Hacker News Reader

Comment by buro9 | Hacker News Reader

This must be a US only thing.

In the UK nearly all cards can be used for contactless payments below a fixed amount (£ 30 at the moment).

Additional security (inconvenience) only kicks in on higher price purchases.

Additionally, there is no time delay for contactless, and chip and pin is extremely fast too.

Contactless is far faster than even unlocking your phone (even if you use a fingerprint unlock), and can usually be done concurrent to the cashier putting your item in a bag or reaching to pass it to you... it is essentially frictionless.

This all works so well I find myself doing something I never though I would... I've abandoned cash. Contactless payments are that good, and fast, and work at the end of the day when my phone is out of battery, and works for every one of my daily casual purchases (travel, food, a book, some toiletries, some groceries, etc).

View on HN

Same here in Canada, for slightly more (100 CAD, I believe). It's incredibly convenient. So easy to spend money! Tap, tap, tap with just a dumb card.

During a recent trip to the US, they had to swipe my card and make me sign a piece of paper (which I gleefully sign with an "X" as if I were illiterate). It felt so backwards.

Some US establishments seem to have stopped requiring a signature under a certain dollar amount but the tap capability isn't universal and I've noticed that it even varies across locations. So either they're pilot testing or some other factor like franchise vs. corporate are at play.

The tap to pay has actually become less common, in my experience. At one point, two of my cards supported it. Now, none of them do. Le sigh.

I lived in the US then moved to Ontario. I find that about 70% of card readers here have "NO TAP" taped across the top. Since the insert chip, enter code, wait, and approve process actually takes longer than the swipe-and-sign in the US, I've found the time spent, averaged over my actually purchases, to be about the same. It probably has more potential to improve in the future.

I tap everywhere in Mtl. It's rare for me to find terminals where I can't tap.

Back in Sweden, Chip-and-PIN was so efficient - you can insert your card, enter your pin, and get an authorization all meanwhile the cashier is ringing up your goods. Then when the total is done, you just hit "OK" on the final amount and in seconds you're done.

In pretty much every other country I've visited, you have to do the whole process serially after the total is done, which is quite slow.

Yea, frustrating that in Canada you can't enter your pin or anything until everything is rung up.

In the UK and Europe, didn't governments essentially force banks into the modern age in terms of electronic payments that your contactless and contact cards use?

By comparison banks in the US use the debit card & ACH system which has many issues compared to credit cards and European payment systems.

Can't speak for all of Europe, but in Norway, the banks did it of their own accord. They got their heads together in the early 1990s and founded a private company, co-owned by all the banks, that has been stewarding the technology used for inter-bank transfers and card payments.

They've been quite good at this — Norway has had chip and pin since the early 2000s, and contactless payments (using NFC in ordinary cards, not phones) have existed for a few years now. Money transfers are also completely effortless; all you need is the other person's bank account number.

For consumers, the main hurdle remaining is the speed of transfers between banks. They only perform transfers in bulk twice a day (and for years they only did it once a day).

Contactless cards did exist here in the US a number of years ago. I had one from Chase. Then around 2014 when it expired, the replacement card did not have contactless payment anymore. According to this article it was simply a lack of demand: http://www.digitaltransactions.net/news/story/Chase-To-Disco...

My experience from the US is... interesting. I tapped-and-paid $700 (not a typo) when visiting NY... and American Express had no idea I was in the US (unless they cooperate with US Border Controll). In the UK, I'm limited to 30 GBP.

Did you buy the ticket with your American Express card? The data transmitted by the merchant (airline) includes some basic itinerary information.

That would be awesome if the CC provider automatically created a travel notification for you upon booking.

The next few decades of adverts that I couldn't unsubscribe from would be less than awesome though.

Some do.

Many airlines transmit level 3 purchase data as part of the credit card transaction, which will contain your complete itinerary -- which can be fed into the bank's risk system.

Amex already takes this into account.

No, I haven't, that's exactly the point! And I think that's the first transaction I've made in the US..

You can still get contactless cards from Amex at least (I'm not sure about Chase). But you have to specifically request them (and hope you can find a CS rep who knows what you're asking for). I think it's a bit of a chicken and egg thing - it's hard to get a true measure of demand when people don't even know it's a possibility...

Lack of demand or lack of interest from the banks to invest in the technology/security? I'd love to know why the US adopted "Chip and Signature" rather than "Chip and Pin". Requiring a signature is essentially worthless. My understanding was that it was a combination of US customers not being familiar with using a PIN and concern over where the liability lies if fraud occurs (the assumption being that if someone uses a PIN then the card owner gave them the PIN).

My guess is that the signature thing probably carries more weight as a contract for payment owed; and if that's not actually true it still feels true enough to make it more of a comfort to the retailers/customers.

I don't think chip and signature is a requirement - most places seem to ask for a PIN rather than a signature.

Just swiping the card, however, also works just fine and I now use it everywhere again because I can't be bothered to remember and type in yet another passcode. Just more friction in the process.

> most places seem to ask for a PIN rather than a signature

That is for debit, which is an entirely different thing than credit.

There are no US banks that implement Chip & PIN. Heck, it's nearly impossible to get a Chip & PIN capable card for travel if you have a US issuing bank.

Swipe support will in theory eventually be disabled (e.g. authorizations declined by your issuing bank) at some point in the future when Chip & Signature is being rolled out.

If you're typing your PIN code into a terminal in the US, you are using debit though.

I only ever use a credit card, so I'm not sure that's true. Or can you debit a credit card?

Here US, some stores when using a chip credit card (not debit/checking account btw) requires a pin instead of a signature, not sure if they call it a pin but it's 4 digits to verify purchases . . . instead of signature.

I have never heard of a US credit card using a PIN. May I ask what kind of card you have?

My corporate CitiBank card required me to set a pin when they switched to chip cards. All my other chip cards have been chip and signature though.

I have a MasterCard that takes a pin. I've been asked to enter the pin at several places, including WalMart. It is a credit card, not a debit card.

Frankly, I'm baffles by these claims that US cards don't work with chip and pin because so far, if I use the chip, I have been required to use the pin.

I also have a corporate amex with a pin set up, but I've never used it.

Target VISAs switched to chip and pin recently. I assume related to their data leak.

> There are no US banks that implement Chip & PIN. Heck, it's nearly impossible to get a Chip & PIN capable card for travel if you have a US issuing bank.

Not entirely, but your last sentence is true. Some issuers do PIN credit cards. I have one from First Tech Federal Credit Union that uses PIN and touts it as a benefit. When I used it in Europe, it worked exactly as expected and prompted for my PIN just like in the States. There are a handful of smaller issuers that also do PIN primary (mostly credit unions but at least one Florida bank with a card catering to Cuban trade does) and a few more that have PINs but the PIN is secondary so it isn't asked for unless the terminal's configuration insists on it.

> There are no US banks that implement Chip & PIN

Not true - BarclayCard Arrival/Arrival+ do. However, they prioritize signature first. They can be used at automated kiosks that require PINs, though.

Isn't Barclay/BarclayCard (arguably) not a US bank though?

They have a US office and offer cards to US residents. That's all that matters.

An increasing number of terminals now reject the swipe, with the screen stating something like "this card has a chip, please insert and wait". Cashiers are starting to ask, before you swipe, "does your card have a chip?" I even used a terminal yesterday where, after inserting the card, it asked me to identify whether my card was a "Citibank Card" or "Visa Debit Card" (ambiguous, since the card was a Citibank card with a Visa logo). The implementation of this chip rollout in the US is a mess.

The selection was because your card had multiple AID's on it. Some terminals still need some work, and sometimes configuration, to handle AID selection properly. The US Common Debit AID is still not widely supported, which is why many grocery stores still haven't rolled out Chip & PIN support - they don't want to pay the credit card interchange fees because their merchant or terminals don't support the debit AID.

So yes, the chip rollout here in the states is a giant clusterfuck for the time being. It will get better soon, once the hodgepodge of banks and hardware vendors get everything straightened out.

What about the October 2015 liability shift? If grocery stores "still haven't rolled out Chip & PIN support", then they face liability for counterfeit and lost or stolen cards. Issuers can conditionally allow fallback transactions [1], do you know if issuers are generally denying fallback transactions? Is the prompt "this card has a chip, please insert and wait" for a swipe on a card with a chip due to the merchant's policy to avoid the liability shift, or is it due to the issuer denying fallback?

[1] http://www.emv-connection.com/downloads/2015/05/EMF-Liabilit...

The liability shift only matters if the potential loss outweighs the cost of running all transactions as credit until your issuing bank and hardware support the US Common Debit AID is greater than the potential fraud liability.

For a grocery store <1% per transaction and 3% per transaction is a pretty huge difference, one of my local stores that only takes debit cards still doesn't support chip cards because of the madness with the US Common Debit AID preventing them from enabling the EMV support on their terminals.

There is an attack on chip-and-PIN cards when the ATM system hasn't been upgraded to chip cards. The problem is that the PIN for chip-and-PIN is same as for ATM withdrawals. The terminal also gets enough information from chip cards to clone the magnetic strip. The result is that compromised terminal can produce cloned cards that can be used to withdraw cash from ATMs.

I had one from Wells Fargo and was pretty sad when my new card didn't have it. I used to love to pay for things without taking my card out of my wallet.

That doesn't make sense, adding the contactless facility mustn't cost more than pennies. As a store owner contactless saves a lot of friction and time at check out. Once the transaction is processed on the terminal surely the whole system upstream is identical.

Nobody here has mentioned the Merchant Category Codes, which is what governs the max amount before a transaction is required to have sig or PIN. I'm sure it varies by country too, but I only have experience with the US system.

Edit:https://en.wikipedia.org/wiki/Merchant_category_code

Yep. I worked for a company that "did" debit/credit card handling at the point of sale ( not clearing ) and the Smart Card guys were right down the hall. This around 1989-1995. The Smart Card guys mostly sold to Europe. It hasn't much caught on here, and I'd say that's mainly due to inertia.

> In the UK nearly all cards can be used for contactless payments below a fixed amount (£ 30 at the moment).

This sounds really interesting.

I've had chip cards in the U.S. for a couple years, but I've never seen someone use a contactless payment card here. Even tap to pay with phone is very uncommon.

Haha, I've done the opposite. I found it was too easy to spend money, that I was doing so without thinking as much of it as I would have in the past. I've gone back to cash as a form of self control

Reply on news.ycombinator.com