Visa: Some merchants see dip in fraud thanks to chip cards
usatoday.com
usatoday.com
"According to Ericksen, the ability for EMV transactions to continue as usual without the card remaining dipped after the creation of the cryptogram is actually already an existing EMV process, but it is just not widely used. With the implementation of Quick Chip, no additional testing or certification is needed from a Visa or EMVCo point of view, there are no changes to the process and the technology is inherently EMV compliant."
http://www.pymnts.com/news/emv/2016/visa-puts-the-quick-into...
Simply put, requiring the authorization token (card, phone, etc) be present and accessible for the entire transaction is not a bug, it's a feature. I surely do not want transactions happening after I've left the store, and while you can sign a verified transaction request with everything needed to process the transaction on okay from the bank, that's an extra level of complexity on top of a system I already don't trust them to get right.
http://www.npr.org/sections/money/2016/04/13/474135422/episo...
Of course, that analysis ignores the very painful cost to consumers of identify theft, which is why I'm glad they're finally implementing a more secure system.
The US banking sector is an ridiculously slow moving, technologically regressive cesspool, frankly. Their piggybacked debit system is a disaster compared to what we have here.
This is growing in the US as well, which is why chip-and-PIN seems less helpful coming this late in the game to the US market. I'd much rather it be required that restaurants (among other merchants) use portable credit card readers like they do in Canada to keep cards in the hands of their owners.
50% of credit card fraud is 1st person fraud (you lie about the purchase yourself). Rest is online fraud, which is expected to go up with the chip and pin. The same happened in UK as crooks just moved to different liquidation methods of stolen credit cards. Stolen / copied card is actually the smallest part of the problem and banks estimate that cost of people forgetting their pin numbers is higher than the actual fraud.
The estimate is that all fraud goes online until credit cards get tokenized CC numbers or time based CVV numbers (the card has a battery, LCD screen and CVV changes every few hours).
In Europe we had pinless-magnetic-only-sign-here cards and the like and were getting rid of them ~ten years ago
Yes, it requires a pin number.
Though chip+pin does nothing for online fraud so I don't get it.
After Target got thoroughly pwned a couple of years ago, I'm sure their security team have quite a bit of say in how things will run. Other companies won't take the risk of upsetting customers who can't use their card if they forget their PIN.
All in all, one would wonder why greedy banks in Europe weren't pulling same stuff or invested in tech with more problems. What American banks did made ton of sense given their evil and consumers' apathy. I was shocked at tge recent reversal to chip cards.
My biggest gripe is the sound for a successful transaction is the same as an error sound. It always causes me to do a double take to ensure it went through.
It's a crapshoot which one will work at any given store. I do prefer the chip over swiping due to having to replace cards so often when the stripe wears out.
Contactless is listed at a lot of places, but it doesn't work consistently for some reason. Makes it hard to trust using it when the store is busy.
As of this month, all of my contactless cards have been replaced by EMV cards without NFC. Now I only have it on my phone and smart watch.
That "someone" is me, by the way.
In all seriousness, using cards used to be super-fast. Remember those Visa commercials - swipe and go, swipe and go, oh no someone with cash ugh it will take forever.
Now in CVS I have to swipe the card, tap NO (I don't want to donate), YES (this is debit card), my pin, YES (is $9.75 correct?) and then wait for transaction to be completed. Meanwhile a guy next to me handed $10 bill and got quarter back. He left before I finished swiping my card..
Donate?! WTF, go away. I want to swipe and go, damnit. I didn't come to your establishment to take part in your charity drive.
Debit? Credit? WTF, can't you tell?!
Is this the correct amount? Shit, I don't know. Did the computer add correctly? Is this a bartering interface, where I get to say "NO", and make a counteroffer? No? Then why the hell are you asking me when I don't have a real alternative choice to make?
My personal supreme pet peeve is going to a gas pump, pressing the credit button at the pump (which has both credit and debit buttons), then being asked if the credit card I just swiped is in fact a debit card.
No, they can't tell when the same card can be processed in both ways. Just for fun, check out your bank's debit card fraud protection details - odds are you're much better protected if you run your debit card as a credit card (i.e. no PIN, but a signature), that way visa/MC takes on the fraud risk.
Also, on some rare occasions when I use my debit card, the PIN entry pops up without prompting. If I don't trust the place or don't want to divulge my PIN to prying eyes, I have to hit a cancel button to process as credit. I've never seen a PIN prompt show up when swiping my credit card. If they can't tell, how does the terminal prompt for PIN only when a debit card is swiped?
Why I think that screen is there is to shield a merchant from someone coming back after the purchase to complain. And I doubt any merchant would use that confirmation to defend an error and risk losing a customer. Which, to me, makes it even more useless.
It's not slow outside the US, where it's been in use for a long time.
In the US, it depends on the POS. At Walgreens it's basically instant, whereas at Target it takes like 8-10 seconds. It's just poor implementation.
Is it necessary for the average person to be able to instantaneously spend hundreds of pounds? I don't see why all retailers need such high security (e.g. sandwich shops).
I personally rarely spend more than 50GBP in a store. Large amounts of groceries in bulk, full fuel tank when I owned a car.
The contactless limit is 30GBP and that makes sense to me. If I cared about losing that amount of money I wouldn't go outside. I can sit on the metro and see that 25%+ of the people there are playing with smartphones worth 300GBP+.
Given all of that I don't find the US stance on security very odd. I want large payments to be verified, I don't care if someone buys a sandwich on my card, even if I never get that back from the bank.
To put it another way - huge payments should not be possible using a physical object that is used all over the place. I'd be happy for my bank to call me (2FA) for all payments above 100GBP, and for them to freeze payments if many many small payments happen in a short time span.
Otherwise, I'll see problems on my statement, cancel the card, and carry on with life.
> How is this ANY different other than harder to implement a scanner which would steal the swipe [...]
The magnetic stripe on the card is essentially just a barcode read by magnets. Like a regular barcode, it's trivial to copy.
The chip on a card is actually a very low power computer that uses cryptography to produce an authentication token the scanner can present to a bank to authenticate a single purchase. It's essentially impossible to recreate the entire chip and the token can only be used on the purchase it was intended for so skimmers are pretty much dead.
You can read a little more about it here http://www.firstdata.com/downloads/thought-leadership/EMV-En...
That is not to say it is impossible to get the secret inside of the chip, but it is hard, often requiring partial disassembly, some sort of side-channel and you will often destroy the card in the process.
"Visa chip cards are not only more secure, they are also simple to use. Chip cards and terminals work together to protect in-store payments. A unique one-time code is generated behind-the-scenes that is needed for the transaction to be approved - a feature that is virtually impossible to replicate in a counterfeit card."
Magnetic cards can be easily duplicated. A Smartcard is virtually impossible to duplicate (The NSA might be able to. A criminal won't).
The Pin code is used in Europe to provide 2 factor authentication. Something you have (the card) with something you know (the PIN). Its only to prevent people from using your smart card if it's physically stolen.
Certainly harder than cloning a magnetic stripe, but the PIN verification was as simple as the reader saying "Is 1111 the right pin?" and the card responding "Yep, that's the right pin." So they took apart the cards and MITMed the response to always confirm, no matter what pin was entered.
Hopefully that's been fixed by now, but with the number of readers that would need to be upgraded, I wouldn't count on fixes rolling out quickly. And who knows if there are other weaknesses?