Hacker News Reader

Comment by lxgr | Hacker News Reader

> absolutely no information about who I just paid or how much I paid them.

That's unfortunately how the contactless payments protocol works. Chip cards don't have a display, so user-visible on-device payment confirmation was never a design goal.

There's been some attempts in introducing it (apparently with mixed/bad results, since it's not a thing anymore), but it's ultimately not possible: Since the final payment amount is often not known at the time you tap/dip/swipe your card, what you'd see on your phone would differ from what is ultimately charged.

Arguably, not showing an amount rather than an estimate that will usually be either way over or under the actual amount is better.

View on HN

> Since the final payment amount is often not known at the time you tap/dip/swipe your card

As a foreigner, I have trouble understanding this.

How can the final amount of a transaction not be known when you are paying it? Is that one of the usual nonsensical shenanigans stores like to play with taxes in the USA?

One example is at the gas station I have to tap/swipe my card to activate the pump and then I get charged when I'm done.

Gas stations are an exception: They will usually pre-authorize a certain amount (usually some number that is not likely to be exceeded by reasonable gas tank sizes) and adjust downwards once the final amount is known.

This is different from having different amounts in the chip transaction and in the "actual" transaction amount fields.

This was annoying when gas prices were very high. We had a van with a massive tank and the pre-auth wasn't enough. We would hit the limit and need to drive to the next pump to continue.

At this gas station scenario, you have two transactions - the preauth, verified by the card, with a specific limit; and afterwards a transaction (not verified or even seen by the card) with the actual amount.

The former is something that the card/phone can show and verify, as that is the actual amount you're authorising, even if you don't "spend" all of it.

In some stores you can tap your card before the transaction is completed, once the receipt is 'closed' the payment terminal will receive the final amount and use the authorized session to complete the payment.

You can also simply wait for the receipt to be closed before tapping, then the terminal will show you the full amount.

I - for example - use the pre-transaction tapping when buying groceries, it means I can just walk out when the last item is scanned.

It is a security risk - an attacker may add some expensive item to the session - but I think I can take it, the terminal will still show the total at transaction close.

This is not related to taxes as far as I understand. I's just that for legacy magnetic stripe payments, there is no dynamic element to the transaction data, which in practice allows the customer to swipe while the cashier is still ringing up items.

Accordingly, this is what customers have become used to, and this assumption has been further baked into POS software.

Rather than forcing all POS vendors and customers to change this habit, the EMV standard was relaxed for the US (and a few other markets where this is common) to not necessarily include the final transaction amount in the payment data signed by the chip.

This used to be common with tips at restaurants. The would take your card to the back and swipe it, then come back with the receipt. The receipt had a box for a tip. When you left they would then charge the card for the total including the tip.

With chip cards restaurants now tend to bring the card machine to the table. This way you can enter the tip on the machine and complete the payment without the card leaving your hand. I don't know if this is because the machine is there anyways or because chip payments need to know the amount when the transaction is authorized.

The machine is just a fancy new toy, although it does have the added benefit of your card not leaving your control. It's still possible to put the tip in after your chip card has been read.

This is a different thing: The tip is usually reconciled only during payment capture time (which is a batch process and distinct from the authorization stage).

In some countries, the switch from signature to PIN has coincided with the introduction of chip cards, and given that the terminal needs to be brought to the customer anyway for those (or vice versa), it's just simpler for everyone involved to include the tip amount right there.

I have yet to be in a restaurant in the US where they bring the reader to the table. I wish they would, but I've never seen it (Minnesota, US, other places in the Midwest).

The ones here will do it if you want to pay via phone *Pay. Obviously not every restaurant has updated to that though, especially mom and pop joints. I usually leave the tip in cash anyway. Covid has put an end to my restaurant visits for a while though except the occasional outdoor place.

What? Every restaurant I go to still takes the chip card and uses it. If you want to pay via phone *Pay they'll bring out a wireless POS to finish the transaction, if they support phone pay at all.

These guys want instant feedback rather than checking a ledger later that day or night. This seems like paranoia to me after using *Pay for several years now. Ask for your receipt if you're nervous about it.

At least for the EMV standard the card definitely knows the transaction amount; it's one of the core fields of the transaction that's signed by the chip on the card iff it meets the restrictions configured in it.

Of course, the issuing bank may charge some extra fee on top afterwards, but the amount that the chip card sees and signs should be the exact same number that the POS system would print onto a receipt as the transaction amount.

Reply on news.ycombinator.com