Hacker News Reader

Comment by pzb | Hacker News Reader

This is a great move to help reduce fraud for their US merchants, but even more important is it expands their potential market. Adding a chip reader opens up the rest of the world.

However, I'm still not sure how they will handle the PIN part of Chip and PIN, as the usual requirement is that the PIN is entered on a dedicated Pin Entry Device which then only presents the unlocked smart card to the merchant register.

View on HN

Yeah, this device would actually be useless in other parts of the world. e.g. in Australia you can no longer sign for credit card/eftpos transactions.

PayPal Here solution to this was to have a seperate Bluetooth card reader and pin pad http://techcrunch.com/2013/02/21/paypal-here-is-coming-to-th...

I think this only handles chip and signature cards, which is pretty useless.

Does anyone know if people can use chip and pin cards but only sign for them?

When EMV was first introduced in the UK (10 years ago...) you could opt to sign instead of entering a PIN number. If you try and do that now in most cases the transaction is declined by the bank. This can cause issues when travelling abroad to countries that aren't use to or don't have the hardware for EMV.

There was also a key liability shift, in that the bank would not accept liability for fraudulent transactions which had been signed for, if chip and pin was available.

No surprise, then, that chip and PIN pretty much became the default, purely because no retailer wanted to take the risk.

Actually as of tomorrow in Australia, you won't be able to sign if you have a card that uses a chip.

http://www.smh.com.au/digital-life/digital-life-news/pins-to...

Depends on the card, which therefore depends on the risk profile that the issuing bank is willing to undertake.

There's a list of acceptable verification methods in the card, and a list of methods the device is can perform is contained in the terminal software. The intersection of these is what's usually performed.

(background - I wrote my first EMV processing kernel in 2001 and am currently working on a bluetooth-enabled card-reader and PIN entry device that looks like it will directly compete with the square device)

If the card supports it. Simplified: the card/chip has a list of "cardholder verification methods" ordered by preference If the terminal/reader supports one of these methods, the card/chip will use it.

Some cards are pin only - notably most of Maestro, Visa Electron and V-PAY cards.

A lot, a majority?, of chipcards issued in the U.S. prefers signatures - I'm uncertain what the percentage is for which doesn't support pin at all.

What's really frustrating is the preference for signature. It makes almost all US chip cards useless outside of the US and Canada because, for whatever reason, standalone terminals and even some online POS pads will trip over the "signature preferred" bit. It also means that cards like you list are not usable at a signature-only terminal, even one like SquareUp that can do online, live verification.

Why can't the US financial system just _follow_ the rest of the world for once?

I haven't run into the "signature preferred" problem yet with automated PoS terminals. Where did you run into this issue? I had no problem buying train tickets with my US-bank-issued EMV card at AMS airport using my PIN.

If I may ask, which bank issued yours? My (former) JPMC card didn't work at any unattended terminals like Luas stops in Dublin. When I went to some stores and used the PIN pad, the terminal spit out a paper for me to sign. I'm looking for a card that is confirmed to work as a PIN-primary card. So far, only the State Department FCU seems to have one.

Mine is a Barclaycard Arrival+ (http://www.barclaycardarrival.com/). It is not a PIN-primary card, but it absolutely works in PIN mode at automated PoS systems.

PenFed (https://www.penfed.org/visasignaturepoints/) also offers a true chip-and-PIN EMV card in the US (again, signature priority, but I've verified the PIN works at PoS).

I don't think your JPMC card has a PIN assigned to the chip. Its PIN can only be used at an ATM to get a cash advance.

Barclays is a British bank fwiw. They're likely to have all the infrastructure in place.

You can implement the pin-pad via the square app. doesn't need to be implemented in hardware.

Not if you want approval from the payment card industry you can't.

They'll want proof that no other app can access the screen, that screen presses can't be recorded and lots of other stuff.

I'm going through this with a hardware pinpad at the moment, the list of requirements is very long and quite stringent.

--edit-- I'm not saying this is impossible, but I find it very unlikely. All the other EMV devices I know of that are designed for use with iOS and Android devices have built-in hardware pinpads because it's just easier... the PCI is very precious about PIN data. For good reason.

Reply on news.ycombinator.com