Hacker News Reader

Comment by 3D30497420 | Hacker News Reader

The use of signatures in the US boggles my mind. Who checks this ever? I worked retail for years in the US and I would usually check the signature and (very rarely) challenge a signature. The customer was almost never happy I did this, so I generally wouldn't bother unless there were other reasons to be concerned. (For example, kids clearly using their parents card or someone who wrote "see ID" on the card.)

One additional thought: I now live in Europe, and use my contactless card for payments. However, sometimes it fails and I am required to use my chip and PIN. (I'm guessing because the bank thought the transaction needed additional security for some reason.) In this case, if I only had my phone, I would be stuck?

View on HN

The need for signatures has decreased (and was mostly killed by the pandemic). But there are still a few stores I go to that need a "signature" either by pen or on a terminal--but just a scribble or an X suffices.

In other words, the signature is completely useless as a fraud prevention mechanism, which is why Chip+PIN was introduced in the first place.

Chip & PIN cards (at least in the UK) have limits before you're forced to verify again via C&P. It's usually a £ amount or # of transactions.

Apple Pay does not force the above, as you have already identified yourself via mandatory biometrics or device PIN.

The re-verification isn't a hard spending limit or count. There's some fuzzy logic (or like the kids today would say "AI") behind it.

Basically it references the purchase to your history and if there's something funky it forces you to re-auth.

Mostly happens to me on vacations and road trips when I pay in multiple locations 100s of km away from each other.

But I've never had to do it at my local grocery store(s), even though I might visit them multiple times a week.

It's called Strong Customer Authentication in the UK. I'm merely repeating what I understand of it, and what I have actually read on bank websites. For example:

"In a ‘card present’ scenario, the convenience of contactless at point-of-sale would remain, however customers will be asked to complete a Chip and PIN transaction when they reach the maximum total contactless spend, or have exceeded the card issuer's limits for consecutive contactless transactions since they were last authenticated." [1]

"When you spend around £100 in shops (across multiple payments, not just in one go) without having used Chip & PIN , we’ll do an extra security check by declining the next contactless payment and asking you to use Chip & PIN instead. " [2]

[1] https://www.barclaycard.co.uk/business/business-matters/frau... [2] https://monzo.com/blog/2019/09/11/strong-customer-authentica...

There is a transaction / amount limit for contactless transactions. Banks generally keep it secret for security - but it can be something like "transactions over x EUR need PIN and also ever fifth will need PIN".

It is pretty annoying because there are a lot of terminals that don't have the PIN keyboard, e.g. on vending machines. If you card decides it needs PIN, you are not buying, unless you can sidestep it using a phone.

>There is a transaction / amount limit for contactless transactions.

It doesn't seem to be universal though. I paid for multiple hotels in Europe (so hundreds of pounds/Euros) with contactless payments and--although I actually made a point of making sure my card had a PIN after a problem on my previous trip--I never needed it.

Most (if not, all) banks will send the transaction to a risk management solution such as LexisNexis including a bunch of metadata. It then assigns a risk score and your bank will factor that in with their risk appetite when deciding whether to ask for your PIN.

With Apple Pay it never asks for PIN (been using for years). I'm no expert, but I think authenticating with FaceID/TouchID means it always provides the equivalent of a PIN.

I think it can ask for a PIN but it is the PIN of the phone when FaceID does not work so is not the card PIN.

Depends on the provider, but with some, you can go contactless+PIN (saved my stomach once or twice already).

Reply on news.ycombinator.com