are amazingly bad at capturing anyway.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
See Chip and PIN is broken, https://www.lightbluetouchpape...
A follow-up was Chip and Skim: cloning EMV cards with the pre-play attack, https://www.lightbluetouchpape...
This is Ross Anderson's security group at Cambridge, UK, who were the first folks to note that the signature requirement was so the customer was protected, not the bank.
davecb@spamcop.net
It's only a matter of time until the theft rate goes right back up. It only went down because crooks don't have the tools to bypass it yet - they exist, they're not expensive, and easy enough to use, they're just not in widespread use yet because there's still enough money in magstripe cards.
The rollout of the chip system has been nothing short of a disaster in the US. Half the places that do have the new equipment have the chip readers disabled, because they simply don't work. In places where they have them turned on, it's coinflip odds that the machine will reject the chip, and I have to use the magstripe anyway. Even when it does work, it still takes forever, and since there's no PIN, it's not actually doing anything to improve the security of the transaction. To top it off, my card has already been copied and used (physical transaction at a gas station, even though I still had my card) since the chip rollout, and had to be replaced.
They're easy to bypass, easy to duplicate, and have been nothing but a hassle and expense for everyone involved.
If you sign, you can prove it if someone forges your signature.
It's not for the bank or the merchant: merchants want to get rid of them, so they won't have to repay false charges.
PINs and the like are way too insecure: for example, see https://www.lightbluetouchpape...
davecb@spamcop.net
and it always gets approved anyways...
It has been annoying that I can't use my credit card at US gas stations since I have a foreign Mastercard and VISA and live in a 4 digit zip code. So they won't accept it at the pump. :/ Oh well, I will in the states soon again so I will try to fill up at Shell to see if it works. :)
I have heard that Shell have replaced all their readers with the ones that can read the chip because there were a demand that all gas stations updated their readers.
But now they have extended their deadline to 2020.
https://usa.visa.com/visa-ever...
L'Idiot
Signing means only somebody need to know your signature and imitate it, and as far as I can tell it isn't for fraud and signature comparison, as yourself can fake a signature, no this is about accepting the sale as a contract. The CC company does not care at all about comparing signature for fraud as it is utterly stupid (Not difficult for most people to imitate it, especially that you are supposed to sign your card in the back, therefore signature CANNOT be a security device , as it is known by the card holder). Stealing pins and the attack mentioned OTOH ask for a big sophistication. So for your "way too insecure" I think I will trust chip and pin any time of the day over signature.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Can't say I've had anyone ever check my signature before.
Plus it changes on a daily basis.
Zero security.
I can't recall the last time a cashier actually validated my signature. The signatures mean nothing. They offer no security whatsoever. Heck, I've been putting "See ID" on the back of my cards, and still, no one checks. It's a joke.
Does anybody know why? Why is the USA having such a hard time getting chip and PIN working? It seems very odd to me that the US is so far behind the rest of the world.
We have had chip and PIN here for about 8 or 10 years. I think I saw my first American portable chip terminal last summer at the Minneapolis airport. Up till then the servers still walked away with your card (how sketchy is that!), and then brought a piece of paper for you to write your name on.
None of them can see the clouds; The polished wings don't care.
Except all the signature does today is give you that warm fuzzy feeling that you're authorizing something, without it actually being used for a single thing.
Rather like signing the back of a check.
The signature doesn't prove anything at all..
The retailer can always claim that *someone* was present at the time, they can then draw an arbitrary signature later.
The PIN proves that *someone* was present at the time of the transaction, *and* that they knew the correct PIN.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Welcome to the new millennium!
Just wait *another* two decades and "tap" cards will totally blow your minds!