Hacker News Reader

Comment by oneplane | Hacker News Reader

I wonder why they chose a system or workflow that breaks with what we are pretty much doing everywhere else in the world: chip + PIN. It works, it's fast and reliable. And with optional NFC it's even faster.

While people can always make up arguments for some edge case where it wouldn't work for them, that is anecdotal at best. Resisting change it only going to hurt (economically, technically, knowledge-wise) in the long run. I know that learning from history is not humanity's greatest skill, but actively working against what turned out to be a bad practise seems rather.. strange.

And at the same time, some commercial services jump in to fill the void, which is not something you probably want either due to the risk of monopoly, data sharing and other privacy concerns.

View on HN

It's interesting because according to my understanding, the U.S. is actually using a pretty good system for dealing with credit card fraud in general...which sadly seems to be the rare exception in regards to consumer protections in the U.S.

Basically -- again, as I understand it -- the losses due to credit card fraud is either on the merchant or the card-issuer -- generally the two groups most equipped to deal with the issue. If Visa thinks it's losing too much money due to fraud, they have the control to influence change on the system, put more resources into detecting or preventing it, etc. But they can generally view it as a cost-profit analysis, and handle it appropriately. Of course there's side effects, it costs all of us involving the courts or police, to some degree, but in the absence of a perfect solution in an ideal world, that's something that was going to happen anyway.

Which isn't to say the future couldn't change; money-ed lobbyists, such as Visa, can get the laws in the U.S. system modified to put the onus on the consumer, or on the business (which could drastically damage small businesses), but for the time being, the system does seem, to me, to be working well ... here.

Yup, that's essentially how the system works.

One reason that can work in the US is because there is so much money slopping around in the system from high interchange/network fees. An issuing financial institution may bear most of the risk of fraudulent transactions, but the revenue of interchange fees is easily 10x that of fraud.

So, there are aligned incentives to keep the system secure which ends up being friendly to the individual consumer, but it comes at a cost because consumers bear this cost in the form of opaque fees in everything they buy.

Get a good cashback card and it's not that much. Use your personal cashback card for billable business expense and you probably make money.

One thing it does do is incentivize the banks to monitor transactions. They know my card # has been stolen before I have a clue, calling me nearly immediately.

Consumer incentives are paid by the merchant, who will adjust prices to compensate.

Merchant fee - cash back = net cost to consumer

Well, dealing with symptoms, no matter how good the system to deal with it is, is still just covering symptoms, not problems.

I'm personally more attracted to fixing the problem instead of trying to keep dealing with the fallout.

Because it would break or otherwise add friction to the existing workflows in the US? But I know that every system used in the US that's different from some other country is clearly the result of stupidity. It seems pretty obvious in this case that many of the interested parties didn't see the upsides of PINs outweighing the downsides.

I don't believe the source of lack of change would be pure stupidity, but rather an extreme weighing in the favour of short term money making.

Most EMV countries have standardised on Chip + PIN, and before that on magstripe + PIN, and it is used equally across all of them.

Perhaps the problem is that people still think in terms of 'good guy' and 'bad guy' and nobody wants to be the 'bad guy' that made everyone upgrade their system to some sort of secure payment method. https://www.theatlantic.com/business/archive/2016/03/us-dete...

Wouldn't the criminal in this case be able to intercept the letter with the PIN also and replace it with a letter that looks the same but has the wrong PIN? The receiver would not be able to find out the PIN is wrong because the cards chip does not work at all.

Pins are generally mailed separately before after mailing the cards. (In this case I'm speaking of debit cards) It might make it difficult to map the pins to the chips, but maybe not since it seems these are bulk mailings.

Some banks allow the user to choose the pin when ordering the card so they can save the postage on one extra letter.

I have never received the pin by post. My bank sends me the card, then I have to go online to activate it and set the pin on the website - the card never has a pin assigned to it by default.

Reply on news.ycombinator.com