The credit card industry is still on dial-up while thieves are using broadband
business.time.com
business.time.com
The recent mentions of EMV had me thinking there was some new type of security that improved on Chip and Pin but no - you haven't even had that yet.
What was the hold-up? This was launched in the UK ten years ago.
Nobody wants to pay for new EMV-capable payment terminals; heck, at a conference I went to two years ago, people were still using carbon copy credit-card processing machines (!).
In the SF Bay Area, every merchant that uses Square as a payment processor can only process mag-stripe transactions. Square supports neither Chip and PIN nor NFC/PayPass/PayWave transactions -- by design. (This leads to a "better customer experience", IIRC.)
OTOH, the huge machine-learning machinery built by credit-card processors in the US has helped mitigate much of this risk; I've had enough false positive declines that I'm confident that the fraud-prevention systems currently used, while expensive, work in 90+% of cases.
Edit: I should mention that in Canada, Chip-and-PIN roll-out occurred concurrently with the roll-out of NFC/PayWave/PayPass, so the "increased" security of PIN was offset by the ability to read your credit card wirelessly. The banks mitigate this by limiting PayWave/PayPass transactions to ~$100 (it's meant to be used for things like going to McDonald's or Tim Horton's/Starbucks).
In the Netherlands, cash is on the way out due to the massive adoption of instant Debit Card payments for even the smallest purchases. Merchants prefer not to handle cash because it's safer (robbing a store with no money is pointless) and cheaper (no dealing with money transports, deposits, counting the registers, having change on hand). Compared to all of that, getting card terminals is cheap.
Using the same system for Credit Cards is mostly just a side-effect of the push to eliminate cash. It's also the reason Credit Card usage isn't all that widespread in the Netherlands. They're only used for big ticket items (sparingly), on vacation and for international online purchases.
The fees for Interac are typically rather low (IIRC, a monthly fee plus $0.50/transaction) compared to Visa/MC (some percentage of the sale, depending on risk).
Debit transactions through Visa/MasterCard generally just give you the worst of both worlds (high merchant fees, and transactions affect your checking account balance instantly).
I'm not sure about the fees, but I'm under the impression they are lower than credit (mostly because POS systems are set up to prefer PIN style transactions).
http://www.youtube.com/watch?v=rP_X6j06EGE
Notice what you see at 0:13? A chipped card. In America. So it seems someone is trying to get this moving...
Instead of chip-and-pin there are alternatives which create one-time numbers through the magnetic strip. I think those should be put into place.
What could the bank do? Well they already have my cellphone number. A SMS with you're about to transfer XXX to bank account YYYY would be nice. Or a MAC-adress savety? Allow me to add machines the way Apple does with their iPhone. Instantly block all other machines.
Edit: Solutions
That's still orders of magnitude better than 'No PIN'. And frankly, if you allow others to see your PIN you are not properly educated by your bank (I sometimes see elderly people do that and they get a pass from me) or reckless/careless (in which case I have no sympathy).
Of course attack vectors exist. They always do. This very site talked about card skimmers a couple of times for example, which copy the magnetic stripe and record the PIN at the same time. As soon as you mix social engineering/clever people in the mix you have boundless opportunities. But that's a different terrain, attacking the person in front of the ATM and not the technology.
In reply to your potential solutions: That 'Send SMS to phone' is implemented over here - I get my transaction codes for my mobile banking site via SMS and the message specifically restates amount and target before the TAN itself.
About my PIN? Yeah it doesn't work outside my country. In just 1.5 hours dive you can use that card abroad without the PIN. The banks have now blocked this by blocking the card abroad. So I need a Credit Card as well...
My friend works for the biggest payment system we have around here. They do not care about these systems as they're focusing on a society without PIN/Credit Cards. Cool of course, but for now we're stuck in 1980.
That said: I see a weird trend over here as well - it seems stores are regularly switching between the card&pin method and the braindead 'just sign here' way of things. So my card can probably be abused, albeit not online and not at any ATM.
I don't think we disagree a lot: There are still huge gaping holes that aren't hard to exploit. But that's still no reason _not_ to use the card&pin system (-> see article). We shouldn't stop there and wear a smug face, 'Europe is secure, we are done'. But in the light of this article we're still better off.
Nope. All that proves is that you own the card. It doesn't imply that the transaction is worthy of approval by the bank.
It needs to be a three-way conversation between the merchant, you, and your bank. The merchant is represented by his POS. You are represented by your phone. And the bank sits somewhere in the cloud. The merchant presents the bill to your phone. You approve the charge by entering a code on your phone. Then the bank approves your approval, and the transaction is complete. Everything is encrypted, and there is nothing to skim.
This requires a) having a mobile phone, and b) having a properly-working mobile phone (battery charged, able to receive a signal, etc). That's a lot to ask for a lot of people in a lot of locations. If a device representing a third party is requires, we'd be better off with an RSA-type key fob.
The point is not to have replayable data streams (mag stripes) available for interception and abuse.
Deleted comment
There are three parties involved: the merchant, you, and the bank. You are ordering the bank to transfer funds to the merchant. Naturally, the bank has a say in the matter. After all, you might or not be able to afford the shiny Maybach.
To keep out hackers, the whole interaction needs to be strongly encrypted. That requires the merchant, you, and the bank to be able to communicate securely. Mag stripes are not secure. But your phone, provided you are not a complete ditz, offers hope.
Merchant presents bill to your phone. You approve (or not — maybe you stole the phone and don't know the code). Merchant presents your approval to the bank. The bank approves or declines, and the transaction completes or it doesn't. Eavesdroppers can intercept the encrpted interactions but can't replay them with any effect other than to raise alarms.
Why isn't something like the above already in place? Because it will cost a bundle to convert, and current credit card fraud rates are at the single-digit basis point level.
Actually, the reason improvements like chip and pin are not prevalent in the US is that the US has historically had better datacomm than other places, so the need to authenticate offline was less urgent. At least, that's the excuse I've heard.
Thankfully these wise financial institutions know how to count monies, offloading fraud costs into higher fees and fines for consumers and businesses. Else we'd all be in a bad spot.