Chip Credit Cards Give Retailers Another Grievance Against Banks | Hacker News Reader

Chip Credit Cards Give Retailers Another Grievance Against Banks

mobile.nytimes.com

31 pointsmsoad77 comments

Reading something like this is really strange to me in Australia. We've had chip-and-PIN for ages - August last year, signatures were phased out completely.

I'm paying with my phone via Commbank Tap & Pay [1] and the one part of going overseas I'm not looking forward to is going backwards in banking systems & technology.

Initially, chipped cards were (are?) slower because the approval was transmitted via dial-up (!) or GPRS. The newer terminals (that also support NFC) are using 3G and are fine speed wise. Some retailers even do batched approvals - the terminal does some kind of check and displays "offline approve".

1: https://www.commbank.com.au/personal/online-banking/commbank...

It's certainly convenient, but I find it a little scary that the PIN is not needed on purchases under $100. Granted, your phone is going to have its own security lock before you can run the app, but what about the smart chip debit cards in your wallet?

There's really no issue. If your card is stolen and fraudulent charges made the bank will reverse them. Having used chip payments for years now, I couldn't imagine living without them.

What if the card is stolen alongside your pin? Will the charges not be reversed because the pin was stolen?

The only way for a PIN to be stolen is if you wrote it on the card, or if it was forced out of you e.g. at gunpoint.

The latter is incredibly rare. The former is your own fault. That's why generally if a PIN was provided the liability is on the card holder.

While this doesn't invalidate your point, I've seen recordings of people being coerced to give up their pin by someone acting like they are being helpful in getting an ATM to work. The guy of course has a skimmer and gets it later.

Card skimmers.

Card Skimmers will only copy track1 and track2 of the magnetic strip. In order to get the pin you need an additional piece of equipment that records the pinpad, such as a well placed camera.

Many skimming devices do both... They even capture the CCV.

Yes. The whole point of FDIC insurance is that you will be reimbursed for any sort of theft. Even pin + card.

No. And FDIC insurance has nothing to do with this. Most banks will in fact try to hold you fully liable for fraudulent transactions if your stolen card was used with its PIN. Their rationale is that if you gave your PIN to an unauthorized person, or used a weak PIN, or wrote it down and got the piece of paper stolen, then you should be liable. See for example: "If your Password or PIN is used in such a transaction, you will be liable for the full debt" http://www.scotiabank.com/ca/common/pdf/borrowing/revolving_...

No, FDIC insurance is insurance against bank insolvency not theft.

The pin is not on the card. You're responsible yourself for keeping it safe.

If you use Apple Pay there can be no fraud by hacking the retailer since Apple does not give the retailer your CC number but rather a token. Apple Pay is very quick and convenient and secure.

What damage will someone do? I guess you risk an occasional transaction you don't know about. Someone can hardly hit 100's of transactions quickly without flagging something. Also I'd be surprised if the banks don't already/shortly tie your location to the transaction as the swipe is increasing done from the phone (or they have your mobile banking app even if card based).

One thing I'm trying to change is get my partner to stop using a clone credit card they have of mine. It makes it hard for me to do my monthly scan of spending an know what what should/shouldn't be there.

Going forward I hope they get an e-ink screen on the card showing the last spend amount. I dislike when businesses swipe small transactions and you cant see the terminal amount. I generally ask for the receipt in these cases but having the most recent spend on the card would make things that little bit easier.

Couldn't the "PIN-required" threshold theoretically be a user preference encoded on the chip?

As far as I know that is the cards's choice. My card does unlimited via nfc but it prompts for a pin when over a limit or number of purchases.

One of my good friends is Canadian, and he is a manager at a Shopper Drug Mart in Toronto. He said once Canada went to chip-and-PIN, that the incidence of fraud essentially went to zero. The only time there is fraud is when the cashier isn't paying attention and allows a transaction that is swipe instead of PIN, via some special way the customer can swipe the card (pulling it out too quickly or something).

The idea that PIN doesn't bring fraud down to almost zero is ridiculous and it really is about fees. That's why debit card transactions with PIN have such low interchange, because the PIN brings the fraud down to essentially zero as well.

some special way the customer can swipe the card (pulling it out too quickly or something).

When chip cards were introduced here, the cards and the readers weren't very reliable, so the rule was "if the reader can't talk to the chip, you swipe the card instead". This would happen if the card wasn't fully inserted, if the contacts were dirty or corroded, etc.

That lasted maybe two years before the fraud increased and the reliability improved to the point that the fallback wasn't worthwhile. Now if a chip doesn't read the answer is "try it again" followed by "do you have a different card?"

I vividly remember that turning point in Canada a few years ago. My techno-enthusiastic brain had never been so excited to pull out cash to pay for a coffee.

Exactly this

The rest is whining by merchants. And look their fraud levels are going down, so they have a reason to like it

Chip-and-pin existed elsewhere a long time ago, if anyone got a non-chip-and-pin reader on the last 5 years they should have known better

Oh I forgot in the US nobody knows the rest of the world exists

The merchants are the ones calling for chip-and-PIN. What they are whining about is high interchange fees, and their whining is entirely justified. Visa & the rest of the credit card industry is a racket, an extra sales tax on all retail with the proceeds going to a handful of very rich people.

Merchants are furious about the required upgrade to a chip-and-signature system which requires them to pay for expensive upgrades to all their POS machines and is much slower to validate than swiped cards, but leaves high interchange fees and doesn’t appreciably bring down their fraud liability.

> Visa & the rest of the credit card industry is a racket, an extra sales tax on all retail with the proceeds going to a handful of very rich people.

Well, I agree, but first of all, getting payed in money is not free as well, and second, they should pass that fee on to the consumer then.

> said it cost the average convenience store $26,000 to upgrade its gas pumps and point-of-sale terminals.

This seems backwards. Here in Australia we just pay a rental fee to the bank, for the pin pad human interface device. Everything else is business specific and shouldnt need upgrading...

In the US the merchant owns and is responsible for the POS equipment. The banks had to strong-arm merchants into upgrading via liability changes for non-compliant merhants.

Do the merchants need to validate there devices are maintained and operated in accordance with VISA requirements?

Banks (including PEDS used by the bank) are audited by VISA to make sure they follow required stanadrds/processes (i.e. see https://www.visa-asia.com/ap/center/merchants/riskmgmt/inclu... although this looks out of date)

From the article: "Banks say interchange fees help cover the cost of fraud. Retailers argue that fees should therefore decrease if fraud is reduced."

In my three year history of taking credit card payments online there has never been a time when I was not made to bare the entire cost of the chargeback plus Stripe's chargeback fees. So I am wondering When, if ever, does the bank or the processor bare the costs of a fraudulent purchase?

Does Stripe do in person payments?

EMV reduces fraud a whole lot for card-present payments. It does absolutely zero for online transactions, due to some unfortunate history around (not) integrating chip readers into laptops and desktop computers.

> From the article: "Banks say interchange fees help cover the cost of fraud. Retailers argue that fees should therefore decrease if fraud is reduced."

Austria is chip&pin only (except for american cards which are allowed to do magstripe) and interchange fees are < 1%. Sure, part of that has been the EU forcing the networks down to that level, but this could not have been done if Chip&PIN was not in place.

This article had been submitted earlier: https://news.ycombinator.com/item?id=10577790

Apple Pay is the best solution. It is quick and since Apple sends a token and not the CC number there is perfect security from hackers as long as the bank ensures that the correct CC is entered in the iPhone. In other words, Apple Pay does not depend on merchants updating their software.

Target and later Lowes (and perhaps Neiman-Marcus) were hacked because they were running their POS terminals on Windows XP embedded which had been last updated in 2006 (the embedded version). Microsoft told the retailers such as Target and Lowes to update their POS terminal software to Windows 7 embedded which is still supported yet they ignored this manufacturer recommendation.

At any rate, the quickest, most efficient approach is to use Apple Pay when you can and all retailers should support it for its efficiency of use and its security.

Kind of a rant, sorry.

Chips are great, but in-store fraud transactions (from unauthorized purchases) have scaled downward, until...

Google Wallet, and Apple Pay.

In fact, it's now easier to perform in-store credit card fraud, thanks to such technologies.

This is important because stores are becoming more and more complacent with chip tech, when what they should really be doing is not allowing transactions via Google Wallet, Apple Pay, or any similar technologies.

We'll hear on the news that chips are a big deal — and don't get me wrong, they are — but with new technologies comes new opportunities, and it's now 100x easier to perform a fraudulent in-store transaction, it really makes me laugh how much of an afterthought we're giving these technologies when all you have to say is "chip" and everyone's like "oh okay that's safe."

    > In fact, it's now easier to perform in-store credit
    > card fraud, thanks to such technologies.

How is it easier for someone to perform fraud using Apple Pay? You'd need to both have and then unlock either my phone or watch to make a payment using them, which is still two-factor authentication...

Apple Pay is an effective way of 'laundering' stolen card details due to weak enrollment procedures.

More info: http://www.nytimes.com/2015/03/17/business/banks-find-fraud-...

An industry consultant, Cherian Abraham, put the fraud rate at 6 percent, compared with a traditional credit card fraud rate that is relatively minuscule, 10 cents for every $100 spent. Mr. Abraham wrote in a blog post, one of the first to spotlight the issue, that the Apple Pay fraud “is growing like a weed, and the bank is unable to tell friend from foe. No one is bold enough to call the emperor naked.”

The vulnerability in Apple Pay is in the way that it — and card issuers — “onboard” new credit cards into the system. Because Apple wanted its system to have the simplicity for which it has become famous and wanted to make the sign-up process “frictionless,” the company required little beyond basic credit card information about a user. Nor did it provide much information to the banks, like full phone numbers and addresses, that might help them detect fraud early.

This has largely been debunked elsewhere -- the fraud is entirely on the poor verification by the banks.

When I got an iPhone supporting Apple Pay, I added two cards to it. One just set up with nothing more than entering the information. The other one triggered a phone call to the issuing bank where I had to jump through multiple verification hoops to convince them I was the cardholder.

Apple can't fix the first bank's security problem, and I don't really expect them to.

I had to call the bank for one and install the companies app (and login) for another.

Both took a few minutes, not really an issue.

It isn't that the process is so simple. It's that it allows fraudsters to convert their "fullz", previously used best online, to in-store Apple Pay cards.

You could theoretically call into the victim's bank, and with their SSN + address + etc. add the card to Apple Pay. This would allow you to use the card in-store. Contrast this with previous use, where you the potential damage might range from taking over the account and performing online transactions.

Being able to go from online transactions to in-store transactions is huge. But it's not so simple as just "type in the cc #, zip, and cvv". You need their entire details and to be very methodical. The issue is... people are easily convinced to part with all their identity information.

This is a story. I'm going to need to see some data.

"Mr. Scheeler testified that it cost the average convenience store $26,000 to upgrade its gas pumps and point-of-sale terminals..."

Really? This strikes me as a nice bit of hyperbole. Most convenience stores I've ever come across have, at most, two or three PoS terminals. Even the most expensive card readers with EMV support—the ones with the fancy colour screens, NFC, and so on—don't cost more than $800 or so.[1] Even with paying someone to set it up, I just can't see the average convenience store spending more than a few thousand dollars.

[1] https://www.barcodesinc.com/verifone/mx-880.htm

Gas pumps often are not just a payment terminal though, they use an integrated system handling gas type selection, pump control and payment, so I can imagine they're a bit more costly to replace.

The kind of readers that are attached to gas pumps seem more expensive and do a lot more.

EDIT: They look like this: http://kytx.images.worldnow.com/images/24359909_BG1.jpg if you aren't familiar with what US gas pumps look like.

How much does an average convenience store make in annual profit?

There is very little direct benefit to US consumers from chip cards. Sure, it will reduce fraud, but from a consumers point of view it doesn't matter. By federal law, unless the bank can prove negligence, they have to refund your money. In practice they take your word for it over the phone, and overnight you a new credit card.

There is a small chance retailers and banks will pass on fraud savings via lower prices, but it will be hard to notice a 2-3% price decrease.

It is very easy to notice waiting 5 more minutes for youe morning coffee since each transaction takes 30s instead of the old 3-5s, though.

Bear in mind that the rest of the world is already moving on from actually inserting the chip card into the reader. Contactless transactions can happen in around 400 milliseconds and even regular insert card+type PIN payments often don't take 30 seconds.

There is very little direct benefit to US consumers from chip cards.

A reduction in fraud will make running a successful retail business easier, creating more jobs, offering more choice, and leading to more retail entrepreneurs doing what they want to be doing. The knock on effect is that people get to live in a better society with less crime. I think that's quite a significant impact.

It matters because it should reduce the costs of everything by %1.

Really, they don't have this in the US yet? Wow...

I've had chip-and-signature on credit cards for years here. What changed this year was that the issuing banks shifted liability to the retailers, but only if the retailers don't support at least chip-and-signature.

Meanwhile, in April one of my cards reissued and now does chip-and-PIN. I've been to Europe twice since then and enjoyed, for the first time, being able to use the automated ticket kiosks in train stations.

In the last couple weeks, two of the major banks I have credit and debit cards with have forced me to cancel the old cards to 'upgrade' to their chip cards. Aside from the incredible annoyingness and inconvenience of dealing with their forced measures, does anyone have any insights on why they are doing this, and now? I don't feel good about it, and it makes me want to move banks.

Presuming you are US based, https://en.wikipedia.org/wiki/EMV#United_States

POS // Retailers are having fraud and liability shifts forced on them from the payment networks and banks. If a POS // Retailer accepts a fraudulent swipe, they eat the bill now, fraudulent chip purchase (much harder), bank pays.

That was always the case. The real question is why did it take the US a decade longer to do poorly what the rest of the world has been doing effortlessly.

After Oct 1st 2015, whichever side that has not upgraded to chip (bank or merchant) eats the cost of any fraud. As more retailers upgrade, the risk for the bank's who haven't upgraded grows.

    > does anyone have any insights on why they are doing
    > this, and now

Because it cuts shop fraud down to essentially zero, and the rest of the developed world have been using it for long enough to be embarassing that the Americans aren't?

These complaints are all "first world problems". It's a non-issue.

Umm, most of the rest of the first world uses chip and pin. This is more a US problem than anything more general.

FWIW, South Africa started moving to C&P 6 years ago - http://www.bizcommunity.com/Article/196/182/34015.html - as did Nigeria - http://www.atmmarketplace.com/news/postilion-drives-africas-... . And Kenya is further along on the migration than the US - http://www.foxnews.com/tech/2014/02/10/chip-and-pin-future-c... .

Chip amd pin or EMV cards seem to have quite high usage in Africa, the Middle East and South America [1]. Although perhaps you think cash dominates a lot more in poorer parts of the world?

[1] https://www.emvco.com/about_emvco.aspx?id=202

The first, second, and third world are all on Chip+PIN. The US is the sole holdout for mag-stripe cards.

"The US is the sole holdout" is such a common phrase for things the rest of the world takes for granted.

These machines have backed up the local grocery stores. Seriously terrible UX. Worse, it was a forced upgrade; swipes are rejected.

If us dummy Europeans have managed it for years, one would think you clever Americans would be able to get to grips with it too...

Dummy?

You can't enter your card until about 10 seconds have passed after all your items have been scanned, or it blows up.

You must leave your card in for ~20sec, or it blows up, while the machine does seemingly nothing.

The quickest you can complete a transaction is ~30+ seconds; after all the items have been scanned.

Compare this to ~5 seconds with the swipe method.

Now, take 25 seconds / registers * people. That is the lower bound on how much additional time we must wait in line because of these BS machines.

Trader Joe's is now a wasteland of wasted time standing in line.

As has been pointed out several times in these comments, Americans appear to be living with their head above the clouds regarding these machines. in Finland all the machines are hooked up to 3G and initialised in the morning before customers arrive. It takes less than 2s for the the machine to ask for your pin and I'd say on average less than 2-3s to accept it. Tell me, what is the problem?

Please try reading the article and the thread.

TJ's put in the new machines and those machines have the constraints I described above.

Europe, its ilk, and their terminals are completely irrelevant.

> Europe, its ilk, and their terminals are completely irrelevant.

Not really. It's a valid comparison to figure out what the cause of the problem actually is.

The only explanation that would be remotely plausibly acceptable was if some long-running encryption process was occurring between the card and the terminal.

More likely it is just poor specifications and poor execution.

Sounds like a poor implementation. This problem is rare in the UK - the time from card entry to PIN entry, and PIN entry to completion, is typically near-instant on most terminals.

> Sounds like a poor implementation.

That's the US we're talking about, I'm quite sure their banks built everything from scratch without taking into account what a few decades of use have taught European banks.

It was also slower than is it today when introduced, at least in France (though mostly because connection was over dialup or GPRS).

And with contactless, it's faster still...

What you describe isn't the case here in 'dumb' Sweden. Eg, I put my card in while the grocery items are still being scanned. Nor do I recall a 30 second wait when visiting 'dumb' Norway, Denmark, Germany, or Switzerland.

Come visit Holland. Chip+PIN takes as long as it takes to enter the pin (max5s). Only some mobile terminals in low reception spots take between 10-20s.

And now with wireless PIN transactions less than €25 are instantaneous. And above again take the time to enter the PIN.

> You can't enter your card until about 10 seconds have passed after all your items have been scanned, or it blows up.

What pos terminal did you use? Besides you can just use NFC in Europe these days which is even faster.

If it's really taking 30 seconds to verify a card tx then without a doubt your internet connection and/or bank and/or reader hardware is incredibly poor.

Yes, as stated: the reader is incredibly poor.

Also, yes, the banks suck.

Here in Australia: * The cashier presses credit on the POS terminal. * It may take 1s for the logo to come up. You hold your card against the reader for ~1s. The icon changes while it's verifying which takes < ~5s.

This was how it was until places put in new terminals that refuse swipes from chip cards. Instead, you have to insert the chip portion of your card into a slot (after waiting 10s for the prompt to appear [or it will error out]). Then, you must leave your card in the slot, untouched, for about 20s.

The tap terminals have existed in the US for years. Usability was pretty much the same as the swipe method: fast and easy.

It's not that slow.

> In early October, the F.B.I. issued a warning that chip-and-signature cards were still vulnerable to fraud. The original announcement seemed to incorrectly indicate that banks were issuing chip-and-PIN-enabled credit cards, and urged consumers to use the PIN instead of a signature whenever possible. The bureau also warned that the new cards “can be counterfeited using stolen card data obtained from the black market.”

Amazing. It's as if they should have just caught up with the rest of the world on Chip and PIN instead of going half the way there.

Reply on news.ycombinator.com