Hacker News Reader

Comment by Nursie | Hacker News Reader

I don't know why the US hasn't adopted EMV. It's not perfect, but it has cut down fraud massively here in Europe.

They're very hard to clone (I won't say impossible, but attacks against EMV have not generally been of this nature) and the transaction records at both ends will tell you whether the actual, real card was there.

The liability is more clear-cut as a result. If the customer claims the charge was unauthorised, that's between the bank and the customer.

--edit-- of course with EMV cards Coin would no longer be possible or relevant. Neat product, only useful in a magnetic-stripe world, which is at least a decade behind the curve now.

Theoretically with EMV you could put all your credit-cards on one chip and the terminal will either choose a supported default or present you a list, but that would require cross-bank cooperation, never going to happen.

View on HN

As a Brazilian, I think the US banks are very strange.

"Swipe" cards have been phased out years ago - you'd have to try hard to find a bank which will still issue one.

Specifically because you can no longer find ATMs which rely solely on the magstripe. Some banks have biometric fingerprint readers (where you put in your hand and it reads multiple fingerprints at the same time) in addition to the PIN code of the debit/credit card, and sometimes additional passwords.

My bank does not rely on biometrics, but in order to do any transactions, I have to enter a code generated by the bank which consists of three strings, which are prompted one at a time, displayed on screen mixed with other random and unrelated strings, so that someone peeking over my shoulder would not be able to match the button with what's on screen and finally, before the transaction is complete, the account's password. And that's with a chip.

The portable readers you can find everywhere still have magstripe readers in addition to the chip reader and will refuse to read the magnetic strip if the card contains a chip.

Those portable readers use either a 3g connection or standard dialup.

As for the physical "imprints", this is something that 30-somethings like me can barely remember.

Also related: there are no bills which can't be paid online. All banks accept them, unless specified otherwise (usually there are restriction after the expiry date). If you get a bill by mail (instead of email), you can just type the barcode. Or scan it, if you have a reader or a mobile phone with the bank's app.

The concept of getting bills by mail, and then mailing back cheques, as found in the US, is completely alien.

Very interesting, thanks for sharing.

You hit on something though; in the U.S. there are tens of thousands of ATM machines all over. They all accept PIN numbers, and I "believe" magnetic-strip as well (not sure if they're doing fancy stuff too with built-in chips or not). It's the standard that everyone uses; debit card and credit cards alike.

To change that to support different tech, you'd have to upgrade all of the ATM machines, all of the credit cards, and all of the backend tech. That's a lot of coordination between banks/credit-card companies. On top of that you have POS systems in stores which are all magnetic-strip based as well, accepting PINs and/or signatures.

Any sort of switch would have to be phased-in over years and require a lot of buy-in. Unless retailers, banks, ATM providers, and credit card companies have a good business case to do so, they probably won't.

I'd imagine it would be easier for some other type of technology which displaces cards entirely, like phone-based payments, would eventually replace all of this. An idea like Coin augments the current "archaic" system and has the potential to take off. But outside of the U.S. it sounds like it won't work without modification.

I think here in the UK there was a multi-year phase in. Started with the banks own ATMs, then the machines that smaller businesses loan from banks to take payments, then (when there were enough commercial offerings available) there was a sort of forced date for merchants to make the switch (or take more liability, that was the choice).

I think it took at least 5 years.

So yeah, non-trivial. And if (as it sounds like) the banks in the US have managed to offload most of their fraud problems to everyone else involved in the transaction, then there's probably little incentive.

According to Wikipedia, in the UK it took less than 2 years to go from initial trial in 2003 to liability shift in 2005.

"Chip and PIN was trialled in Northampton, England from May 2003, and as a result was rolled out nationwide in the United Kingdom in 2004 with advertisements in the press and national television touting the "Safety in Numbers" slogan. During the first stages of deployment, if a fraudulent magnetic swipe card transaction was deemed to have occurred, the retailer was refunded by the issuing bank, as was the case prior to the introduction of Chip and PIN. On January 1, 2005, the liability for such transactions was shifted to the retailer;"

Also note this bbc article[1] suggesting a Feb 2006 deadline for not accepting signatures from cards that were chip and pin enabled.

[1] http://news.bbc.co.uk/1/hi/business/4692566.stm

EMV cards had been distributed to customers since the late 90s.

I would guess the banks had been rolling out EMV capable ATMs well before 2003. Retail level EMV may have taken two years from trial to liability swith. Infrastructure changes would have pre-dated that by years.

I know EMV cards had been distributed to customers since the late 90s because I used to use mine for testing while I developed the software I wrote that ran several of the retailer systems in that Northampton trial :)

The phase-in in USA has "started" for years already - it's supposed to be finished at October 2015; and those who haven't upgraded their gear by that time will be liable for all fraudulent transactions they accept.

Canada already went through this. It started with the POS terminals, then gradually the cards were replaced with chip cards, then gradually the text on the terminal changed from "Swipe card" to "Swipe or Insert card".

From a consumer perspective, it was virtually painless. The biggest change is that credit card transactions now require a PIN (assuming a chip card and chip-enabled POS).

Just finishing going through this in my province. The latest transition is that all gas pumps now suddenly require me to leave the card in. Yay for Chip and Pin!

That's terrible, so many cards will be left behind.

After the preauth, you're required to take it out before you can start pumping.

Much easier to do in Canada with the number of banks involved. The US would be an entirely different story.

The lack of chip card support in Coin effectively makes it a US only product at this point as most of the card-heavy countries have moved past mag swipe (or, are in the process).

Yeah, having fewer banks and heavier regulation definitely helps.

Also, as other people have pointed out, the US is moving to chip cards in a couple of years (2015). So this product already has a very short shelf-life.

Nah, just have the major banks start issuing chip cards, and then providing chip terminals to merchants. Once the terminals are in-place and work, everyone else has a strong incentive to catch up (fraud prevention) and a lower cost of entry (since they don't have to push merchants to support their new tech).

Once a quarter of cards sport chips and a quarter of machines support chips, it's just a question of issuing new chip cards when old cards come due (or get lost/stolen).

You can magstripe in much of mainland Europe still.

The Chip and Pin machines have a channel to swipe. There are very few places where you hand over a card. For example, in the train stations, the machine to swipe a card is on the same side of the glass as the customer. The agent never handles your card.

So they might be more accepting of Coin (given that they don't see that it is different) than American businesses.

In Australia, if you try to use a magnetic strip in situations where you could use the the chip (i.e. both the card and machine have chip support) it is refused, and the machine tells you to insert the chip.

It's entirely possible that Coin may still be useless outside the US if most machines will reject your card's strip.

This is inaccurate. Whether you are required to hand over the card or not is governed by each member state's regulation. For instnace, in Netherlands or UK you can keep your card; in Poland you might still be asked to hand it over and sometimes for your ID with it. Also, good luck trying to swipe in the Netherlands -- most merchants taped the terminals so that locals do not get confused.

"Everywhere" else in the world has managed - the combined population of countries that have deployed EMV / chip and pin is vastly higher than the US.

And it is coming to the US too, in some form or other: Pretty much all the major banks have committed to introduce it (though in some cases chip + signature) by mid 2015.

Right but it's not monolithic. States in the US are not meaningful borders economically speaking. So you can't just do one state at a time, or one region.

I'm not saying the US isn't behind the times, but where else has a singular rollout of tech like this been done on a US scale?

> So you can't just do one state at a time, or one region

Of course you can. Countries outside the US did it city by city, bank by bank.

In fact, the US is in the process of a gradual rollout of EMV cards now - a mix of chip+pin and chip+signature cards. The aim for when to complete the transition varies by state, bank, and type of merchants, but most aim to be complete by mid 2015.

There was no big bang switchover anywhere that has already made the transition to my knowledge.

The banks did rolling releases of chip and pin cards as people were issued new cards over a period of years before the switch was complete. When the first people got chip and pin cards there were no locations where they could use the pin.

And in the UK at least, it took a couple of years before you had to use the pin even when faced with a chip+pin terminal - you could keep opting to sign for a long time.

Doing a singular rollout of tech like this is stupid and unnecessary.

I remember scratching my head trying to buy ticket from automated ticketing machine in Amsterdam Centraal because the machine required chipped card only and none of my US cards that I carried had one (not to mention the error was not clear enough and I was trying all my cards in different orientation).

So that's why this video was so confusing to me. It was essentially this guy sliding someones card (he claims it's his, but neither the device nor the card know, right?) and then happily paying stuff with it through his fake replica (or the high-tech version of it, the 'coin').

It seemed like a completely unusable system for it's complete lack of any security.

(Particularly if you consider there are now live payment systems that use pretty much the same audio jack serial port hack as this one does to clone cards)

I would assume it would be like any other credit card transaction: up to the merchant to verify the account holder with an ID.

The fraud you're speaking of is not limited to this technology; anyone could find and use a credit card they found on the ground if the merchant did not verify it.

Theoretically, the creators of coin can implement some sort of security in these sorts of situations:

1) They require you to register this "coin" device 2) They require you to add some banking account details

Now, if you were to "clone" someone else's card without their permission, the trail would lead directly to you...

so, you think they'll accept liability for fraud?

I don't think so, there's also no way for anyone to trace the transaction back to them

I don't know if they will accept liability, but they can try to prevent it as much as possible within their ecosystem.

That brings up an off-topic point I've always wondered about. If apple will not make it possible for third party devices to interface with the iPhone through the normal port, why do approve apps that rely on hardware using the audio jack this way?

I've seen credit card readers that act as a hull for an ipod touch and connect to the data port. (Necessary in austria because the audio trick wont work with chips)

But they _do_ allow that. You have to pay a license fee to Apple for the connectors, programming interface etc, but even without that you can do communication using one of the established protocols like MIDI. Also, you could use Bluetooth 4.0 without any licensing at all. So the question to why they allow it is that they're not consistently evil :)

What really concerns me is that these Coin people are now selling, for a trivial fee, a system for other people to clone my card. If I lived in the US where mag stripes were the norm, I would be seriously concerned about this.

Thankfully, in Canada, everything is done via chips, so even with Visa purchases my card never leaves my hand (or at least, my sight). Restaurants bring the terminal to your table, they process everyone there, and then you're done. Sending your card away feels almost archaic now (and a bit patrician, which has its appeal).

In Australia, we've even moved beyond EMV; the majority of merchants now accept Visa PayWave and MasterCard PayPass for tap-and-go.

[edit: Oh, and all my debit/credit cards are now paywave/paypass enabled, and they are all from the big 4/5 banks]

The Coin page doesn't mention this at all; does it have this? If not, it sounds like a step backwards.

I was thinking the same thing. A full 60% of MasterCard and Visa transaction are now paywave/paypass. That's pretty impressive uptake, and I'd imagine it will be just as quick one introduced en-mass overseas. Would love to know Coin's development path for this eventuality!

"Australia leads the world in contactless payments, which have grown from almost zero three years ago to more than 35 million transactions a month and now account for 60 per cent of all MasterCard and Visa credit card transactions, according to Westpac."

http://www.theland.com.au/news/agriculture/agribusiness/gene...

It's times like this that show how backwards the US is in many things.

The whole time I was watching the video, I was thinking "Huh - who swipes their card any more?!"

I don't think they have a path for this. Getting the bank to hand over the keys needed will be next to impossible.

I'll let you in on a little secret - paywave/paypass etc are EMV cards. The interface is wireless and they have a shorter transaction flow. There are less (zero) customer validation techniques, final evaluation (pass/fail) takes place at the stage a 'normal' EMV transaction would decide on pass/online/fail.

As usual there are variations between implementations, but underneath it's all good-ol' EMV :)

So I doubt that these could be supported easily by Coin, it requires various keys that the banks do not allow to escape.

If Coin do manage to get talking to banks about allowing wired or wireless EMV apps to be loaded onto a customer Coin card then that would be awesome. I predict that layers of bureaucracy and brand-management will prevent this.

But good luck to 'em if they try!

Why have the coin with "contactless" payment (as paywave etc is known in the uk at least) when the phone itself should be capable of that itself.

I wonder why the big US banks aren't on board with driving contacless NFC payments?

Commonwealth Bank, the largest bank in Australia is very soon releasing native Android NFC support and NFC style "smart tags" that you stick to the back of your iPhone.

https://www.commbank.com.au/personal/online-banking/commbank...

This pretty much eliminates the need for any kind of "card aggregation". I wonder how quickly other countries will follow suite?

I'm in the UK, and had a NFC "smart tag" on the phone I threw away a year ago. Never bothered getting a new tag for my new phone. Maybe when I next upgrade my phone and get one with built in NFC.

I don't know much about PayWave and PayPass, but this actually sounds even less secure than credit cards. And it still relies on the big two. Sounds like a step in the wrong direction.

It's not about convenience, it's about security and reliability. That's the direction we need to take.

It's less secure than chip and pin credit cards, but it does require the presence of an object that can execute the right encryption operations with the right private keys, which makes it more secure than easily cloned mag-stripe cards. Because it is less secure, there's typically a low transaction limit (in the UK 15-20 pounds).

And it is about convenience - people are willing to accept the risk for the added convenience.

Transaction limits are absolutely an important factor in limiting these kind of risks.

In Netherland, there's also one electronic payment system that does not require a PIN: the "chip knip" (chip wallet). You explicitly transfer an amount of money from your account to the chip (often about $20), and you can use that to pay. You still need to approve the payment by pressing a button on the machine, but if you lose it, you don't lose a lot.

And it probably works without a phone/internet connection, because the money is right there on the card and nothing needs to be verified on any server.

We also have the cheque/savings/credit buttons which I've not seen anywhere else in the world (besides NZ). I have my Westpac debit card set up to use cheque/credit for my personal account and savings for my joint account, but I've not met a single other person who makes use of this feature..

EMV where you need to input a PIN Number is simply a way for VISA/MC to push all the liability onto the customers for stolen credit cards. If a purchase is made with the credit card and PIN, then the issuing bank can simply let the liability fall on the customer, instead of the bank eating the costs, like how it's done today.

The banks don't eat the costs -- the merchants do.

In the UK at least this is not true. The bank have to demonstrate you did not take reasonable care to protect your PIN (e.g you left it written down in your wallet).

See some of the following case studies by the FOS that support the fact that the customer is not always liable even if the PIN is used:

http://www.financial-ombudsman.org.uk/publications/ombudsman...

Merchants eat the costs where no EMV card was used. Customers eat some costs where the bank can prove negligence, and face court if the bank can prove fraud (i.e. signed statement it wasn't you but later the CCTV footage is found. Oops)

Other than that, here in Europe, customers are protected by law from having to take on the liability. Varies by country, but basically it's a case of "you're responsible to see that nobody else gets to take my money, that's why you're a bank numbnuts"

As I Canadian I also read this with a little sadness. It's something I have always wanted ... but now someone made it just as we're close to finishing the transition to EMV.

It can actually be a bit tricky to use my company card to buy lunch at restaurants sometimes because "there's no chip".

Their FAQ says future versions of Coin will support EMV, but I'm not familiar enough with the hardware to know how difficult that is.

Would be good for those stupid loyalty/membership cards I guess, if you are good with explaining what the hell this weird card looking thing is and why it will work like the normal cards every single damn time you use it.

The EMV transaction process has "application selection" as one of its early stages, and some cards do contain multiple applications. However AFAICT this is never across banks or across schemes. So you may get a card that has (say) a Mastercard application on it for domestic use and another for foreign use.

In theory, you could slam mastercard, visa, amex, credit, debit, whatever else you want, all on the one chip. Depending on the exact card and terminal implementation a transaction would either use the default application or get an on-screen display asking you which you would like to use. But you'd have to get the banks to load the app on there as there are sensitive keys involved.

That's not exactly the same as Coin - you couldn't pre-select which card to use in which situation, and you couldn't load them yourself. I suppose in theory you could have multiple EMV chips on a card like Coin and have a circuit-switching arrangement of some sort. There would need to be a way to embed them there and that would put a limit on things...

--edit-- about the stupid loyalty card things - in Australia I noticed most of them had started working on barcodes, and people had smartphone apps that gave them a menu and displayed the right code, pretty cool.

There are three tricks involved with this.

One, you may not be able to download the card app from one card and upload it to another. My GlobalCard fu is not well honed enough to tell you what ADPU you'd need to invoke in order to try, but it goes against the goals of the product to allow this anyway.

Two, if a credit card company provides you with an EMV card, it's got a private key loaded into the card, and may have even originally been generated on the card. It is outright not allowed under any circumstance to download that private key and upload it to another chip; that would be a major hole in the scheme.

Three, not all banks use the same crypto. Even if they all agreed to a single kind of crypto operation, different EMV chips have different performance characteristics when carrying out crypto operations. If the bank can't control the actual EMV chip any more, then they cannot control elements of their payments processing (e.g. session closure within a certain time frame). This problem is the easiest to solve of these three problems.

So, unless the banks get on board with allowing their apps and their keys to be provisioned on an already existing card, or provide some kind of proxy mechanism whereby an EMV card can delegate another card to act on its behalf (and imagine the security concerns with that) then this isn't going to happen.

I don't see the benefit to the banks for doing this. You're far more likely to see paypal succeeding in turning your phone into your wallet (and they are doing it) then you are to see Visa or MC allowing you to link multiple EMV cards into one.

1) Agree, you can't get at various bits of data that must be present in order for the card to be able to do what it does. Most likely sits in private 'files' that READ DATA can't access.

2) Yup, and combined with '1' this means that you'd have to get the banks to do it

3) You'd have to get some more cross-scheme standards about the crypto capabilities sorted out. I estimate we could have all the schemes in agreement by... 2025? Or is that optimistic?

The benefit would only be to the consumer, in the same way that Coin may benefit people, however any method of doing this with EMV would present some sort of extra attack surface and that's generally Bad(TM).

The technical issues are solvable (by any reasonable issuer bank), but Visa/MC simply prohibit you to put competitors together with their cards.

Want to add some loyalty cards on the same chip? Sure!

Want to combine two different MC products? Sure!

Want to have Mastercard together with Visa or some local card network that we dislike? Nope, we don't want that so we'll not allow you to issue such cards.

Very true. Forgot about that.

Share branding? Are you CRAZY???

As another Canadian:

1. Chip cards do make this almost completely irrelevant

2. Supporting EMV is going to be tricky, because cloning those cards is also tricky (skimmers have spent hundreds of thousands on it and haven't figured it out).

3. Most membership cards, even ones that have magnetic stripes on them, actually use the barcodes on the card. Safeway, CostCo, Shoppers, etc. all have mag stripes, but they all use the barcodes. The Coin won't help you with a single one of them.

4. If, as a cashier, someone handed me a Coin and said 'It's okay, it's a Visa', I would say 'no'. No signature, no card number, no anything. There's no difference from my perspective between a person putting their Visa onto the Coin and a person putting someone else's Visa onto the coin, and I'm not going to start accepting obviously cloned cards regardless of who's holding it.

Americans going to Europe: Remember that your credit card might not work as often in Europe. Be prepared for hearing "We only take chip & pin cards here" in shops etc.

Imagine my dismay when a coffeeshop in Amsterdam would not take my magstrip only American Express.

The different scenarios my imagination has come up with all end with you saying "mega bummer, dude".

I paid with cash in the end :) A+, would do again.

amex cards all have chip versions that you can request for free

Have the chip version of the Amex Platinum. Since its the US version, its chip and signature, not chip and pin, and works almost nowhere in Europe.

For those who don't know, the term "coffeeshop" in the Netherlands refers to places that sell cannabis. "café" is a regular café.

A lot of places wouldn't take Amex of any description; it's far less commonly supported than Visa and Mastercard.

Actually, most places WILL take the old 'swipe' cards. But most cashiers and either never worked with or forgetting about swipe cards. You just have to be very verbal and upfront and let them know yours is a swipe/ swipe and sign job.

Many won't take it though, because of the increased fraud risk. I agree that the majority of cases are simple misunderstanding, but that isn't always the case.

Actually, in the Netherlands, even supermarkets stopped accepting swipe cards. The machines are still physically capable of reading swipe cards, but the supermarket simply won't let you, presumably exactly because of this risk.

Note that a lot of places wouldn't accept credit cards in the first place (swipe or not), only debit cards.

I've had the same issue in the past which can be frustrating (though now I always travel with enough cash).

I actually called Visa about it and they told me that any vendor accepting Visa transactions is required by their contract with Visa to accept swipe transactions. She said it was there because the US was still rolling out chip and pin cards.

I keep hearing this but I spent six months in Europe and the only place that wouldn't take my swipe card was SNCF ticket kiosks. Wasn't a problem anywhere else.

Europe is a big place, with around 50 countries... 6 months won't begin to scratch the surface.

It varies a lot by country. In Ireland, for instance, POS terminals deployed in the last five years or so in smaller shops typically don't have a swipe reader at all, and even where a swipe reader is available, the company may have a policy of not accepting swipe cards.

I want chip and pin cards SO BADLY here.

Mainly because it would make my trips to Europe a lot easier, where many systems I've encountered won't work on some non-EMV cards.

Chase Sapphire Preferred offers EMV cards[0] and no foriegn exchange charges. Makes a good travel card.

[0] Technically: chip-and-signature rather then chip-and-pin. Also, you have to ask for the EMV but they're super friendly about it.

I've found my chip and signature Amex Platinum Card to be just as useless in Europe as my old magstrip-only card.

That's surprising; chip and signature exists in part for accessibility reasons and everywhere is meant to accept them.

I had a really tough time with credit cards in Denmark.

I had one chip & sig card that didn't work except in like one restaurant I went to. A couple of places I could use any regular credit card though. Ended up having to go to ATMs and carry cash, which is so uncommon that people think you're a drug dealer. :D

Bank of America has a similar one too, and it doesn't have a yearly fee.

While I don't have that Chase card, I do know very well that most BofA branded cards have far less lucrative rewards than many of their competitors. FIA has a few great cards and they're owned by BofA. But even when I became a so-called "platinum privileges" bofa customer their best card was not very attractive.

Flat 2% cashback cards are great. Rotating 5% category cards a great. Big signup bonuses are great.

I have a Chase British Air card I opened with a 100,000 mile bonus, plus a companion pass once a certain spending level was reached. Long story shorter, we opened two (one for me, one for my wife). Pooled the miles together. We have 220k miles and a companion pass. We're using this for 2 first class tickets from SFO to Europe in the spring. That is, literally, $25,000 in airfare.

Oh, and it's chip + sig :)

tl;dr Often annual fees are very worth it. And also often, an issuer will waive them in all or part.

More and more US banks are starting to issue cards with chip + PIN. My new American Airlines card has it as does my Amex Blue.

http://creditcardforum.com/blog/chip-and-pin-credit-cards-us...

I have an AmEx but not Platinum. It's not worth the extra fees to me.

If they get some sense and implement this on their lower-end charge cards, I'd be a pig in shit. I try to have this be the only card I use.

The chip is available on all of the Amex charge cards, green through platinum. Just ask customer service for it.

Thought that was all chip-and-signature instead of chip-and-pin.

Chip-and-sig is almost useless.

Also, I'm a stingy bastard with the fabled Unicorn Card (Zync) that's no longer offered. I think any changes would mean a forced upgrade. I'm worried about a forced upgrade when the card expires too.

I'm sorry, yes, all the chips on Amex cards are chip and sig, and are just as useless as you describe.

Whether chip and sig is accepted in places around europe will probably depend on the software they have, the merchant's agreement with their acquirer, whether it's an unattended terminal and a bunch of other stuff.

Surprised to hear it's next to useless, but not really surprising that it's less useful.

Chip and sig was accepted everywhere I went in Europe this year. I have a European bank issuer though.

I was up in Canada a few months ago, where EMV cards are ubiquitous. C&S is accepted everywhere, but merchants routinely get confused by the second receipt printing out. I've heard it's the same in Europe.

Here's a very thorough spreadsheet from the FlyerTalk forums: http://www.flyertalk.com/forum/17837493-post1.html

There are a handful of credit unions that issue dual C&S/C&P cards. It's a little harder to get one than an ordinary card, but probably worth it if you're traveling abroad. (I got one from Andrews.)

Marriott Rewards Credit Card by Chase offers a Chip and Pin card. They also have a 70K sign-up bonus points going on right now. If you are new to Marriott Rewards, send me an e-mail and I can send you a referral that qualifies both of us for bonus points.

I didn't realize European automated machines would basically never accept my cards. On a subsequent trip I tried to get chip card, but neither my personal banker nor the branch manager at Wells Fargo had ever even heard of them and insisted I was confused about the problem.

Shopping for a new bank, for many reasons.

Yeah. Wells Fargo is just about the worst bank ever. Even says a WF District Manager I know.

Wells Fargo definitely has chip cards. They shipped me a chip version of my WF credit card out of the blue a while ago.

Citi issues cards with chips now. They have sent me newst one with chip without me even asking.

The US is shifting to EMV at merchants by 2015, see: http://corporate.visa.com/newsroom/press-releases/press1142....

For Debit cards payment scheme's are already joined on 1 EMV chip. The terminal configuration decides which one is used. To join issuers on 1 card I agree cross-bank cooperation will never happen.

Credit cards are divided by payment scheme's. Banks just issue cards for 1 of the scheme's eg. Mastercard or VISA, ... don't think Mastercard. In this field I don't think Mastercard will want their competitor on the same card. Even technically it's not so easy to implement for a payment processor (I work for a payment processor).

This is a total stab in the dark from a foreigner, but I though that it was only recently that US banks could be larger than a state-level entity. My entirely uneducated guess would be that with only state-level banks, none of them would have the pure muscle to push something as big as this.

Canada has adopted EMV very quickly. Within only a few years, I went from swiping everything to swiping almost nothing.

My American card has a chip. It is rolling out here.

Because it's a massive cost for almost no gain.

Do elaborate on "no gain".

A few basis points.

You'll have to dumb it down, I have no idea what this means.

One basis point = one hundredth of a percent

Errr, did you read the part where fraud has dropped massively? And liability is more clear-cut and reasonable for pretty much all parties?

--edit-- and did you think us Europeans just rolled it out for shits and giggles?

> And liability is more clear-cut and reasonable for pretty much all parties?

Meaning shifted entirely to the consumer?

No, the merchant takes reasonable liability - if they permit non-EMV transactions (in a customer-present scenario) they assume the risk.

Under law in much of Europe, the consumer is not under much risk. In the UK (for example) the credit card provider is legally a party to the debt and has a responsibility to refund the consumer on demand if the consumer is willing to state (in a legally binding way) that the transaction was not authorised by them. Debit cards are governed by different rules that amount to much the same, though the legal protections are weaker.

EU law shifts pretty much all liability away from consumer.

There's a cap of EUR 150 consumer liability for lost&stolen (physically) cards up until you notify the bank; zero liability for lost&stolen cards after the time of notification, and zero liability for any fraudulent transactions if your card isn't lost or stolen.

Only UK law (and MC/Visa rules for UK) is a bit different, but another poster describes them below.

Plus depending on whether the terminal allowed chip and pin, and the card had a chip the liability is shifted between the merchant and the bank.

Credit card fraud is generally not a problem in the US for consumers or the credit card companies, the two groups that would be in a position to adopt a new credit card technology. The merchants accept all the liability in the US credit card system, and they're at the mercy of the credit card company's policies, and the consumer's desire to use their card of choice or go somewhere else. As a consumer, I avoid cash-only businesses, and even tend to frequent ones that accept my card of choice (Discover) over those that only accept the cheaper cards (Visa/MC.) Businesses know this, and they're willing to accept credit cards so that they can earn most people's business.

Thankyou, that's an explanation that makes a lot of sense - the poor schlubs at the sharp end are not in a position to make changes.

The merchants generally do have the liability for fraud, but ultimately this "cost of doing business" is reflected in higher prices to the consumer.

But the consumer doesn't notice.

I love cash-only places. You know all your money is going to the hard working people making your sandwich instead of the big four credit card corporations.

You mean, instead of Uncle Sam.

Exactly, just more for Uncle Sam. At least credit card companies are re-investing their profits to cut down fraud and try to make money transfer easier in general. Could they be doing more? Of course, but the CC corporations have done a lot of good, even for the little SMB / mom & pop shop. The transaction rates these companies charge is very low, and that's all thanks to the competition that has driven down the price over the years

for almost a second I thought you were serious.

>You know all your money is going to the hard working people making your sandwich instead of the big four credit card corporations.

In reality, much of your money is going to huge companies that supply their products, like Sysco.

That was exactly the same in Europe. Yet the bank pushed EMV hard.

And the EMV transition has been going on behind the scenes in the US for years too, so expect to start getting cards with a chip as your cards expire over the next couple of years.

if by that you mean no gain to the financial institutions who get a cut whether fraud happens or not, they yeah. No big gain for them = not happening.

I don't know about the US, but professional swipe-card fraud is something that the average European will typically have read about in their local newspaper by now.

It is extremely common.

@virtuz - you are hell-banned

Ref: https://news.ycombinator.com/item?id=6735258

The US hasn't adopted EMV because it isn't necessary. EMV was created because in Eastern Europe many businesses didn't have sufficiently reliable phone and internet connections to validate credit cards -- in the US we have no such problem.

The cost of rolling out EMV was determined to be greater than the cost credit card companies paying for the increase in fraud and chargebacks out of pocket.

I'm not sure about this logic considering one of the earliest adopters of EMV was the UK.

Pretty much every major US bank has committed to rolling out EMV by middle of 2015.

> EMV was created because in Eastern Europe many businesses didn't have sufficiently reliable phone and internet connections to validate credit cards

The first large chip and pin deployment was in France, in 1992. At the time, Eastern Europe was in economic chaos, and not really on the radar.

Reply on news.ycombinator.com