Hacker News Reader

Comment by jimnotgym | Hacker News Reader

In the UK cards moved to 'chip and pin' in 2006! Fraud in a 'customer present' scenario is very low at our stores. The last fraud in fact was a foreign card that didn't support chip and pin. I can't believe Visa and MasterCard have not made it mandatory world wide...

...except card fraud lossed are recharged to the merchant so perhaps they don't care?

Out of interest there is a special exception for disabled people who cannot use a pin pad btw...

View on HN

And even earlier in other EU countries I imagine, as I was in Luxembourg in 2001 and used pin to pay in supermnarkets with my UK card.

Yes, I think it was way earlier than 2006. In France, every card in 1995 had chip and pin.

I think there were a few years where both chip & pin and signatures were in use, but 2006 was the date that chip and pin was mandatory

http://www.theukcardsassociation.org.uk/news/10yearschipandp...

The UK was relatively late to the party, some large retailers here campaigned against it as they were afraid that going online for authorisations would increase the time it took to serve people. I believe that the offline mode was enough to appease them, even now you occasionally run up against offline-only EMV terminals.

I was just looking for a chip-and-pin card that I (as an American) could get for traveling to the UK and apparently there really isn't much out there. I think all of the US cards that support chip and pin prioritize signature over pin.

I also found this Visa page explaining that PIN isn't used in the US because it's too expensive:

https://usa.visa.com/visa-everywhere/security/the-cost-of-pi...

I recently traveled to the states from Canada and was amazed at the number of places that didn't even have the infrastructure for chip & pin - I was at a popular tourist spot and it was all iPads & Square Readers.

Weird. The Square readers we have in Australia support both chip-and-pin and contactless (+pin for purchases > $100). Were they only using the cheaper audio-jack swipe readers in the US? (Not allowed here any more)

I've been using Apple Pay recently, and one annoyance I had was that one store when I paid (for a >$2k purchase) didn't ask for my PIN... it asked for a signature. And then of course I was meant to present my card for verification. And I couldn't... what?

It was the audio jack swipe readers.

Apple Pay lets you spend that much money? I think with Google Pay + my bank the limit is $100 / transaction, after which you have to use your card + pin (which, let's be honest, makes sense.

Before I moved full time to the UK i was in the same position. The only bank I found that provided true chip and pin was Andrews FCU. https://www.andrewsfcu.org/personal/loans-and-credit/credit-...

I never got one though, I ended up getting married soon after and got a UK bank account.

FWIW, I set an ATM PIN for a US issued CC and found the PIN worked for retail terminals in NZ. YMMV

I hope that didn't count as a cash advance

It did not

Might check some of the credit unions you can join. I know at least FirstTech uses chip and pin for their credit cards.

I can confirm that. I specifically signed up for FirstTech for their Chip and Pin cards. Their Mastercard is quite good for traveling and has Chip and Pin.

It was great when I was traveling in Iceland where pretty much every transaction was made with my card. It's a regional credit union, but I only had to visit a branch in person one time to change the PIN on my card.

First Tech security is pretty top notch. For online trnsacations over a certain amount they would ask for password verification.

I just wished online transactions owned it up for optional two factor online transactions, pin card transactions and SMS verifications for all transactions above $500.

That would drop fraud significantly.

FirstTech's credit card is PIN priority. I've only used it in Canada so far, but it works as expected there.

Do you know if you have to join the credit union to get a card, or do they issue them to anybody?

Edit: I just contact them and you do indeed have to become a member first.

First Tech's membership bar is quite low, I was surprised how easy it was to get my SO an account. The Zelle integration on the mobile app is pretty slick too!

> The last fraud in fact was a foreign card that didn't support chip and pin.

"The last fraud"? Are frauds so rare that it's meaningful to talk about the last one?!

Last in this case means "previous" or "most recent". Its just ambiguous English.

Oh yes, I understood that. I still can't believe they're so rare that you can talk about the "most recent" one. And how would jimnotgym know? Most puzzling.

Note the phrase 'at our stores' in the preceding sentence. We don't know whether it's a couple of stores or a supermarket chain, but either way, it is likely that someone knows within any given enterprise.

Oh, I interpreted that as a patriotic way of saying "at British stores". Thanks for explaining!

I'm visiting London this summer (I'm from Texas).

Normally, I pay for everything with American Express. Would you recommend I get a different card for London? I wonder if there's a US card that support chip and pin?

A lot of businesses in the UK/Europe do not accept American Express due to higher fees. You would be better off getting a different card preferably that supports contactless payments so you could use it on the tube and buses instead of an Oyster card (remember to touch it on the way out as well).

https://tfl.gov.uk/fares-and-payments/contactless

A Revolut card supports chip and pin and contactless, I'm not sure if it's 100% launched for US customers yet though: https://www.revolut.com/us/

Upvote and reply, because Revolut is a dream. Prepaid so fraud is minimum risk (no possible overdraft), top up via mobile app, disable the card when you're not using it. It's so convenient that I use it to buy from shady sites (game keys, in game currency etc) and just disable the card once the purchase is complete. I can't believe it's still free.

Sorry for gushing. I love Revolut.

Mostly it's fine using AMEX. There's enough exceptions I carry another card, but it's not that bad.

Also: TFL accept AMEX contactless as payment/oyster equivalent.

Most businesses now do support Amex -- there's been a major shift in the last few years.

You'll find a number of places that don't take American Express, so have an alternative with you. If you have Apple or Android Pay, that'll cover you for most purchases under £100 (under £30 in some places with outdated tech).

> under £30 in some places with outdated tech

under £30 with our brand new chip an pin machines too. I am supposed to make a load of calls this week to try and resolve it...

In some places more than that. I think my record with Android pay so far is around £180.

I traveled all over England this last year with a Chase Visa. No problem the majority of places, but definitely a few places that were inconvenienced by having to pull a signature pad out from under a pile of stuff because no one's used it in months, and a few places that asked me to just pay in cash. I would expect London itself to see enough foreign traffic to be more accepting in this regard, though.

> Normally, I pay for everything with American Express. Would you recommend I get a different card for London? I wonder if there's a US card that support chip and pin?

Amex isn't as widely accepted outside the US. If you have a Visa or Mastercard, bring that.

Almost all credit cards issued in the US now support EMV chips. They almost never support PINs, but that doesn't actually matter because all merchants are required to be able to accept all three.

I've traveled all over the world, and never once has this been an issue. Nobody's even batted an eyelid when I give them a US-issued card. Except, of course, for places which only accept cash, but that's a separate question.

Get an ATM card and take cash out of a machine when you get to London. Seriously, this works well, you get a fair exchange rate, and most places still take cash.

But it is easier to use plastic in the Tube, as others have said.

Honestly, if you have a Visa/Mastercard with no foreign transaction fees then just use Apple Pay/Samsung Pay. It's almost ubiquitously used in the UK, and would be very rare to find somewhere that didn't take it.

If your phone supports it, a lot of places accept Apple Pay and Android Pay now. Just set them up with your card then pay contactlessly.

Of course you still have the problem that not eveywhere takes Amex, so getting a Visa is recommended too.

Credit cards in general are not too popular in Europe, they're either not accepted at all or only Visa and Mastercard are accepted. A Maestro debit card is your best bet and will work in almost all terminals in Europe.

This is not at all true of London. Last time I was there I didn’t even get local currency as I used credit for everything.

That is two different things.

Paying by card is very common in some countries (Northern Europe, France), paying by credit card is common in some (UK, Ireland), paying by cash is common in others (Germany).

It's not possible to generalize all of Europe for any of these, except to say that all EU/EEA countries have modern systems.

(For example, there are restaurants in Sweden that don't take cash, and restaurants in Germany that don't take any cards, restaurants in Denmark that charge an extra 2% if you use a credit card rather than a debit card, and restaurants in Britain that happily accept the 5% it costs them to accept AmEx.)

Which bit of Europe do you mean? I live in Europe and almost always use card.

All stores still accept signature payments. Although not everywhere accepts AMEX due to the higher merchant fees.

Make sure the back of your card is signed, though, and make sure to sign your receipt the same way. I had more store clerks questioning my signature on a 1 week trip to London than in a decade of using a CC in the US.

Not necessarily — you might have trouble buying a laptop or phone without a PIN, for example.

(It may be possible, but require the manager's discretion or authorization.)

I rarely use chip and pin any more. Contactless is everywhere. The UK is the most advanced in this regard, though.

Contactless is useless for fuel unless you top up with over half a tank remaining. ApplePay / Google Pay work sometimes, but retailers put arbitrary limits on despite payment being authenticated (Pay for my £60 weekly shop in the store but maximum £30 in the petrol station, Sainsburys? I didn't bring my wallet, looks like I'm coming back. Thanks for that.)

Is the UK most advanced? In Australia they can pay for anything up to $100 with tap. Over $100, they can still tap, but then need to enter their PIN into the terminal (i.e. no need to insert the card for PIN entry – a tap is sufficient). We don't have that in the UK.

Similar in Poland. You can always tap and then it asks for PIN or it doesn't. I expect this decision is based on the amount of the purchase and maybe some other factors.

I don't think having a higher limit makes anything more advanced. I'm fine with having a lower limit for cards, and then switching to Apple/Samsung/Google Pay for higher priced transactions.

Most advanced in Europe maybe. I rarely use anything but contactless in the UK (where I live), but often find no option for contactless elsewhere in Europe. I've never had to swipe and sign anywhere in my whole life, though.

This is how it works in the Netherlands as well, but below €25.

AFAIK chip and pin shifts liability for fraud onto the credit customer. While banks may be more than eager to do so, they may also be wary of a customer backlash over this.

In the UK the law remains what it always was - the customer is not liable unless they enabled the fraud. (I'm right now in the process of getting my card replaced after fraudulent charges that I can only assume were put through as though they were chip and pin). In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now.

> In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now.

This actually was true across Europe for the first few years when EMV chips were rolled out. It took some time before they passed a law which absolved customers of liability for fraud processed as EMV transactions.

There are well-documented cases where liability had been shifted to the customer, and which was only reversed through there being evidence that is not normally available in these cases:

"In one disputed transaction case we assisted in, the customer had his card stolen while on holiday, and then used in an EMV transaction. The issuer refused to refund this customer on the basis that their records showed the PIN was used. Luckily, the customer managed to obtain the merchant receipts, and these contained the TVR. This indicated that the PIN was not used, and the merchant opted to fall back to signature. We decoded the TVR and informed the customer, who was then able to get a refund. Other customers are less fortunate: it is unusual for the TVR to be included on the receipt, and often the merchant receipt has been destroyed by the time the dispute is being considered."

https://www.cl.cam.ac.uk/research/security/banking/nopin/oak...

The law may always have been that the customer is not liable unless they enabled the fraud, but I hope the rules of evidence and/or practices of dispute resolution have changed so that the infallibility of the system is no longer tacitly assumed.

Not sure where this is coming from but this is definitely NOT the case in Canada or in Europe.

Not in Europe.

> ...except card fraud lossed are recharged to the merchant so perhaps they don't care?

For a long time after EMV chips were introduced, the liability was actually shifted back to the customer. EMV chips were initially a huge step backwards for customer protection, and it took some years before this was fixed in law across Europe.

Nowadays, if you see a merchant who can't accept EMV chips, it's likely their POS vendor who's liable. The merchant is liable in theory, but some vendors still don't provide EMV-capable terminals, so they've agreed to assume the risk until they do.

Also, I believe contactless is something the US is behind on too

Reply on news.ycombinator.com