5 ms·

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature

I was very surprised to learn there's no check for Chip and Pin requirements beyond what the magstripe requests. I naively assumed if the card had that feature the terminal could force it to be used. What would happen with the other fields he mentions, like whether or not you can withdraw cash with the card?

q3k 11y ago
IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.
- stanmancan 11y ago
  I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
  - JaggedJax 11y ago
    That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.
    - noddingham 11y ago
      Based upon my knowledge of EMV liability, the merchant would still be clear from fraudulent charges if they had an EMV reader. If the device tells the reader it can't do chip & pin, then the buyer is the least secure part of the transaction.
    - TeMPOraL 11y ago
      Not in all cases, I believe. For instance, to use my debit card in China, where a lot of payments is still done via magstripe, I have to call my bank and ask them to enable magstripe transactions for me in their system. Otherwise, the bank will keep rejecting transaction attempts.
- JaggedJax 11y ago
  They could definitely do this, but I don't think any of them do (or will for quite a while). It's perfectly acceptable for a business to continue sending magstripe transactions if they want. The business just takes the responsibility for chargebacks. This would just look like a transaction where either the reader didn't have the functionality or the merchant decided not to use it.
  - sliverstorm 11y ago
    The business has an interest in using chip & PIN. I forget the details of the contracts they have with the banks, but the chip adds extra protection to the credit card company, and the PIN adds extra protection to the business. Which is why people are annoyed that the credit card companies want to stop at chip & signature.
- sliverstorm 11y ago
  Pretty sure this has already happened to me in the USA. Though, I was scattered at the time and don't remember for certain.
- the_mitsuhiko 11y ago
  > IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory. That's how it works for all countries other than the US. In the US EMV capable terminals are not common so transactions in the US are typically permitted no matter if magstripe or EMV. This is why starting with October this year the US are finally making the switch to EMV and once that roll-out is complete, magstripe transactions could (theoretically) be either disabled or severely limited. For instance you might have to confirm a magstripe transaction with a text message.
chrisfosterelli 11y ago
The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.
- JaggedJax 11y ago
  Agreed. I think for it to truly work it would require support from the terminal in the form of letting the processor know if the terminal does or doesn't support chip & pin. If the terminal doesn't support it the processor always lets it through. If the terminal does support it the processor only lets it through if using chip and pin. Then again, maybe there won't be non chip and pin terminal much longer so that won't matter.
- nailer 11y ago
  > Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. Should that read 'credit card fraudsters are creating fake cards that include the chip' ?
  - alanfalcon 11y ago
    No, what he wrote makes sense as written in this context.
- Strilanc 11y ago
  I always assumed that chip/pin being used was at least checked by the credit card company. The machine should be telling them if it supports chip/pin, and the cc company independently knows all the information about your card, so... urrrrgh.
  - seanp2k2 11y ago
    What's also interesting about our chip readers here in the US is that they only do chip + signature for credit cards, so they're not adding anything if someone physically has your card (I've had the ones they auto-reissue, which Chase claims they cannot stop in their system, stolen from my mailbox).
halviti 11y ago
The problem of tricking the reader will be solved in the US the same way the rest of the world solved the problem. You stop using magnetic stripes. For the longest time, chip-and-pin readers in most european countries would let you just swipe the magnetic card if you didn't have a chip.. this allowed americans (and whoever else still uses this technology) to be able to shop when they travel. Unfortunately a disproportionate amount of theft occurs by bypassing the chip-and-pin system. Many european countries and banks finally had enough and said "no more loopholes, chip-and-pin only" and set a date. Lo and behold this spurred the US banks to finally start releasing chip-and-pin enabled cards, otherwise their clients would find themselves unable to buy things overseas. The deadlines have come and went in my country, and today it is literally impossible to buy anything with just a magnetic stripe. I imagine the US will solve the problem the same way.. by no longer allowing magnetic stripes to be used.
- rconti 11y ago
  I can't claim to spend a ton of time in a huge variety of countries, but in the past year I've been to Iceland, England, Wales, Scotland, Italy, France, and New Zealand, and I can't remember anywhere I had to use the EMV chip in my credit cards except places like parking garages that didn't have the physical facility for a mag stripe swipe. Every retailer terminal could read a magstripe. More annoyingly, whether I swiped or dipped, a signature was required. Except, again, where there was no way to sign (parking garages). Then, magically, my PIN was "good enough". I went out of my way to get EMV cards last year due to upcoming trips, because I had only been overseas sporadically over the past decade and assumed that the magstripe was gone. It was not. If anything, merchants seemed more able to deal with them than 10 years ago, where I occasionally had a clerk who couldn't figure out whether to swipe extremely slowly, or quickly enough to set fire to the equipment.
  - pjc50 11y ago
    You're a US resident with a US card? As a UK resident with a UK card it's been a long time since I swiped or signed. I think you must have the "require signature always" bit set on your cards because someone in the issuing chain doesn't trust EMV.
Slump 11y ago
This would only be an issue for those that don't authorize with the issuer immediately when the card is read. The issuer would know the service code read by the pin pad and should be able to determine that it is incorrect based on the PAN read by the pin pad and the fact that the merchant is certified to support EMV. They could choose to decline the authorization at that point. Most payment processors that I'm aware of in the US do this.
JimmaDaRustla 11y ago
There is a sentinel character on the mag stripe which identifies the card as chip and pin. As mentioned in the README of this repo, it can be disabled - for the purposes of backwards compatibility, this is a necessary evil. Fortunately, it is easy to detect! The terminal will send the magstripe data online when authorizing the transaction, and the backend systems will identify the corruption in magstripe data and identify it as fraud.

q3k 11y ago

IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory.

stanmancan 11y ago
I live in Canada and that's what happens with all of my visa/debit chip cards. If you attempt to swipe your card and it, as well as the terminal, are chip enabled then it gives you an error and asks you to insert your card into the terminal.
- JaggedJax 11y ago
  That is triggered by the magstripe though. The point here is you can trick the reader by turning off that feature on the magstripe and the reader doesn't do any additional check on whether EMV should be required.
  - noddingham 11y ago
    Based upon my knowledge of EMV liability, the merchant would still be clear from fraudulent charges if they had an EMV reader. If the device tells the reader it can't do chip & pin, then the buyer is the least secure part of the transaction.
  - TeMPOraL 11y ago
    Not in all cases, I believe. For instance, to use my debit card in China, where a lot of payments is still done via magstripe, I have to call my bank and ask them to enable magstripe transactions for me in their system. Otherwise, the bank will keep rejecting transaction attempts.
JaggedJax 11y ago
They could definitely do this, but I don't think any of them do (or will for quite a while). It's perfectly acceptable for a business to continue sending magstripe transactions if they want. The business just takes the responsibility for chargebacks. This would just look like a transaction where either the reader didn't have the functionality or the merchant decided not to use it.
- sliverstorm 11y ago
  The business has an interest in using chip & PIN. I forget the details of the contracts they have with the banks, but the chip adds extra protection to the credit card company, and the PIN adds extra protection to the business. Which is why people are annoyed that the credit card companies want to stop at chip & signature.
sliverstorm 11y ago
Pretty sure this has already happened to me in the USA. Though, I was scattered at the time and don't remember for certain.
the_mitsuhiko 11y ago
> IIRC from some resarch I did, a decent card provider will reject a magstripe transaction from a terminal with EMV capability if a card is known to also be EMV capable... At least, it could in theory. That's how it works for all countries other than the US. In the US EMV capable terminals are not common so transactions in the US are typically permitted no matter if magstripe or EMV. This is why starting with October this year the US are finally making the switch to EMV and once that roll-out is complete, magstripe transactions could (theoretically) be either disabled or severely limited. For instance you might have to confirm a magstripe transaction with a text message.

chrisfosterelli 11y ago

The terminal has no method to determine if the card is Chip and Pin enabled aside from the magstripe. Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. I would argue the way they should implement it is such that the bank itself rejects the transaction if it knows the card is chip enabled and the terminal is as well.

JaggedJax 11y ago
Agreed. I think for it to truly work it would require support from the terminal in the form of letting the processor know if the terminal does or doesn't support chip & pin. If the terminal doesn't support it the processor always lets it through. If the terminal does support it the processor only lets it through if using chip and pin. Then again, maybe there won't be non chip and pin terminal much longer so that won't matter.
nailer 11y ago
> Sure it could check for the actual chip, but credit card fraudsters aren't creating fake cards that include the chip so that wouldn't help either. Should that read 'credit card fraudsters are creating fake cards that include the chip' ?
- alanfalcon 11y ago
  No, what he wrote makes sense as written in this context.
Strilanc 11y ago
I always assumed that chip/pin being used was at least checked by the credit card company. The machine should be telling them if it supports chip/pin, and the cc company independently knows all the information about your card, so... urrrrgh.
- seanp2k2 11y ago
  What's also interesting about our chip readers here in the US is that they only do chip + signature for credit cards, so they're not adding anything if someone physically has your card (I've had the ones they auto-reissue, which Chase claims they cannot stop in their system, stolen from my mailbox).

halviti 11y ago

The problem of tricking the reader will be solved in the US the same way the rest of the world solved the problem. You stop using magnetic stripes. For the longest time, chip-and-pin readers in most european countries would let you just swipe the magnetic card if you didn't have a chip.. this allowed americans (and whoever else still uses this technology) to be able to shop when they travel. Unfortunately a disproportionate amount of theft occurs by bypassing the chip-and-pin system. Many european countries and banks finally had enough and said "no more loopholes, chip-and-pin only" and set a date. Lo and behold this spurred the US banks to finally start releasing chip-and-pin enabled cards, otherwise their clients would find themselves unable to buy things overseas. The deadlines have come and went in my country, and today it is literally impossible to buy anything with just a magnetic stripe. I imagine the US will solve the problem the same way.. by no longer allowing magnetic stripes to be used.

rconti 11y ago
I can't claim to spend a ton of time in a huge variety of countries, but in the past year I've been to Iceland, England, Wales, Scotland, Italy, France, and New Zealand, and I can't remember anywhere I had to use the EMV chip in my credit cards except places like parking garages that didn't have the physical facility for a mag stripe swipe. Every retailer terminal could read a magstripe. More annoyingly, whether I swiped or dipped, a signature was required. Except, again, where there was no way to sign (parking garages). Then, magically, my PIN was "good enough". I went out of my way to get EMV cards last year due to upcoming trips, because I had only been overseas sporadically over the past decade and assumed that the magstripe was gone. It was not. If anything, merchants seemed more able to deal with them than 10 years ago, where I occasionally had a clerk who couldn't figure out whether to swipe extremely slowly, or quickly enough to set fire to the equipment.
- pjc50 11y ago
  You're a US resident with a US card? As a UK resident with a UK card it's been a long time since I swiped or signed. I think you must have the "require signature always" bit set on your cards because someone in the issuing chain doesn't trust EMV.

Slump 11y ago

This would only be an issue for those that don't authorize with the issuer immediately when the card is read. The issuer would know the service code read by the pin pad and should be able to determine that it is incorrect based on the PAN read by the pin pad and the fact that the merchant is certified to support EMV. They could choose to decline the authorization at that point. Most payment processors that I'm aware of in the US do this.

JimmaDaRustla 11y ago

There is a sentinel character on the mag stripe which identifies the card as chip and pin. As mentioned in the README of this repo, it can be disabled - for the purposes of backwards compatibility, this is a necessary evil. Fortunately, it is easy to detect! The terminal will send the magstripe data online when authorizing the transaction, and the backend systems will identify the corruption in magstripe data and identify it as fraud.