Hacker News Reader

Comment by Brushfire | Hacker News Reader

I'm curious if they are also logging the zip code entered via keypad. I can't remember the last time I used a pump without zip code validation.

View on HN

As a foreigner who travels to the US on occasion - and therefore doesn't actually have an US zip code - what's up with that? If you have a keypad installed anyway, then why the hell not accept the chip reader with pin code? Not complaining or anything, but it's quite baffling. Nowhere else in the world that I've seen, they don't restrict payments to locals....

Try using a pump in Israel. I had to ask for help every time. Not only is Israel still using mag stripe, there's also some sort of national ID # you have to enter into the pump. And the license plate # too I think. I think tourists are supposed to be able to use all 0, but I couldn't navigate it.

This is from 2012 but seems pretty close to what I dealt with there last year: https://www.tripadvisor.com/ShowTopic-g293977-i1733-k5730382...

Which is to say: every country has its weird thing. :-)

In Australia, we have this weird thing where you pump the fuel then walk into the shop to pay. It's just a ruse to get you to buy energy drinks and two chocolate bars.

It used to be like that here in Denmark, but due to a rash of fuel thefts, now it's all pre-pay at the pump.

It was so odd going to Germany last month, and actually being able to pump and then pay in the shop afterwards.

In New Jersey (and I think Oregon), you can't pump your own gas. Full service only.

Years ago (this predated energy drinks by a couple decades) I filled up at a rural station in GA that had old mechanical pumps. I went inside to pay, having not taken note of the cost. When the cashier asked me how much I'd purchased and I told him I'd have to go check, he waved me off and pulled out a pair of binoculars to read the charge off the pump.

I like to think now he foresaw the coming age of skimmers and wanted his pumps to remain immune.

That's how it was in the US about 15+ years ago (in Oklahoma at least). I don't think there was any kind of law about it, it's just how it was done. You pumped, then when inside to pay. Occasionally, you'd come across a gas station in a bad area, and they had a sign to pay inside before you pumped (due to people pumping and then speeding off).

Nearly all US card issuers don't do chip&pin, it's chip&signature (yes, useless, I know). So the gas stations have little incentive to upgrade since there's nothing to sign. Another poster on this thread suggests that non-EMV chip transactions (which are the vast majority in the US right now) aren't any more secure than a mag strip swipe, so there's not much of a benefit.

I'm not sure, but I'd expect that if you don't have a US zip code you can just go inside and use your card with the cashier.

Yes, absolutely you can go inside and pay, the annoying part there is that you have to guess how big the tank on the rental car is, especially when returning it full.

First world problems, yes :)

I don't get it. If you want to return it full, just fill it up.

You must pay prior to filling up in the US.

So say you're going to pump $100 worth of fuel, and stop when the tank is full? You'll only be charged for what you pump.

Didn't work that way for me - last time I was filling up, I did pay a bit more before than fit into the tank and checked the bank account later - got charged for the full amount.

That's weird, they should just put a hold on for the amount you entered and then charge the actual amount pumped. Sometimes the holds appear as charges? Did you get a refund later?

Ah, that makes sense. Is this the case everywhere in the US?

Pay with cash, pump, then go inside to collect your change. That’s what I’d do. And if you prepay inside with your card, you still should be able to go inside for change.

Thanks, I'll try that.

They don't restrict payments to locals. Usually if you don't have a zip code the machine accepts 00000. I've been to a couple gas stations that explained how to enter your postal code if you are Canadian (with letters substitution, I think I've only seen 0s for letters. So if your Canadian postal cost is ABC 123 then you enter 000123). If the machine is set to deny all cards without a zip code you can always pay for your gas INSIDE as the card terminals inside are "normal."

The zip code is to prevent criminals from stealing gas (via vendor fraud chargeback) via a card stolen elsewhere, not to prevent criminals from stealing cards at the gas station.

I wonder if they use the stolen cards to steal gas from other stations, that eventually by and large gets sold back to stations from what I have read.

The real reason for requiring zip code entry is a lower interchange fee for the station. If they didnt get a lower interchange fee they wouldnt care at all. It is also the only identity verification information that can be entered on a 10 key pad.

It might be the case that enough of the zip codes are the same as where the pump is located or a few adjoining areas that trial and error would work well enough.

I don't believe the most common skimmer has access to this, but the prevalence of required zip code with other transactions is so low it doesn't matter.

Most frequently required: 1. Card no. 2. Expiration 3. CVV 4. Full name 5. Zip code (or address)

But plenty of transactions will be fulfilled with just #1 and #2.

Used one without zip verification the other day in Los Angeles.

Before I started pumping my gas someone walked up and offered me $25 in gas for $15 in cash.

From the write-up, it sounds like these were just grabbing the card data. Where I live most pumps do ask for zip code but a non-negligble number don't.

Why haven't gas pumps converted to chip cards?

In many areas the zip code associated with the cards will likely be one of only 1-3 choices, particularly if the gas station isn't on a through road.

Reply on news.ycombinator.com