So I guess anyone can just use anyone else's credit card...

[WelshBloke]

Maybe. Maybe not.

http://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/



Chip and pin just shifts the vulnerability up the chain a little further.

That's not the kind of problem that chip and pin is designed to fix.

Chip and pin is to make physical use of your card more secure.

Internet and phone purchases are nothing to do with the chip and pin system (although my online banking uses them, but it's a fairly clunky system. It's better than that "verified by visa" crap though, that shit needs to die yesterday.)

 

[Murloc]

Chip & pin bitches. Get with the times.

KT

seriously, I don't understand how the country where the silicon valley is located is still in the stone age of credit cards.

A stolen credit card should not be usable. At least make them do the effort to skim properly at an ATM (and this racket is drying up too because the ATM builders have wised up to it).

 

[Ichinisan]

seriously, I don't understand how the country where the silicon valley is located is still in the stone age of credit cards.

A stolen credit card should not be usable. At least make them do the effort to skim properly at an ATM (and this racket is drying up too because the ATM builders have wised up to it).

Interestingly, the chip+PIN tech started in the USA, but it seems it just won't catch on without government mandates.

 

[Exterous]

seriously, I don't understand how the country where the silicon valley is located is still in the stone age of credit cards.

A stolen credit card should not be usable. At least make them do the effort to skim properly at an ATM (and this racket is drying up too because the ATM builders have wised up to it).

Interestingly, the chip+PIN tech started in the USA, but it seems it just won't catch on without government mandates.

It doesn't surprise me at all. Estimates vary but the yearly savings on fraud by switching to Chip & Pin have been $1bn-3bn dollars. Given that Chip and Pin would cost the banks $1.4bn more per year in card replacement costs alone it hasn't made financial sense for them to switch. Now that the cost of fraud is increasing the banks are moving in the direction of Chip and Pin

 

[DCal430]

So weird how far behind the US is.
We've had chip and pin for so many years now, and now it's all just tap/PayPass/PayWave for purchases up to XX amount.

We tried to move to PayWave years ago and at first it was catching on, but the problem is merchants refused to keep supporting it, as they had plans of bringing their own payment method using bar codes.

 

[Eug]

Bar codes? Really? How would that work?

BTW, PayWave etc up here in Canada is great. Just tap and you're done, at least for small purchases. Same thing for gas stations. Tap the card against the reader and you're done.

Except I'm not sure that would be viable in a lot of US locales. I remember driving down to the US and most of the gas stations wouldn't even allow you to start pumping gas until you paid in advance. It was really annoying. I'd get to the gas station, pull up to the pump, and then have to pre-pay for say $50, and then pump gas. And then get change if necessary. Like, WTF?!?

Why didn't I pre-pay at the pump? Cuz they wanted a zip code. But I don't live in the US of A dammit! I hear they may be getting rid of the zip code thing though. Is that true?

There are pumps in Canada that require pre-authorization, but they don't actually require pre-payment. So you might pre-authorize for say $50, but if you only put in $45, then the actual credit card transaction is for $45. So on your credit card you'll see the pre-authorization locked for a day, but then when it actually goes through, the proper amount is listed. But even that pre-authorization is optional. If you don't want to pre-authorize on a credit card, you simply pay by cash, and that is usually done after the pumping is done. You don't have to pre-pay in cash. I suppose if you're in the roughest neighbourhoods they might ask you to pre-pay, I dunno, but I've never come across such a pump in Canada.

EDIT:

Hmmm... Interesting. Mastercard says if you type in the 3 numbers from your Canadian postal code, and then add two zeroes, it should now work as a fake zip code at a US gas pump.

http://www.mastercard.ca/education/travel-tips/US-gas-code.html

 

[Ichinisan]

Bar codes? Really? How would that work?

CurrentC
http://currentc.com/
https://en.wikipedia.org/wiki/Merchant_Customer_Exchange

If I understand correctly, an association of retailers came up with that independently from financial institutions because they wanted to eliminate transaction fees. While CurrentC *could* ultimately reduce the cost of goods and services, it's definitely not as convenient.

Retailers that are part of the Merchant Customer Exchange disabled their RF payment systems after Apple Pay launched (which also blocked Google Wallet). CurrentC might be dead-on-arrival when it launches in August.

 

[Eug]

CurrentC
http://currentc.com/
https://en.wikipedia.org/wiki/Merchant_Customer_Exchange

If I understand correctly, an association of retailers came up with that independently from financial institutions because they wanted to eliminate transaction fees. While CurrentC *could* ultimately reduce the cost of goods and services, it's definitely not as convenient.

Retailers that are part of the Merchant Customer Exchange disabled their RF payment systems after Apple Pay launched (which also blocked Google Wallet). CurrentC might be dead-on-arrival when it launches in August.

I didn't realize that is how CurrentC worked. Wow. That's horrible.

The only possible way this could get any traction IMO is if they offer lots of incentives to use it.

 

[Ichinisan]

... I remember driving down to the US and most of the gas stations wouldn't even allow you to start pumping gas until you paid in advance. It was really annoying. I'd get to the gas station, pull up to the pump, and then have to pre-pay for say $50, and then pump gas. And then get change if necessary. Like, WTF?!?

They used to allow pump-then-pay at most gas stations around the country. Then, gas prices went way up and drive-off theft went way up. They had to change the system.

Why didn't I pre-pay at the pump? Cuz they wanted a zip code. But I don't live in the US of A dammit! I hear they may be getting rid of the zip code thing though. Is that true?

I always pay at the pump with my Visa debit card. Nearly all machines will ask me if I want to run as debit or credit. I choose debit and enter my PIN. If I choose credit, I sometimes have to enter my zip code (not every time).

Typically, there's a $1 authorization charge initially to make sure the card is good before it starts pumping. When the transaction clears in a couple days, my bank account shows the actual amount of the charge.

 

[BoberFett]

That's not the kind of problem that chip and pin is designed to fix.

Chip and pin is to make physical use of your card more secure.

Internet and phone purchases are nothing to do with the chip and pin system (although my online banking uses them, but it's a fairly clunky system. It's better than that "verified by visa" crap though, that shit needs to die yesterday.)

Exactly, it doesn't do anything for the vast majority of credit card fraud.

How much fraud is committed by theft of the physical card vs a hacked database full of card numbers then using them for online purchases?

Chip and pin is security theater.

 

[WelshBloke]

Exactly, it doesn't do anything for the vast majority of credit card fraud.

How much fraud is committed by theft of the physical card vs a hacked database full of card numbers then using them for online purchases?

I've no idea what the proportions of credit card crime are but is that really relevant?

Locking my front door doesnt stop somebody from getting into my car but that doesnt mean that I leave my front door unlocked all the time.

Chip and pin is security theater.

No it isnt. It addresses a specific problem with credit/debit cards.

 

[pete6032]

Targets around here have new terminals installed, but the chip slots aren't yet active =/

At the Target stores here, I have found that some of the stores have turned on their chip readers, but other stores have not. I find that strange. I'm not sure why some stores would enable them and others wouldn't.