Hacker News Reader

Comment by otteromkram | Hacker News Reader

I think this should be hammered into everyone's head and am surprised it isn't already.

I get regular emails from retailers and banks reminding me that they will never call and ask for money or personal info. Then they state exactly what you said; hang up and call the institution's official number if you're unsure who is calling.

(Note: a quick way to find the official number is by looking on your debit/credit card. It should be printed on there.)

(Note note: Don't sign your credit/debit card. Put "SEE ID" or something in the signature area.)

View on HN

> Note note: Don't sign your credit/debit card. Put "SEE ID" or something in the signature area.

When is the last time anybody has even looked at the back of your card?

Signature comparison (or even asking for a signature) is no longer required in most circumstances under the card schemes’ rules, whatever the signature panel says.

Why not sign the card?

"SEE ID" is an explicit instruction.

But I haven't had anyone check the card in ages.

But not a meaningful one. It's a signature panel, not an endorsement one like on checks, or a free-form message to card-accepting merchants.

Best case everybody will ignore it; worst case your card will be declined because somebody will still actually attempt to compare the signatures on the receipt and card, and “SEE ID” is not a signature.

The purpose of "SEE ID" is that a cashier or server actually requests a photo ID like a license and verify the name and visual identity to the person presenting the card.

This seems like the second most secure form of identity check (chip + PIN #1) if everyone could be made to follow it consistently.

> This seems like the second most secure form of identity check (chip + PIN #1) if everyone could be made to follow it consistently.

Yes, but that's not happening since there is no incentive for the merchant to do it. Merchants are generally not liable for card-present lost/stolen card fraud, so the only thing this does for them is add friction.

It's a textbook principal-agent problem (in addition to requiring a human in the loop), and I highly doubt that the schemes would ever introduce anything like that, especially given that there are viable alternatives available (PIN entry on the terminal, on-device authentication for mobile wallets etc.)

Reply on news.ycombinator.com