4 ms·

The EMV chip credit card transition in the US has been a disaster

44 points by chewymouse 10y ago

resoluteteeth 10y ago
Articles like this ("chip cards are annoying and they're pointless because we aren't using pins") keep coming out lately, but I think it's important to consider two facts. 1) The user experience is mostly only bad because it's not clear whether terminals accept the chips or not. Once everyone has chip cards this will be a nonissue. 2) Chip and pin cards in Europe have had serious problems with attacks that make it possible to use a small device between the card and terminal to use stolen cards without knowing the pin, making the whole pin system fairly pointless. Chip cards still provide a lot of security, and chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table. Anyway, in my opinion the bigger issue is that chip cards do nothing to secure internet transactions. This is sort of a shame, but it would require much more effort on the part of the credit card processors, merchants, and banks to fix.
- Symbiote 10y ago
  For (2), is there any evidence that these attacks have been carried out? I know researchers have demonstrated "stealing" low-value things, like a coffee, in an offline transaction. That's not especially useful for criminals. > chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table In Europe, that was seen as a problem — waiters weren't (aren't?) trusted not to record the card number for future use. A device like this [1] can sign a transaction, but at least the British banks only use it for online banking (logging in, making a transfer and/or adding a new destination for a transfer). [1] https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
- drdaeman 10y ago
  > chip cards do nothing to secure internet transactions While not today, NFC-enabled cards may change this (using snartphones as networked readers). Probably with much less effort, than needed to fix the offline stuff, because 3D-Secure is already a thing and adding physical card possession doesn't seem to be a hard problem (again, only for NFC-enabled cards)
- tdkl 10y ago
  > continue the system where waiters take the card to terminal away from the table. There are portable POS terminals you know. Most of the time the portable device is used first for ordering, where the waiter enters the order, kitchen receives it and the billing software makes the receipt ready. When the guest is ready to pay, he uses the card right beside the guest. Btw, this existed in EU for years now.
  - superuser2 10y ago
    Yeah, Americans restaurants could easily (and cheaply) have adopted Square years ago. They are just very resistant to change and not inclined to spend their already thin margins or take risks on technology.
- superuser2 10y ago
  It doesn't matter when everyone has chip cards - it matters when merchants decide to enable chip functionality on the terminals they have already paid for and installed. The overwhelming majority of retail establishments near me have not. I think the solution to online payments is something like Apple Pay coming to all platforms.
jalk 10y ago
I remember the first chip terminals in Denmark as being annoyingly slow. This was probably 5 years ago. Today they are as fast as swiping. Rollout of nfc based cards /terminals has been going on for 10 months or so, and those are super snappy, don't know about security implications though.
kylehotchkiss 10y ago
"Critics have told me that banks opted for a signature versus a PIN code because it saves them large amounts of money by not having to store PIN codes for everyone."
- qq66 10y ago
  PINs are very costly because every time someone forgets one, you need to do an identity verification which usually depends on a human employee of the bank.
  - nocha 10y ago
    I'm in the UK and I forgot my credit card pin a few years back. Getting it sorted was as simple as phoning an automated phone number, entering my card details and they then posted a new pin to the address they had on file. I highly doubt there was a single human involved in the entire process, and it was probably just an add to their lost card procedures.
walrus01 10y ago
All of this FUD about bars and restaurants is a solved problem in Canada, where almost everyone uses Interac chip and pin cards. There are lots of hardware choices of portable wireless chip and pin terminals for restaurant use.
jimrandomh 10y ago
I live in Massachusetts, and the stores near me have recently switched from accepting swipe cards to using chips (in the same cards). It's worse, for silly reasons. With a swipe card, you can swipe any time while the cashier is scanning your items, then after they finish scanning they indicate they're done and then it asks you to confirm the result. With a chip card, if you insert the card before the cashier is done scanning, it won't work; it'll give an error and you have to take it out and reinsert it after they finish. On top of which there's also a ~20% read error rate.
- woliveirajr 10y ago
  Have to wait to finish to insert the card and type the pin is just a matter of design of the equipment: you can insert it as any time of the supplier designs it that way.
  - Tibbes 10y ago
    Insert it any time, yes, possibly. Remove it at any time, no. The chip on the card is cryptographically signing the transaction, which includes the total. It can't sign it until the total is known. In practice, I suspect the equipment is designed not to allow you to insert the card early so that you check the total first.
- foepys 10y ago
  Why would you want to confirm a transaction before you know how high it is? Maybe the cashier made a mistake and scanned your milk 20 times.
  - erikpukinskis 10y ago
    Efficiency. You can finish payment while the cashier is ringing you up, and then you can bag groceries while the cashier is finishing the transaction and moving on to the next customer. If you have to wait for the total before entering your PIN and accepting the transaction, you hold up the line. Some people might want to wait for the number, but why force me to? If the cashier made a mistake, you can say something to the cashier before they confirm. Worst case you can always reverse it.
woliveirajr 10y ago
In Brazil, probably all cards have chip and chip+PIN has become universal. It works great: - it's as fast as swyping and signing; - there are portable terminals using gsm, so no waiter has to take your card far from you (yes, take a photo of your card from front and back and go shopping online!) - there is competition among the providers: you can stick to the company that will have a smaller fee providing you the equipment. When used my card in travels to the USA, found it funny to have to swype: the magnetic strip is easily damaged (and wouldn't work sometimes) and the "signature" on those equipments were laughable, since you sign whatever you want. In Europe, don't remember to have swiped my card. But the PIN had some problem (and had the same in the USA with chip+pin): cards can have 4 or 6 digits inn Brazil, but there were room for just 4. Sometimes it works if you type just the first 4, some countries you type the last 4.
korginator 10y ago
I'm amazed at how EMV chip technology which has been in use in my country for over a decade, with chip based transactions being the de-facto mode, became a "disaster" in the US. Banks have started issuing chip-only cards, and several retailers don't use magstripe any more. ATM cards too are chip-based for several years. This "disaster" in the US appears more like a case of poor education and training than a problem with chip cards themselves.
- erikpukinskis 10y ago
  For me the biggest issue is the speed. I have to sit and wait for maybe 30 seconds while the transaction is processed. I believe the issue is that many vendors here have old card readers that are slow. It's not just a training issue.

44 points by chewymouse 10y ago

Articles like this ("chip cards are annoying and they're pointless because we aren't using pins") keep coming out lately, but I think it's important to consider two facts. 1) The user experience is mostly only bad because it's not clear whether terminals accept the chips or not. Once everyone has chip cards this will be a nonissue. 2) Chip and pin cards in Europe have had serious problems with attacks that make it possible to use a small device between the card and terminal to use stolen cards without knowing the pin, making the whole pin system fairly pointless. Chip cards still provide a lot of security, and chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table. Anyway, in my opinion the bigger issue is that chip cards do nothing to secure internet transactions. This is sort of a shame, but it would require much more effort on the part of the credit card processors, merchants, and banks to fix.

Symbiote 10y ago
For (2), is there any evidence that these attacks have been carried out? I know researchers have demonstrated "stealing" low-value things, like a coffee, in an offline transaction. That's not especially useful for criminals. > chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table In Europe, that was seen as a problem — waiters weren't (aren't?) trusted not to record the card number for future use. A device like this [1] can sign a transaction, but at least the British banks only use it for online banking (logging in, making a transfer and/or adding a new destination for a transfer). [1] https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
drdaeman 10y ago
> chip cards do nothing to secure internet transactions While not today, NFC-enabled cards may change this (using snartphones as networked readers). Probably with much less effort, than needed to fix the offline stuff, because 3D-Secure is already a thing and adding physical card possession doesn't seem to be a hard problem (again, only for NFC-enabled cards)
tdkl 10y ago
> continue the system where waiters take the card to terminal away from the table. There are portable POS terminals you know. Most of the time the portable device is used first for ordering, where the waiter enters the order, kitchen receives it and the billing software makes the receipt ready. When the guest is ready to pay, he uses the card right beside the guest. Btw, this existed in EU for years now.
- superuser2 10y ago
  Yeah, Americans restaurants could easily (and cheaply) have adopted Square years ago. They are just very resistant to change and not inclined to spend their already thin margins or take risks on technology.
superuser2 10y ago
It doesn't matter when everyone has chip cards - it matters when merchants decide to enable chip functionality on the terminals they have already paid for and installed. The overwhelming majority of retail establishments near me have not. I think the solution to online payments is something like Apple Pay coming to all platforms.

jalk 10y ago

I remember the first chip terminals in Denmark as being annoyingly slow. This was probably 5 years ago. Today they are as fast as swiping. Rollout of nfc based cards /terminals has been going on for 10 months or so, and those are super snappy, don't know about security implications though.

kylehotchkiss 10y ago

"Critics have told me that banks opted for a signature versus a PIN code because it saves them large amounts of money by not having to store PIN codes for everyone."

qq66 10y ago
PINs are very costly because every time someone forgets one, you need to do an identity verification which usually depends on a human employee of the bank.
- nocha 10y ago
  I'm in the UK and I forgot my credit card pin a few years back. Getting it sorted was as simple as phoning an automated phone number, entering my card details and they then posted a new pin to the address they had on file. I highly doubt there was a single human involved in the entire process, and it was probably just an add to their lost card procedures.

walrus01 10y ago

All of this FUD about bars and restaurants is a solved problem in Canada, where almost everyone uses Interac chip and pin cards. There are lots of hardware choices of portable wireless chip and pin terminals for restaurant use.

jimrandomh 10y ago

I live in Massachusetts, and the stores near me have recently switched from accepting swipe cards to using chips (in the same cards). It's worse, for silly reasons. With a swipe card, you can swipe any time while the cashier is scanning your items, then after they finish scanning they indicate they're done and then it asks you to confirm the result. With a chip card, if you insert the card before the cashier is done scanning, it won't work; it'll give an error and you have to take it out and reinsert it after they finish. On top of which there's also a ~20% read error rate.

woliveirajr 10y ago
Have to wait to finish to insert the card and type the pin is just a matter of design of the equipment: you can insert it as any time of the supplier designs it that way.
- Tibbes 10y ago
  Insert it any time, yes, possibly. Remove it at any time, no. The chip on the card is cryptographically signing the transaction, which includes the total. It can't sign it until the total is known. In practice, I suspect the equipment is designed not to allow you to insert the card early so that you check the total first.
foepys 10y ago
Why would you want to confirm a transaction before you know how high it is? Maybe the cashier made a mistake and scanned your milk 20 times.
- erikpukinskis 10y ago
  Efficiency. You can finish payment while the cashier is ringing you up, and then you can bag groceries while the cashier is finishing the transaction and moving on to the next customer. If you have to wait for the total before entering your PIN and accepting the transaction, you hold up the line. Some people might want to wait for the number, but why force me to? If the cashier made a mistake, you can say something to the cashier before they confirm. Worst case you can always reverse it.

woliveirajr 10y ago

In Brazil, probably all cards have chip and chip+PIN has become universal. It works great: - it's as fast as swyping and signing; - there are portable terminals using gsm, so no waiter has to take your card far from you (yes, take a photo of your card from front and back and go shopping online!) - there is competition among the providers: you can stick to the company that will have a smaller fee providing you the equipment. When used my card in travels to the USA, found it funny to have to swype: the magnetic strip is easily damaged (and wouldn't work sometimes) and the "signature" on those equipments were laughable, since you sign whatever you want. In Europe, don't remember to have swiped my card. But the PIN had some problem (and had the same in the USA with chip+pin): cards can have 4 or 6 digits inn Brazil, but there were room for just 4. Sometimes it works if you type just the first 4, some countries you type the last 4.

korginator 10y ago

I'm amazed at how EMV chip technology which has been in use in my country for over a decade, with chip based transactions being the de-facto mode, became a "disaster" in the US. Banks have started issuing chip-only cards, and several retailers don't use magstripe any more. ATM cards too are chip-based for several years. This "disaster" in the US appears more like a case of poor education and training than a problem with chip cards themselves.

erikpukinskis 10y ago
For me the biggest issue is the speed. I have to sit and wait for maybe 30 seconds while the transaction is processed. I believe the issue is that many vendors here have old card readers that are slow. It's not just a training issue.