3 ms·

IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few C

IMO it's super dumb that we're going through the whole business of replacing card readers to get chip support but NOT getting pin requirements. I've had a few CCs stolen from my mailbox (apartment with a large shared mailbox with simple padlocks). The new chip-only doesn't protect against this at all. MasterCard SecureCode was also a step in the right direction IMO, but the adoption rate seems very low. Basically, I want to require a second factor for every purchase. There's no way to do that right now with US cards that I know of. Debit cards can do it in person, but the fraud liability is different from CCs, and I don't get the fat 3% back or help my credit score. The best option online seems to be PayPal, which again loses the CC benefits. Thus, I just accept the inconvenience of getting my CC stolen a few times per year, since I'm not liable for the fraud, but it makes me cringe how this is currently the best solution available because of how messed up the incentives in the payment industry are here.

kibibyte 10y ago
Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)
TwoBit 10y ago
How were thieves able to activate cards stolen from your mail box?
- kiwijamo 10y ago
  My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.
nullc 10y ago
Merchant groups actually advocated chip+pin over chip+signature... (though mostly because they don't want credit card payments to be easier than debit or cash).

kibibyte 10y ago

Given that the transition from magstripe to chip-and-sign hasn't been so smooth (confusion among customers and cashiers for a few months), I can see why we haven't moved towards it yet. Merchants would be more nervous about additional lost sales because of customers not knowing what to do or not being used to having to memorize PINs for their credit cards. PINs really only just deter someone from physically stealing your card and then using it, so until card theft becomes a problem, I don't think we're going to be moving to chip-and-PIN any time soon. (On the bright side, Android/Apple Pay are generally good enough to function as chip-and-pin: it's as secure as a chip card, and don't allow thieves to use your cards unless they're either sophisticated enough to get past the fingerprint sensor, or they know your passcode. It's just a bit awkward to set up.)

TwoBit 10y ago

How were thieves able to activate cards stolen from your mail box?

kiwijamo 10y ago
My current bank considers a purchase using a PIN to be sufficient for automatic instant activation of the card. I was surprised given my previous bank required a phone call to confirm my identity. I guess the policy varies from bank to bank.

nullc 10y ago

Merchant groups actually advocated chip+pin over chip+signature... (though mostly because they don't want credit card payments to be easier than debit or cash).