4 ms·

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different webs

by nojvek 10y ago

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

tonyedgecombe 10y ago
This is one area where PayPal has an advantage, you are pushing the payment rather than the vendor pulling it.
Tistron 10y ago
Is this not changing though? I can't remember the last time I bought something online without having to either use password or 2factor auth, and there are no places here that do not require a pin code when using a cc in a store. I'm in Sweden though (but using mastercard).
- the_af 10y ago
  Hmmm, that's interesting. I've never been to Sweden, but pretty much no shops in any country I've ever visited required a pin code for Visa or Amex credit cards. Is this really changing?
  - gambiting 10y ago
    What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.
    - OJFord 10y ago
      I was made to sign my card for the first time ever recently in order to complete an exchange that required a refund and repurchase... Parent comments are talking about online purchases, for which your PIN is not needed.
      - the_af 10y ago
        I was talking about brick & mortar shops. Now I've done some reading, and it seems my country (in Latin America) is following US standards. It seems US-issued credit cards only require signatures, even when used abroad, and only recently (as far as I can google it) are they slowly starting to switch to either PIN or chip-based cards. Newly issued cards where I live have chips (this is a relatively recent development), which I'm not sure exactly how are supposed to be safer than magnetic strip cards, and also don't require PINs.
    - the_af 10y ago
      Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa credit card, either. Maybe it's the type of card? I'm talking about credit cards, mind you. Debit cards are different, and while in my country Visa Electron doesn't require anything but a signature, it's entirely possible if I tried to use it abroad they'd ask for a pin code. Not sure.
      - Tistron 10y ago
        I believe it is possible to use a cc here without the pin if you show ID and sign a receipt. I think I've seen it for people who've forgotten their code and tourists who don't know their code.
      - gambiting 10y ago
        I have both British and Polish debit and credit cards, Visa and Mastercard(Visa Classic credit cards), I've used them in Spain, Germany, Netherlands, France, Spain and Portugal, and literally never had to sign for them, be it in shops or restaurants. I'm not saying there aren't cards that need signing,but I've literally never seen any.
        the_af 10y ago
        My experience is the opposite: I've never used a PIN. I've done some reading and now I believe it depends on the country which issued the card (as opposed to the country where you're using the card). So if you have a card issued in the US and Latin America, you probably won't asked for a PIN -- because you don't have one -- and instead you'll be asked for id and your signature. If you have a card issued in Europe, you'll be asked for a PIN. Interesting. A PIN seems safer than a signature to me, or possibly the combination of chip + PIN, but it simply doesn't get used where I live.
    - Slump 10y ago
      Chip and signature is the norm in brick and mortar stores in the USA. Even then, many purchases will not require a signature unless the transaction is over a certain amount, typically $50. Many card issuers were too nervous to go full chip and pin in US markets for whatever reason.
- tomjen3 10y ago
  There are a couple online stores that requires verified by visa. Just means I don't care to shop there, its a pain.
djtriptych 10y ago
All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites. They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assumed passwords might get phished and thought through how to protect users in that case. My credit card numbers are one of my pieces of private information I feel _least_ apprehensive about sharing.
- krupan 10y ago
  Thing is, you pay for that cc number protection with every transaction. How are you going to pay for the same sort of protection on your password?

by nojvek 10y ago

To be honest credit cards are a terrible system in terms of security. Everything to make a charge is on the card and people freely give it out to different websites.

tonyedgecombe 10y ago

This is one area where PayPal has an advantage, you are pushing the payment rather than the vendor pulling it.

Tistron 10y ago

Is this not changing though? I can't remember the last time I bought something online without having to either use password or 2factor auth, and there are no places here that do not require a pin code when using a cc in a store. I'm in Sweden though (but using mastercard).

the_af 10y ago
Hmmm, that's interesting. I've never been to Sweden, but pretty much no shops in any country I've ever visited required a pin code for Visa or Amex credit cards. Is this really changing?
- gambiting 10y ago
  What do they require then? I've never in my entire life used my credit/debit card without typing in the PIN number(except for contactless payments, of course). I'm in the UK. I think they can be used with a signature too? Maybe? I've never heard of anyone actually signing a bill instead of using the pin, and besides, I don't even sign my cards.
  - OJFord 10y ago
    I was made to sign my card for the first time ever recently in order to complete an exchange that required a refund and repurchase... Parent comments are talking about online purchases, for which your PIN is not needed.
    - the_af 10y ago
      I was talking about brick & mortar shops. Now I've done some reading, and it seems my country (in Latin America) is following US standards. It seems US-issued credit cards only require signatures, even when used abroad, and only recently (as far as I can google it) are they slowly starting to switch to either PIN or chip-based cards. Newly issued cards where I live have chips (this is a relatively recent development), which I'm not sure exactly how are supposed to be safer than magnetic strip cards, and also don't require PINs.
  - the_af 10y ago
    Yes, they require a signature. I'm not saying this is a safe practice, just that I've never seen a store where they asked me for a pin code for major credit cards such as Visa, Amex and (I'm pretty sure, but I don't have one) MasterCard. And I'm talking not only my own country, but also the US and several countries in Europe. When I was in the UK some years ago, they didn't ask me for my pin code when I used my Visa credit card, either. Maybe it's the type of card? I'm talking about credit cards, mind you. Debit cards are different, and while in my country Visa Electron doesn't require anything but a signature, it's entirely possible if I tried to use it abroad they'd ask for a pin code. Not sure.
    - Tistron 10y ago
      I believe it is possible to use a cc here without the pin if you show ID and sign a receipt. I think I've seen it for people who've forgotten their code and tourists who don't know their code.
    - gambiting 10y ago
      I have both British and Polish debit and credit cards, Visa and Mastercard(Visa Classic credit cards), I've used them in Spain, Germany, Netherlands, France, Spain and Portugal, and literally never had to sign for them, be it in shops or restaurants. I'm not saying there aren't cards that need signing,but I've literally never seen any.
      - the_af 10y ago
        My experience is the opposite: I've never used a PIN. I've done some reading and now I believe it depends on the country which issued the card (as opposed to the country where you're using the card). So if you have a card issued in the US and Latin America, you probably won't asked for a PIN -- because you don't have one -- and instead you'll be asked for id and your signature. If you have a card issued in Europe, you'll be asked for a PIN. Interesting. A PIN seems safer than a signature to me, or possibly the combination of chip + PIN, but it simply doesn't get used where I live.
  - Slump 10y ago
    Chip and signature is the norm in brick and mortar stores in the USA. Even then, many purchases will not require a signature unless the transaction is over a certain amount, typically $50. Many card issuers were too nervous to go full chip and pin in US markets for whatever reason.
tomjen3 10y ago
There are a couple online stores that requires verified by visa. Just means I don't care to shop there, its a pain.

djtriptych 10y ago

All of my cards have excellent theft protection policies though. If my card gets stolen, I'm not responsible for any damages. That's a great security policy; better than most websites. They _assume_ card numbers will get stolen all the time and invest in identifying suspicious behavior. And all behavior is 100% auditable all the time. Security isn't just about authentication/authorization. I wish more websites assumed passwords might get phished and thought through how to protect users in that case. My credit card numbers are one of my pieces of private information I feel _least_ apprehensive about sharing.

krupan 10y ago
Thing is, you pay for that cc number protection with every transaction. How are you going to pay for the same sort of protection on your password?