Comment by dgallagher | Hacker News Reader

Comment by dgallagher | Hacker News Reader

Parent Full thread

Very interesting, thanks for sharing.

You hit on something though; in the U.S. there are tens of thousands of ATM machines all over. They all accept PIN numbers, and I "believe" magnetic-strip as well (not sure if they're doing fancy stuff too with built-in chips or not). It's the standard that everyone uses; debit card and credit cards alike.

To change that to support different tech, you'd have to upgrade all of the ATM machines, all of the credit cards, and all of the backend tech. That's a lot of coordination between banks/credit-card companies. On top of that you have POS systems in stores which are all magnetic-strip based as well, accepting PINs and/or signatures.

Any sort of switch would have to be phased-in over years and require a lot of buy-in. Unless retailers, banks, ATM providers, and credit card companies have a good business case to do so, they probably won't.

I'd imagine it would be easier for some other type of technology which displaces cards entirely, like phone-based payments, would eventually replace all of this. An idea like Coin augments the current "archaic" system and has the potential to take off. But outside of the U.S. it sounds like it won't work without modification.

"Everywhere" else in the world has managed - the combined population of countries that have deployed EMV / chip and pin is vastly higher than the US.

And it is coming to the US too, in some form or other: Pretty much all the major banks have committed to introduce it (though in some cases chip + signature) by mid 2015.

Right but it's not monolithic. States in the US are not meaningful borders economically speaking. So you can't just do one state at a time, or one region.

I'm not saying the US isn't behind the times, but where else has a singular rollout of tech like this been done on a US scale?

> So you can't just do one state at a time, or one region

Of course you can. Countries outside the US did it city by city, bank by bank.

In fact, the US is in the process of a gradual rollout of EMV cards now - a mix of chip+pin and chip+signature cards. The aim for when to complete the transition varies by state, bank, and type of merchants, but most aim to be complete by mid 2015.

There was no big bang switchover anywhere that has already made the transition to my knowledge.

The banks did rolling releases of chip and pin cards as people were issued new cards over a period of years before the switch was complete. When the first people got chip and pin cards there were no locations where they could use the pin.

And in the UK at least, it took a couple of years before you had to use the pin even when faced with a chip+pin terminal - you could keep opting to sign for a long time.

Doing a singular rollout of tech like this is stupid and unnecessary.

The phase-in in USA has "started" for years already - it's supposed to be finished at October 2015; and those who haven't upgraded their gear by that time will be liable for all fraudulent transactions they accept.

I think here in the UK there was a multi-year phase in. Started with the banks own ATMs, then the machines that smaller businesses loan from banks to take payments, then (when there were enough commercial offerings available) there was a sort of forced date for merchants to make the switch (or take more liability, that was the choice).

I think it took at least 5 years.

So yeah, non-trivial. And if (as it sounds like) the banks in the US have managed to offload most of their fraud problems to everyone else involved in the transaction, then there's probably little incentive.

According to Wikipedia, in the UK it took less than 2 years to go from initial trial in 2003 to liability shift in 2005.

"Chip and PIN was trialled in Northampton, England from May 2003, and as a result was rolled out nationwide in the United Kingdom in 2004 with advertisements in the press and national television touting the "Safety in Numbers" slogan. During the first stages of deployment, if a fraudulent magnetic swipe card transaction was deemed to have occurred, the retailer was refunded by the issuing bank, as was the case prior to the introduction of Chip and PIN. On January 1, 2005, the liability for such transactions was shifted to the retailer;"

Also note this bbc article[1] suggesting a Feb 2006 deadline for not accepting signatures from cards that were chip and pin enabled.

[1] http://news.bbc.co.uk/1/hi/business/4692566.stm

EMV cards had been distributed to customers since the late 90s.

I would guess the banks had been rolling out EMV capable ATMs well before 2003. Retail level EMV may have taken two years from trial to liability swith. Infrastructure changes would have pre-dated that by years.

I know EMV cards had been distributed to customers since the late 90s because I used to use mine for testing while I developed the software I wrote that ran several of the retailer systems in that Northampton trial :)

Canada already went through this. It started with the POS terminals, then gradually the cards were replaced with chip cards, then gradually the text on the terminal changed from "Swipe card" to "Swipe or Insert card".

From a consumer perspective, it was virtually painless. The biggest change is that credit card transactions now require a PIN (assuming a chip card and chip-enabled POS).

Just finishing going through this in my province. The latest transition is that all gas pumps now suddenly require me to leave the card in. Yay for Chip and Pin!

That's terrible, so many cards will be left behind.

After the preauth, you're required to take it out before you can start pumping.

Much easier to do in Canada with the number of banks involved. The US would be an entirely different story.

The lack of chip card support in Coin effectively makes it a US only product at this point as most of the card-heavy countries have moved past mag swipe (or, are in the process).

Yeah, having fewer banks and heavier regulation definitely helps.

Also, as other people have pointed out, the US is moving to chip cards in a couple of years (2015). So this product already has a very short shelf-life.

Nah, just have the major banks start issuing chip cards, and then providing chip terminals to merchants. Once the terminals are in-place and work, everyone else has a strong incentive to catch up (fraud prevention) and a lower cost of entry (since they don't have to push merchants to support their new tech).

Once a quarter of cards sport chips and a quarter of machines support chips, it's just a question of issuing new chip cards when old cards come due (or get lost/stolen).

You can magstripe in much of mainland Europe still.

The Chip and Pin machines have a channel to swipe. There are very few places where you hand over a card. For example, in the train stations, the machine to swipe a card is on the same side of the glass as the customer. The agent never handles your card.

So they might be more accepting of Coin (given that they don't see that it is different) than American businesses.

In Australia, if you try to use a magnetic strip in situations where you could use the the chip (i.e. both the card and machine have chip support) it is refused, and the machine tells you to insert the chip.

It's entirely possible that Coin may still be useless outside the US if most machines will reject your card's strip.

This is inaccurate. Whether you are required to hand over the card or not is governed by each member state's regulation. For instnace, in Netherlands or UK you can keep your card; in Poland you might still be asked to hand it over and sometimes for your ID with it. Also, good luck trying to swipe in the Netherlands -- most merchants taped the terminals so that locals do not get confused.

Reply on news.ycombinator.com