Hacker News Reader

Comment by watertom | Hacker News Reader

Chips aren't anymore secure, I can read the data off my card with a standard chip reader, and I have. The same data on the chip is on the mag strip.

Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. Why?

Getting EMV certified requires every part of the transaction chain to go through unified system testing, for each combination of hardware, software, card type, processor, issuing bank.

I've been eyeballs deep in this nonsense for the last year or so. We just can't justify the expense of getting EMV certified, so we just accept the chip and do a regular transaction.

As a consumer you have no way of knowing if your transaction is and EMV transaction or just a chip enabled regular transaction.

View on HN

Hi! I have implement a complete payment terminal application with magstripe, chip and contactless capabilities.

I have also designed security protocols to keep the data and keys from the bad guys, including things like Key Injection Facility, loading and exchange protocols, etc.

These things (terminals, cards, HSMs) can be extremely safe. Not only there are protocols available that in my knowledge have never been breached but also the devices themselves are built in secure manner to prevent any physical attacks. The entire infrastructure can be made so that no single employee can get hold of any secret material.

The truth is, that there is a range of solutions and the secure ones cost. It costs to set them up and use correctly. It costs to produce chip card that can dynamically sign and encrypt the data. It is up to the issuer (bank) how much they pay for the security of their card and typically banks are not too eager to overpay. Rather, they take calculated risk.

Another problem is that North America is particularly behind in security standards. I remember, while working on this application (10 years ago) there was much more leniency for US users (issuers, acquirers) than the rest of the world.

Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device.

They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US).

https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...

Let's assume you swiped my card and now you have full contents of my credit card.

For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted.

My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN.

The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines.

The gist of the story is to move to a bank that cares for security.

> The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN.

Forgive my ignorance, but aren't most sellers in America willing to process transactions (even large ones) without PIN entry?

I realize pin-and-chip is a largely secure scheme, but the chip rollout in the US hasn't actually implemented a two-factor system.

Credit card payment organization will hold merchants, acquirers, issuers liable for fraund if the party is lagging behind in security even if it can't be shown directly that the fraud was their fault. This is called liability shift.

http://www.emv-connection.com/best-practices/what-is-the-fra...

The page you linked to says that gas pumps ("Automatic Fuel Dispensers") are exempted from liability shift until October of this year. But that's actually out of date information: the exemption for ATMs has been pushed to October 2017 (from the original date of October 2015), but gas pumps aren't required to go that route until October 2020:

https://usa.visa.com/visa-everywhere/security/emv-at-the-pum...

While I don't doubt they're already out there, I don't recall ever seeing a gas pump in the US with a chip reader.

Also, it's at leas worth noting that technology for skimming chip-based transactions already exists in the wild:

https://krebsonsecurity.com/2017/01/atm-shimmers-target-chip...

The "shimmers" take advantage of poor implementations of the EMV standard, but the chances strike me as fairly high that there's going to be a lot of poor implementations of EMV out there in the wild. (Not only is the less secure "chip and signature" approach common in the US, I've made more than one purchase with what could be described as "chip and nothing": put my card in a chip reader and make a purchase without being asked for either a PIN or a signature.)

There was a presentation at either the latest Black Hat or Defcon (forget which, been watching presentations from both the past few weeks) with a live demo of a really nifty EMV fraud system. Rather than stealing card info, you'd install shimmers in a bunch of ATMs or other such places, then run a system where people could pay for access to the card at a certain location at a certain time. Walk up to the ATM and money comes out. The money comes from an account which (I believe) was being used at the time (or within a few minutes of it) on one of the far-away bugged machines.

Correct - we only have chip, not chip + pin in the US. Sometimes the chip requires a signature and the merchant sets their own threshold.

I think you're correct. I have a credit card from a major bank here and there's no pin associated with it. It does have a chip though.

>up to a floor limit for offline transactions.

Buy stolen CCs without pin in large volume

Set up online merchant account (eBay is common), use software to scrape and copy listings for popular products that cost less than the floor amount but more than your costs. When someone orders a product and the payment clears automatically put in an order for the product on a different website (preferably one that allows a guest checkout). Automate more and more parts of the process as time goes on (e.g. using a different card when one is declined)

Keep the transaction volume low and you're basically printing money at the rate of the difference between card info cost and item cost.

This is a pretty common tactic to monetize large volumes of CC#s.

It doesn't help that most merchants don't cross reference billing address with the bank and some don't require the security code.

Clever, but how do you receive money in that scheme? You need an account under a fake name, right? That seems really hard to get (as it is a prerequisite for all kinds of crimes).

Stolen CC numbers sound like hard things to get in the first place, but they're available online. Fullz (identity-stealing kits w/ SSN and driver license info) and bank drops are similarly available, for a higher fee, as well as aged accounts for many sites.

So the skimmers in the article are pretty basic, but there are more advanced ones that have pin hole cameras to record pins too. You could also mitm the keypad too with another patch line.

Two years ago at defcon, someone presented on advanced skimmers that could read chips too. He claimed they need a network connection to work, as there's only a two minute window to reuse the same token.

> You could also mitm the keypad too with another patch line.

This was noted in the article. There appears to be availability on the board for an extra connection.

it seems like the pin entry has to be associated with the card

> For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted.

Not quite. The one who gets your card info probably won't use it. They will more likely sell it. If the person who buys it can't use it, whoops, too bad.

How do large online purchases work with your card?

what bank?

> Rather, they take calculated risk.

And credit-cards are a testament to that.

You can't tell from the receipt? Home depot is well known for doing EMV, and the result I see on the receipt is a lot more detailed, with listings for AID, TVR, IAD, TSI and ARC. Chip-enabled regular transactions just seem to list the AID, an Approval #, and a Transaction ID.

I don't know about US, but over here with my Polish bank I have 100% control over the limits for each type of transaction possible with my card, I can set them myself through the web portal of my bank - the types are:

1) transactions with card present(chip+pin or signature)

2) transactions with card not present(someone types in your card number into the terminal)

3) internet transactions(card number + CVV from the back).

I can set any of them to zero, effectively blocking the transaction type completely. So yes, while you can read the card number and exp date from the chip, you can't get the CVV number from the back of the card, which means it's only useful for the second type of transactions - and I don't see any reason to ever change the limit on that to anything other than zero - so any information gained from just skimming the chip/magstripe is effectively useless without the CVV written on the back.

Setting limits to zero is kind of defeating the purpose of having a card in the first place.

The better solution is to have a bank with good reputation that expends effort in making your transactions safer.

My bank:

- has their cards well issued (and I know this since I have worked as credit card terminal developer for many years and I know every detail of how cards are personalized and designed actual security systems),

- sends me a code to verify my internet transactions (remember not to use your phone to do internet transactions!),

- processes chargebacks without fuss unless there is a reason to suspect cardholder is trying to defraud the merchant.

> remember not to use your phone to do internet transactions!

Do you have time to explain?

I'm aware of the problems with using sms as 2FA but if I understand you correctly you mean something else?

(Around here most banks demand we use BankID which is typically downloaded to the sim card in the phone.)

You should never use the same device to perform transactions and receive your codes. The security of the scheme lies on using two separate devices under your control.

If you were to enter your credit card details on the same device you use to receive codes (most likely your only mobile phone), the attacker having some kind of malware code could first steal your card information and then use your phone to receive the codes to complete the transaction.

This requires infecting just one device, so basically as a fraudster you create a malware and wait for people to have their phones infected. Then you defraud those that use phones for credit card transactions and either don't need separate codes to complete the transaction or use the phone for this.

It is much more difficult to get two devices infected that are used by the same user. This only typically happens in case of targeted attacks and is rarely seen.

My colleague at one of the companies I worked for lost the money he saved to buy a flat this way. He got his phone infected with malware and then over few days he got all his money sucked out of his account in a series of increasing transactions.

Many banks supply you with a hardware security token.

But also, I don't care as a consumer. Because I don't have any liability. In fact, I prefer the swipe as it is a few seconds faster.

Except getting skimmed and disputing charges is annoying, not something I care to deal with. I'd rather we have more secure infrastructure that doesn't sustain criminal activity.

I've been skimmed twice, and both times the (major US) banks made it super easy to dispute and I had my money back in a matter of minutes.

Now I keep a low-limit branded gas card that can only be used at gas stations. Go ahead and skim me. All they can do is charge $30 worth of Munchos and beef jerky.

It takes 5 minutes and a few clicks on a web site now a days. I'm all for more security too but like OP it isn't really my responsibility nor my liability so I have little care.

My last bank made that easy. But required a new card and a new PIN, and immediately and automatically cancelled the old one. As I was abroad at the time, this was not a fun process. Not that it's particularly fast even if you walk into a branch.

This is one of the reasons I think it's important to have more than one credit card when traveling (especially abroad). Redundancy in case one get shut down at an inconvenient time in an inconvenient place.

After having to replace a couple cards and update all the subscription services that were pulling from the old ones, I do care.

You could take the approach that my wife and I do. We both have 1 card each linked to our checking account. We have a 3rd card that is signed up to all of our reoccurring payments (electric, cable, water, sewage, trash, netflix, etc) that card is stored in a safe deposit box.

The thinking is if either one of our cards get compromised we will can just replace that card, the third card will remain safe while locked up. That is unless the company or payment processor gets breached which is a larger issue in itself.

One of my card issuers [1] has a feature called "ShopSafe". ShopSafe lets you create virtual credit cards on top of your real card. Each virtual card has a separate lifetime charge limit and expiration date. Once a charge is made against a given virtual card, future charges on that card can only be made from that merchant.

For recurring payments I make a ShopSafe card per merchant. If one merchant has a breach all I should have to do is make a new ShopSafe card for them. All of the others should be unaffected.

If the underlying card is compromised and replaced the ShopSafe cards should continue to work as long as the underlying account is not closed.

This has worked out quite well. There are only three annoyances.

1. The interface is annoying. It is a small Flash window.

2. The expiration date can only be up to one year out.

3. Some merchants, like Amazon, use a variety of merchant names depending on what you are buying. For example, the shoelaces I bought recently from Amazon show up on my credit card statement as "AMAZON MKTPLACE PMTS AMZN.COM/BILLWA". The Kindle book I bought recently comes from "Amazon Services-Kindle 866-321-8851 WA". My subscription to the Kindle edition of "Analog Science Fiction and Fact" comes from "KINDLE-AnalogScien 866-216-1072 WA". (A few months ago, Analog came from "AMAZON DIGITAL SVCS 866-2866-216-1072 WA"). I also see in my Amazon purchase history things from "Amazon.com AMZN.COM/BILLWA".

Dealing with that would require five ShopSafe cards, and picking the right one for a given purchase.

There is a workaround I've heard for this with Amazon, but have not gotten around to trying. Buy Amazon gift cards with a ShopSafe card, and use them to pay for everything else.

[1] Bank of America. I believe that Citi has a similar feature.

For those that aren't with Bank of America, https://getfinal.com/ offers a similar service for all. (no affiliation)

This is exactly what my wife and I do, we both have our primary spending cards (her Discover It, my Capital One QuickSilver) that get used for everyday purchases - but I've also got a very basic Wells Fargo Platinum card that gets used for recurring payments (car insurance, unlimited car wash pass, internet bill, utility bill, etc).

We don't touch the debit card attached to our checking account unless there's no choice, however - which is usually just WinCo when we can't get what we want (or get what we want for a reasonable price) at Fred Meyer or Albertson's. All of our credit cards have $0 liability, and worst case if someone skims them and maxes our limits we have to temporarily switch to a backup card while the charges are reversed and a new card is mailed - someone draining my checking account leaves me with the inability to pay rent, electricity and gas and Wells Fargo is happy to drag their ass on reversing unauthorized debit card payments.

I do the opposite: I try to limit recurring transactions to one or two per card.

My cards have been compromised by Target, Home Depot, and other vendors. I never know exactly who, just get the notice from the bank that I'm getting a new card.

The side benefit for me is that these small transactions keep the cards active with regular on-time payments.

If one of them is compromised, I only have one or two recurring payments instead of having to change all of Netflix, Ting, Comcast, Virgin Mobile, Google Play, Apple, NY Times, WSJ, etc.

My defense, however imperfect, against having to deal w/ having to update subscriptions is to have a card I only use for subscriptions, so there's a low chance it gets skimmed. I use Mr. Swipey swipe all day long without need to (excessively) worry that someone illicitly cloning Mr. Swipey will affect my relationship with Mr. Subscribey.

Pfft. My new Amazon CC got compromised the day I got it. I used it precisely once, for an Amazon transaction.

I've probably had 5 cards compromised in the past decade. The biggest hassle is changing recurring payments. I don't track them, I just do my best ten wait for the bills to fail. What's annoying is sometimes they keep successfully charging my account for 4-5 months before failing. How they're able to bill the old number I don't know.

But yeah, they just call you and send you a new card. No need to select which transactions are fraudulent typically -- or at best 2 mins on the phone. No big deal.

Sucks when you're overseas but google voice + headphones and then Apple Pay means your new card is active the minute it's issued, even if you won't get it in the mail for 2 weeks.

I recently had to get a card replaced and what was interesting was that some companies with recurring subscriptions automatically updated to the new card number without any input from me. Not everyone did this but it was about half of my recurring charges. They must have some way of updating the info via the card provider. The expiration date and CVV changed as well but they magically already had it.

Visa's product is called Account Updater[1] and MasterCard's is Billing Updater[2]. It allows previously approved billers to get updated card information when a card is replaced due to expiration, loss, fraud, upgrade, etc.

[1] https://usa.visa.com/dam/VCOM/download/merchants/visa-accoun...

[2] https://www.mastercard.com/us/wce/PDF/Billing%20Updater%20Br...

This happened to me, too.

It's a case of where consumer laws have been used against the overall public interest.

As a consumer using a debit card, you have lots of exposure. Bounced transactions, lots of paperwork and more bureaucratic pitfalls.

Credit cards with premium issuers are just a minor hassle. With Amex or Citi, you literally just need to click. With lousy issuers, you can be stuck dealing with a breach event for a long time.

This. And if these things happen to you with any frequency they aren't so friendly. I've gotten my debit card skimmed several times (I was able to determine through the process of elimination that my at the pump usage at the gas station was responsible). The last time, which of course happened to be the only time I got hit for any significant amount of money, the bank fought every step of the way and ended up ruling against me. I had to go back and forth with the BBB to finally get it sorted out. In the end, it was a months long process with lots of headaches.

With a debit card you have full liability if you don't report quickly vs $50 cap with a credit card. Not worth the risk of using a debit card ever IMO.

Agreed. Sadly, this is stuff I didn't know 5 years ago.

> Because I don't have any liability

Where do you think the cost of losses goes? To the consumer via higher prices...

You pay that whether or not your card info gets stolen

Sure, but if the industry, as a whole, is more secure, those operating costs go down, and, in theory, so do fees charged to consumers.

This is only true if you use a credit card. A debit card on the otherhand, carries a lot of liability.

Although you might not be affected directly, it's cost of doing business that affects all consumers.

> Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card.

By the way, do you have any reference on this? Everywhere I've searched, chip seems synonymous with EMV.

For background, I was developing those types of applications few years ago, professionally.

Every chip or contactless transaction is an EMV transaction. This is by virtue of EMV being the protocol that terminal uses to communicate with the card.

EMV allows for different types of transactions with different level of security.

For example, if the transaction can be done offline (gas pump unattended terminal situation) AND executing CVM rules (both terminal and issuer have their own rules) points to the possibilty of exchanging encrypted PIN, the PIN can be sent safely encrypted to the card for verification.

If the card or the terminal does not support encrypted verification then the PIN can be sent in the clear and vulnerable to skimming.

Okay then I'm extremely confused. You say:

> Every chip or contactless transaction is an EMV transaction.

But the parent comment I was replying to says:

> Just because you are using the chip doesn't mean you are doing an EMV transaction.

I presume you're saying he's wrong in this? Or am I misunderstanding what you both mean?

I'm also confused by the PIN thing you mention. Why is there a PIN at all, and why is there an "encrypted PIN exchange"? We're talking about the US, right? The US is chip & signature, and there is no PIN involved. I thought it was supposed to be that the card generates a unique one-time authorization code (public-key signatures?) and the bank validates it? Where does a PIN come into play?

For each transaction a set of very flexible rules is being executed with the aim to perform a number of verifications.

Card Verification

- no verification (just read magstripe or magstripe equivalent from chip or contactless card that does not have any more advanced verification mechanism)

- static verification - for chip, card sends static signature along with the data so that the terminal can verify electronic signature

- dynamic verification - for chip, card accepts challenge and generate response so that the terminal can verify the signature. This also makes it much more difficult to copy the card because it is not enough to copy the available data, you also need to copy the key that is embedded in the card.

Cardholder Verification

- no verification -- sometimes no cardholder verification will be performed (for example contactless under certain limit, unattended terminals without PIN capability or on a plane when there is special rules for airline terminals because people are typically verified separately)

- Signature -- this is where US is stuck it seems

- offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem

- offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more.

- online PIN -- the PIN is never exchanged with the card, it is encrypted and sent to the bank and bank decides whether it likes it or not.

Transaction verification

- floor limit -- sometimes the transaction can be agreed between the terminal and the card. Typically there is some information stored on the card and set of rules that decide that this is possible. The card may be decreasing a limit of funds available offline and when it hits the limit it will force you to perform full chip transaction.

- online verification -- the message goes online to the bank and bank decides.

>- offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem

>- offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more.

what's the difference between the two? can't the attacker put a physical keylogger on the pin pad?

Honestly it doesn't make much of a difference when it comes to classic skimming, because, yes, as you say, you can put a keylogger on the pinpad.

The problem comes from physically stolen cards, if your card doesn't rely on cryptography to secure the request/response channel you can insert a shim between the reader and the card to fake acceptance of an arbitrary pin. This specific attack has already been demonstrated, and if my memory serves correctly it's already being used in the wild.

> The US is chip & signature, and there is no PIN involved.

I'm in the US and the credit card I have through my credit union requires a PIN on chip transactions.

He's mostly wrong. The entire point of moving to chip is because liability stops being on the retailer if they implement EMV. Chip and EMV go hand-in-hand. Why bother upgrading your terminals for chip and not do EMV? Might as well stick with swipe then, its the same liability agreement.

Its all a stopgap measure to chip and pin anyway. Once everyone is used to EMV and all the terminals have been replaced, we'll have a sunset on swipe and then move to chip and pin, which will be a minor upgrade. This will all take time. Lets remember the United States has a quarter of the world’s credit card transactions, but only 4.5% of its population. Its a very big cc market and change isn't going to come quickly.

Interesting, is this a U.S. thing? Because I remember reading about attacks on EMV in Europe and they all seemed to boil down to forcing a fallback to magstripe.

there is no magstripe fallback on chip and pin, there is offline mode fallback tho

I don't know about everywhere. But in my country, when the terminal fails to read the chip, it asks you to swipe the magstripe. Then it realises "oh this card should have a chip" and forces you to insert again.

After about 3 cycles, it gives up and accepts the magstripe (plus the pin)

In Norway, on the 3rd cycle, if it actually accepts more tries, you have to sign the receipt and if the purchase is more than 1000 NOK/130ish USD (might be higher) they have to phone the bank to verify/get a verification code to put on the shops receipt.

Often it will just deny the transaction completely and the shop queue grows _looong_

My understanding from working in a bank in the UK is that it is the shop's discretion to use signature instead of PIN with Chip & Pin however the bank does not refund/guarantee fraudulant signature transactions like it would a PIN code.

I've lived for long durations in the UK, France and Switzerland I've never seen this happen in any of them. However, I have seen it happen twice while traveling for a few days in Norway.

In the US, I have to try the chip and fail three times. Then it prompts me to use magstripe. My chip does not work, so have tested this a LOT.

Curious question: can you request a replacement card be issued? Broken chip sounds like something reasonable to replace for (insert mumbling about poor user experience and whatnot here).

I had this happen with American Express. Went to two stores in a row where the chip failed and I had to use a different card. Went online to request a new card and they sent one out immediately with no charge or really any questions (I think I did say that the chip stopped working, but that was it).

Later, before the new card arrived, I tried using the old one again and it worked, so I just chalked the whole thing up to those two stores likely using the same payment processor that was having issues that day or something.

Wow, that's crazy. My chip and PIN in Canada has a magstripe. Sometimes it'll fail and I'll have to swipe.

What do you do when the chip and PIN fails?

In the UK, it's never failed for me.

I've always found that cleaning the contacts fixes it

Most U.S. banks implement Chip and Sign, though, and enable the Magstripe fallback because retailers still haven't certified their systems end-to-end for Chip and PIN.

Thats basically two cards in one package linked to same account.

I need to look it up again, but I recall the fix was to deny fallback for readers that support a chip. So this was an issue before but they fixed it.

Wait so what's the point of an old-style chip transaction then? Isn't it just painfully slower?

I curious how much slower the chip (EMV, or or 'old-style) is than the magetic swipe? Here in EU there is not difference, the transaction is done in couple of seconds max and most of this is the time spent waiting for authorization response. The entry mode chip/magtripe/contactless doesn't make that much difference.

It definitely feels like it takes forever and completely disrupts the motion I'm in by making me wait around to do nothing. I've never timed it but the 10 extra seconds I read [1] sounds pretty accurate.

[1] https://www.cardfellow.com/quick-chip-slow-chip-card-transac...

Because it's a different experience in the US versus EU. I'm a US expat and my experience at registers abroad is way different with my PIN+Chip card -most of the time I use contactless, but for the few shops that have held-off upgrading their terminal, it's still pretty fast. I barely have enough time to put groceries in a bag before I feel my phone notify me of the transaction completion and the terminal tells me to remove my card.

It baffles me that the US is still struggling to get chip-and-pin working properly, when most of Europe has been using chip-and-pin for over a decade and is now transitioning to contactless. America seems weirdly bad at this sort of co-ordination problem.

Because the U.S. does not have chip-and-pin, we have chip-and-sign. The main reason is that federal law in the U.S. limits the credit-card holder fraud liability to $50, and does so with language around signatures. Those same laws also set out fraud penalties for people fraudulently signing.

Since all of the laws revolve around signing, we don't get PINs.

There is a second wrinkle to this for Europe: because there is no equivalent to these laws, in many cases Europeans are the ones completely on the hook for fraudulent transactions as the correct PIN number is seen as evidence the consumer having leaked it. So in cases of fraud the U.S. chip-and-signiture winds up protecting the consumer much more.

America doesn't even have chip-and-pin at all; we have ship and signature, which is a security joke (I've never seen anyone check the signature).

This is not true.

Maybe in your region of the USA chip and signature is prevalent but in my experience (SF bay area) every chip transaction has required a PIN.

Or perhaps it's your card-issuing bank?

Debit vs credit.

AFAIK ALMOST NO US-based banks issue chip+pin credit cards. Only chip+signature. Debit cards are indeed chip+pin, but in USA you'd have to be careless to ever use a debit card anywhere but an ATM.

This. I'd NEVER give thieves access to my bank account, that's what credit cards are for. Chip transactions take ~5 seconds, it just feels slow because with a swipe you can put the card away in your wallet while the processing is happening.

Chip+PIN doesn't really exist for US CCs. I've setup PINs on a few cards but they only work overseas where the terminal refuses signature.

Mastercard vs Visa. Visa issued cards do not typically support chip-and-pin. Mastercard issued credit cards often do.

In the UK at least, chip takes about 2 - 3 seconds. 4 or 5 would feel long. Contactless is usually instantaneous; I assume there's more caching involved somewhere.

I haven't seen anyone or myself swiped in about 10 years, and that was only because the chip reader wasn't working at the time.

Contactless transactions for smaller amounts are often offline approved without requesting approval from the bank/network. This takes off the 2-3 seconds of the transaction time.

Apparently, there's an optimization that needs to get done with the retailer's bank. Big retailers have this completed so their chip transactions are very fast. Smaller ones either don't or need to go through a middle-man servicer which adds time and god knows if the middle man has completed this optimization. Subway restaurants, which are individually franchised, are like this. They just have one of those cheap chip terminals and the transactions can take 30+ seconds. Meanwhile at Walgreens it only takes a few seconds.

A lot of this has to do with Quick Chip, which forgoes writing the host authorizer ID to the credit card's chip thus simplifying and shortening the transaction. QC rollouts happen at whatever pace retailers want, so you'll see some shops using QC and others that don't.

https://www.cardfellow.com/quick-chip-slow-chip-card-transac...

The end result in credit card fraud is purchasing something and using a mule to send the fraudulently purchased item to a fencer, who sells it for cash.

Having a requirement that all vendors use chip-enabled cards simply increases the cost of producing each cloned card; so the goal is to raise the cost of committing the fraud.

At least that is my understanding.

No, it's not just slower. It's also much more likely to fail. I don't know why anyone bothers except that the card networks forced the issue.

It depends on the issuer. Dutch banks by default block all transactions outside of the EU (specifically targeted at countries that still use swipe transactions). That pretty much completely eliminated skimming.

The point of the chip is to make it difficult to create a counterfeit card.

Reply on news.ycombinator.com