Comment by Mister_Snuggles | Hacker News Reader

Comment by Mister_Snuggles | Hacker News Reader

Parent Full thread

Mister_Snuggles

Chip & Pin is an interesting beast.

Canada went straight to Chip & Pin, skipping over Chip & Sign. Since credit cards generally didn't have PINs at the time, there was a little work on the part of the issuing banks to assign PINs. One of my cards came with a letter that said "Use the same PIN as you use with your regular bank card", another came with one that said "Here's your new PIN, you can change it at any of our ATMs" (I only have a credit card with this bank). This all happened over 10 years ago.

When I visited the US recently, I used one of my cards and the cashier said "Oh, you're from Canada, you have to enter a PIN" after inserting it into the payment terminal. A payment at Walmart was even easier as the terminal was customer-facing, it worked just like it does in Canada - insert card, verify amount, enter PIN, done.

Clearly the infrastructure is in place, since the transactions all worked, but there seems to be some strange reluctance for the card issuers to actually use it.

Chip + Sign reduces 80% of classic fraud. Chip + PIN reduces ~98% (last I heard in 2016).

Someone I spoke to at capital one said that Visa/MS decided to do Chip+Sign in the US due to the increased support costs of forgotten PINs.

Also people in US are in the habit of handing their card over to family members to use, which works with signature because the POS operator never checks the signature, but won't work with PIN because PINs are supposed to be super-secret. Hence requiring PIN would reduce the spend on credit cards (no lending and spending), hence fewer smaller boats for credit card executives.

Huh? Someone trusts their family member to spend responsibly with their credit card, and is happy for that person to forge their signature, but wouldn't tell them the PIN code because it's "supposed to be super-secret"? That doesn't make sense to me.

I agree with you. I think it's more likely that people would forget somebody else's PIN more easily.

Should have explained the logic better: it is the banks that have taken the decision not to use PINs (partly) because they do not want to get into a position where they both tell people never to reveal their PINs, but also tacitly condone card sharing that implies PIN-sharing.

I'd be interested to know how much of a problem this is in Canada.

Maybe it's different here because debit cards are so common that we've been trained to remember our PINs. My bank even uses Chip & PIN as the first step for an in-person transaction at a teller.

> My bank even uses Chip & PIN as the first step for an in-person transaction at a teller.

Some banks do that here in the US as well, as do retailers. Those are both for debit card transactions, though.

But fraud is up. Chip & Pin has just motivated them to use online methods. Or load other pay to load cards without a chip.

The card issuers are afraid people will forget their PIN, since most people have only one ATM card but multiple credit cards. And if one CC provider requires a PIN, but another one doesn't, then the customer will put the card back in their wallet and pull out another card. Or they will not switch between cards, and consolidate to only one card (whereas a lot of people pull out a credit card at random, apparently).

Personally, I cannot remember PINs. At all. That means I can never use debit cards. If chip and pin were a thing, I guess I would have to get a tattoo or something.

It's a per-card setting. Issuers here in the UK default to PIN for both credit and debit, but both are available with signature for those who need it.

It's a four digit number! How hard can they be? Set it to something memorable. Even something "insecure" like a memorable date is more secure than a signature.

If two letters of my credit card signature are distinguishable, that means I was focusing hard on it. It's basically just a squiggle.

How often do they even check it though? And of those times, how often would they refuse it? I know that pre-chip and PIN in the UK I had a card for years where the signature strip had been rubbed off, and I was never challenged on it. When I've visited the US they've also very rarely checked.

I've been using credit cards without ever signing them for about a decade, and have been questioned zero times about it.

That worked up until I was required to change it the first time, or until I was assigned a PIN.

I definitely had chip and sign for a few months in Canada before they added a pin to my card. Circa 2011.

Reply on news.ycombinator.com