7 ms·

The card actually is inactive until you activate it once it arrives

celticninja 11y ago
but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process? Why dont you send the card and PIN out separately like a bank?
- nacs 11y ago
  > but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process Every "normal" credit and debit card I've received in the mail has used this same procedure -- call a number on a removable sticker stuck to the card to activate it where the only verification is the phone number you're calling from (and caller ID is easily faked). How is this any worse than how every other card activates? And how do you propose they get around the mail interception problem? Have a courier deliver it to you and place it in your hand?
  - celticninja 11y ago
    I was wondering why they think their system is more secure than the traditional method of issuing cards and PINs through the post.
  - MrOwen 11y ago
    Half of the cards I remember activating were based on the originating phone number (which I think you could still possibly spoof) which should have been tied to your account when you signed up. If the phone you're calling from isn't the same one on your account, there's likely some additional information you provide or maybe go through a CS rep to finish activation. Unfortunately, like you say, there are also many bank's systems who ignore or simply don't care about the call ID number. As for interception, I guess you could require a signature for delivery but that's a pita. You just have to weigh the risks in that situation and the convenience of not requiring a signature obviously outweighs the risks of theft. EDIT: grammar
  - kuschku 11y ago
    Holy shit, that’s horrible. Where I am, PIN and Card arrive in different letters, and the Card letter is only sent once you confirmed via your online banking interface (which uses 2FA) that you received the PIN letter. And you need to confirm online in your banking interface to have received the card to be able to use it.
    - bpicolo 11y ago
      For credit cards in the US you virtually never use a PIN. Debit cards only
      - simantel 11y ago
        That's changing as of this month. Most banks have already issued new chip cards, which require a PIN. If a merchant is still using the old swipe and sign system, now they'll be liable for any fraudulent transactions if the customer has a chip card.
        jrockway 11y ago
        The system in the US is not chip-and-PIN, it's chip-and-signature.
        hollerith 11y ago
        All of the new chip cards in the US I've read about are signature only. It was decided that the US consumer would dislike the added complication of needing to use PIN. I'd like a chip card that requires a PIN (and that is accepted widely in the US) because such a card would make unauthorized charges less likely after the card is lost or stolen, but was not able to find one.
        doppelganger27 11y ago
        I have a US chip card where I've set a PIN for transaction purposes, so it's not signature only, but it'll still accept both. That said, all of the chip card readers that I've used (few and far between still...) seem to have been configured for signature only, so I haven't been prompted for my PIN yet.
  - Domenic_S 11y ago
    > (and caller ID is easily faked) It's been a long time since I was into telephony stuff, but IIRC caller ID is easily faked but ANI is not. Do verifications use CID or ANI?
    - mh- 11y ago
      they use ANI, as they're toll free numbers you're dialing (which means they're already capturing ANI for billing purposes[1].) this is also why caller ID blocking (as provided by your telco) doesn't work when calling toll-free numbers. 1: https://en.wikipedia.org/wiki/Automatic_number_identification#Toll-free_numbers https://en.wikipedia.org/wiki/Automatic_number_identificatio...
iamsohungry 11y ago
False: the card is inactive until someone activates it.

but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process? Why dont you send the card and PIN out separately like a bank?

nacs 11y ago
> but if someone intercepts your mail, then they know your address and could possibly know your phone number. How secure is the activation process Every "normal" credit and debit card I've received in the mail has used this same procedure -- call a number on a removable sticker stuck to the card to activate it where the only verification is the phone number you're calling from (and caller ID is easily faked). How is this any worse than how every other card activates? And how do you propose they get around the mail interception problem? Have a courier deliver it to you and place it in your hand?
- celticninja 11y ago
  I was wondering why they think their system is more secure than the traditional method of issuing cards and PINs through the post.
- MrOwen 11y ago
  Half of the cards I remember activating were based on the originating phone number (which I think you could still possibly spoof) which should have been tied to your account when you signed up. If the phone you're calling from isn't the same one on your account, there's likely some additional information you provide or maybe go through a CS rep to finish activation. Unfortunately, like you say, there are also many bank's systems who ignore or simply don't care about the call ID number. As for interception, I guess you could require a signature for delivery but that's a pita. You just have to weigh the risks in that situation and the convenience of not requiring a signature obviously outweighs the risks of theft. EDIT: grammar
- kuschku 11y ago
  Holy shit, that’s horrible. Where I am, PIN and Card arrive in different letters, and the Card letter is only sent once you confirmed via your online banking interface (which uses 2FA) that you received the PIN letter. And you need to confirm online in your banking interface to have received the card to be able to use it.
  - bpicolo 11y ago
    For credit cards in the US you virtually never use a PIN. Debit cards only
    - simantel 11y ago
      That's changing as of this month. Most banks have already issued new chip cards, which require a PIN. If a merchant is still using the old swipe and sign system, now they'll be liable for any fraudulent transactions if the customer has a chip card.
      - jrockway 11y ago
        The system in the US is not chip-and-PIN, it's chip-and-signature.
      - hollerith 11y ago
        All of the new chip cards in the US I've read about are signature only. It was decided that the US consumer would dislike the added complication of needing to use PIN. I'd like a chip card that requires a PIN (and that is accepted widely in the US) because such a card would make unauthorized charges less likely after the card is lost or stolen, but was not able to find one.
        doppelganger27 11y ago
        I have a US chip card where I've set a PIN for transaction purposes, so it's not signature only, but it'll still accept both. That said, all of the chip card readers that I've used (few and far between still...) seem to have been configured for signature only, so I haven't been prompted for my PIN yet.
- Domenic_S 11y ago
  > (and caller ID is easily faked) It's been a long time since I was into telephony stuff, but IIRC caller ID is easily faked but ANI is not. Do verifications use CID or ANI?
  - mh- 11y ago
    they use ANI, as they're toll free numbers you're dialing (which means they're already capturing ANI for billing purposes[1].) this is also why caller ID blocking (as provided by your telco) doesn't work when calling toll-free numbers. 1: https://en.wikipedia.org/wiki/Automatic_number_identification#Toll-free_numbers https://en.wikipedia.org/wiki/Automatic_number_identificatio...

iamsohungry 11y ago

False: the card is inactive until someone activates it.