Hacker News Reader

> CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN

Or maybe they did the math, found that the average US consumer has a handful of credit cards, and figured that if they put a PIN on their card it would get used less. Resulting in less profit for the credit card company.

I don't think this is correct, because competition hasn't created a better outcome.

Competition doesn't produce good outcomes, it produces winners who then have a monopoly and can create barriers to entry so that competition no longer exists.

Ever heard of market regulation?

Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it?

Are consumers supposed to skip the best option just because the company behind it is getting too big?

> Ever heard of market regulation?

Yes, that's what I'm suggesting.

> Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it?

Ever heard of market regulation?

Shifting blame onto consumers doesn't fix the problem. Instead of establishing who is to blame, we could fix the problem.

> Are consumers supposed to skip the best option just because the company behind it is getting too big?

This is exactly why blaming consumers doesn't fix the problem.

Ah yes, my mistake!

For who?

The big credit card banks make a lot of money.

At least in Europe PIN cards can still be swiped, so you don’t have that problem.

Only up to a certain threshold. After that you have to enter the pin.

> restaurants and other retailers don't just bite the bullet and buy the $100 terminals

Because it's never $100 cash.

It's $100, and a subscription fee for the service, and a percentage of the transaction. Indefinitely.

If you already have a really good deal with your provider, this may be a more significant hit to profit than fraud--especially for a restaurant (where fraud is less because you can't reconvert the food into cash unlike merchandise).

I hate the "SaaS" subscription model, but it's infected everything.

That's fair to complain about rent-seeking aspects of SaaS, but credit cards existed before the word SaaS was ever used, and subscription services existed long before computers did.

Thing is, even if merchants didn't buy a new $100 terminal, if they're already accepting credit cards with an old terminal, they're already paying a subscription fee and a percentage of transaction, so in this specific case, it is $100 cash. (Pedantically, it's closer to $300 https://www.merchantequip.com/processing-equipment/wireless-...)

Most of Europe is moving to contactless card payments and PIN is needed only for large amounts (over 20 euro, recently raised to 60 euro) and for cash withdrawals. The result is I already happened to forget the PIN, fortunately I had another card.

So, stolen card can be used for small payments, but there's easy process to immediately block it (via app or internet banking).

Good banks allow you to pick your own PIN. For some reason in Europe few do that.

Looks strange. All my 10+ cards in Japan allow to pick a PIN.

Japan is funny anyway. 15 years ago I could go to every ATM to get cash. Now I think it is just possible to get cash from a 7-Eleven ATM with a non japanese card.

Now we can withdraw cash from ticket vending machine on train station but maybe no one actually use it.

https://www.gmo-pg.com/en/corp/newsroom/press/gmo-paymentgat...

Really only few? I thought it normal to change your pin in the ATM.

Since it often is completely unencrypted just use an android phone or whatever to get the details. And since the small-payment-limitation is just in the payment terminal you don't have to care about that either. And blocking the card isn't even immediate.

Card doesn't even need to leave victims pocket to read it.

You can't make this stuff up.

Are you claiming that contactless payment are unencrypted?

There really isn't a "payment", the card broadcast everything needed to anyone who asks. There is no handshake or anything.

And yes, it is unencrypted in a lot of countries.

There are even apps in the play store for reading them.

This is just wrong. https://en.wikipedia.org/wiki/EMV#Transaction_flow

Card processes transactions internally, tracks usage limits for offline, etc. Other way you couldn't read transaction history with these android apps. (but I think history access is now restricted and can't be read from new cards)

No, there are different solutions, and where I live the common practice is to perform the contactless operation while the cashier is still scanning the goods (and thus the total has not even been established), and just press ok when the final total is presented and be on your way. (if the total exceeds a certain number you will be prompted to enter your PIN, but you do not need to use your card again)

It pretty much is the same thing as swiping the magnetic stripe.

I've read out the information from the card myself and there are multiple demonstrations of it where they have a more powerful antenna and read it from peoples pockets in their wallets.

>It pretty much is the same thing as swiping the magnetic stripe.

It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.

What would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated.

Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.

Because it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode.

Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.

Doesn't matter? I'll just use the details that I got on the internet instead.

Card not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.

I forgot my PIN too on some cards but that’s because they didn’t have an app that allowed me to easily customize the PIN. But yeah contactless is so practical, paying in the US is such a slow experience in comparison.

I’d say about half of the stores I frequent have contactless payment terminals in the U.S. Far from universal but it’s not like it doesn’t exist here.

yeah but my US bank cards don't support it :( if I pay with my European cards people freak out ("WHAT IS THIS!!!")

I think Coronavirus has pushed many US banks to issue contactless cards. Just got new contactless ones from Amex, Chase, and Bank of America in the past couple months.

>CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. [...] So we had a dumb hybrid approach, and usually the retailer pays for the fallout of this decision.

I don't think there's anything specifically wrong (security-wise) with chip + sign for processing. Sure, you don't need to enter a pin to verify the transaction, but it's not like you can clone the chip, so there isn't any security issues there. AFAIK the only issue is that for some banks, the magstripe information can be read off the chip, that can be used afterwards to spoof a magstripe transaction, which the bank allows (for legacy reasons). The core problem is allowing legacy transactions, not in not having a pin.

If you lose the card someone can just use it if there is no pin. Lose a card with a pin it can’t be used.

I do agree that it's one deficiency, but it doesn't matter much. The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it. There aren't organized criminal rings for it because it simply doesn't scale. Not to mention that you have a very limited window to spend it compared to a skimmed card. The banks probably figured that adding pin adds marginal security for significantly more hassle.

> The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it

I must confess that I actually did once find a credit card on the ground while walking through an outdoor parking lot--and I did start using it in stores.

It was one of those mini cards some banks issued that were designed to go on a key ring for convenience. From the wear on it, it had been out there at least a couple days.

When I picked it up I had every intention of reporting it to the bank. However, when I picked it up and saw the name and photo--they were mine!

I pulled out my key ring and sure enough, my card was missing. I didn't use that card much, but still, I used my key ring several times a day so I have no idea how I failed to notice that it was missing.

As to how it fell off, there was a hole in the corner for the key ring to go through, and the card had cracked between the hole and the edge. The next two times my bank issues to me new cards and included a key right card, the same kind of crack developed. I stopped using them after that as the risk of losing them seemed to high.

Bank of America stopped issuing them in 2010, after 8 years. I wonder if it had anything to do with a high lost card rate?

What's the purpose of a signature even? The retailer is not allowed to (by terms of service) ask you for any ID to compare it against. This is just trappings for show.

The purpose of the signature is that you sign it when you get the card, then if it gets stolen, they check that signature with the signature of the person signing it.

Of course, no one checks these days.

No one was ever checking. It would have been pointless to try.

I picked up my grandmother's medicine from a costco pharmacy for a while. One time, there was some question of whether she had picked up her medicine or a charge or something. To resolve this, the pharmacist printed a sheet of the latest signatures associated with her account. All were indeed mine.

No, it signifies your acceptance of the card terms. Nobody is qualified to make an accurate comparison.

Interestingly, here in Finland retailers are required by their terms to check your ID for magstripe purchases over 50 EUR. This policy predates chip cards, i.e. not a new thing.

So there is some regional variation in practices.

Same in Italy, with old swipe cards you have to show an ID; some merchandiser don't ask but they should.

Anyway, this mostly faded away since most of new cards are chip&pin and, more importantly, in Italy most of the people use debit cards (Bancomat is the common debit circuit here) or... cash :-\

Aren't there suppose to sign the back of your card in the provided space? Or is it different by country?

The movement towards eWallets is a better UX than a pin, as the device is a witness factor (chip) while the device-level auth (passcode or <body part>Id) represents similar proof as a pin. The added benefit, here, is that users can order online with as much safety as at a terminal (Maybe I'm missing a nuance or two here?) and no terminal is necessary.

> retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system

I think its been about a year or more for me since I last swiped my card (or saw it swiped). 100% chip/EMV or Apple Wallet here.

I severely miss swiping every time I have to sit there for ten seconds staring at a terminal with the chip in, waiting for it to obnoxiously beep. Phone NFC is a bit nicer when it works (often doesn't) but I wish it didn't require authentication. Swiping feels like the golden age of shopping convenience.

With the exception of Amex and Discover and a few others that issue their own cards, Visa and MasterCard don't issue the cards. Thousands of banks and credit unions do. They're the ones responsible for managing fraud on those accounts.

The banks decided the PIN part of chip and PIN only protects against physical theft -- what they call "lost and stolen" fraud.

Assuming that is accurate, given the costs associated in dealing with customers who forget their PINs, and the fact that Visa massively pushed for chip and signature, it's not hard to see why none of the banks wanted to be the hardest card to use in the wallet: Lost and stolen is an infinitesimal amount of loss for them when compared to counterfeits and e-commerce fraud.

The average US card user has something like 5+ cards. You are not supposed to re-use or write down pins. PIN use would not scale past one or two cards.

What’s the difference in fraud protection debit vs credit?

I’m not a fan of using credit cards as you’re constantly in debt and need to make sure you’re paying back your balance.

You are protected by consumer credit laws with a credit card which puts responsibility on the retailer and card issuer. You can issue a charge back and it's their mess to sort out.

A debit card puts the onus on you. Your bank will probably help you but they're doing so for good customer service, not because the law tells them to.

If you are the victim of fraud or faulty goods, a credit card is on your side. Otherwise with a debit card you may have to rely on the courts.

Rule of thumb, use a credit card for everything but set it to clear the balance every month.

> You are protected by consumer credit laws

What country are you referring to? Is it a widespread thing?

Better protected with a CC because you are spending a banks money and not your own. Obviously they will care alot more about theirs, however nowadays Debit Cards have very similar protections. Just pay the full balance every month and you never go into debt and with the right card you will earn a free vacation once a year with the bonuses.

Retailers buy POS terminals? Not rent them from their bank?

> as debit cards do not have the same protections against fraud as CCs do.

I am curious: how often were you defrauded, how and where?

Doesn't matter, what matters is sleeping safely at night that if a company gets hacked and loses card details, my credit card being fraudulently used is the banks problem. With a debit card it's my problem that the bank isn't legally required to help with.

In Europe (at least in some countries) local law dictates that unauthorized debit card payments are to be reimbursed by banks.

Reimbursed, sure. After the money is already out of your account for potentially multiple days, while your other payments bounce. With a credit card the only thing stolen is the bank’s money.

You are saying that poor people (as in, people who have not enough money in their account to sustain living after a fraudulent transaction) should have creditcards instead of debitcards? Here I would not even be able to get a cc if I made under a certain amount/month which would not make me poor enough for that. Or do you mean something else? Cards (debit/credit) normally (and for good reasons like this) have limits far below what I have in my account and the bank is good at detecting fraudulent transactions. Credit is considered not good for people who are not well off here; there are entire tv campaigns to dissuade them from it so I am curious if you are recommending it and if that is normal in, presumably, the US.

Debit cards in the U.S. are usually only limited by the amount of cash in your checking account (sometimes not even then, US banks are big on “overdraft protection”). If it’s the day after payday and you have $1200 in your account, and someone steals your debit card, you can very easily be drained to near zero. The only saving grace would be if the banks fraud detection kicked in due to unusual purchase patterns. I’d still rather the thief steal the banks money, not mine.

That is not true here in the eu. You can reverse debit card transactions and direct bank debit transactions.