6 ms·

The US was one of the last countries to get Chip + PIN, and even then they messed it up, and got chip + sign. 90% of the places I use a card in seem to be stil

by mugsie 9y ago

The US was one of the last countries to get Chip + PIN, and even then they messed it up, and got chip + sign. 90% of the places I use a card in seem to be still swiping the cards, while we have had full chip + PIN implementation here (Ireland) since at least 2005 or 2006.

bluGill 9y ago
I don't want pin. I have half a dozen credit/debit cards in my pocket (the card I use for almost everything, my backup card just in case the first is lost, my HSA card, my company card, a debit card, and the store care for a store I shop at often) there are another half a dozen that the issuers want me to carry but are not worth the space they take up. I cannot mentally manage that many different pins. verification comes in 3 parts: something you carry (card), something you know (card number, pin), something you are (your signature, fingerprint). Generally you need two. However since the card number is memorable (hard but possible) the pin is no additional security.
- Dayshine 9y ago
  Signature isn't something you are, it's not in any of those three categories, it's closer to your address. Chip + pin = Something you carry (card/chip) + something you know (pin). You need the physical card to use it, card number isn't sufficient.
- mugsie 9y ago
  Signature is also not something "you are" - it is an easily faked thing, that is basically never actually verified. PINs can be changed, so if you came up with a way of memorising them, its easy. You also don't need PINs for things like loyalty / membership cards traditionally - just for payment cards.
- LordKano 9y ago
  I don't use my PIN either, for a different reason. I force them to process it as a credit card because I get the consumer protections of the CC processing agreements. If I use my PIN, it's more like an ATM transaction. LK
  - stan_rogers 9y ago
    Chip and PIN credit card transactions are still credit card transactions everywhere else, with all of the attendant protections.
  - cmurf 9y ago
    Which law applies to the transaction is what the card account is; not the transaction. TILA applies to credit cards, and EFTA applies to debit cards. Whether you're costing the merchant more money with higher fees for credit transactions, or if this gets normalized to a debit transaction later on, I'm not sure. But either way it's ridiculous to "force" a credit card transaction on the merchant.
    - kevin_thibedeau 9y ago
      > either way it's ridiculous to "force" a credit card transaction on the merchant. I do it more often because of the number of times I've been screwed by trying to use debit mode and end up with a non-functional gas pump or forced to reswipe with the mag stripe because they only support credit transactions from the chip.
    - tonyztan 9y ago
      Even though the different transactions on a debit card may have the same legal status by law, banks typically apply "zero liability" to transactions processed by Visa/MasterCard, while holding users accountable for fraudulent debit transactions processed by ATM networks, up to $50 if you report within 2 days, then $500 within 60 days, and then unlimited customer liability after that.
      - LordKano 9y ago
        This! Precisely this! There is no benefit to me to go with a debit transaction and the risk of significant liability if there is a data breach. So, I don't do debit transactions.
- cat199 9y ago
  > I cannot mentally manage that many different pins. Pick 4 digits on the card, multiply/add them by some constant number you know. You're now done 'memorizing'.
  - digikata 9y ago
    Don't simple mnemonics have a risk of helping to reduce the search space to guess a pin?
    - stickfigure 9y ago
      We're talking about a 4-digit search space. The system already needs (and presumably already has) extreme rate-limiting measures.
- IncRnd 9y ago
  Signatures are not in the category, "something you are."
- cmurf 9y ago
  This is b.s. for numerous reasons: - You can have the PIN reset for all of those cards so that they all match, (or better we should be using PK based push notifications to a smart phone app; plug in the card, and you get a push notification to deny/allow on your phone, instead of entering in a PIN.) - Signatures aren't even verified the vast majority of transactions. They only come into play if you catch fraud and report it. So it's used after the fact, not in advance. - Signatures are predicated on pen on paper on a flat writing surface perpendicular to gravity. Your signature is not at all the same to a handwriting expert if you change any of those things, and in particular the digital capture of signatures is complete utter bullcrap: no angular, or pressure information is captured. We should just use smiley faces on all such POS systems, in lieu of even attempting a signature (it is in fact what I do). Digital signatures are Tonka Toys. They are nothing like a finger print.
muninn_ 9y ago
Chip+pin isn't the sole marker of innovation. Anyway, as I said, if you build out an entire infrastructure based on a different way of doing things, you can't just up and change that over night. It takes time. It costs money. There are associated opportunity costs, etc....
- mugsie 9y ago
  Sure - but the rest of the world had the same assumptions, (and infrastructure) and we managed to do it. Chip and PIN is not the sole marker, but it is the most obvious one, which is why people use it as a benchmark.
  - muninn_ 9y ago
    It's an obvious one, which indicates a superficial understanding of the financial industry and technology in particular. Credit cards, and their use, was from the outset largely an American phenomenon. When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin. But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform. When will Europe catch up with banking technology?
    - mugsie 9y ago
      > When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin. It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005 > But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform. Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US). What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.
Mister_Snuggles 9y ago
The infrastructure in the US seems to support Chip+PIN just fine, it seems to be that the card issuers don't want to issue cards with PINs. When I last visited the US, my Canadian credit card worked just like it does in Canada. Insert into the machine, verify the amount, enter my PIN, done.
- mugsie 9y ago
  Yeah - my EU cards can use a PIN in some machines in the US now.
- cmurf 9y ago
  That's right. It is basically a flag on the account, which ends up as a notification at the POS system. So you get this hilarious crap with a U.S. card outside the U.S. where you're still signing shit, because the POS system tells them you have to sign. I lost count of the various reactions when traveling outside the U.S.: - Why is it printing extra receipts? Oh... you have to sign one of these. - Hold on, let me go find a pen for you to sign. - Asks coworker what this message means. Oh he has to sign, must be an American. And get this shit. My debit card in the U.S.? I always use a PIN for it everywhere. But when I travel outside the U.S. that same goddamn card requires a signature every damn time. It's really fucking stupid, there's no nice way to put it.
mikeash 9y ago
Since chip-and-pin seems to be used as an excuse to push liability for fraud onto the cardholder, I'd much rather stick with chip-and-signature. If we could have chip-and-pin while still keeping me at zero liability for fraud, I'd take it.
bzbarsky 9y ago
Why do you think they messed it up? Chip+sign is a solution to a real market problem with chip+PIN in the US: the the typical consumer has many credit cards. https://www.quora.com/What-is-the-median-number-of-credit-cards-per-adult-in-the-United-States https://www.quora.com/What-is-the-median-number-of-credit-ca... claims an average, not median, of 3.5 per cardholder, and that matches the numbers at http://www.creditcards.com/credit-card-news/ownership-statistics.php http://www.creditcards.com/credit-card-news/ownership-statis... . Heavy credit card users have a lot more: it's common for stores to have store-brand cards that give you a discount at that store, so a number of people end up with a dozen different cards for stores they commonly shop at. Expecting people to remember this many different PINs is not realistic. So every card issuer was worried that users would just stop using their card because they could not remember the PIN. This is the problem chip+sign is meant to solve. In other countries, patterns of credit card use are quite different. http://www.theukcardsassociation.org.uk/wm_documents/UK%20Card%20Payments%202015%20taster%20for%20website.pdf http://www.theukcardsassociation.org.uk/wm_documents/UK%20Ca... page 6 claims an average of 2 cards for the UK, for example. So the "can't remember the PIN" problem was not as big a deal.
- mavhc 9y ago
  Just set all your pins to be the same
  - bzbarsky 9y ago
    That's assuming the issuer allows you to set the PIN. In many cases they do not, in my experience with both debit cards and chip+PIN cards (the one chip+PIN card I have in fact does not allow that).
    - mugsie 9y ago
      This is in the US, with the broken Chip + PIN implementation. I can go to pretty much any ATM in the EU and change the PIN on all of my cards.
      - 9y ago

by mugsie 9y ago

bluGill 9y ago

I don't want pin. I have half a dozen credit/debit cards in my pocket (the card I use for almost everything, my backup card just in case the first is lost, my HSA card, my company card, a debit card, and the store care for a store I shop at often) there are another half a dozen that the issuers want me to carry but are not worth the space they take up. I cannot mentally manage that many different pins. verification comes in 3 parts: something you carry (card), something you know (card number, pin), something you are (your signature, fingerprint). Generally you need two. However since the card number is memorable (hard but possible) the pin is no additional security.

Dayshine 9y ago
Signature isn't something you are, it's not in any of those three categories, it's closer to your address. Chip + pin = Something you carry (card/chip) + something you know (pin). You need the physical card to use it, card number isn't sufficient.
mugsie 9y ago
Signature is also not something "you are" - it is an easily faked thing, that is basically never actually verified. PINs can be changed, so if you came up with a way of memorising them, its easy. You also don't need PINs for things like loyalty / membership cards traditionally - just for payment cards.
LordKano 9y ago
I don't use my PIN either, for a different reason. I force them to process it as a credit card because I get the consumer protections of the CC processing agreements. If I use my PIN, it's more like an ATM transaction. LK
- stan_rogers 9y ago
  Chip and PIN credit card transactions are still credit card transactions everywhere else, with all of the attendant protections.
- cmurf 9y ago
  Which law applies to the transaction is what the card account is; not the transaction. TILA applies to credit cards, and EFTA applies to debit cards. Whether you're costing the merchant more money with higher fees for credit transactions, or if this gets normalized to a debit transaction later on, I'm not sure. But either way it's ridiculous to "force" a credit card transaction on the merchant.
  - kevin_thibedeau 9y ago
    > either way it's ridiculous to "force" a credit card transaction on the merchant. I do it more often because of the number of times I've been screwed by trying to use debit mode and end up with a non-functional gas pump or forced to reswipe with the mag stripe because they only support credit transactions from the chip.
  - tonyztan 9y ago
    Even though the different transactions on a debit card may have the same legal status by law, banks typically apply "zero liability" to transactions processed by Visa/MasterCard, while holding users accountable for fraudulent debit transactions processed by ATM networks, up to $50 if you report within 2 days, then $500 within 60 days, and then unlimited customer liability after that.
    - LordKano 9y ago
      This! Precisely this! There is no benefit to me to go with a debit transaction and the risk of significant liability if there is a data breach. So, I don't do debit transactions.
cat199 9y ago
> I cannot mentally manage that many different pins. Pick 4 digits on the card, multiply/add them by some constant number you know. You're now done 'memorizing'.
- digikata 9y ago
  Don't simple mnemonics have a risk of helping to reduce the search space to guess a pin?
  - stickfigure 9y ago
    We're talking about a 4-digit search space. The system already needs (and presumably already has) extreme rate-limiting measures.
IncRnd 9y ago
Signatures are not in the category, "something you are."
cmurf 9y ago
This is b.s. for numerous reasons: - You can have the PIN reset for all of those cards so that they all match, (or better we should be using PK based push notifications to a smart phone app; plug in the card, and you get a push notification to deny/allow on your phone, instead of entering in a PIN.) - Signatures aren't even verified the vast majority of transactions. They only come into play if you catch fraud and report it. So it's used after the fact, not in advance. - Signatures are predicated on pen on paper on a flat writing surface perpendicular to gravity. Your signature is not at all the same to a handwriting expert if you change any of those things, and in particular the digital capture of signatures is complete utter bullcrap: no angular, or pressure information is captured. We should just use smiley faces on all such POS systems, in lieu of even attempting a signature (it is in fact what I do). Digital signatures are Tonka Toys. They are nothing like a finger print.

muninn_ 9y ago

Chip+pin isn't the sole marker of innovation. Anyway, as I said, if you build out an entire infrastructure based on a different way of doing things, you can't just up and change that over night. It takes time. It costs money. There are associated opportunity costs, etc....

mugsie 9y ago
Sure - but the rest of the world had the same assumptions, (and infrastructure) and we managed to do it. Chip and PIN is not the sole marker, but it is the most obvious one, which is why people use it as a benchmark.
- muninn_ 9y ago
  It's an obvious one, which indicates a superficial understanding of the financial industry and technology in particular. Credit cards, and their use, was from the outset largely an American phenomenon. When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin. But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform. When will Europe catch up with banking technology?
  - mugsie 9y ago
    > When Europe finally caught up (and to this day, in the year 2017 there are still businesses that don't have credit card infrastructure set up - meanwhile even mobile food trucks in the US offer it), Americans had already built out the infrastructure and found out about the hard issues - which gave Europeans time to implement a better solution, which was chip + pin. It was a US based in the beginning - but by the time Chip + PIN started there was significant infrastructure already in place. Its not like we all just started to use cards in 2005 > But all that aside, the real question is, why are you still using a physical credit card? In the US, I can use Apple/Google Pay at nearly every business I find, and all of the large banks and most regional and smaller firms offer support for their products on the platform. Sure - that is down to market forces, not banking tech. There are banks here where I can use both Apple / Android pay, and all merchants take it (by virtue of our advanced usage of contactless payments - another thing that was introduced before the US). What other areas is the US more advanced in (bank tech wise) ? We have online only banks, push notifications for transactions, and all the other things I see advertised by US banks.

Mister_Snuggles 9y ago

The infrastructure in the US seems to support Chip+PIN just fine, it seems to be that the card issuers don't want to issue cards with PINs. When I last visited the US, my Canadian credit card worked just like it does in Canada. Insert into the machine, verify the amount, enter my PIN, done.

mugsie 9y ago
Yeah - my EU cards can use a PIN in some machines in the US now.
cmurf 9y ago
That's right. It is basically a flag on the account, which ends up as a notification at the POS system. So you get this hilarious crap with a U.S. card outside the U.S. where you're still signing shit, because the POS system tells them you have to sign. I lost count of the various reactions when traveling outside the U.S.: - Why is it printing extra receipts? Oh... you have to sign one of these. - Hold on, let me go find a pen for you to sign. - Asks coworker what this message means. Oh he has to sign, must be an American. And get this shit. My debit card in the U.S.? I always use a PIN for it everywhere. But when I travel outside the U.S. that same goddamn card requires a signature every damn time. It's really fucking stupid, there's no nice way to put it.

mikeash 9y ago

Since chip-and-pin seems to be used as an excuse to push liability for fraud onto the cardholder, I'd much rather stick with chip-and-signature. If we could have chip-and-pin while still keeping me at zero liability for fraud, I'd take it.

bzbarsky 9y ago

Why do you think they messed it up? Chip+sign is a solution to a real market problem with chip+PIN in the US: the the typical consumer has many credit cards. https://www.quora.com/What-is-the-median-number-of-credit-cards-per-adult-in-the-United-States https://www.quora.com/What-is-the-median-number-of-credit-ca... claims an average, not median, of 3.5 per cardholder, and that matches the numbers at http://www.creditcards.com/credit-card-news/ownership-statistics.php http://www.creditcards.com/credit-card-news/ownership-statis... . Heavy credit card users have a lot more: it's common for stores to have store-brand cards that give you a discount at that store, so a number of people end up with a dozen different cards for stores they commonly shop at. Expecting people to remember this many different PINs is not realistic. So every card issuer was worried that users would just stop using their card because they could not remember the PIN. This is the problem chip+sign is meant to solve. In other countries, patterns of credit card use are quite different. http://www.theukcardsassociation.org.uk/wm_documents/UK%20Card%20Payments%202015%20taster%20for%20website.pdf http://www.theukcardsassociation.org.uk/wm_documents/UK%20Ca... page 6 claims an average of 2 cards for the UK, for example. So the "can't remember the PIN" problem was not as big a deal.

mavhc 9y ago
Just set all your pins to be the same
- bzbarsky 9y ago
  That's assuming the issuer allows you to set the PIN. In many cases they do not, in my experience with both debit cards and chip+PIN cards (the one chip+PIN card I have in fact does not allow that).
  - mugsie 9y ago
    This is in the US, with the broken Chip + PIN implementation. I can go to pretty much any ATM in the EU and change the PIN on all of my cards.
    - 9y ago