4 ms·

Testing the Limits of Credit Card Signatures (Part 1)

48 points by chaosmachine 16y ago

wanderr 16y ago
The Lowes self checkout is annoying because you have to switch back and forth from the touch screan to the credit card pad thing several times, so by the time it wants me to sign, I just write something vulgar. It's never been a problem.
chaosmachine 16y ago
Be sure not to miss part 2, where the author takes things to the next level... http://www.zug.com/pranks/credit_card/ http://www.zug.com/pranks/credit_card/
- bmalicoat 16y ago
  That ended up being kinda mean to that Circuit City salesman. He probably thought he was making the sale of his life.
nakkal 16y ago
I have drawing a straight line for all my CC transactions for the past two years and no one has bothered about it. I think this will automatically phase out automatically with new technologies like RFID...
ghshephard 16y ago
Anything under $25 no longer requires a signature anyways. I suspect that number will just keep getting larger. All my credit cards are disabled the instant I take them out of my normal buying pattern, and even RedBox makes me enter my zipcode to rent a $1. movie on the CC, so there are clearly more effective mechanisms to preventing fraud than signature verification.
ccarpenterg 16y ago
Signature is only required when a compliance process has begun. So, for example, when you check your transactions and see one that you can't recognize then you call your bank and object that trx. In that moment the bank ask for the physical documents and may check your signature, but it depends on the rules of your card operator (Visa, MasterCard, Amex).
- philwelch 16y ago
  But that opens up an obvious scam: 1. Buy something with your credit card 2. Sign with a false name 3. Contest the charge 4. Get a refund--keep the merchandise.
  - MichaelApproved 16y ago
    There are lots of soft was to scam the system. The question is are you that type of person? Is that the life you pick? Running small scams hoping you won't get caught. Focus your energy on building something useful. You've already completed step one of that process "read hacker news."
    - philwelch 16y ago
      Don't worry--having the mindset and creativity to think of ways to break the system aren't always bundled with the inclination to actually do them. I have better ways of applying my creativity. I suspect I just have what Schneier calls a "security mindset": http://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html http://www.schneier.com/blog/archives/2008/03/the_security_m...
scorxn 16y ago
The trouble is that most of these "pranks" boil down to testing the attention of service-level employees of corporations. They don't give a shit, and shouldn't, given the realities of filling as many orders as possible during a shift.
froo 16y ago
I've often tested the limits of credit card signatures to the point that I now regularly pose as several Disney cartoon characters.
sliverstorm 16y ago
Just the other day I went out and bought gas at a gas station for my friend's bike, with his credit card and his cell phone in my pocket. (He got his licence the next day) The scanner didn't work so I had to go to the counter, and had to fake a signature. Nobody even batted an eye. It was exhilarating, and unnerving at the same time... Maybe I should just chalk it up to my mind-busting ability to play it cool?
- sliverstorm 16y ago
  (just kidding about that last bit!)
thinkcomp 16y ago
We're working on fixing this issue. Fortunately, I think our system works better. http://www.facecash.com http://www.facecash.com
- ericd 16y ago
  Your site looks gorgeous, but I think your tagline and copy could use some serious work. After I read "The future of payments has arrived" I had no idea what your product does, and you failed my 5 second filter. Since I wanted to maybe suggest an alternative, though, I spent some more time to figure out what you product does by reading the bottom. I still couldn't figure out what your product does. Does this thing link my face with my credit card somehow? Why on earth would I share banking details with you if I have no idea what the benefit will be. Why no about page, at least?
  - thinkcomp 16y ago
    Thanks for the feedback. We were hoping that people would be intrigued by the photo of the product (the same image where you read the tagline), and then click on one of the links below (https://www.thinklink.com/index.html?more=1 https://www.thinklink.com/index.html?more=1), but you're right that it's not clear enough. We'll work on it. For the record, what it is: a pre-funded alternative payment system that uses your phone, a barcode, and your face to eliminate the need for a plastic card at the point of sale. Hence no crazy signature problems.
    - ericd 16y ago
      Ah OK, I didn't see those. I think a horizontal nav with About, Signup, etc. would do wonders, at least for those that expect an about page. A more explanatory tagline would help too, though. Thanks for the clarification. How do you all plan to get around the very high hurdle of getting high penetration of point of sale systems that are compatible and can show a picture of someone's face? There're a lot of legacy systems out there... Don't mean to bust your chops, just curious. Could do phone-based required authorization instead, which would at least remove the picture requirement?
nzmsv 16y ago
Most cashiers hand my card back to me with the receipt to sign, and can't verify my signature. But many stores are now switching to using a PIN with chip cards, at least here in Canada. And Europe's had chip cards forever now. In fact, some places there no longer even have machines to read a magnetic stripe.
- arethuza 16y ago
  Chip and PIN cards work pretty well (and yes I do know they have vulnerabilities) - I only use cash once or twice a month. I actually can't remember the last time I used a credit/debit card and actually signed for something - that would seem rather quaint these days.
  - randlet 16y ago
    Chip & Pin has been a major headache for me...I'm living in the UK for a year and neither one of my Canadian CC's have chip and pin. On numerous occasions cashiers have to call management to find out if they're even allowed to accept my credit card....I just carry cash now.
    - arethuza 16y ago
      Surely the answer to that is to set up a UK bank account and use a debit card (I make most payments with a debit card).
      - randlet 16y ago
        I am self employed and according to the banks I spoke to I am not staying in the UK long enough for them to give me an account.
      - rg 16y ago
        It's become rather difficult to set up UK personal bank accounts, thanks to the "know your customer" anti-terrorist regulations. Plus, UK retail banks offer uniformly terrible customer service by international standards (I've experienced three UK banks). Using offshore credit cards has long been a common choice.
metaprinter 16y ago
forget credit cards, my name has been misspelled on my driver's license since i can remember, spanning 2 states and 1 decade. I've never been asked about it. Not when i bought my house or started a business or opened credit... no one cares.
Judson 16y ago
Its more like testing the limits of the "next" button (since the article is broken down into 5-6 pages).
tbgvi 16y ago
In most cases the only time a signature gets looked at is if someone is contesting a charge. The CC processor would ask the store for a record showing that they actually made a purchase. In the end, signatures are really there to protect the store not you. It's in their best interest to have you sign with your actual signature. If you signed as Donald Duck and then contested the charge they'd probably have a hard time proving it was you and they'd lose money.
lionhearted 16y ago
I've done stuff like this - just made a smiley face on the sign line. Never had a problem with it. It's funny though, occasionally at a very official place I've had a staff member say my real signature that matches all my ID is too messy and ask me to write down my name beneath it in print. That happened to me at at least one or two consulates over the last few years when applying for visas. Also, I remember one time a friend got a 250 euro ticket driving through Austria, and I thought it was nonsense. He was speeding sure, but I think they inflated it by more than it was, and they said he had to pay on the spot or they wouldn't let him go. If I was in that spot, I think I'd write "Coerced Void" in artful cursive on the receipt and protest it later with the credit card company.
olliesaunders 16y ago
While I was working in a supermarket on the till I once contested a signature. This women's signature didn't match the one on the back of the card one bit. So I said "Can you sign that again please", and she did, but it still didn't match. Then I said "these signatures don't match at all" and she got all shirty with me, at which point I decided I wasn't being paid enough to care and just put it through anyway.
rabble 16y ago
It's because the signatures aren't used as a security system in the first world. Here in South America i get checks and credit card receipts rejected on a pretty regular basis because my signature is slightly off. By which i mean, i didn't make the curve of the P the same way. Believe me, i prefer they didn't check. When i complain, they offer to let me put each variation of my signature on file, so i could have several which pass the test.
- isleyaardvark 16y ago
  I was all set to agree with you, but then I looked up VISA's Merchant Agreement online [pdf]: http://usa.visa.com/download/merchants/rules_for_visa_merchants.pdf http://usa.visa.com/download/merchants/rules_for_visa_mercha... I was surprised to see on page 28 that it is considered a security feature.
- microtherion 16y ago
  I've had a number of transactions and credit card applications rejected in Switzerland because my signatures didn't match. Not sure if Switzerland qualifies as "first world", on that basis.
nkohari 16y ago
IANAL, but legally, any mark you make with the intent of signing is a signature. I guess you could claim after the fact that it wasn't you who signed the receipt, though...
aneth 16y ago
Signing a credit card receipt is not for signature verification. You are signing a contract that you agree to pay under the terms of your card agreement. Therefore, it doesn't matter how you sign as long as it was you. If you sign a multimillion dollar recording contract with a smiley face, you are still agreeing to the terms of the contract. Your signature doesn't have to match anything. If signatures were for verification, then they wouldn't have you sign the back. That would be like writing your login on post-it note stuck to your computer.

48 points by chaosmachine 16y ago

The Lowes self checkout is annoying because you have to switch back and forth from the touch screan to the credit card pad thing several times, so by the time it wants me to sign, I just write something vulgar. It's never been a problem.

chaosmachine 16y ago

Be sure not to miss part 2, where the author takes things to the next level... http://www.zug.com/pranks/credit_card/ http://www.zug.com/pranks/credit_card/

bmalicoat 16y ago
That ended up being kinda mean to that Circuit City salesman. He probably thought he was making the sale of his life.

nakkal 16y ago

I have drawing a straight line for all my CC transactions for the past two years and no one has bothered about it. I think this will automatically phase out automatically with new technologies like RFID...

ghshephard 16y ago

Anything under $25 no longer requires a signature anyways. I suspect that number will just keep getting larger. All my credit cards are disabled the instant I take them out of my normal buying pattern, and even RedBox makes me enter my zipcode to rent a $1. movie on the CC, so there are clearly more effective mechanisms to preventing fraud than signature verification.

ccarpenterg 16y ago

Signature is only required when a compliance process has begun. So, for example, when you check your transactions and see one that you can't recognize then you call your bank and object that trx. In that moment the bank ask for the physical documents and may check your signature, but it depends on the rules of your card operator (Visa, MasterCard, Amex).

philwelch 16y ago
But that opens up an obvious scam: 1. Buy something with your credit card 2. Sign with a false name 3. Contest the charge 4. Get a refund--keep the merchandise.
- MichaelApproved 16y ago
  There are lots of soft was to scam the system. The question is are you that type of person? Is that the life you pick? Running small scams hoping you won't get caught. Focus your energy on building something useful. You've already completed step one of that process "read hacker news."
  - philwelch 16y ago
    Don't worry--having the mindset and creativity to think of ways to break the system aren't always bundled with the inclination to actually do them. I have better ways of applying my creativity. I suspect I just have what Schneier calls a "security mindset": http://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html http://www.schneier.com/blog/archives/2008/03/the_security_m...

scorxn 16y ago

The trouble is that most of these "pranks" boil down to testing the attention of service-level employees of corporations. They don't give a shit, and shouldn't, given the realities of filling as many orders as possible during a shift.

froo 16y ago

I've often tested the limits of credit card signatures to the point that I now regularly pose as several Disney cartoon characters.

sliverstorm 16y ago

Just the other day I went out and bought gas at a gas station for my friend's bike, with his credit card and his cell phone in my pocket. (He got his licence the next day) The scanner didn't work so I had to go to the counter, and had to fake a signature. Nobody even batted an eye. It was exhilarating, and unnerving at the same time... Maybe I should just chalk it up to my mind-busting ability to play it cool?

sliverstorm 16y ago
(just kidding about that last bit!)

thinkcomp 16y ago

We're working on fixing this issue. Fortunately, I think our system works better. http://www.facecash.com http://www.facecash.com

ericd 16y ago
Your site looks gorgeous, but I think your tagline and copy could use some serious work. After I read "The future of payments has arrived" I had no idea what your product does, and you failed my 5 second filter. Since I wanted to maybe suggest an alternative, though, I spent some more time to figure out what you product does by reading the bottom. I still couldn't figure out what your product does. Does this thing link my face with my credit card somehow? Why on earth would I share banking details with you if I have no idea what the benefit will be. Why no about page, at least?
- thinkcomp 16y ago
  Thanks for the feedback. We were hoping that people would be intrigued by the photo of the product (the same image where you read the tagline), and then click on one of the links below (https://www.thinklink.com/index.html?more=1 https://www.thinklink.com/index.html?more=1), but you're right that it's not clear enough. We'll work on it. For the record, what it is: a pre-funded alternative payment system that uses your phone, a barcode, and your face to eliminate the need for a plastic card at the point of sale. Hence no crazy signature problems.
  - ericd 16y ago
    Ah OK, I didn't see those. I think a horizontal nav with About, Signup, etc. would do wonders, at least for those that expect an about page. A more explanatory tagline would help too, though. Thanks for the clarification. How do you all plan to get around the very high hurdle of getting high penetration of point of sale systems that are compatible and can show a picture of someone's face? There're a lot of legacy systems out there... Don't mean to bust your chops, just curious. Could do phone-based required authorization instead, which would at least remove the picture requirement?

nzmsv 16y ago

Most cashiers hand my card back to me with the receipt to sign, and can't verify my signature. But many stores are now switching to using a PIN with chip cards, at least here in Canada. And Europe's had chip cards forever now. In fact, some places there no longer even have machines to read a magnetic stripe.

arethuza 16y ago
Chip and PIN cards work pretty well (and yes I do know they have vulnerabilities) - I only use cash once or twice a month. I actually can't remember the last time I used a credit/debit card and actually signed for something - that would seem rather quaint these days.
- randlet 16y ago
  Chip & Pin has been a major headache for me...I'm living in the UK for a year and neither one of my Canadian CC's have chip and pin. On numerous occasions cashiers have to call management to find out if they're even allowed to accept my credit card....I just carry cash now.
  - arethuza 16y ago
    Surely the answer to that is to set up a UK bank account and use a debit card (I make most payments with a debit card).
    - randlet 16y ago
      I am self employed and according to the banks I spoke to I am not staying in the UK long enough for them to give me an account.
    - rg 16y ago
      It's become rather difficult to set up UK personal bank accounts, thanks to the "know your customer" anti-terrorist regulations. Plus, UK retail banks offer uniformly terrible customer service by international standards (I've experienced three UK banks). Using offshore credit cards has long been a common choice.

metaprinter 16y ago

forget credit cards, my name has been misspelled on my driver's license since i can remember, spanning 2 states and 1 decade. I've never been asked about it. Not when i bought my house or started a business or opened credit... no one cares.

Judson 16y ago

Its more like testing the limits of the "next" button (since the article is broken down into 5-6 pages).

tbgvi 16y ago

In most cases the only time a signature gets looked at is if someone is contesting a charge. The CC processor would ask the store for a record showing that they actually made a purchase. In the end, signatures are really there to protect the store not you. It's in their best interest to have you sign with your actual signature. If you signed as Donald Duck and then contested the charge they'd probably have a hard time proving it was you and they'd lose money.

lionhearted 16y ago

I've done stuff like this - just made a smiley face on the sign line. Never had a problem with it. It's funny though, occasionally at a very official place I've had a staff member say my real signature that matches all my ID is too messy and ask me to write down my name beneath it in print. That happened to me at at least one or two consulates over the last few years when applying for visas. Also, I remember one time a friend got a 250 euro ticket driving through Austria, and I thought it was nonsense. He was speeding sure, but I think they inflated it by more than it was, and they said he had to pay on the spot or they wouldn't let him go. If I was in that spot, I think I'd write "Coerced Void" in artful cursive on the receipt and protest it later with the credit card company.

olliesaunders 16y ago

While I was working in a supermarket on the till I once contested a signature. This women's signature didn't match the one on the back of the card one bit. So I said "Can you sign that again please", and she did, but it still didn't match. Then I said "these signatures don't match at all" and she got all shirty with me, at which point I decided I wasn't being paid enough to care and just put it through anyway.

rabble 16y ago

It's because the signatures aren't used as a security system in the first world. Here in South America i get checks and credit card receipts rejected on a pretty regular basis because my signature is slightly off. By which i mean, i didn't make the curve of the P the same way. Believe me, i prefer they didn't check. When i complain, they offer to let me put each variation of my signature on file, so i could have several which pass the test.

isleyaardvark 16y ago
I was all set to agree with you, but then I looked up VISA's Merchant Agreement online [pdf]: http://usa.visa.com/download/merchants/rules_for_visa_merchants.pdf http://usa.visa.com/download/merchants/rules_for_visa_mercha... I was surprised to see on page 28 that it is considered a security feature.
microtherion 16y ago
I've had a number of transactions and credit card applications rejected in Switzerland because my signatures didn't match. Not sure if Switzerland qualifies as "first world", on that basis.

nkohari 16y ago

IANAL, but legally, any mark you make with the intent of signing is a signature. I guess you could claim after the fact that it wasn't you who signed the receipt, though...

aneth 16y ago

Signing a credit card receipt is not for signature verification. You are signing a contract that you agree to pay under the terms of your card agreement. Therefore, it doesn't matter how you sign as long as it was you. If you sign a multimillion dollar recording contract with a smiley face, you are still agreeing to the terms of the contract. Your signature doesn't have to match anything. If signatures were for verification, then they wouldn't have you sign the back. That would be like writing your login on post-it note stuck to your computer.