Following Other Credit Cards, Visa Will Also Stop Requiring Signatures (siliconbeat.com)

An anonymous reader quotes SiliconBeat: Visa, the largest U.S. credit card issuer, became the last of the major credit card companies to announce its plan to make signatures optional... Visa joined American Express, Discover, and Mastercard in the phase-out. Mastercard was the first one to announce the move in October, and American Express and Discover followed suit in December... However, this change does not apply to every credit card in circulation; older credit cards without EMV chips will still require signatures for authentication... Since 2011, Visa has deployed more than 460 million EMV chip cards and EMV chip-enabled readers at more than 2.5 million locations.
"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment," the article notes -- suggesting a future where fewer shoppers are signing their receipts.

"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."

Comments

Turn on your damn chip reader

[L. J. Beauregard]

Does this also apply to merchants who won't turn on their damn chip readers?

Re:Turn on your damn chip reader

[Anonymous Coward]

The signature isn't for verification. It's all about signing saying you agree to the charges and agree to pay. The signature doesn't even get sent to the clearing house. I've scribbled,signed heywood blowme, Dick Hertz, Mike Hunt,....and never heard a thing about it.
The signature is just a stupid throwback to the days of the paper credit card slips.

Re:Turn on your damn chip reader

[ShanghaiBill]

Nobody, absolutely nobody, looks at the signature for anything. You can sign anything you want. You can just draw a horizontal line, or even just tap the pad. As long as at least one pixel is set, the card reader will accept the signature.

Re: Turn on your damn chip reader

[Anonymous Coward]

No. The ones the rest of the world uses successfully and reliably.

Re: Turn on your damn chip reader

[stephanruby]

The chip readers work differently in the US. Before the transaction is authorized, the amount is verified through a centralized database. Plus all the handshake protocols are done synchronously and no information is allowed to be cached.

This is why the chip readers in the US at times seem to be taking forever to process transactions and the chip readers in Europe are actually quicker than their European magnetic strip reader counterparts.

So in the US, I really doubt that it's the chip readers are even broken. It is more likely that a store owner decided not to use that feature until the business could switch to a more reliable and blazing fast internet connection, or until the business could get more cashier staff to deal with the extra wait time and queue time this created during peak business rush hours.

Re: Turn on your damn chip reader

[zifn4b]

I have an EMV MasterCard. Used it today, in fact, and was asked to sign. I don't think I have a PIN for the card.

You really don't seem to understand how credit/debit cards work. Unless you're getting a cash advance, credit transactions never require a PIN. Hence, why they all used to require a signature. That way if the cardholder disputed the charge, the merchant could represent the signature to the cardholder and say "is this your signature?" Debit cards, on the other hand, always require PIN's because it's a completely different type of network with different operating regulations. Visa/MasterCard use variants of the ISO 8583 specification whereas Cirrus/STAR/etc. use something completely different. And, by the way, if you have a debit card from a financial institution that is Visa or MasterCard this is why they tell you to always run it as credit. If you run it as credit, the merchant pays the interchange fees. If you run it as debit, the issuer does and in many cases passes the cost along to the cardholder.

The dying art of editing

[whoever57]

From TFA:

"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."

That sentence is missing the word "require": "and require a PIN" . This changes the meaning, since in most of Europe the signature requirement has not been dropped, it has been (mostly) replaced with a PIN. I believe banks in Europe will still issue chip-and-signature cards to elderly people on request.

[I now await the replies pointing out the grammar errors in my post. Also, my recent experience is limited to the UK -- perhaps it is different in other European countries, but I don't think so].

Re:The dying art of editing

[PvtVoid]

This. Transaction verification is a long-solved problem that Americans refuse to adopt because we're too fucking stupid.

Re:The dying art of editing

[mrbester]

There's a button that can be pressed that allows customers to tip; the reader is handed to you and there is a blank field for the you to type in an amount. Then you enter your PIN. AFAIK this functionality has always been present so you could do it on chip and signature as well.

If the server has pressed OK twice after entering the bill total (skipping the gratuity step) then the transaction can be voided and restarted if necessary.

Slated to begin in April 2018

[Vektuz]

From TFA, for those asking instead of reading, April 2018 is when the signature requirement will cease.

Most supermarkets already have some sort of deal where signature is only required on purchases larger than $50 anyway.

PIN no need for chip

[markdavis]

>"In Canada, Australia and most of Europe, credit cards have long abandoned the signature for the EMV chip and a PIN to authenticate the transaction, like one does with a debit card."

We never needed a "chip" in the first place. Many millions of dollars wasted to overhaul everything- replacing readers, putting in chips, replacing all cards, updating interfaces and software- and still no PIN! A PIN code is a password. If required, without it, a card would be useless (at least in physical transactions, which is all we are really talking about anyway, since on-line can't use "chip readers"). Doesn't matter if it is a valid card, a stolen card, or a "made up" (cloned) card- put in the wrong PIN too many times and POOF, the account is frozen.

A password/PIN is required for my phone, my Email, my work account, Slashdot, my bank card, voicemail, calling to discuss my cable TV account, just about everything.... except credit cards??? Do they REALLY think people can't handle at least a freaking 4 digit number password in 2018?

>"Businesses that accepted EMV cards reported a 66 percent decline in fraud in the first two years of EMV deployment,"

Add a PIN, and then get a 99% decline in in-person fraud. Again, chip security does NOTHING for online security. Develop a PIN for use online and watch fraud drop tremendously there, too.

Re:PIN no need for chip

[ledow]

Your PIN is your signing key. It encrypts the data to the bank such that only they can read it, think of it like that.

Just transmitting card number + PIN is no more secure than just card number + expiry date, really.

But transmitting card number + nonce generated a secure chip on the card, signed with the user PIN and an internal incrementing number from the chip itself and presented to the bank? Now replay attacks are useless and even knowing card number + the PIN itself doesn't help.

You now have to physically have THAT card itself to make it work (worst you could do is a "cardholder not present" transaction otherwise, which doesn't need the PIN anyway). In the same way, your example of card number + postcode (also used in other countries) shouldn't be enough on its own either.

Though I hate Chip And PIN for many reasons, yours aren't any of them, and it's undeniable that nobody bothers or is even capable of verifying signatures at all. And it has significantly reduced fraud.

Until, that is, we went stupid and put NFC payments on the same card so any kind of temporary physical proximity is enough to charge, even without the user knowing. But that's another matter entirely.

And I don't know about you, but my card provider has online challenges at online stores if I don't use the card very often there or if it's an unusual transaction - by way of asking for a password that I NEVER use at a cash machine or anywhere else - only online. Verified By Visa and/or Master SecureCode.

Your problem is that you don't understand what the PIN is actually doing. Asking for a PIN doesn't work how you think - you use the PIN to unlock the chip on the card which is than able to sign a transaction and give a signature (AuthCode) that you then give to the vendor from where the bank can confirm the transaction came from your card itself.

Because unless you want to give everyone on the planet a way to present data to the secure chip and read responses (probably not good for customer ease of use) by way of some kind of chip reader that plugs into every possible smartphone and every computer, then it's not useful to have every online transaction require a PIN any more than an expiry date or postcode. And, in fact, is why those online system exist with an ENTIRELY DIFFERENT code that only works online. Hell, they even present a custom challenge so you know you're not being tricked into entering your code online on a fake site (i.e. only Verified By Visa and I know what text it should be putting in the box that asks me to verify my code).

Rather than complain about something you don't understand, use it and test it and investigate it. The reason Chip & PIN is there and works is because someone sat down, thought of all the use cases, thought of the attacks, and designed a single cheap chip that could solve most of them effectively enough for pennies-per-card (I've never been charged for a replacement credit card in my life, and chip-bearing smart-cards are so cheap as to be throwaway items if you have any dealings with them in access control / banking / code-signing / etc. applications).

I haven't even signed my last four / five cards (all of which reached their expiry dates), because NOBODY uses the signature and nobody even queries it any more. That's how long other countries have been using Chip & PIN.

Plus... you DO NOT want some cheap random bit of hardware interfacing with your card and just needing to send it a PIN that you type in plaintext onto it to unlock. You'd hope that such devices would at least have to have some kind of bank / merchant secure certificate to sign their part of the transaction to help you a) stop people just playing with credit cards using hobbyist electronics, b) require some form of device certification to be able to talk to your card, c) provide some security over the interface, d) provide some accountability should someone just start cloning a particular card reader that you issue out.

Chip & PIN has many holes. But you don't see that because you don't even understand the purpose of the PIN in the first place.

Re:Signing is for your protection, not the bank's

[Solandri]

You've got it backwards. If the customer initiates a chargeback, the credit card company assumes the customer is telling the truth. It's not up to the customer to prove the charge was fraudulent. It's up to the merchant to prove the charge was legit. And the easiest way for a merchant to do that is to send the credit card processor a copy of the signature on the receipt. If the receipt matches the customer's signature on file, case closed - it's not fraud. (If the signature doesn't match or there is no signature, the credit card company may or may not decline the chargeback. Merchants can submit other info - address, phone number, etc. - that are not on the card but which the card issuer has on file. That's why gas station pumps ask you to type in your zip code when you use a credit card. But in my experience as a retail business, any customer chargeback where we weren't able to produce a signed receipt or if the signature was faint or illegible, we automatically lost.)

Merchants want to get rid of signatures because it's what the credit card companies use to shift the cost of fraud onto the merchants. Think about it. There are two possible ways for credit card fraud to happen. Either you gave away/lost your card, or the credit card processor allowed a charge that it shouldn't have. The merchant has no way of knowing if a card is fraudulent. All they see is a card, stick it into the reader, and the machine tells them the transaction was approved or declined. The credit card companies got laws passed which prohibit merchants even from requiring ID before they have to accept a card. They can ask for ID, but it's illegal to refuse a credit card transaction just because the customer doesn't have or doesn't want to show ID. But somehow the credit card companies have managed to make the party which has no control over fraud (merchants) pay for fraud. (The exorbitant interest fees you pay credit card companies pay for delinquent customers, not fraud.)

This is why the state of credit card security is so deplorable. Online banking is very secure. Online bill pay is very secure. Wire transfers are very secure. But credit cards security sucks because the parties which can do something about security (the credit card companies and processors) aren't the ones paying for fraud. So they've had little to no incentive to improve credit card security for decades because it hasn't cost them a dime. The merchants have been paying for all the fraud. And whatever the merchant pays for, you pay for via higher prices.

Chip & PIN has its problems, but it's still much more secure than Chip & Sign. And problems with the current Chip & PIN implementation can easily be fixed without altering the process (just need to modify the algorithm the chip uses).