Hacker News Reader

Comment by pfarnsworth | Hacker News Reader

PINs are a lot more dubious. If you get fraud on your account that is verified by PIN, then you will have an impossible time charging it back in the case of fraud. So PINs are safer for merchants and for credit card companies, but less safe for consumers if there ever is fraud. It's the exact opposite of what you would expect.

View on HN

If you pick a common 4-digit PIN, there are 10 000 possibilities for your PIN code. Given that your card will block after 3 incorrect tries, the probability that a thief will correctly guess your PIN code is ~0.03%. If you pick a 5- or 6-digit PIN, that probability is 0 for all intents and purposes, since it's extremely likely that the thief will assume a 4-digit PIN.

In most countries, you cannot choose the length of your PIN; often it is limited to 4 digits, and e.g. some ATMs don't even wait for you to press enter after you enter the fourth digit (UK).

In Australia you can choose a PIN up to 6 digits, though the banks may warn you that a >4 digit PIN can be problematic in countries like, well, the UK I suppose.

edit: huh, it's actually more than 6. According to Commonwealth Bank, it can be up to 12.

Given no one checks card signatures, a signature based system relies on you reading your statement carefully and going through the process of disputing a charge, and depending on the scale of the fraud you may well not notice.

With a PIN based system, on the other hand, they're blocked from making the transaction to begin with.

It’s my understanding that this isn’t totally true. You are liable for the fraud if you have been “negligent” with your PIN and stored it insecurely or divulged it. If the fraudster obtained it through some other means then your bank is liable. It’s true that the merchant isn’t liable.

Reply on news.ycombinator.com