6 ms·
I'm dealing with development on some of this right now for US based POS customers and so far everything I've been told is that the US isn't even going to attemp
by Sleaker 11y ago
I'm dealing with development on some of this right now for US based POS customers and so far everything I've been told is that the US isn't even going to attempt to utilize the PIN entry capabilities, so we're still using signature validation in case of fraud. I'm not sure how this is any better than MSRs. The whole spoofing PIN validation thing doesn't even come into play because it's not even going to be checked.
- ghshephard 11y ago"signature validation " I've left the back of my credit-card unsigned for 2+ years, and in that entire time, and north of 500+ transactions with a signature, I've been asked for identification less than 10 times. I wonder if there has been a single person challenged on a signature in the last 5+ years with a credit card if they even made the slightest attempt to sign in a fashion similar to what's on the back of the card?
- hga 11y agoTip from my father, who switched from cash to almost all credit cards at POS: write "Photo ID Req." in permanent marker in the signature area. And, hey, one time when he sent me in to BBQ joint for some takeout with his card the cashier did look, but I was able to show my ID and make a plausible case for being his eldest son ^_^.
- ghshephard 11y agoHow often do people actually request Photo ID?
- fweespeech 11y agoCertain organizations require cashiers to check ID 100% of the time. They generally deal with high value purchases (3-4 figures). But outside of those? Almost never.
- MichaelGG 11y agoProblem is the card is not valid unless signed. An attentive merchant will insist on the card being signed. This has only happened to me a couple of times but still.
- ghshephard 11y agoIn California, Singapore, British Columbia - I've never had any problem with having an unsigned card, other than being asked for ID a handful of times.
- heywire 11y agoOne of my American Express cards doesn't even have a place to sign anymore (Amex Blue Cash Everyday)
- rasz_pl 11y agopermanent marker is not that permanent under IPA or acetone.
- DougBTX 11y agoThe signature panel is not permanent either, on at least one of my cards it has rubbed off to reveal a strip of "void void void" underneath.
- ghshephard 11y agoIt would be hilarious if merchants let you use that card.
- kbenson 11y agoConsidering at this point the vast majority of my CC usage never requires the card leave my possession, I can't imagine anything the card says being a major impediment.
- kelnos 11y agoI know people who do that, and they tell me that most merchants don't actually ask for ID. Which is surprising, since the merchant bears the pain in the case of fraud.
- TeMPOraL 11y agoI guess in 99% of cases they see the transaction is not a fraud. This is, by the way, the reason software development is hard - if you were to approach this problem the way typical software requirements are defined, you'd only piss the clerks off. In real life, people dynamically adjust their compliance with procedures to run the common case with minimum effort and improvise if something unexpected happens.
- derekp7 11y agoExcept the person working the cash register isn't the merchant -- they are an employee, who isn't really worried about their job because they've only been there for a few months, and replaced a previous employee that was there for less than a year.
- Domenic_S 11y agoThe lesson from your story is that "See ID" doesn't work. Indeed, these are the merchant guidelines from Visa: > In the US, some customers write “See ID” or “Ask for ID” in the signature panel, thinking that this is a deterrent against fraud or forgery; that is, if their signature is not on the card, a fraudster will not be able to forge it. In reality, criminals often don’t take the time to practice signatures. They use cards as quickly as possible after a theft and prior to the accounts being blocked. They are actually counting on you not to look at the back of the card and compare signatures; they may even have access to counterfeit identification with a signature in their own handwriting. In this situation, follow recommended steps listed above under Unsigned Cards. It makes even more sense given this guideline, from the same handbook: > When should you ask a cardholder for an official government ID? [M]erchants cannot make an ID a condition of acceptance. Therefore, merchants cannot as part of their regular card acceptance procedures refuse to complete a purchase transaction because a cardholder refuses to provide ID. (Source, PDF: https://usa.visa.com/dam/VCOM/download/merchants/VBS-06-APR-14-card-acceptance-guide-for-merchants.pdf https://usa.visa.com/dam/VCOM/download/merchants/VBS-06-APR-...)
- ghshephard 11y agoI struggle to understand the security rationale behind that advice - what is more likely - Thief spends 60-90 seconds practicing the signature on the card, or Thief acquires government ID that matches name on the card. Regardless - any time I'm making a large purchase (even with a signed card), you can be certain they scrutinize my government ID - I've never seen a retailer who has ever paid attention to the rules that stipulate you cannot make an ID a condition of acceptance.
- Domenic_S 11y agoIf it were a meaningful amount of money, it's more likely the criminal would clone the card onto one with their own name on it. It's purely a branding rationale. For some people, being "grilled like a potential criminal" by a checker would be enough for them to stop using the card or not shop at that store. Either way, it's a negative association between that merchant and that card for that kind of customer. Card networks have fantastic anti-fraud algorithms that are way more reliable than a bored teen checker.
- fweespeech 11y agoI think, honestly, the US system operates on the "well, if there is no chargeback, its valid" system.
- kelnos 11y agoI don't think I've signed the back of any of my cards in close to 10 years, and I've been asked for identification less than 10 times.
- xirdstl 11y agoAs a consumer that uses credit cards, I don't think of this as much of a problem. All the credit cards I've used have 0 liability for fraud. It's a nuisance if my card is used fraudulently because I'll be issued a new card with a new card number, but disputing and getting a fraudulent charge removed has never been difficult. In fact, in a lot of cases, the bank is proactive about trying to identify those up front and contacts me.
- gnopgnip 11y agoIf someone steals your chip+pin card and your pin you will probably be considered negligent by the bank. If they steal your credit card and fake your signature you will probably have zero liability.
- kbenson 11y agoDepending on how the liability is defined, I might consider purposefully burning out my chip-and-pin so it falls back to signature authorization. I'm not interested in allowing the credit industry pulling a bait-and-switch on me by promising a new secure system that also shifts liability to me, when the new system is horribly insecure. Luckily, since I live in the US, it looks like they are requiring online auth, so I just need to make sure this includes online pin auth.
- Sleaker 11y agoretailers aren't supposed to accept unsigned cards though. And they can even force you to sign the card before they accept it. They are also not allowed to ask for Identification if your signature matches the back of the card (customer can complain to Visa/MC etc if they are asked). This is why the 'SEE ID' stuff is not really recommended. IT all comes back to fraud prevention though, and the point of the signature is not to protect you, but to protect the merchant in case you file a charge-back saying that you didn't actually authorize the purchase.
- sprite 11y agoNone of my cards are signed and the merchant never checks the back of the card or asks for ID after signing. In a lot of cases AMEX doesn't even require signatures for purchases.
- yonran 11y agoThe chip+signature card is pretty annoying when traveling. While visiting New Zealand (where local cards are all chip+PIN) with a U.S. chip+signature card, the majority of clerks actually request to see the card and visually inspect the signature. Also, I can’t use the cheapest petrol stations because they all require PIN.
- joosters 11y agoDo banks in the US transmit the signature to the bank when you sign on an electronic pad? Can the signature be retrieved later on if you query a transaction?
- kbenson 11y agoMy understanding is yes, but they are never looked at unless requested. Planet money did a story on this last year[1], and recently re-ran it. The money quote from the article was when asking the expert if there was any consequence to signing some random picture as your signature was something along the lines of "No, except it may be somewhat awkward if you had to verify it in a trial for some reason." 1: http://www.npr.org/sections/money/2014/09/08/345820789/why-do-we-sign-for-things-a-rabbi-a-lawyer-and-a-mastercard-exec-explain http://www.npr.org/sections/money/2014/09/08/345820789/why-d...
- Sleaker 11y agoYour question doesn't make much sense to me, but with what I've worked with _retailers_ do not send the electronic signature to the bank. It is for the retailers documents (ie to print on the receipt, or to store in a database with the transaction). In the case of a dispute they would then send the information.
- heywire 11y agoSome payment network providers do provide electronic signature storage as a service for this purpose.
- rasz_pl 11y agoGoing for signature instead of pin is BRILLIANT ... for the banks, because any fraud is charged out of merchants pocket - he didnt verify card owner identity at the time of the transaction. Good luck asking every single customer for ID at the supermarket checkout. Whole point of PIN was to move responsibility over to VISA and banks. This is why they kept claiming every transaction with chip&pin card is 100% valid and there is no chance of fraud. Reading this article gave me LOL. Their super fraud prevention is asking the card for multiple pin verification before client enters real PIN, so if the card validates random bad PINs reader can flag fraud. This will stop scammers for ... one week? until they start programming shims to only validate one particular PIN making the card act like the real one.
- Sleaker 11y agoit's just an odd situation, the Chip cards have to remain inserted while the entire transactions completes, but the signature is on the card.. how do you verify until after the fact?
- bri3d 11y agoIt's much better than MSRs because online transactions aren't vulnerable to skimming / replay. This eliminates the ability to clone cards using an ATM skimmer or over-the-wire stolen track data, which by my understanding is one of the primary identity theft attacks against US cards. This "yes-card" attack relied on having physically stolen the original card (not skimmed) and only worked against offline transactions using SDA, which, as far as I know, aren't supposed to happen in the US. As long as merchants continue to accept magstripes the security benefit isn't really there, but, in the ideal world where they accept only chip-and-sig, it's still much more secure than MSR even without the added protection of a PIN.
- kbenson 11y agoIt's possible to encode a card with a specific number, so as long as you know the number and cvv, you could conceivably create your own card, since you are bypassing the chip-and-pin system anyway.
- makomk 11y agoIt worked against transactions that use offline PIN verification, which happen to be a lot more common than offline transactions. Some security researchers in the UK demonstrated the same attack using online transactions with offline PIN verification, which was standard for everything except ATM transactions at the time.
- amyjess 11y agoSignature validation has nothing to do with fraud prevention. Your signature just means you accept the terms of the cardholder's agreement.