3 ms·

Not all terminals in the States support chip functionality, so for the time being chip & pin cards here still have normal mag strips and can be run as older, re

by jrkatz 10y ago

Not all terminals in the States support chip functionality, so for the time being chip & pin cards here still have normal mag strips and can be run as older, regular cards - the mag strips can still be read/stolen & used.

lvh 10y ago
That's true, but the shimmers in question clearly have smart card pins. What you're describing is the traditional skimmer; a shimmer is not merely a thinner skimmer. These devices read the data between the chip and the terminal. This would be fine, if payment processing consistently used iCVV/EMV, but it turns out they don't.
sly010 10y ago
And it's unlikely that this will change anytime soon due to the lack on incentives on all sides. Funny as it may be my debit card for some reason has a $500 (unmodifiable) limit on chip&pin purchases, but it has no such limit for swipe purchases. When I asked them how is that more secure, I got a verbal shoulder shrug. Banks are in the business of underwriting. I believe at least on the corporate level they probably don't like the idea of fully secure, verifiable payments, because that would mean you don't need them anymore.
- nine_k 10y ago
  Banks are also in a business of storing your money, transferring your money, and borrowing you money. Note that "storing" here is actually "letting the bank invest the money". I don't think any of these activities are undermined by completely verifiable purchase transactions.
- lostlogin 10y ago
  Can you explain what you mean by "unmodifiable"? I have a limit, but on the banks app and website I can lower it (and I keep it very low) in the hope that any issues I have would be limited by this. Is this not actually worth doing?
seanp2k2 10y ago
IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few CCs stolen from my mailbox (apartment with a large shared mailbox with simple padlocks). The new chip-only doesn't protect against this at all. MasterCard SecureCode was also a step in the right direction IMO, but the adoption rate seems very low. Basically, I want to require a second factor for every purchase. There's no way to do that right now with US cards that I know of. Debit cards can do it in person, but the fraud liability is different from CCs, and I don't get the fat 3% back or help my credit score. The best option online seems to be PayPal, which again loses the CC benefits. Thus, I just accept the inconvenience of getting my CC stolen a few times per year, since I'm not liable for the fraud, but it makes me cringe how this is currently the best solution available because of how messed up the incentives in the payment industry are here.
- kibibyte 10y ago
  Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)
- TwoBit 10y ago
  How were thieves able to activate cards stolen from your mail box?
  - kiwijamo 10y ago
    My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.

by jrkatz 10y ago

lvh 10y ago

That's true, but the shimmers in question clearly have smart card pins. What you're describing is the traditional skimmer; a shimmer is not merely a thinner skimmer. These devices read the data between the chip and the terminal. This would be fine, if payment processing consistently used iCVV/EMV, but it turns out they don't.

sly010 10y ago

And it's unlikely that this will change anytime soon due to the lack on incentives on all sides. Funny as it may be my debit card for some reason has a $500 (unmodifiable) limit on chip&pin purchases, but it has no such limit for swipe purchases. When I asked them how is that more secure, I got a verbal shoulder shrug. Banks are in the business of underwriting. I believe at least on the corporate level they probably don't like the idea of fully secure, verifiable payments, because that would mean you don't need them anymore.

nine_k 10y ago
Banks are also in a business of storing your money, transferring your money, and borrowing you money. Note that "storing" here is actually "letting the bank invest the money". I don't think any of these activities are undermined by completely verifiable purchase transactions.
lostlogin 10y ago
Can you explain what you mean by "unmodifiable"? I have a limit, but on the banks app and website I can lower it (and I keep it very low) in the hope that any issues I have would be limited by this. Is this not actually worth doing?

seanp2k2 10y ago

IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few CCs stolen from my mailbox (apartment with a large shared mailbox with simple padlocks). The new chip-only doesn't protect against this at all. MasterCard SecureCode was also a step in the right direction IMO, but the adoption rate seems very low. Basically, I want to require a second factor for every purchase. There's no way to do that right now with US cards that I know of. Debit cards can do it in person, but the fraud liability is different from CCs, and I don't get the fat 3% back or help my credit score. The best option online seems to be PayPal, which again loses the CC benefits. Thus, I just accept the inconvenience of getting my CC stolen a few times per year, since I'm not liable for the fraud, but it makes me cringe how this is currently the best solution available because of how messed up the incentives in the payment industry are here.

kibibyte 10y ago
Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)
TwoBit 10y ago
How were thieves able to activate cards stolen from your mail box?
- kiwijamo 10y ago
  My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.