Testing the Limits of Credit Card Signatures (Part 1) | Hacker News Reader

Testing the Limits of Credit Card Signatures (Part 1)

zug.com

48 pointschaosmachine36 comments

The trouble is that most of these "pranks" boil down to testing the attention of service-level employees of corporations. They don't give a shit, and shouldn't, given the realities of filling as many orders as possible during a shift.

Signature is only required when a compliance process has begun. So, for example, when you check your transactions and see one that you can't recognize then you call your bank and object that trx. In that moment the bank ask for the physical documents and may check your signature, but it depends on the rules of your card operator (Visa, MasterCard, Amex).

But that opens up an obvious scam:

1. Buy something with your credit card

2. Sign with a false name

3. Contest the charge

4. Get a refund--keep the merchandise.

There are lots of soft was to scam the system. The question is are you that type of person? Is that the life you pick? Running small scams hoping you won't get caught. Focus your energy on building something useful. You've already completed step one of that process "read hacker news."

Don't worry--having the mindset and creativity to think of ways to break the system aren't always bundled with the inclination to actually do them. I have better ways of applying my creativity. I suspect I just have what Schneier calls a "security mindset": http://www.schneier.com/blog/archives/2008/03/the_security_m...

Be sure not to miss part 2, where the author takes things to the next level...

http://www.zug.com/pranks/credit_card/

That ended up being kinda mean to that Circuit City salesman. He probably thought he was making the sale of his life.

Its more like testing the limits of the "next" button (since the article is broken down into 5-6 pages).

It's because the signatures aren't used as a security system in the first world. Here in South America i get checks and credit card receipts rejected on a pretty regular basis because my signature is slightly off. By which i mean, i didn't make the curve of the P the same way. Believe me, i prefer they didn't check.

When i complain, they offer to let me put each variation of my signature on file, so i could have several which pass the test.

I was all set to agree with you, but then I looked up VISA's Merchant Agreement online [pdf]: http://usa.visa.com/download/merchants/rules_for_visa_mercha...

I was surprised to see on page 28 that it is considered a security feature.

I've had a number of transactions and credit card applications rejected in Switzerland because my signatures didn't match. Not sure if Switzerland qualifies as "first world", on that basis.

I've done stuff like this - just made a smiley face on the sign line. Never had a problem with it. It's funny though, occasionally at a very official place I've had a staff member say my real signature that matches all my ID is too messy and ask me to write down my name beneath it in print. That happened to me at at least one or two consulates over the last few years when applying for visas.

Also, I remember one time a friend got a 250 euro ticket driving through Austria, and I thought it was nonsense. He was speeding sure, but I think they inflated it by more than it was, and they said he had to pay on the spot or they wouldn't let him go. If I was in that spot, I think I'd write "Coerced Void" in artful cursive on the receipt and protest it later with the credit card company.

Anything under $25 no longer requires a signature anyways. I suspect that number will just keep getting larger.

All my credit cards are disabled the instant I take them out of my normal buying pattern, and even RedBox makes me enter my zipcode to rent a $1. movie on the CC, so there are clearly more effective mechanisms to preventing fraud than signature verification.

Most cashiers hand my card back to me with the receipt to sign, and can't verify my signature. But many stores are now switching to using a PIN with chip cards, at least here in Canada. And Europe's had chip cards forever now. In fact, some places there no longer even have machines to read a magnetic stripe.

Chip and PIN cards work pretty well (and yes I do know they have vulnerabilities) - I only use cash once or twice a month.

I actually can't remember the last time I used a credit/debit card and actually signed for something - that would seem rather quaint these days.

Chip & Pin has been a major headache for me...I'm living in the UK for a year and neither one of my Canadian CC's have chip and pin. On numerous occasions cashiers have to call management to find out if they're even allowed to accept my credit card....I just carry cash now.

Surely the answer to that is to set up a UK bank account and use a debit card (I make most payments with a debit card).

I am self employed and according to the banks I spoke to I am not staying in the UK long enough for them to give me an account.

It's become rather difficult to set up UK personal bank accounts, thanks to the "know your customer" anti-terrorist regulations. Plus, UK retail banks offer uniformly terrible customer service by international standards (I've experienced three UK banks). Using offshore credit cards has long been a common choice.

What's the advantage of chip + PIN over stripe + PIN?

In the first full year after chip & pin became mandatory in the UK card fraud in stores dropped by 47%. While retailers can still accept signatures, if they do so they are not guaranteed the funds. Before the change, if the signature matched then they got the funds regardless. Now the only way to be sure you get paid is to accept PIN authorised transactions.

What this article doesn't say is that a lot of stores ask for ID when paying by card... something that always surprises me; this NEVER happens at home.

It is much more difficult to clone a chip card than a magnetic one.

I have drawing a straight line for all my CC transactions for the past two years and no one has bothered about it.

I think this will automatically phase out automatically with new technologies like RFID...

In most cases the only time a signature gets looked at is if someone is contesting a charge. The CC processor would ask the store for a record showing that they actually made a purchase.

In the end, signatures are really there to protect the store not you. It's in their best interest to have you sign with your actual signature. If you signed as Donald Duck and then contested the charge they'd probably have a hard time proving it was you and they'd lose money.

While I was working in a supermarket on the till I once contested a signature. This women's signature didn't match the one on the back of the card one bit. So I said "Can you sign that again please", and she did, but it still didn't match. Then I said "these signatures don't match at all" and she got all shirty with me, at which point I decided I wasn't being paid enough to care and just put it through anyway.

Just the other day I went out and bought gas at a gas station for my friend's bike, with his credit card and his cell phone in my pocket. (He got his licence the next day)

The scanner didn't work so I had to go to the counter, and had to fake a signature. Nobody even batted an eye. It was exhilarating, and unnerving at the same time...

Maybe I should just chalk it up to my mind-busting ability to play it cool?

(just kidding about that last bit!)

The Lowes self checkout is annoying because you have to switch back and forth from the touch screan to the credit card pad thing several times, so by the time it wants me to sign, I just write something vulgar. It's never been a problem.

IANAL, but legally, any mark you make with the intent of signing is a signature. I guess you could claim after the fact that it wasn't you who signed the receipt, though...

We're working on fixing this issue. Fortunately, I think our system works better.

http://www.facecash.com

Your site looks gorgeous, but I think your tagline and copy could use some serious work. After I read "The future of payments has arrived" I had no idea what your product does, and you failed my 5 second filter. Since I wanted to maybe suggest an alternative, though, I spent some more time to figure out what you product does by reading the bottom. I still couldn't figure out what your product does. Does this thing link my face with my credit card somehow? Why on earth would I share banking details with you if I have no idea what the benefit will be. Why no about page, at least?

Thanks for the feedback. We were hoping that people would be intrigued by the photo of the product (the same image where you read the tagline), and then click on one of the links below (https://www.thinklink.com/index.html?more=1), but you're right that it's not clear enough. We'll work on it.

For the record, what it is: a pre-funded alternative payment system that uses your phone, a barcode, and your face to eliminate the need for a plastic card at the point of sale. Hence no crazy signature problems.

Ah OK, I didn't see those. I think a horizontal nav with About, Signup, etc. would do wonders, at least for those that expect an about page. A more explanatory tagline would help too, though. Thanks for the clarification.

How do you all plan to get around the very high hurdle of getting high penetration of point of sale systems that are compatible and can show a picture of someone's face? There're a lot of legacy systems out there... Don't mean to bust your chops, just curious. Could do phone-based required authorization instead, which would at least remove the picture requirement?

I've often tested the limits of credit card signatures to the point that I now regularly pose as several Disney cartoon characters.

forget credit cards, my name has been misspelled on my driver's license since i can remember, spanning 2 states and 1 decade. I've never been asked about it. Not when i bought my house or started a business or opened credit... no one cares.

Signing a credit card receipt is not for signature verification. You are signing a contract that you agree to pay under the terms of your card agreement. Therefore, it doesn't matter how you sign as long as it was you. If you sign a multimillion dollar recording contract with a smiley face, you are still agreeing to the terms of the contract. Your signature doesn't have to match anything.

If signatures were for verification, then they wouldn't have you sign the back. That would be like writing your login on post-it note stuck to your computer.

Reply on news.ycombinator.com