10 ms·

Chips aren't anymore secure, I can read the data off my card with a standard chip reader, and I have. The same data on the chip is on the mag strip. Just beca

Chips aren't anymore secure, I can read the data off my card with a standard chip reader, and I have. The same data on the chip is on the mag strip. Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. Why? Getting EMV certified requires every part of the transaction chain to go through unified system testing, for each combination of hardware, software, card type, processor, issuing bank. I've been eyeballs deep in this nonsense for the last year or so. We just can't justify the expense of getting EMV certified, so we just accept the chip and do a regular transaction. As a consumer you have no way of knowing if your transaction is and EMV transaction or just a chip enabled regular transaction.

throwaway613834 9y ago
> Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. By the way, do you have any reference on this? Everywhere I've searched, chip seems synonymous with EMV.
- lmilcin 9y ago
  For background, I was developing those types of applications few years ago, professionally. Every chip or contactless transaction is an EMV transaction. This is by virtue of EMV being the protocol that terminal uses to communicate with the card. EMV allows for different types of transactions with different level of security. For example, if the transaction can be done offline (gas pump unattended terminal situation) AND executing CVM rules (both terminal and issuer have their own rules) points to the possibilty of exchanging encrypted PIN, the PIN can be sent safely encrypted to the card for verification. If the card or the terminal does not support encrypted verification then the PIN can be sent in the clear and vulnerable to skimming.
  - throwaway613834 9y ago
    Okay then I'm extremely confused. You say: > Every chip or contactless transaction is an EMV transaction. But the parent comment I was replying to says: > Just because you are using the chip doesn't mean you are doing an EMV transaction. I presume you're saying he's wrong in this? Or am I misunderstanding what you both mean? I'm also confused by the PIN thing you mention. Why is there a PIN at all, and why is there an "encrypted PIN exchange"? We're talking about the US, right? The US is chip & signature, and there is no PIN involved. I thought it was supposed to be that the card generates a unique one-time authorization code (public-key signatures?) and the bank validates it? Where does a PIN come into play?
    - lmilcin 9y ago
      For each transaction a set of very flexible rules is being executed with the aim to perform a number of verifications. Card Verification - no verification (just read magstripe or magstripe equivalent from chip or contactless card that does not have any more advanced verification mechanism) - static verification - for chip, card sends static signature along with the data so that the terminal can verify electronic signature - dynamic verification - for chip, card accepts challenge and generate response so that the terminal can verify the signature. This also makes it much more difficult to copy the card because it is not enough to copy the available data, you also need to copy the key that is embedded in the card. Cardholder Verification - no verification -- sometimes no cardholder verification will be performed (for example contactless under certain limit, unattended terminals without PIN capability or on a plane when there is special rules for airline terminals because people are typically verified separately) - Signature -- this is where US is stuck it seems - offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem - offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. - online PIN -- the PIN is never exchanged with the card, it is encrypted and sent to the bank and bank decides whether it likes it or not. Transaction verification - floor limit -- sometimes the transaction can be agreed between the terminal and the card. Typically there is some information stored on the card and set of rules that decide that this is possible. The card may be decreasing a limit of funds available offline and when it hits the limit it will force you to perform full chip transaction. - online verification -- the message goes online to the bank and bank decides.
- drzaiusapelord 9y ago
  He's mostly wrong. The entire point of moving to chip is because liability stops being on the retailer if they implement EMV. Chip and EMV go hand-in-hand. Why bother upgrading your terminals for chip and not do EMV? Might as well stick with swipe then, its the same liability agreement. Its all a stopgap measure to chip and pin anyway. Once everyone is used to EMV and all the terminals have been replaced, we'll have a sunset on swipe and then move to chip and pin, which will be a minor upgrade. This will all take time. Lets remember the United States has a quarter of the world’s credit card transactions, but only 4.5% of its population. Its a very big cc market and change isn't going to come quickly.
lmilcin 9y ago
Hi! I have implement a complete payment terminal application with magstripe, chip and contactless capabilities. I have also designed security protocols to keep the data and keys from the bad guys, including things like Key Injection Facility, loading and exchange protocols, etc. These things (terminals, cards, HSMs) can be extremely safe. Not only there are protocols available that in my knowledge have never been breached but also the devices themselves are built in secure manner to prevent any physical attacks. The entire infrastructure can be made so that no single employee can get hold of any secret material. The truth is, that there is a range of solutions and the secure ones cost. It costs to set them up and use correctly. It costs to produce chip card that can dynamically sign and encrypt the data. It is up to the issuer (bank) how much they pay for the security of their card and typically banks are not too eager to overpay. Rather, they take calculated risk. Another problem is that North America is particularly behind in security standards. I remember, while working on this application (10 years ago) there was much more leniency for US users (issuers, acquirers) than the rest of the world.
- amelius 9y ago
  > Rather, they take calculated risk. And credit-cards are a testament to that.
- ransom1538 9y ago
  Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device. They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US). https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR5176947/?tag=hyprod-20&creative=395033&creativeASIN=B01N4L19CR&linkCode=df0&hvadid=167140485757&hvpos=1o2&hvnetw=g&hvrand=2889272093920227984&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=1027028&hvtargid=pla-312069085145 https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...
  - lmilcin 9y ago
    Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.
gambiting 9y ago
I don't know about US, but over here with my Polish bank I have 100% control over the limits for each type of transaction possible with my card, I can set them myself through the web portal of my bank - the types are: 1) transactions with card present(chip+pin or signature) 2) transactions with card not present(someone types in your card number into the terminal) 3) internet transactions(card number + CVV from the back). I can set any of them to zero, effectively blocking the transaction type completely. So yes, while you can read the card number and exp date from the chip, you can't get the CVV number from the back of the card, which means it's only useful for the second type of transactions - and I don't see any reason to ever change the limit on that to anything other than zero - so any information gained from just skimming the chip/magstripe is effectively useless without the CVV written on the back.
- lmilcin 9y ago
  Setting limits to zero is kind of defeating the purpose of having a card in the first place. The better solution is to have a bank with good reputation that expends effort in making your transactions safer. My bank: - has their cards well issued (and I know this since I have worked as credit card terminal developer for many years and I know every detail of how cards are personalized and designed actual security systems), - sends me a code to verify my internet transactions (remember not to use your phone to do internet transactions!), - processes chargebacks without fuss unless there is a reason to suspect cardholder is trying to defraud the merchant.
  - reitanqild 9y ago
    > remember not to use your phone to do internet transactions! Do you have time to explain? I'm aware of the problems with using sms as 2FA but if I understand you correctly you mean something else? (Around here most banks demand we use BankID which is typically downloaded to the sim card in the phone.)
    - lmilcin 9y ago
      You should never use the same device to perform transactions and receive your codes. The security of the scheme lies on using two separate devices under your control. If you were to enter your credit card details on the same device you use to receive codes (most likely your only mobile phone), the attacker having some kind of malware code could first steal your card information and then use your phone to receive the codes to complete the transaction. This requires infecting just one device, so basically as a fraudster you create a malware and wait for people to have their phones infected. Then you defraud those that use phones for credit card transactions and either don't need separate codes to complete the transaction or use the phone for this. It is much more difficult to get two devices infected that are used by the same user. This only typically happens in case of targeted attacks and is rarely seen. My colleague at one of the companies I worked for lost the money he saved to buy a flat this way. He got his phone infected with malware and then over few days he got all his money sucked out of his account in a series of increasing transactions.
secabeen 9y ago
You can't tell from the receipt? Home depot is well known for doing EMV, and the result I see on the receipt is a lot more detailed, with listings for AID, TVR, IAD, TSI and ARC. Chip-enabled regular transactions just seem to list the AID, an Approval #, and a Transaction ID.
jjeaff 9y ago
But also, I don't care as a consumer. Because I don't have any liability. In fact, I prefer the swipe as it is a few seconds faster.
- jmanderley 9y ago
  Except getting skimmed and disputing charges is annoying, not something I care to deal with. I'd rather we have more secure infrastructure that doesn't sustain criminal activity.
  - notyourwork 9y ago
    It takes 5 minutes and a few clicks on a web site now a days. I'm all for more security too but like OP it isn't really my responsibility nor my liability so I have little care.
    - nmcfarl 9y ago
      My last bank made that easy. But required a new card and a new PIN, and immediately and automatically cancelled the old one. As I was abroad at the time, this was not a fun process. Not that it's particularly fast even if you walk into a branch.
      - astura 9y ago
        This is one of the reasons I think it's important to have more than one credit card when traveling (especially abroad). Redundancy in case one get shut down at an inconvenient time in an inconvenient place.
  - reaperducer 9y ago
    I've been skimmed twice, and both times the (major US) banks made it super easy to dispute and I had my money back in a matter of minutes. Now I keep a low-limit branded gas card that can only be used at gas stations. Go ahead and skim me. All they can do is charge $30 worth of Munchos and beef jerky.
- 9y ago
throwaway613834 9y ago
Wait so what's the point of an old-style chip transaction then? Isn't it just painfully slower?
- whipoodle 9y ago
  No, it's not just slower. It's also much more likely to fail. I don't know why anyone bothers except that the card networks forced the issue.
- porlune 9y ago
  The end result in credit card fraud is purchasing something and using a mule to send the fraudulently purchased item to a fencer, who sells it for cash. Having a requirement that all vendors use chip-enabled cards simply increases the cost of producing each cloned card; so the goal is to raise the cost of committing the fraud. At least that is my understanding.
- CyberMuz 9y ago
  I curious how much slower the chip (EMV, or or 'old-style) is than the magetic swipe? Here in EU there is not difference, the transaction is done in couple of seconds max and most of this is the time spent waiting for authorization response. The entry mode chip/magtripe/contactless doesn't make that much difference.
  - throwaway613834 9y ago
    It definitely feels like it takes forever and completely disrupts the motion I'm in by making me wait around to do nothing. I've never timed it but the 10 extra seconds I read [1] sounds pretty accurate. [1] https://www.cardfellow.com/quick-chip-slow-chip-card-transactions/ https://www.cardfellow.com/quick-chip-slow-chip-card-transac...
    - have_faith 9y ago
      In the UK at least, chip takes about 2 - 3 seconds. 4 or 5 would feel long. Contactless is usually instantaneous; I assume there's more caching involved somewhere. I haven't seen anyone or myself swiped in about 10 years, and that was only because the chip reader wasn't working at the time.
kalleboo 9y ago
Interesting, is this a U.S. thing? Because I remember reading about attacks on EMV in Europe and they all seemed to boil down to forcing a fallback to magstripe.
- rasz 9y ago
  there is no magstripe fallback on chip and pin, there is offline mode fallback tho
  - cbhl 9y ago
    Most U.S. banks implement Chip and Sign, though, and enable the Magstripe fallback because retailers still haven't certified their systems end-to-end for Chip and PIN.
    - rasz 9y ago
      Thats basically two cards in one package linked to same account.
  - phire 9y ago
    I don't know about everywhere. But in my country, when the terminal fails to read the chip, it asks you to swipe the magstripe. Then it realises "oh this card should have a chip" and forces you to insert again. After about 3 cycles, it gives up and accepts the magstripe (plus the pin)
    - tempay 9y ago
      I've lived for long durations in the UK, France and Switzerland I've never seen this happen in any of them. However, I have seen it happen twice while traveling for a few days in Norway.
    - snakeboy 9y ago
      In the US, I have to try the chip and fail three times. Then it prompts me to use magstripe. My chip does not work, so have tested this a LOT.
dec0dedab0de 9y ago
The point of the chip is to make it difficult to create a counterfeit card.
tinus_hn 9y ago
It depends on the issuer. Dutch banks by default block all transactions outside of the EU (specifically targeted at countries that still use swipe transactions). That pretty much completely eliminated skimming.

throwaway613834 9y ago

> Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. By the way, do you have any reference on this? Everywhere I've searched, chip seems synonymous with EMV.

lmilcin 9y ago
For background, I was developing those types of applications few years ago, professionally. Every chip or contactless transaction is an EMV transaction. This is by virtue of EMV being the protocol that terminal uses to communicate with the card. EMV allows for different types of transactions with different level of security. For example, if the transaction can be done offline (gas pump unattended terminal situation) AND executing CVM rules (both terminal and issuer have their own rules) points to the possibilty of exchanging encrypted PIN, the PIN can be sent safely encrypted to the card for verification. If the card or the terminal does not support encrypted verification then the PIN can be sent in the clear and vulnerable to skimming.
- throwaway613834 9y ago
  Okay then I'm extremely confused. You say: > Every chip or contactless transaction is an EMV transaction. But the parent comment I was replying to says: > Just because you are using the chip doesn't mean you are doing an EMV transaction. I presume you're saying he's wrong in this? Or am I misunderstanding what you both mean? I'm also confused by the PIN thing you mention. Why is there a PIN at all, and why is there an "encrypted PIN exchange"? We're talking about the US, right? The US is chip & signature, and there is no PIN involved. I thought it was supposed to be that the card generates a unique one-time authorization code (public-key signatures?) and the bank validates it? Where does a PIN come into play?
  - lmilcin 9y ago
    For each transaction a set of very flexible rules is being executed with the aim to perform a number of verifications. Card Verification - no verification (just read magstripe or magstripe equivalent from chip or contactless card that does not have any more advanced verification mechanism) - static verification - for chip, card sends static signature along with the data so that the terminal can verify electronic signature - dynamic verification - for chip, card accepts challenge and generate response so that the terminal can verify the signature. This also makes it much more difficult to copy the card because it is not enough to copy the available data, you also need to copy the key that is embedded in the card. Cardholder Verification - no verification -- sometimes no cardholder verification will be performed (for example contactless under certain limit, unattended terminals without PIN capability or on a plane when there is special rules for airline terminals because people are typically verified separately) - Signature -- this is where US is stuck it seems - offline plaintext PIN -- cardholder enters pin, terminal sends the pin to the card, card responds if the pin is correct -- this is the source of most of the skimming problem - offline encrypted PIN -- same as above but the pin is being encrypted with a key established securely with the card. This is safe but the cards cost more. - online PIN -- the PIN is never exchanged with the card, it is encrypted and sent to the bank and bank decides whether it likes it or not. Transaction verification - floor limit -- sometimes the transaction can be agreed between the terminal and the card. Typically there is some information stored on the card and set of rules that decide that this is possible. The card may be decreasing a limit of funds available offline and when it hits the limit it will force you to perform full chip transaction. - online verification -- the message goes online to the bank and bank decides.
drzaiusapelord 9y ago
He's mostly wrong. The entire point of moving to chip is because liability stops being on the retailer if they implement EMV. Chip and EMV go hand-in-hand. Why bother upgrading your terminals for chip and not do EMV? Might as well stick with swipe then, its the same liability agreement. Its all a stopgap measure to chip and pin anyway. Once everyone is used to EMV and all the terminals have been replaced, we'll have a sunset on swipe and then move to chip and pin, which will be a minor upgrade. This will all take time. Lets remember the United States has a quarter of the world’s credit card transactions, but only 4.5% of its population. Its a very big cc market and change isn't going to come quickly.

lmilcin 9y ago

Hi! I have implement a complete payment terminal application with magstripe, chip and contactless capabilities. I have also designed security protocols to keep the data and keys from the bad guys, including things like Key Injection Facility, loading and exchange protocols, etc. These things (terminals, cards, HSMs) can be extremely safe. Not only there are protocols available that in my knowledge have never been breached but also the devices themselves are built in secure manner to prevent any physical attacks. The entire infrastructure can be made so that no single employee can get hold of any secret material. The truth is, that there is a range of solutions and the secure ones cost. It costs to set them up and use correctly. It costs to produce chip card that can dynamically sign and encrypt the data. It is up to the issuer (bank) how much they pay for the security of their card and typically banks are not too eager to overpay. Rather, they take calculated risk. Another problem is that North America is particularly behind in security standards. I remember, while working on this application (10 years ago) there was much more leniency for US users (issuers, acquirers) than the rest of the world.

amelius 9y ago
> Rather, they take calculated risk. And credit-cards are a testament to that.
ransom1538 9y ago
Sorry I am probably ignorant here but, don't these guys just use mag stripe reader? They often just ask to see your credit card, lean down, swipe on their own device. They aren't 'cracking' Key Injection Facility or messing with protocols. They just add a simple card reader? The reason they hit gas machines is the volume and most don't take chips (US). https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR5176947/?tag=hyprod-20&creative=395033&creativeASIN=B01N4L19CR&linkCode=df0&hvadid=167140485757&hvpos=1o2&hvnetw=g&hvrand=2889272093920227984&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=1027028&hvtargid=pla-312069085145 https://www.amazon.com/dp/B01N4L19CR/ref=asc_df_B01N4L19CR51...
- lmilcin 9y ago
  Let's assume you swiped my card and now you have full contents of my credit card. For the fraudster to receive any funds from my account they would have to go with that data somehow to my issuing bank and have their transaction request accepted. My bank will never do this because my card is a secure one. They expect it to generate a signed document listing the details of my transaction along with the name (ID) of the merchant and terminal performing the transaction. The message also certifies that the PIN I entered was successfully verified by my card. The message can only be created by the card using my PIN. This requires the card to be stolen along with the PIN. The only money I can loose in case my card is stolen without the PIN is up to a floor limit for offline transactions. It's peanuts but it allows for quick transactions for example from vending machines. The gist of the story is to move to a bank that cares for security.

gambiting 9y ago

I don't know about US, but over here with my Polish bank I have 100% control over the limits for each type of transaction possible with my card, I can set them myself through the web portal of my bank - the types are: 1) transactions with card present(chip+pin or signature) 2) transactions with card not present(someone types in your card number into the terminal) 3) internet transactions(card number + CVV from the back). I can set any of them to zero, effectively blocking the transaction type completely. So yes, while you can read the card number and exp date from the chip, you can't get the CVV number from the back of the card, which means it's only useful for the second type of transactions - and I don't see any reason to ever change the limit on that to anything other than zero - so any information gained from just skimming the chip/magstripe is effectively useless without the CVV written on the back.

lmilcin 9y ago
Setting limits to zero is kind of defeating the purpose of having a card in the first place. The better solution is to have a bank with good reputation that expends effort in making your transactions safer. My bank: - has their cards well issued (and I know this since I have worked as credit card terminal developer for many years and I know every detail of how cards are personalized and designed actual security systems), - sends me a code to verify my internet transactions (remember not to use your phone to do internet transactions!), - processes chargebacks without fuss unless there is a reason to suspect cardholder is trying to defraud the merchant.
- reitanqild 9y ago
  > remember not to use your phone to do internet transactions! Do you have time to explain? I'm aware of the problems with using sms as 2FA but if I understand you correctly you mean something else? (Around here most banks demand we use BankID which is typically downloaded to the sim card in the phone.)
  - lmilcin 9y ago
    You should never use the same device to perform transactions and receive your codes. The security of the scheme lies on using two separate devices under your control. If you were to enter your credit card details on the same device you use to receive codes (most likely your only mobile phone), the attacker having some kind of malware code could first steal your card information and then use your phone to receive the codes to complete the transaction. This requires infecting just one device, so basically as a fraudster you create a malware and wait for people to have their phones infected. Then you defraud those that use phones for credit card transactions and either don't need separate codes to complete the transaction or use the phone for this. It is much more difficult to get two devices infected that are used by the same user. This only typically happens in case of targeted attacks and is rarely seen. My colleague at one of the companies I worked for lost the money he saved to buy a flat this way. He got his phone infected with malware and then over few days he got all his money sucked out of his account in a series of increasing transactions.

secabeen 9y ago

You can't tell from the receipt? Home depot is well known for doing EMV, and the result I see on the receipt is a lot more detailed, with listings for AID, TVR, IAD, TSI and ARC. Chip-enabled regular transactions just seem to list the AID, an Approval #, and a Transaction ID.

jjeaff 9y ago

But also, I don't care as a consumer. Because I don't have any liability. In fact, I prefer the swipe as it is a few seconds faster.

jmanderley 9y ago
Except getting skimmed and disputing charges is annoying, not something I care to deal with. I'd rather we have more secure infrastructure that doesn't sustain criminal activity.
- notyourwork 9y ago
  It takes 5 minutes and a few clicks on a web site now a days. I'm all for more security too but like OP it isn't really my responsibility nor my liability so I have little care.
  - nmcfarl 9y ago
    My last bank made that easy. But required a new card and a new PIN, and immediately and automatically cancelled the old one. As I was abroad at the time, this was not a fun process. Not that it's particularly fast even if you walk into a branch.
    - astura 9y ago
      This is one of the reasons I think it's important to have more than one credit card when traveling (especially abroad). Redundancy in case one get shut down at an inconvenient time in an inconvenient place.
- reaperducer 9y ago
  I've been skimmed twice, and both times the (major US) banks made it super easy to dispute and I had my money back in a matter of minutes. Now I keep a low-limit branded gas card that can only be used at gas stations. Go ahead and skim me. All they can do is charge $30 worth of Munchos and beef jerky.
9y ago

throwaway613834 9y ago

Wait so what's the point of an old-style chip transaction then? Isn't it just painfully slower?

whipoodle 9y ago
No, it's not just slower. It's also much more likely to fail. I don't know why anyone bothers except that the card networks forced the issue.
porlune 9y ago
The end result in credit card fraud is purchasing something and using a mule to send the fraudulently purchased item to a fencer, who sells it for cash. Having a requirement that all vendors use chip-enabled cards simply increases the cost of producing each cloned card; so the goal is to raise the cost of committing the fraud. At least that is my understanding.
CyberMuz 9y ago
I curious how much slower the chip (EMV, or or 'old-style) is than the magetic swipe? Here in EU there is not difference, the transaction is done in couple of seconds max and most of this is the time spent waiting for authorization response. The entry mode chip/magtripe/contactless doesn't make that much difference.
- throwaway613834 9y ago
  It definitely feels like it takes forever and completely disrupts the motion I'm in by making me wait around to do nothing. I've never timed it but the 10 extra seconds I read [1] sounds pretty accurate. [1] https://www.cardfellow.com/quick-chip-slow-chip-card-transactions/ https://www.cardfellow.com/quick-chip-slow-chip-card-transac...
  - have_faith 9y ago
    In the UK at least, chip takes about 2 - 3 seconds. 4 or 5 would feel long. Contactless is usually instantaneous; I assume there's more caching involved somewhere. I haven't seen anyone or myself swiped in about 10 years, and that was only because the chip reader wasn't working at the time.

kalleboo 9y ago

Interesting, is this a U.S. thing? Because I remember reading about attacks on EMV in Europe and they all seemed to boil down to forcing a fallback to magstripe.

rasz 9y ago
there is no magstripe fallback on chip and pin, there is offline mode fallback tho
- cbhl 9y ago
  Most U.S. banks implement Chip and Sign, though, and enable the Magstripe fallback because retailers still haven't certified their systems end-to-end for Chip and PIN.
  - rasz 9y ago
    Thats basically two cards in one package linked to same account.
- phire 9y ago
  I don't know about everywhere. But in my country, when the terminal fails to read the chip, it asks you to swipe the magstripe. Then it realises "oh this card should have a chip" and forces you to insert again. After about 3 cycles, it gives up and accepts the magstripe (plus the pin)
  - tempay 9y ago
    I've lived for long durations in the UK, France and Switzerland I've never seen this happen in any of them. However, I have seen it happen twice while traveling for a few days in Norway.
  - snakeboy 9y ago
    In the US, I have to try the chip and fail three times. Then it prompts me to use magstripe. My chip does not work, so have tested this a LOT.

dec0dedab0de 9y ago

The point of the chip is to make it difficult to create a counterfeit card.

tinus_hn 9y ago

It depends on the issuer. Dutch banks by default block all transactions outside of the EU (specifically targeted at countries that still use swipe transactions). That pretty much completely eliminated skimming.