My bank sent me 64 copies of the same debit card
old.reddit.com
old.reddit.com
This reminds me of a time I was traveling and had to cancel a lost credit card. I told the card company that I was not at home,was definitely outside of the country, not going to be home, definitely staying at an address that was not the home address listed on the account, wanted the card to be sent to _me_ and not my _home_, gave them my foreign delivery address 5 times over as many weeks, got 5 separate promises that the card was definitely going to reach me at my outside-of-the-country-and-not-at-home location in just a few business days, and the card never showed up. So I just gave up. And then, when I finally went home there were 5 goddamn cards in my mail slot.
Honestly this reason alone makes Apple's purely digital credit card my favorite. Need a new card number? Just push a button. No incompetent shipping divisions with 5 hops and as many business days between you and your ability to buy things when your card number is breached.
(Turns out I threw the wallet in the recycling can while cleaning the garage. So I guess don’t pay me to build the system that replaces physical identity tokens.)
Next morning after more than ~1 hour of turning my apartment upside down I, out of desperation and thanks to intuition, dove into container and recovered my trash bag. Everything apart from cash survived.
If I report a lost debit/credit card to prevent fraud then the card is cancelled and I can't pay with my phone and have to wait a week for a replacement card. At least I can still drive without a physical licence.
My "cash" or card transactions has gone down manifold over the last couple of years. Everyone, including roadside vendors, accept mobile payments that's enabled using UPI (unified payments interface) that's tied to my bank account. There are dozens of apps and "wallets" that use it, including Google Pay, Amazon Pay, Paytm, PhonePe, etc.
My income tax records are all available online, and "filing" is a matter of importing this data using a tool that the income tax department makes available on their website, checking the pre-filled forms, and pushing the "submit" button -- signed using an Aadhaar number enabled OTP.
Vehicle rego can be checked in the app so I can see my expiry and get notifications when renewal is due. We haven't had to attach any physical proof of vehicle registration since 2011.
The app can be used as proof of digital licences for boats, cars, trucks and for occupational licences (builders, tradies, security) since 2017. I can also view demerit points. Also does proof of age and more recently COVID checkins. The app was locally developed. I think most states here have similar systems https://my.sa.gov.au/
It meets all identity requirements and has the benefit of not providing your address.
Little known fact: you can have a PO BOX address on your driving license (California). When you give the DMV your physical residence address, and a different mailing address, they will print the mailing address on the driver license. That's what I do.
Most of the population use insecure Android phones and are not the Little Snitch & 1Password wielding HN crowd.
[0] https://dcurt.is/apple-card-can-disable-your-icloud-account
It's not just charges made on your Apple card. Here's a comment thread[1] from two years ago when I mentioned Apple did the same thing to me over a recurring charge for iCloud that failed because I got a new debit card and didn't update it in time. (I was traveling.)
Unlike the author of the post you linked I was given zero notice or warning that all-things-Apple would stop functioning. I had assumed the charge would just fail the same way any other charge to a "bad" card wouldn't go through and that my iCloud subscription might lapse. I never in a million years imagined the charge would create an $8 debt to Apple payable immediately and that my iPhone (which I owned outright, not financed through Apple or anyone else) would be bricked unless and until I paid up. I was unable to download anything from the app store at all until I entered new payment information. I couldn't even download free updates to free third-party apps.
Over $8.
Last time you described this situation as "the app store was basically bricked on my phone". That's quite a difference.
I had set up my iphone to only update on wifi, and was travelling for a month or so only using mobile network.
When I tried to get an uber, I realized the app didn't work correctly (the driver appeared to be in the middle of the ocean). Same for other apps.
Games and apps that don't use heavy server code work fine, but google maps, uber, whatsapp, facebook, and some of the KEY things will break eventually if you never update them.
The phone might as well be bricked, updates fail and constantly pop up the payment screen, can't install new apps.
It's like having a virus on your phone.
He said his Bank Account info had changed and the Auto-Pay to Apple Card failed. He mentions a card decline but that he had available balance, he never mentions that is Apple Card is disabled however and is vague about the specifics surrounding the card.
He bought a Macbook, didn't or wasn't able to fulfill the trade-in, and thus the Apple Store determined he owed the amount they credited for the Trade-In. So when the Apple Store tried to debit his Apple Card for the trade-in amount it failed. The Apple Store then disabled the device purchased and the accounts associated with the purchase.
I have a feeling if you tried to do this with a Pre-Paid Visa or a Debit Account, Apple would still disable the device and accounts.
* Yeah it's just what I said. Apple/Store froze his accounts, not Apple Card.
https://www.macrumors.com/2021/03/03/apple-missed-apple-card...
This will happen to anyone's accounts if they don't fulfill a transaction with Apple Store. It has nothing to do with Apple Pay.
** I also find it strange that he missed an email from Apple telling him he was delinquent on his purchase AND didn't see any emails about an Auto-Pay failure all while waiting for an email from Apple Support about his account being disabled.
In this case, the person received a trade-in credit for a phone, did not send the phone in, and then when Apple tried to collect the trade-in credit, that payment bounced.
https://9to5mac.com/2021/03/03/apple-card-apple-id-unrelated...
What if that phone had got lost/stolen in transit, instead of not being sent at all?
https://9to5mac.com/2021/03/03/apple-card-apple-id-unrelated...
They did not do this.
He forgot to send them his trade-in and that triggered it. Nothing to do with the card.
It’s kinda outrageous he hasn’t updated the article to indicate this.
"Cool people don't say they're cool".
The rest of their Apple ID, as far as I can tell, was unaffected. It's another example of big claims turning out to be far more mundane. https://news.ycombinator.com/item?id=26430248
Regardless, it doesn't make sense to me: Visa (Chase Bank) can't lock me out of a damn thing on on the phone I bought on Amazon. They can't even take the phone away: Most credit cards are unsecured debt, the phone isn't collateral that can be repo'ed. Store-branded cards, though also backed by a bank, are sometimes different and purchases are also security for the debt: one of the reasons I stay away from them. I live debt-free, have been fortunate to always be able to do so apart from a small mortgage, but don't really like the idea that a really bad run of luck could be compounded by having some of the things I need taken away from me as I try to dig myself out of a hole.
The mere fact that you can "buy" a game on the Sony store that is available for multiple devices but not be able to play it on all of those devices is already ridiculous.
This license ends upon termination of (a) this Agreement or (b) a Subscription that includes the license. The Content and Services are licensed, not sold. Your license confers no title or ownership in the Content and Services. To make use of the Content and Services, you must have a Steam Account and you may be required to be running the Steam client and maintaining a connection to the Internet.
How do you get one when you're abroad? No idea. You probably don't.
One year I had an epic week of fraud. My credit card number was stolen by someone involved with a local restaurant, the replacement credit card was stolen from my mailbox, and my rent check was stolen from my landlord's mailbox at a completely different address (and successfully cashed!) There was a 3 day period where the only money I had access to was the cash in my wallet because my credit cards, checking account and savings account were all frozen while their account numbers got switched. All the fraud was covered by my bank though.
I only carry plastic because I find paying with the phone a bit cumbersome and besides the card doesn't have a battery and fits better in a pocket.
I have multiple spares laying around just in case. Sometimes the cats hide one, so what, the branch office is in 15 minutes walking distance.
Internet access is better and much cheaper too.
Maybe because Russia haven't had monstrous incumbents in either place and as a result the market worked as intended.
The one bank that doesn't have branches, Tinkoff, uses courier delivery.
You go to your embassy wherever you are and notarize a document that authorizes a trusted party within the country to deal with the bank (and forward you the plastic). If you don’t need cash, you can issue a non-physical card with a click and use it via Apple Pay.
Just curious.
I have Amex because I trust them most to be on _my_ side instead of the merchants side by default. It's not accepted everywhere though. I use this preferentially anywhere its accepted that seems even the slightest bit sketchy.
I have both a Visa and a MasterCard - each from different banks, because I've been caught out when one bank's network is down and I couldn't pay for stuff or withdraw cash while travelling. I've never experienced a failure of ether Visa or Mastercards backends, but when I decided I needed a second source of credit/debit card at a seperate bank, I figured I may as well make sure I have one of each.
I have debit cards because they're pretty much an automatic part of having an account and a credit card, and also because I keep the credit limits on my cards low intentionally, and can use a debit card or online banking savings account with a much higher daily limit for large purchases.
I have one extra "single purpose" Visa card with a high credit limit and that gets used exclusively for my Apple/Google/AWS/Linode/DigitalOcean accounts. This is for peace of mind that my AppStore/GooglePlay accounts and my hosting accounts will _always_ charge successfully - the credit limit is over 10 times my total monthly spend over those accounts, I could conceivably vanish for a whole year and those would still all get automatically paid.
I grab a new one every couple of years when I see one with advantageous terms. I typically only use a couple of them at a time, but I keep the old ones around because: why not? Having more available credit is only a good thing.
Another comment here about invalid card number also reminds me about my passport. I have a Danish passport but never lived there, so my id number has X-es in it in instead of all numerical. That's pretty hard for various form validators to accept..
If someone on the phone could convince a card company to send a new credit card to a random address in a random country, do you have any idea what kind of field day scammers would have?
Not "someone". Me. They happily secure phone actions by both a password and 2FA just like online access. After that point you can do literally anything else with the account, including close it or get a copy of the card details.
Thwarting the verified owner of the account is not fraud prevention.
On the subject of thwarting and card details, though, neither CapitalOne's website nor mobile app will show my card number nor will they let me create temporary card numbers _after_ I've authenticated with a strong password and 2FA whenever I happen to be outside of the country. It just says "Oops, something went wrong". It took me weeks to figure out the first time that it was because I wasn't on a US network.
Their processes are both extremely annoying and can fail and lock out the legitimate account owner (the reason many of you have had trouble replacing cards abroad is because "shipping to a previously known address" is itself a security measure) while at the same time being vulnerable to a targeted attack from someone with knowledge of how the process works.
There must be some safeguards beyond the various identity questions they asked me - but I don't know what they were.
When the NEXT card didn't arrive I went by my old house and sure enough the folks living there had received all three copies. Then I got to spend a few hours being passed around to various people on the phone with the credit card company before I could find the person who knew about the super secret place where the replacement card address was apparently stored.
Edit: Ha, I just remembered the saga actually continued the next time I moved. Remembering this experience, I wanted to proactively have them change not just the regular address, but also the replacement card address. Unfortunately, try as I might, I couldn't find anyone who would believe me that just updating the regular address on the account wouldn't work. Sure enough though, when it was time for a replacement, it once again went to the old address!
That all sounds good. I'd be curious how the customer experience is when there's an unrecognized charge or you need to open a dispute though.
It's as easy or easier than disputing any other credit card charge. Open the wallet app. Tap the card to bring up a list of transactions. Tap the transaction you want to dispute. Tap "Report an Issue". Tap one of "Dispute Charge", "Unknown Transaction", "Incorrect Merchant Info", or "Other Issue".
It is a good idea assuming you can guarantee the security of the card. Banks typically don't have an incentive to defraud each other by supplying backdoored cards, so banks could indeed partner with each other allowing people to go into any local bank branch, acquire a card and then call their bank to associate it with their account. Of course, you still have the identity verification problem there, as you wouldn't want an attacker to be able to associate a card they acquired with your account and then spending your money.
However, if you're going to solve the identity verification problem for the above, why bother with a card at all? We all have phones or similar computing devices that can act as a card (for Apple Pay & Google Pay, the phone literally simulates a contactless card).
That only changes the card number used for online purchases, not the number on the physical card’s magstripe. The magstripe number doesn’t change, so if you get skimmed, you still need a whole new card.
There’s nothing special about the physical Apple Card.
As for online payments, you might as well use something like Privacy.com that gives you a separate number for each service. That’s better than Apple’s solution, and I’m still not sure why Apple doesn’t do that.
it seemed to me then, and now, that that was a much better experience than waiting for it nervously in the mail.
Schwab dropped this ball and left me in the Guatemalan jungle for 18 days after many assurances that they would definitely not send the new card to my home address. Embassy? Nope. Hotel? Impossible. But sure enough it reached my house. Schwab was great, but this was too much.
I was very impressed.
And what if your phone is stolen or lost? The hassle is no different than card ...
I recommend:
TransferWise https://wise.com/gb/borderless/card
Revolut https://www.revolut.com
> When you use Apple Card, our issuing bank and payment network partner — Goldman Sachs and Mastercard — and their service providers receive information about your transaction, including the merchant, time, and amount in order to operate Apple Card. Neither Goldman Sachs nor Mastercard share or sell your transaction information with third parties for advertising or marketing. [0]
Hmm, I wonder why they sell it then? Since they needed the "advertising or marketing" qualifier, they obviously sell data to third parties.
1. Maybe they are selling purchase data to hedge funds? Lots of possible use cases.
2. Maybe some regulation only requires them to disclose if the information is sold for advertising or marketing (I think I remember this showing up on some post-CFPB credit card disclosure forms). Therefore the lack of such a disclosure for other uses for the information could mean nothing, just that they are minimizing discourses that aren’t legally obligated.
Just about anyone with a financial account in the US will probably instantly recognize this form:
https://www.ftc.gov/system/files/documents/rules/privacy-con...
Should I be able to get your replacement credit card delivered to my home address with that?
> Both your and the parent's points are valid. Identity verification is a hard problem that the major legacy banks have a big problem with. Their processes are both extremely annoying and can fail and lock out the legitimate account owner (the reason many of you have had trouble replacing cards abroad is because "shipping to a previously known address" is itself a security measure) while at the same time being vulnerable to a targeted attack from someone with knowledge of how the process works.
I’ve had them send replacement cards to my hotel without problem.
Some years back I moved to a different city. About a year later I wanted to make a purchase with my credit card. I found out it had expired. I rang the bank and asked for a new one. They promised to send it to me. It never arrived. Rang again, got the same promise, and still no card. When I called them the third time, the employee found out my old address was still in their database. Turns out the credit card department had a different client database then the debit card department (who had my new address).
To change my address, I had to log in to their site. They weren't allowed to change it on the phone. As soon I tried to log in, I noticed I forgot my password. When I clicked 'reset password', there was a new surprise: they send the new password by snail mail.... to the old address of course!
So I had to go in person to the house I used to live in and explain the situation. I asked them to ring me when the letter with my name on it arrived on their doorstep. Luckily the people who now live in my old house were very nice and gave me the letter!
been there. done that. have the t-shirt. :/
I noticed that on my very first visit to the Netherlands. Many shops just don't accept credit card and that was very strange to me on my first visit. My only use case for debit card was to get cash out of ATM until then. So, I was really surprised to see that everybody uses debit card everywhere. And I was told that credit card is mainly used for online booking and traveling.
Note to Americans: In European countries this tends not to be a thing afaik. Privacy is taken more seriously, so there is no central & privatized system to query for credit. However, to rent an apartment, get a loan or get a new job here in Switzerland it's often required to provide something like a credit register extract from the local government office. That register will get notified when someone isn't paying bills, usually after the third notification ~2 months after a bill was issued (notifying the register is costing fees, so businesses try to avoid it as much as possible). After a couple of years, entries get deleted. This way there is an attempt of balancing privacy, social mobility and the interest of businesses to collect their revenue.
Where does that "free" money come from? From the payment network fees, of course. Mastercard takes a 4%-ish cut, the bank keeps 3% of that, and 2% of that goes back in my pocket. Banks have to offer such benefits because they will get cannibalized by the other players if their card can't compete.
Structurally, it's actually quite stupid that there's an invisible tax which you can only recover by playing ball with the creditors... but on an individual level you would have to be foolish to not take advantage.
My bank, and I believe most banks in the Netherlands, requires proof of stable income well above minimum wage before even considering an application for a credit card. This puts credit cards out of reach of a sizable part of the population.
Also, credit checks and reporting new lines of credit to the authorities by lenders are mandatory for all personal loans, be it for getting a mortgage, issuing a credit card, paying monthly installments for a smartphone bundled with a contract, or buying on credit from Dutch online stores or mail order catalogues.
I have a credit card here and only use it for international transactions[0], it has a fairly low limit to the point where if I'm, say, booking long-haul flights I need to pre-load it with money which fortunately only takes moments. This is partly by choice - as it's automatically paid off each month, I want to ensure I can never put more on it than will be in my bank account - but also that was the default limit when I got it.
[0] local online transactions pretty much always use a system (iDeal) that goes via your bank website.
Personally, I only tend to use credit cards for larger purchases (flights, hotels, etc) because you get some better protections if things go wrong.
Shortly after I relocated from the Netherlands to Australia, my house was broken into and my Dutch debit card stolen. The bank would only send my new card to my local branch, which was 20,000km away. And none of my friends could pick it up because they insisted on verifying my id.
Very frustrating...
Pretty secure I suppose, except in the OP’s case, where it was sent to an old address. And they wouldn’t update it over the phone? So they essentially gave some strangers access to his bank account.
meaning two things: you understand the algorithm and you checked the algorithm.
This is like discovering a compiler bug from code that compiled - statistically unlikely, and requires deeper expertise.
I mean I shouldn't be surprised, it's HN.
Tell them your card was lost - problem solved.
Like the teller possibly doesn't know anything about that algorithm except that it exists. Just show them the card doesn't work they can verify that quickly.
I worked for a very large department store on their mobile app. They issued their own in-store credit cards that only had 9 digits and didn't pass the LUHN check.
They jumped into e-commerce a loooong time ago so the tech stack was showing it's age and they didn't have real test servers. (They did but they were almost always unusably slow.) We did almost all of our testing against the production servers. This was fine because we were mostly just loading product pages and building shopping carts.
Normally for testing checkouts we'd use bogus credit cards like 4111 1111 1111 1111, which passes the LUHN check but is obviously a non-working card so our order would fail.
We had to check the in-store card processing a little differently and would test with the number 123456789, thinking that surely couldn't be a real card number. (You may see where this is going.)
We ended up typing out a lot of addresses so we usually picked one with the first state in our state picker, Alaska. Then we found the shortest city name in Alaska, which is Tok (there's a couple other three letter towns in AK but that's what we usually chose.)
One day, someone decided to check the order history of the account we were using to place those test orders. They noticed a tracking number and clicked on it. We had sent several dresses to 1 A St. in Tok Alaska. It was the longest tracking list I've ever seen with several delays and problems that could only occur when shipping to a fairly remote town in Alaska. (I believe avalanche was one of the listed reasons.)
Sorry to whoever had that card!
This is exactly what that movie is about. The bureaucratic-technological engine being prone to tiny errors, which have cascading effects on the people affected. And despite putting in some effort and telling that engine that what it is doing is ridiculous, fixing it is very much non-trivial. Luckily, this time the consequences are minor. A beautiful illustration of "La technique", the runaway engine of rationality and efficiency, as philosopher Jacques Ellul referred to it.
This is a beautiful illustration of that concept!
I remember seeing something similar in Ubiquiti's UniFi forum a few years back. Their WAPs and switches connect to a management portal you can self host and, after treating both http and https interchangeably forever, they decide https should be actual https. Before that, you could type https://..., but the communication would not use TLS.
They had customers with misconfigurations because they were consistently typing their inform (aka server) URL as https:// instead of http:// during device configuration. As soon those devices were updated, the new firmware would expect a proper TLS connection for https:// URLs, so it would fail.
I remember one person in the forum thread saying they bulk updated 600 devices spread across 300 sites and they all disappeared. That person made mistakes, but the configuration they were using was working, so why would they expect that to change? I tried to make the case that it should be considered a serious bug and part of the response was:
> We discussed this internally and decided to move forward because 1) we didn't feel that there would be many affected
That was a real eye opener for me and now I operate under the assumption that most tech companies won't have an issue completely ruining your life as long as it's only you or a small enough group of users that it won't have an impact on their bottom line.
When I was there I would get a fair amount of mail from people in prisons, and we'd send them books.
The coupons had seeds embedded in the paper, and they were however put into a compostable bin, so hopefully they're flowers somewhere.
Well turns out you don’t use that language at Disney. Database problem got shelved.
Few months later a very angry person called up about the multiple pallets of catalogs sitting in his front yard.
I guess the US considers the printed name to be more important for debit cards.
Merchants have the option of verifying the cardholder by comparing the name to some photo ID but it's very uncommon. There is a box on the back to sign the card but in my experience, the Post Office is the only entity that has ever checked it.
Order 8 of the thing, we shipped 64. Oops.
Nutshell: The items were sold in bundles. To arrive at the quantity to ship, you multiply the quantity of bundles ordered by the quantity of each item in the bundle (just 1 or 2 in most cases). I got my variables confused and multiplied the order quantity by itself.
Not my best day.
And the order in question was for 1000 400oz bars of gold (value $700k each).
It took 4 reissued cards to get my name back.
Then they charged me for the extra cards. It took a short conversation with the bank manager to fix that.
I guess it's true that computers just let you make mistakes faster (look at the names on the cards).
Edit: No, apparently the cards had numbers/names inconsistently Photoshopped for privacy. My bad.
Because many UIs only show the last 4 digits, and because of the birthday paradox, it only takes 4 American Express cards saved to a website before you have a 50% chance of 2 of them being indistinguishable from one another.
https://www.doctorofcredit.com/last-four-digits-american-exp...
*AFAICT, each keystroke has to be sent to Redwood City to be individually massaged and returned.
It's not as bad as you think. That's essentially how SSH works for instance, every keystroke has to be sent to the server before it shows up.
I remember waiting multiple minutes on a production system on more than 1 occasion! =D
Is it an older terminal-based system? Lots of those were designed (and still in use, 40+ years later). Usually it's not a big deal, in fact faster than modern interfaces, because they're built for decades-old hardware and low baud rates. Of course if you're still running the original hardware or have really screwed things up then performance goes out the window.
I've been tempted to do a bunch of 0.01 share transactions to see if I could overwhelm them into giving up on paper transaction confirmations.
It didn't actually have information about what data they store in the databases, so they didn't actually fulfil my request. I figured it's not worth the trees to try and chase it up more....
> According to Delloite, the Polish banking market is the leader of digital maturity in Internet and mobile channels
https://www.consdata.com/en/blog/ultra-modern-banks-in-polan...
If anybody wants a taste of well developed an functioning electronic payments system come to Poland. We accept contactless almost everywhere, often times even on street markets and stands.
The pandemic probably helped move things along too
The queue keeps retrying into the external service. While the external service keeps printing cards.
Since it isn't actually how they make money, it turns out they're markedly worse at it.
source: 4.5 years at a Too Big To Fail/Prosecute bank
It should!
>but their security is mostly via the legal system.
Exactly! It's why I hope we eventually replace them with some cryptocurrency (math) based currency that cuts them out of the loop. They're parasites on society.
> Bank proceeds to buy drilling companies to fulfill the necessary plastic demand so customer 8789 with $2.86 in his account can have all the cards he needs
My mortgage, checking, etc statements all got to my home addressed correctly. They held both mortgages and “fixed” it a dozen times.
I can imagine bit flips doing that on non ECC memory.
A customer might request more than 1 card, but it does not explain the wildly different expiration dates, and different delivery dates.
> I used Photoshop's Content Aware feature to remove the numbers and last name. In some cases, it pulls in surrounding items (Like the "Er" from Peter) and I was too lazy to clean it up.
I think between hackerspace members and coworkers, I could easily come up with 63 trusted test partners. I'd of course do some good tracking to make sure I got all the cards back (maybe escrow one of theirs in place of mine), although that could get tricky if any ATMs got pissed off enough to start swallowing them. I guess everyone also has to record video of their attempt?
It'd be fun to coordinate, for sure. I wonder how wide a radius you'd need to cast to get 64 working ATMs....
There are a whole bunch of fun interesting questions with 64 of the "same" chip card.
With a magstripe card you can't really learn anything interesting from having more than one which you couldn't have learned with a single card and a willingness to disobey instructions from the issuer. The card is just a piece of plastic and a small amount of easily transcribed data in the magnetic stripe - so you can clone them, of course, because that's a thing crooks do, and the clones are indistinguishable.
But a chip card is more complicated, potentially much more complicated, and it will have at least some local storage that isn't transparent. This is part of why it resists cloning, you can buy gear to read and write magstripes (for legitimate purposes) very cheaply, and that's enough to clone a magstripe card, but you can't (shouldn't be able to) read enough data from your chip card to clone it.
Let's number the cards #1-64. Suppose you take card #1 and you try to buy a Coke with it from a card vending machine. Does that work? Or does it need to be "activated" by interacting with an ATM first? If it needs to be activated, after that do cards #2-10 work, or do they too need to be activated?
OK. Now having checked the first ten cards working. What happens if you go to an ATM and change your PIN on card #3 ? Does the old PIN work on card #4 still? Or does it need the new PIN even though you never told it the new PIN?
If you know somewhere that you're certain does offline PIN verification and somewhere you're sure has online (ATMs are always online) try card #5 in the offline place and card #6 in the online place, they might behave differently! In the US you may struggle to find anywhere that does offline PIN because most US outfits seem to treat card present as good enough (which is one reason why the US has very high fraud rates)
Also, find somewhere which gives out very detailed receipts with as much information as possible about your card transaction (e.g. cryptograms, and see if cards #1 and #10 are distinguishable based on the information in those receipts.
Finally, if you're aware of a transaction limit (e.g. maybe only ten contactless transactions between PIN requests) see if the limit belongs to a specific card or the account. If you know (or discover) multiple limits, there might be some in each category.