Hacker News Reader

Comment by stevage | Hacker News Reader

Still shocks me how widespread magnetic stripe credit card use is in the US. The rest of the world moved on a very long time ago.

View on HN

In my recent US experience, gas pumps are the only things still using magstripe. Everyone with a card reader at their register seems to be using the chip reader.

The gas stations in my area just switched over to chip readers (at least the ones where I go). However, looking at it, you still have to insert your card all the way into the pump. This means that it would still be possible to add a magstripe skimmer in front of the chip reader. In this case, the gas station would be protected, but you'd still have the possibility of getting your CC # skimmed.

Many places nowadays seem to have card readers that accept swipe, chip or tap. Yet many of them don't seem to have tap activated, and if someone else handles your card (very common in bars and restaurants), you can be sure they will swipe it.

I was in NYC for a week and had to swipe my card at least 6 times during that period. I imagine the rest of the country isn't leaps and bounds ahead.

> I was in NYC for a week and had to swipe my card at least 6 times during that period. I imagine the rest of the country isn't leaps and bounds ahead.

Really? I have worked in NYC for over three years, and the only card I have ever had to swipe in that time is my FSA/transit card that, inexplicably, does not have a chip yet. There were a few smaller merchants in suburban New Jersey that lagged behind, but even they were on chip by 2017.

If the chip interface doesn't work, the backup is swiping. People talk like everything always works perfectly every time. The shinier a new technology is, the more unprepared people usually are for it breaking.

“The major difference between a thing that might go wrong and a thing that cannot possibly go wrong is that when a thing that cannot possibly go wrong goes wrong it usually turns out to be impossible to get at or repair.”

My point is that I have never had to resort to said backup. I have had problems with my chip from time to time, but even in those cases the chip has gone through eventually.

Well, philosophically, you could convince yourself that the chip will always work if you try it enough times. One can't prove that's false. I have no interest in arguing angels on the head of a pin; what I know is that after a few failures, a cashier will tell you to swipe it, and it's obvious it isn't an unusual experience for them, seeing a ton of transactions per day. So any argument you may have based on technical, logical, or scientific grounds seems beside the point. Let alone plain incredulity.

Yep. Swiped at least 3 or 4 times by servers in bars and restaurants, had to 'dip' in the MTA machines a few times (which I assume is a swipe), a few times at random bodegas, and once at a CVS. In all of the cases there was no other working/active option besides cash.

Chip doesn't work once in a while, they end up swiping instead when that happens. Not sure why.

Most of the time, in my part of the world, it's an old machine that won't accept chip and pin. In which case the merchant (and/or Visa) should be 100% liable for fraud.

The general populace has no reason to care. We aren’t liable for fraudulent purchases; it’s just an inconvenience more than anything.

No immediate, concrete reason to care, but it's not like we're not paying for that fraud in the long run. Costs go up to account for the losses.

More security may not be worth it, if the total costs of fraud go down, but they are largely shifted to the individual victim rather than financial companies. I'm pretty sure this has been mentioned a million times; have you ever considered it before?

The financial companies don't treat fraud liability as a charitable gift they give to their customers.

They set APRs, fees, etc. to absorb it. The cost is, ultimately, borne by all of us, in either scenario.

There is an almost unfathomable value in being able to rely on getting the average outcome, rather than being one data point in the average. Insurance is a thing, you know? Also, people prefer taxes to armed robbers. And stuff like that.

I'm confused as to what you're arguing here.

I'm not advocating that individuals be held responsible for credit card fraud. I think the current setup is probably the best - the folks with the most ability to smooth out the losses (the banks) have most of the liability.

I'm simply objecting to the "The general populace has no reason to care" statement up-thread. That we're not directly liable for the fraud doesn't mean we're not getting screwed financially by it.

Better security is an opportunity for businesses to deny that they made a mistake when it is breached. If you have a compulsory PIN, then when a transaction goes through, they can say "it's impossible unless you were at fault". Is it? Who knows, but there are stories and rumors. I'm morally certain that companies will do this if they have the opportunity and are able.

It's no different as an abstract concept than Boeing purportedly sacrificing hundreds of people to try to produce a 0.1% higher ROI. In general, you optimize a number that describes a large system, and you have to consider that there may be tradeoffs - things may get...lumpy.

It's not so much evil as that people have jobs that involve optimizing certain numbers and certain related consequences are outside their purview.

A quantitative improvement could mean implicitly taking away insurance that was gratis.

I don't see how any of this can feasibly argue against pushing for better adoption of contactless payments.

Reply on news.ycombinator.com