Slashdot Mirror
Following Other Credit Cards, Visa Will Also Stop Requiring Signatures (siliconbeat.com)
An anonymous reader quotes SiliconBeat:
Visa, the largest U.S. credit card issuer, became the last of the major credit card companies to announce its plan to make signatures optional... Visa joined American Express, Discover, and Mastercard in the phase-out. Mastercard was the first one to announce the move in October, and American Express and Discover followed suit in December... However, this change does not apply to every credit card in circulation; older credit cards without EMV chips will still require signatures for authentication... Since 2011, Visa has deployed more than 460 million EMV chip cards and EMV chip-enabled readers at more than 2.5 million locations.
"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment," the article notes -- suggesting a future where fewer shoppers are signing their receipts.
"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment," the article notes -- suggesting a future where fewer shoppers are signing their receipts.
"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
Does this also apply to merchants who won't turn on their damn chip readers?
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
From TFA:
That sentence is missing the word "require": "and require a PIN" . This changes the meaning, since in most of Europe the signature requirement has not been dropped, it has been (mostly) replaced with a PIN. I believe banks in Europe will still issue chip-and-signature cards to elderly people on request.
[I now await the replies pointing out the grammar errors in my post. Also, my recent experience is limited to the UK -- perhaps it is different in other European countries, but I don't think so].
The real "Libtards" are the Libertarians!
From TFA, for those asking instead of reading, April 2018 is when the signature requirement will cease.
Most supermarkets already have some sort of deal where signature is only required on purchases larger than $50 anyway.
If you use an American credit card in Europe you still sign (most U.S. cards). The card issuers decide the priority of authentication methods, i.e. signature vs PIN (which has sub-variants), and the vast majority of U.S. card issuers go with signature verification as the first priority. Europe has PIN as the first priority.
Paying with a credit card at supermarkets in Europe is a great way to stand out as an American, as you hold up the checkout line that extra 10 seconds
www.gaiageek.com
No, the signature is not a form of verification, so there's nothing to "defeat". If the customer never inputs the correct pin, ultimately the transaction will be declined. No cashier is going to put up with you trying 10,000 possible combinations until you brute force the right one.
Signatures are a holdover from the old days, and serve no more than to give the retailer a way to prove that both the card and a person were present at the time of sale (say, if a transaction were disputed). Note I said a person and not necessarily an authorized person; back in the signature days the burden of proof was on the retailer to determine that the person using the card was actually the authorized user, but this was rarely done in practice. basically, a signature was proof that a purchase was not a "card not present" transaction.
Case in point, many years ago I was at a register and had swiped my card a second before noticing that an item had been rung up wrong (double charged), so I asked if I could just refuse to sign the electronic pad and "decline" the transaction. The answer from a manager was no, the lack of a signature would make no difference as the transaction happened automatically as soon as the card was read.
How can I use an American credit card in Europe?
Some credit card issuers will assign a PIN to your credit card if you request it. That way, when you go to Europe, you can use your card just like everyone else.
Ask me how the Heisenberg Principle may or may not have saved my life.
A ZIP code is just a bit of additional authentication that pre-dates a proper chip-and-pin system. It's a simple "what you know" test that a credit card thief may not know. Gas purchasing is apparently a very common use of stolen credit cards. As soon as chip readers are more ubiquitous, hopefully that stop-gap measure will go away.
The sooner we can get rid of the idiocy of signing as an authentication or verification, the better. It's just outdated and is nothing but security theatre at this point.
Also, apparently the rule for Canadians is this:
If prompted for your ZIP code, just enter the three digits of your postal code plus two zeros. So for example, if your postal code is A2B 3C4, the 5 digit number you should enter is 23400
Irony: Agile development has too much intertia to be abandoned now.
>"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."
We never needed a "chip" in the first place. Many millions of dollars wasted to overhaul everything- replacing readers, putting in chips, replacing all cards, updating interfaces and software- and still no PIN! A PIN code is a password. If required, without it, a card would be useless (at least in physical transactions, which is all we are really talking about anyway, since on-line can't use "chip readers"). Doesn't matter if it is a valid card, a stolen card, or a "made up" (cloned) card- put in the wrong PIN too many times and POOF, the account is frozen.
A password/PIN is required for my phone, my Email, my work account, Slashdot, my bank card, voicemail, calling to discuss my cable TV account, just about everything.... except credit cards??? Do they REALLY think people can't handle at least a freaking 4 digit number password in 2018?
>"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment,"
Add a PIN, and then get a 99% decline in in-person fraud. Again, chip security does NOTHING for online security. Develop a PIN for use online and watch fraud drop tremendously there, too.
Signing means only somebody need to know your signature and imitate it, and as far as I can tell it isn't for fraud and signature comparison, as yourself can fake a signature, no this is about accepting the sale as a contract. The CC company does not care at all about comparing signature for fraud as it is utterly stupid (Not difficult for most people to imitate it, especially that you are supposed to sign your card in the back, therefore signature CANNOT be a security device , as it is known by the card holder). Stealing pins and the attack mentioned OTOH ask for a big sophistication. So for your "way too insecure" I think I will trust chip and pin any time of the day over signature.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
You've got it backwards. If the customer initiates a chargeback, the credit card company assumes the customer is telling the truth. It's not up to the customer to prove the charge was fraudulent. It's up to the merchant to prove the charge was legit. And the easiest way for a merchant to do that is to send the credit card processor a copy of the signature on the receipt. If the receipt matches the customer's signature on file, case closed - it's not fraud. (If the signature doesn't match or there is no signature, the credit card company may or may not decline the chargeback. Merchants can submit other info - address, phone number, etc. - that are not on the card but which the card issuer has on file. That's why gas station pumps ask you to type in your zip code when you use a credit card. But in my experience as a retail business, any customer chargeback where we weren't able to produce a signed receipt or if the signature was faint or illegible, we automatically lost.)
Merchants want to get rid of signatures because it's what the credit card companies use to shift the cost of fraud onto the merchants. Think about it. There are two possible ways for credit card fraud to happen. Either you gave away/lost your card, or the credit card processor allowed a charge that it shouldn't have. The merchant has no way of knowing if a card is fraudulent. All they see is a card, stick it into the reader, and the machine tells them the transaction was approved or declined. The credit card companies got laws passed which prohibit merchants even from requiring ID before they have to accept a card. They can ask for ID, but it's illegal to refuse a credit card transaction just because the customer doesn't have or doesn't want to show ID. But somehow the credit card companies have managed to make the party which has no control over fraud (merchants) pay for fraud. (The exorbitant interest fees you pay credit card companies pay for delinquent customers, not fraud.)
This is why the state of credit card security is so deplorable. Online banking is very secure. Online bill pay is very secure. Wire transfers are very secure. But credit cards security sucks because the parties which can do something about security (the credit card companies and processors) aren't the ones paying for fraud. So they've had little to no incentive to improve credit card security for decades because it hasn't cost them a dime. The merchants have been paying for all the fraud. And whatever the merchant pays for, you pay for via higher prices.
Chip & PIN has its problems, but it's still much more secure than Chip & Sign. And problems with the current Chip & PIN implementation can easily be fixed without altering the process (just need to modify the algorithm the chip uses).
You wrote "Merchants want to get rid of signatures because it's what the credit card companies use to shift the cost of fraud onto the merchants. " That's the main point I was trying to make.
davecb@spamcop.net
Last time I was in Germany (a few years ago), I was at a deli and I did the EVM thing. All of a sudden the register beeped and spit out a receipt for me to sign. I already had the pen in my hand by the cashier had no idea what was going on. It was the first time they had ever seen the receipt print out like that and ask for a signature.
I think in the grocery store, they had at least seen it a few times. I couldn't use that card at all for the train since the PIN function had been blocked, and the terminal had no way to use the signature.
The sate of CC security is deplorable in the US. I live in Europe and what we see is that the most insecure country is the USofA and not even because of the fact that is is used in more places, because it isn't. The reason is that they do not have implemented the PIN system.
They have done so in every country in the world. There are merchants in those other countries as well. All the same excuses have been thought of as well, yet everywhere they where able to push it through.
It is so bad that many banks and others have decided that if you go to the US, you need to ask that your card be activated. It is the ONLY country where they do that. None. Not some poor country in Africa, not any country elsewhere, just the US, because it is so unsafe.
Now you could say that the US merchants would need to buy a new machine. This is also valid for the rest of the world. The price of these devices is around 25EUR and more expensive and cheaper versions exist. In Europe these will be given to the merchant and paid by the fee.
The thing is that in Europe these machines will be used for any electronic payment. I myself can pay at the supermarket with my Credit Cards, bank card, meal voucher (I get 8EUR per working day for food. Standard practice in Belgium) store voucher, gift voucher and even can combine them if I like.
Normally when I go to somewhere in Europe, I do not even bother to take cash with me. Just pay everything by card. Luckily I was in the US with a friend who lived there, because I was flabbergasted by the fact that you needed to pay cash for so many things.
Parking and toll roads stand out the most. In Europe at these you can pay electronically.
And there is no difference in the procedure in payment on what card you use, just if they are accepted. So no difference in usage. This has been the case for at least 10-15 years, so it is clearly unwillingness from the US.
As to the merchant not knowing if the card is fraudulent or not, the payments are mostly done online. So verification goes back and forth. (Yes, there are exceptions, as always) so the moment you block your card, the merchant will know. This means there is still a small window that the card is valid.
The other problem with the US system is that beacause of that, many airlines still do accptence without e.g. 3d Secure where you get an SMS to confirm that you are you. This would reduce the fraud seriously. I think they are working of making that obligatory.
Don't fight for your country, if your country does not fight for you.
You can't prove anything of the sort... .
As to the specific assertion above, signatures are used by the court in deciding if the credit-cared holder must pay, or if it is fraudulent. See CanlII, Western Currency Exchange Ltd. v. National Bank of Canada, 2002 ABPC 147 at https://www.canlii.org/en/ab/a...
davecb@spamcop.net