Hacker News Reader

Comment by nstj | Hacker News Reader

You might want to qualify this with “in the US” as chip+pin cards are pretty fast in other countries by comparison.

Also there was a great episode of the podcast “Planet Money” a while back which goes into detail on your question [0]:

> Today on the show, we bring you a brief history of what's in your pocket. It's a story of convenience vs. fraud—and it also includes a hippie inventor, the origin of the last great upgrade on your card, the magnetic stripe, and why it takes so long to "dip the chip."

[0]: http://www.npr.org/sections/money/2016/04/13/474135422/episo...

View on HN

Thanks! And correct - should have added "in the US" in te title. Just got back from a trip, and am always reminded how archaic USA banking feels compared to most other countries' systems. With the recent industry switch to chip in the US, I'd hope transactions would be faster and easiee - but the implementation seems terrible: confusing POS interfaces, slow chip reading, still need to sign / no PIN, rarely any "bring the mobile POS to your restaurant table" requires still waiting on the waiter for 5min, etc.

Sure. And that's one of the problems with being first to infrastructure. It's really hard to just "change it all" once something new and better takes hold. It'll get better, even if it's not that great right now. Though, I largely take issue with your statement that U.S. banking feels archaic. I'd say U.S. banking is, if nothing else, generally at the forefront of digital technology despite heavy regulation. (I'm not arguing regulation bad/good, but it is a fact that the industry is heavily regulated).

  I'd say U.S. banking is, if nothing else, generally at the forefront of digital technology despite heavy regulation

I wouldn't call checks, which are still widely used in the US the forefront of digital technolgy.

I think it must have been more than 10 years ago since I've seen my last check and that was an Amex Traveller Cheque

You can be at the forefront and still support older stuff.

Considering how long it took chip and pin to become predominant (which is to say still not 100%) I would say US banking is pretty behind most of the world.

Excellent point. I've never encountered chip and pin in practice in the US, rather chip and signature.

All of my debit card POS uses in NYC have been chip+pin for several months.

Yeah so supporting checks doesn't really mean you're not at the forefront of technology. If anything, the fact that US banks allow people to take pictures of checks, and have done so for like the last 5 years at least, is an example of the kind of innovation seen in the US banking system.

I actually have to write checks regularly to pay my utility bills, or I have to pay a $2.00 convenience fee to have the transaction processed by a third-party hired by the state. Not to mention, I randomly receive checks in the mail from events I speak at or for travel reimbursement or university reimbursement or the like. I love that I can snap a picture and wham my check is deposited.

Not to mention things like Apple Pay, which, without support, configuration, and advice from the banking industry wouldn't be a thing. Naturally they created the technology for the phone, but banks do the rest. How is that not innovation?

> I actually have to write checks regularly to pay my utility bills, or I have to pay a $2.00 convenience fee to have the transaction processed by a third-party hired by the state.

This is exactly why US payment systems are not at the forefront of technology.. whether one can snap a picture and use OCR or not is irrelevant (the phrase "like lipstick on a pig" comes to mind)

That is because of government regulations and infrastructure, not because banks are not technologically advanced. I can easily use something like, say, Chase's QuickPay to pay any recipient. The government just won't accept that form of payment. That has absolutely nothing to do with financial technology. The technology exists and is in use, the government just doesn't use it. I also can't use Apple Pay/Google Pay with the government. Does that mean that Apple/Google aren't technologically advanced? No. It means the government isn't.

It has little to do with the government. I dare say the vast major of US small and even some medium businesses are like this. I still have to write a rent check to my rental company every month, because otherwise I'd have to shell out an additional $30 every month for the privilege of paying through their website.

First, you have a bunch of for-profit fiefdoms with mutually incompatible payment technologies all trying to own it all, refusing to adopt standards. No government should support non-standard payment systems, whereby they have to support all of them, and the on-going support and development baggage that entails.

Second, they lobby to prevent the proper funding of a fast federal payment transaction system, i.e. making the necessary improvements so EFT can take minutes instead of days. They don't want that to be fast or free because it then obliterates their business models if anyone can just plug into that standardized system. Other governments have done this and that's why they have faster in-country payments (and often even in the Eurozone), despite their "regulations and infrastructure" such as they are.

Your example of QuickPay takes 4-5 days to/from a non-Chase account. That's dog slow, no matter the reason, compared to same country transfers in almost any other industrialized country. I can't think of a slower country off hand.

U.S. banks are overwhelmingly using Windows XP as their OS of choice in ATMs, still today. The height of technological achievement!

The open source world has created an alternative system which works extremely well, lacking mostly in usability factors, which could be resolved pretty quickly...but proprietary networks are entrenched quite deeply, so it will be a while before we can use digital cash - probably legislative action will be required, or a mass rebellion against the costs imposed by the payment networks. Sadly, retailers can't seem to think that far ahead.

Hmm not sure if if that's serious or a subtle satire on the complexity of backwards compatibility...

But it seems like the EU method of requiring a systematic API access to your banking and being able to send direct payments for all of those things above (minus the 'convenience fee' I think) would be nicer...

> And that's one of the problems with being first to infrastructure

Is this really true? I thought the US only started getting chip and PIN about 4 or 5 years ago?

Most US credit cards are chip and sign (debit uses a pin, but did before chip cards as well). Occasionally I'll see a transaction where the pos wants a pin and the user has no idea what pin because they have never used a pin with that account.

The US had mag stripes in widespread use first. We are looking at 20 or 30 years ago: most of the rest of the world caught up long ago, but they caught up after the problems with mag stripes were known and so the rest of the world built infrastructure to attempt to fix the now known problems.

Note too that the US has a legal limit of $50 if your card is stolen. As such to the consumer there is no incentive to care about security. Other countries don't have that protection and so consumers rightly refused to take a change until things were more secure. All that security comes at a cost, one consumers cannot afford to gamble on, but to a larger business can call cost of doing business and weigh against the cost of upgrading security.

Other countries have the sort of limits. The banks and processors just storing armed vendors into emv using lower ratesas the carrot and legal requir,nets as the stick.

The US was one of the last countries to get Chip + PIN, and even then they messed it up, and got chip + sign.

90% of the places I use a card in seem to be still swiping the cards, while we have had full chip + PIN implementation here (Ireland) since at least 2005 or 2006.

I don't want pin. I have half a dozen credit/debit cards in my pocket (the card I use for almost everything, my backup card just in case the first is lost, my HSA card, my company card, a debit card, and the store care for a store I shop at often) there are another half a dozen that the issuers want me to carry but are not worth the space they take up. I cannot mentally manage that many different pins.

verification comes in 3 parts: something you carry (card), something you know (card number, pin), something you are (your signature, fingerprint). Generally you need two. However since the card number is memorable (hard but possible) the pin is no additional security.

Signature isn't something you are, it's not in any of those three categories, it's closer to your address.

Chip + pin = Something you carry (card/chip) + something you know (pin). You need the physical card to use it, card number isn't sufficient.

Signature is also not something "you are" - it is an easily faked thing, that is basically never actually verified.

PINs can be changed, so if you came up with a way of memorising them, its easy.

You also don't need PINs for things like loyalty / membership cards traditionally - just for payment cards.

I don't use my PIN either, for a different reason.

I force them to process it as a credit card because I get the consumer protections of the CC processing agreements. If I use my PIN, it's more like an ATM transaction.

Chip and PIN credit card transactions are still credit card transactions everywhere else, with all of the attendant protections.

Which law applies to the transaction is what the card account is; not the transaction. TILA applies to credit cards, and EFTA applies to debit cards.

Whether you're costing the merchant more money with higher fees for credit transactions, or if this gets normalized to a debit transaction later on, I'm not sure. But either way it's ridiculous to "force" a credit card transaction on the merchant.

> either way it's ridiculous to "force" a credit card transaction on the merchant.

I do it more often because of the number of times I've been screwed by trying to use debit mode and end up with a non-functional gas pump or forced to reswipe with the mag stripe because they only support credit transactions from the chip.

Even though the different transactions on a debit card may have the same legal status by law, banks typically apply "zero liability" to transactions processed by Visa/MasterCard, while holding users accountable for fraudulent debit transactions processed by ATM networks, up to $50 if you report within 2 days, then $500 within 60 days, and then unlimited customer liability after that.

This! Precisely this!

There is no benefit to me to go with a debit transaction and the risk of significant liability if there is a data breach. So, I don't do debit transactions.

> I cannot mentally manage that many different pins.

Pick 4 digits on the card, multiply/add them by some constant number you know. You're now done 'memorizing'.

Don't simple mnemonics have a risk of helping to reduce the search space to guess a pin?

We're talking about a 4-digit search space. The system already needs (and presumably already has) extreme rate-limiting measures.

Signatures are not in the category, "something you are."

This is b.s. for numerous reasons:

- You can have the PIN reset for all of those cards so that they all match, (or better we should be using PK based push notifications to a smart phone app; plug in the card, and you get a push notification to deny/allow on your phone, instead of entering in a PIN.)

- Signatures aren't even verified the vast majority of transactions. They only come into play if you catch fraud and report it. So it's used after the fact, not in advance.

- Signatures are predicated on pen on paper on a flat writing surface perpendicular to gravity. Your signature is not at all the same to a handwriting expert if you change any of those things, and in particular the digital capture of signatures is complete utter bullcrap: no angular, or pressure information is captured. We should just use smiley faces on all such POS systems, in lieu of even attempting a signature (it is in fact what I do).

Digital signatures are Tonka Toys. They are nothing like a finger print.

Chip+pin isn't the sole marker of innovation. Anyway, as I said, if you build out an entire infrastructure based on a different way of doing things, you can't just up and change that over night. It takes time. It costs money. There are associated opportunity costs, etc....

Sure - but the rest of the world had the same assumptions, (and infrastructure) and we managed to do it.

Chip and PIN is not the sole marker, but it is the most obvious one, which is why people use it as a benchmark.

It's an obvious one, which indicates a superficial understanding of the financial industry and technology in particular. Credit cards, and their use, was from the outset largely an American phenomenon. When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin.

But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform.

When will Europe catch up with banking technology?

> When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin.

It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005

> But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform.

Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US).

What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.

> It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005

Sure, but it was far more widespread in the United States. Even now, to this day, there are businesses all over Europe (I just did an 11-country tour not long ago) that simply don't take credit cards. In the United States, even student organizations take credit cards for selling things like shirts. Europeans haven't been using credit and debit cards like Americans have, and so even though similar infrastructure has existed, it hasn't existed to the same extent as it has in the United States. It follows that retooling the infrastructure costs significantly more in the United States, as every "swipe machine" had to be replaced with a machine that accepted a chip. Everything from drive-up ATMs to Square, to gasoline pumps have to be replaced. At this point we're kind of conflating technology with economics and market dynamics, but it's worth pointing out that it's not a lack of technology that made the US swipe-only for so long, but market forces. If, it cost me less money to deal with swipe fraud than it does to replace all of my credit card machines... what do you think a business would do?

> Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US).

How do you arrive at this conclusion? I don't recall being able to use contactless payments anywhere in Italy, for example. Not that it doesn't exist, but my impression from visiting Europe and living in the United States has been that contactless payments are far more ubiquitous in the States than the countries I've visited in Europe.

> What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.

Scale. Blockchain. Products. Payments.

What are your thoughts?

I have been using contactless payments for years here, and the 4 other EU countries I have been in this year, all accepted contactless. You may not have been able to use a US contactless card, but people do use it. It is also worth noting that each country in Europe has a different culture and history, which inform the choices people make with banks, and particularly credit cards.

Scale - sure, the US is larger than any of the EU countries population wise - but not sure how that is "innovation".

Blockchain - work on blockchain tech is global - American companies even export the R&D to EU countries ;)

Products + Payments - there is nothing ground breaking in the US, that is not in the rest of the world

I find most European cities are cashless, and accept MasterCard and Visa as well as the local country issuer for payments, attached to a local bank account.

You might have been running into the fact credit cards have much higher merchant fees, even if it's probably a violation of their EMV merchant agreement to refuse to accept these cards.

I see zero meaningful advancement of payments in the U.S. over Europe, to the contrary. There are more cash only restaurants in the U.S. especially if you're not in a big city, it's quite common. I think your opinion is based on a very limited experience across the U.S. and Europe.

And EFT payments in the U.S. are incredibly slow compared to their European counterparts. The fastest bank to bank transfer is Fedfunds wire, and that costs money, upwards of $30 for each party. It's cheap or free in Scandanavian and European cities.

I really have no idea what you're talking about when it comes to American innovation in this area... I see it as yet another example of American pay more to get less sort of classist mantra. Oh but if you have more money, and pay more fees, agree to give away more personal data in the EULA, you can get better services!

It's almost like you've never even been to Europe, and all you shop at in the U.S. is McDonald's, Chipotle and Starbucks.

For around a decade, many cities, example Prague, have accepted text message based payments for public transit. Today most public transit systems have their own apps for payment and ticketing. I can't think of a single U.S. city that does this. They're all exact change only or proprietary ticketing systems.

About the most advanced I can recall, Citi had a short lived tap and pay, NFC based, project in the NYC subway 10 years ago. You still got the 10% metrocard discount. It was ultra proprietary though, Citi cards only.

And then Citi and Amex went and ripped NFC out of all my credit cards for this slow EMV chip. Haha yeah, when will Europe catch up. What we did is catch up with their 3 decade old chip idea.

> I can't think of a single U.S. city that does this. They're all exact change only or proprietary ticketing systems

MBTA in Boston had the mTicket app for mobile ticketing and payments for years. I live in Boston and use the app regularly. Can't comment on other cities because when I visit for a short trip I typically don't bother installing apps.

Amtrak and most airlines use mobile boarding passes too. Interestingly enough, on my recent trip to Europe I used the mobile boarding pass in Logan airport just like everyone else. But in Frankfurt when I showed my phone to the agent they looked at me like I was from another planet, probably thinking "stipid americans"

And while we're on the subject of transportation, about 5 years ago I visited a bunch of european countries, including my home country in Europe, and at that time the only way to call a cab was via dialing the local phone number, cash only of course. Funny because on that trip heading to the airport in the States was matter of acouple taps in the Uber app.

The infrastructure in the US seems to support Chip+PIN just fine, it seems to be that the card issuers don't want to issue cards with PINs.

When I last visited the US, my Canadian credit card worked just like it does in Canada. Insert into the machine, verify the amount, enter my PIN, done.

Yeah - my EU cards can use a PIN in some machines in the US now.

That's right. It is basically a flag on the account, which ends up as a notification at the POS system. So you get this hilarious crap with a U.S. card outside the U.S. where you're still signing shit, because the POS system tells them you have to sign. I lost count of the various reactions when traveling outside the U.S.:

- Why is it printing extra receipts? Oh... you have to sign one of these.

- Hold on, let me go find a pen for you to sign.

- Asks coworker what this message means. Oh he has to sign, must be an American.

And get this shit. My debit card in the U.S.? I always use a PIN for it everywhere. But when I travel outside the U.S. that same goddamn card requires a signature every damn time.

It's really fucking stupid, there's no nice way to put it.

Since chip-and-pin seems to be used as an excuse to push liability for fraud onto the cardholder, I'd much rather stick with chip-and-signature. If we could have chip-and-pin while still keeping me at zero liability for fraud, I'd take it.

Why do you think they messed it up?

Chip+sign is a solution to a real market problem with chip+PIN in the US: the the typical consumer has many credit cards. https://www.quora.com/What-is-the-median-number-of-credit-ca... claims an average, not median, of 3.5 per cardholder, and that matches the numbers at http://www.creditcards.com/credit-card-news/ownership-statis... . Heavy credit card users have a lot more: it's common for stores to have store-brand cards that give you a discount at that store, so a number of people end up with a dozen different cards for stores they commonly shop at.

Expecting people to remember this many different PINs is not realistic. So every card issuer was worried that users would just stop using their card because they could not remember the PIN. This is the problem chip+sign is meant to solve.

In other countries, patterns of credit card use are quite different. http://www.theukcardsassociation.org.uk/wm_documents/UK%20Ca... page 6 claims an average of 2 cards for the UK, for example. So the "can't remember the PIN" problem was not as big a deal.

Just set all your pins to be the same

That's assuming the issuer allows you to set the PIN. In many cases they do not, in my experience with both debit cards and chip+PIN cards (the one chip+PIN card I have in fact does not allow that).

This is in the US, with the broken Chip + PIN implementation.

I can go to pretty much any ATM in the EU and change the PIN on all of my cards.

Yes, I'm aware of that. I can't tell you why that difference exists, but it does.

USA still hasn't adopted the faster payment model of same-day payments between the banks (without charge). Compare that to the UK which most payment transactions are completed within 4 hours

> within 4 hours

It's usually quoted as hours, but in practice is often 'instant.' More info: https://en.wikipedia.org/wiki/Faster_Payments_Service

US is archaic in many ways too: the necessity for paper checks in many situations (and still having to pay for them in many banks), no contactless payment cards, the aforementioned dire signature/chip situation... It's certainly anything but at the 'forefront of digital technology.' Not to mention fees. Fees everywhere! The effort it takes to avoid meaningless 'gotcha' fees is just insane -- and must surely stifle innovation too, in creating friction against change.

> I'd say U.S. banking is, if nothing else, generally at the forefront of digital technology despite heavy regulation.

Transferring money with ACH takes multiple business days, this is not at the forefront of digital technology.

One example of an inefficiency (especially without any reasoning behind why this inefficiency is happening) doesn't mean much.

First, most ACH transactions clear in the same day [0]. Second, that's also completely ignoring newer networks like clearXchange / Zelle, which clears in minutes [1].

[0] https://www.nacha.org/news/what-ach-quick-facts-about-automa...

"Specifically, the NACHA Operating Rules require that ACH credits settle in one to two business days and ACH debits settle on the next business day. Recent enhancements to the NACHA Operating Rules now enable same-day settlement of virtually all ACH transactions."

[1] https://en.wikipedia.org/wiki/ClearXchange

I'm glad you added that. In the UK chip and pin machines are fastest using the Ethernet connection, much slower on the phone line. One advantage of the phone connection however is reduced PCI requirements. SAQ B is simpler than SAQ B-IP

In the UK, the older generation of readers are pretty slow. The newer models are pretty fast, I'm not sure if it's also because they have reliable broadband connections but they basically ask you to remove the card almost as soon as you insert it.

The ones that use GPRS can also be _fairly_ fast, though it introduces a couple of seconds of unavoidable latency. They're not long for this world, though; some countries are already shutting down GPRS networks.

The really slow ones just used dial-up. They mostly seem to be gone now.

We have the same console as I've seen in Tesco petrol station. Ours take a lot longer for auth, I'm guessing that Tesco have a local stopped card list to check against and don't do a full auth with the bank in order to save time.

Might be wrong, just my assumption based on contactless payment being almost instantaneous (like that petrol station).

I'm pretty sure that Transport for London do something similar (ie: transactions get batched and then charged at end of day, blacklisting for bad cards).

However, using a contactless chip card is still a lot slower compared to using an Oyster card. Where as the Oyster card seems to process in a matter of milliseconds, the contactless card takes perhaps 2 seconds or more.

With a long queue of people all using contactless, this potentially adds up to quite a significant delay at the ticket gates.

It would help if they had more Oyster readers and/or better situated ones - at one popular station I use, there's two readers, side-by-side, right next to a tiny exit hole. Even just moving those two a couple of metres apart would improve the flow of humans greatly.

Oyster cards are settled between the reader and the card at the time of contact (then the reader will batch the transactions for forwarding later). POS are generally settled on the switch network, obviously this takes a lot longer.

TfL can and do batch contactless transactions, too.

The charge for travel on a given day is not made against your account until early the next morning. And card readers on buses, for example, don't always have a reliable data connection, so must be able to be processed offline.

You might be right that they are authorising in real time on the Tube readers, though. This would explain the poor performance.

Reply on news.ycombinator.com