19 ms·
Secret Service Warns of Chip Card Scheme
- jovanking 9y agohi
- halestock 9y agoSo, aside from the fact that this is screaming for chip + pin, isn't this a failure on the cardmaker's part to make a card that you can remove the chip without destroying the card?
- atonse 9y agoI keep saying this but the we in the US really screwed up in the transition to chips. We had a chance to change behavior but we went ahead and ignored pins. I simply don't understand why, apart from too many retailers complaining.
- cobookman 9y agoIf cost of fraud is less than the cost of pins. Then nobody will push for pins. Adding pins to checkout process adds friction and checkout time. It might be a minor amount per transaction. However if you add it up across all transactions, it's a significant amount.
- jdblair 9y agoMore friction than printing out a receipt and asking me to sign it? BTW, if you want to see just how efficient chip-and-pin can be, go to a bar in a nordic country. In Helsinki I can pay with chip-and-pin as quickly as cash (assuming change). The bartenders won't even hold a tab open for you, they just charge you every time. I've experienced the same efficiency in Sweden.
- clintonb 9y agoI only sign paper at restaurants. If a signature is needed at a retail store, I usually sign a digital pad.
- wycy 9y agoStill seems slower than entering a pin on a number pad.
- mattnewton 9y agoAlso why are scribbles equatable here, they are very subjective to verify.
- ghaff 9y agoIncreasingly you sign (or in my case scrawl a wiggly line) a pad but I still sign paper fairly regularly. One of the issues with PIN in the US is likely that you'd have needed a whole new workflow and mobile devices at sit-down restaurants. It would arguably be a better system to move to settling up at the table, but it would still be a big and expensive change.
- smelendez 9y agoYou needed new devices anyway to switch to chip, but I think it is a cultural issue with tipping. Some people really like that the server doesn't know how much you tipped until you leave.
- ghaff 9y agoYeah, that may be part of it. It's not really rational but I don't especially like someone waiting for me to enter a tip amount into a keypad. I imagine others feel similarly. The US isn't unique in having tips but in the UK, for example, they tend to put 10% onto the bill automatically. ADDED: And you needed new devices but not mobile systems to bring to the table.
- atonse 9y agoActually with chips with pins, it's faster because you can authenticate locally. Since we don't use chips, we have to do a server roundtrip, which is why initially a lot of the chip cards seemed to take "forever" (30 seconds) to authenticate.
- dfox 9y agoAnother performance issue with early EMV (I assume before NFC) is that it supports more different applications ("cards") on same physical card and there is no preferred one and the terminal essentially tries random file names until it finds something (and in fact is even supposed to continue the search to exhaustion for the rare case when the card contains more than one usable EMV application, in which case the customer is supposed to select the used one from menu). In current version the cards are supposed to contain data file with known name which specifies the filename of preferred application, this is required for NFC cards for somewhat obvious reasons, but AFAIK only recommended for contact-only. This process is probably the largest part of what happens when the terminal/ATM displays message like "Chip initialisation in progress".
- Sir_Substance 9y ago>Adding pins to checkout process adds friction and checkout time. It might be a minor amount per transaction. However if you add it up across all transactions, it's a significant amount. Uuuuuh... The rest of the world has been doing this for at least a decade without any problems at all. You got any kind of citation you can link us to demonstrating that the rest of the world is suffering from this decision in a way that the US is not?
- plopz 9y agoHow do you give your card to someone else to purchase something?
- deleted 9y ago[deleted]
- supertrope 9y agoIf "someone else" is referring to the cashier, the customer uses the payment machine themselves. In PIN using countries the waiter brings a machine or you step over to the front counter. If someone else is your spouse, kid, or personal assistant; you tell them the PIN or ask the issuer for an authorized user card.
- Sir_Substance 9y agoI...don't. Ever. Why would you do that? That's terrible. I usually transfer them the money through the free, instant, secure and traceable inter-bank transfers that are universally provided by every financial institution in my country to every other financial institution in my country, so that they can use their own card.
- oneplane 9y agoYou don't. Ever.
- gambiting 9y agoWell, you don't. But I wouldn't have a problem with my partner using my card, in which case I just give them my pin? On the other hand, that is(or should be) literally impossible with signature.
- ghaff 9y agoI've never heard an authoritative answer about why the US didn't go to PINs when chips were adopted. One strongly suspects there was significant concern about changing retail/restaurant/etc. workflows, confusing customers who mostly don't use debit cards (with PINs), and otherwise introduced more confusion and friction to customers than absolutely necessary.
- bckygldstn 9y agoOn most of the machines I've used in Sweden, you can input your PIN in advance while the cashier is scanning your items. Then you just push "OK" to confirm the final total and walk away.
- calvano915 9y agoThis process also occurs in US with the chip transactions. You can start the auth process while checkout scanning is still occurring. So implementing the pin into the mix would be beneficial and not so much added friction/time in completing checkout.
- bckygldstn 9y agoYeah, I've noticed that works with Apple Pay, but cards still seem really slow to me.
- bluGill 9y agoI'm complaining as a consumer. I have half a dozen cards in my wallet, and each retailer is incentivizing me to get their card (5% off is hard to ignore), if I applied for and carried all those cards I'd have ~20 cards to carry around, each with a different $%&#@%^^% PIN to memorize. It is not possible to do that. Quite frankly, as a consumer I don't need increased security over what we had 20 years ago (mag strip and signature), someone else took the liability for any fraud. Chip+pin is trying to push the cost of fraud on me, and I don't like it. The value of cards over cash or checks is largely because I pay less price for fraud.
- eloff 9y agoUse the same pin for all. It's only marginally less secure.
- paulie_a 9y agoWhy even require a signature in that case, it's a waste of my time. I've literally wrote "blah blah" and seen the signature accepted notification. Signatures do absolutely nothing in that case so why bother?
- mikeash 9y agoI think they just make it harder for you to claim the transaction was fraudulent.
- paulie_a 9y agoI work in the credit card processing industry and can't even begin to comprehend how a fake signature would help. It wasn't a valid signature. Even when you attempt to make a legitimate signature on a screen it comes out incredibly poorly. The only legitimaticy is that "someone signed some form of letters/made a drawing of a penis". I can't see why that would ever prevent chargebacks
- supertrope 9y agoAs of this month (April 2018), the big four card networks have stopped requiring (USA) merchants to collect signatures if chip is used. They had already waived this documentation step for the ~80% of transactions below $50.
- deleted 9y ago[deleted]
- nostromo 9y agoBanks don't pay the cost of point of sale fraud -- retailers do. I imagine if banks were required to shoulder the cost of point-of-sale fraud, suddenly they'd be very interested in issuing PINs.
- supertrope 9y agoOnly if the retailer has failed to upgrade to reading chips. E-commerce merchants have to absorb 100% of fraud which is why many are so picky about addresses exactly matching and sometimes require ID scans or phone verification for new customers or very large orders.
- jotm 9y agoDon't worry, contactless throws all of that out the window. It's like WPS for routers. Anyone got your card? They can make purchases and cashback till your account is out of cash or they get really tired. Yeah, there can be a limit on the number of transactions, but my bank and several others just don't care, there's only a limit on a single transaction, currently £30. Genius, just genius. That's for personal cards, though. Always use a prepaid card when paying for anything, anywhere.
- gambiting 9y agoThat is just not true - you will be asked for a pin if you use contactless multiple times in succession, and you can't do cashback with contactless at all. I also live in UK.
- jotm 9y agoHow many times? I did 5 consecutive purchases in a day with TSB, no PIN requirement. Contactless VISA allows for cashback. Barclays, 3 consecutive purchases, haven't tried cashback.
- dboreham 9y agoPeople in the US routinely give their cards to other people to use (e.g. relatives). Yet banks tell everyone never to disclose your PIN. So using PINs would prevent card lending which would reduce bank's income.
- antiterra 9y agoChip+signature is a trojan horse for chip+PIN and the terminal hw/sw already works with that system if your bank issues a chip and PIN.
- tucif 9y agoAt least in my country I've seen a common practice for the bank to mail (separately, days before/after) an envelope with a temporary PIN to the customer, so that they can activate the card and change it. Not sure if they do that in the US or if they'd do it for corporate cards as well, but I guess it wouldn't be a problem to intercept the second envelope for whoever intercepts the cards. In that case the PIN wouldn't add any value. Now regarding card destruction, I wonder how hard would it be for them to just print fake cards with fake chips that just have the same numbers. Probably a better solution would be forcing to activate the card in an atm, so that the chip would be validated.. cumbersome but safer.
- RightMillennial 9y agoIn my experience, you'll receive the card and temporary PIN separately in the mail for debit cards in the U.S.
- tantalor 9y agoI'd place the blame more on the card packaging; it should be in a tamper proof envelope. Or there should be a "scratch off" necessary to activate the card.
- pronoiac 9y agoI'm getting a redirect loop. Here's a mirror from the Internet Archive: https://web.archive.org/web/20180405160113/https://krebsonsecurity.com/2018/04/secret-service-warns-of-chip-card-scheme/ https://web.archive.org/web/20180405160113/https://krebsonse...
- zeveb 9y agoYou have to enable cookies. I assume it's some sort of anti-DOS defense (e.g., send cookie & redirect; dumb scripts will just uselessly loop instead of causing a server render), but man is it annoying.
- ernesth 9y agoActivating a card usually involves using it in a machine reading the chip and asking the pin (typically an ATM).
- atonse 9y agoNot in the US – we just have to go to a website or call a number and that activates the card.
- sli 9y agoAll of the debit cards I've gotten from traditional B&M banks have let me activate them at an ATM. Only my current bank, which does not have physical locations, doesn't give me that option. I assume it's because they let you use ATMs from partner banks but don't have their own.
- atonse 9y agoAh I just want to clarify, we aren't "required" to activate at an ATM. I'm just saying that we are able to activate a card without having to go to an ATM. I'm sure going to an ATM is an option as well.
- ubernostrum 9y agoI have a credit (really, not debit) card, in the US, that does chip+PIN. I activated it online and chose a PIN on the card issuer's web portal.
- wil421 9y agoIt’s definitely is an option with debit cards in the US. Just not for the banks you use. My bank and credit union both do it.
- m-p-3 9y agoMaybe it's different in the US for corporate cards.
- deleted 9y ago[deleted]
- gonesilent 9y agoThis seems like it would need someone on the inside. How do you know the corps about to get new cards?
- m3kw9 9y agoSome banks now have new activation procedures now include using your card to do a transaction or just use with correct pin.
- drbawb 9y ago>The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that. I guess I'm a little confused as to how this works. In the case of my two card issuers "activating" the card means performing at least one fully online transaction at a chip-enabled merchant. (e.g: card present, chip used, pin entered.) If the card's chip were replaced in transit then I wouldn't be able to activate the new card. I'm guessing they are targeting card issuers that have a different activation scheme; but I'm a bit surprised that my extremely small midwestern bank is actually ahead of the curve on card security.
- mikeash 9y agoSounds like they’re way ahead of the curve. My debit cards activate over the phone just like credit cars.
- dragonwriter 9y agoMine have (in the past, may have changed since the last one was issued) permitted both forms.
- criley2 9y agoMine have the strip that says "call" but they work on first chip use...
- paulie_a 9y agoI've forgotten to activate a card and it still worked, complete with the sticker still on it... And no signature on the back. Hell I don't think a single card I have is actually signed.
- reaperducer 9y agoLately the way to activate the cards I've received is to use them at one of the bank's ATM's. Checking a balance is enough.
- 9y ago
- AlphaWeaver 9y ago> The Secret Service memo doesn’t specify at what point in the mail process the crooks are intercepting the cards. It could well involve U.S. Postal Service employees (or another delivery service), or perhaps the thieves are somehow gaining access to company mailboxes directly. Either way, this alert shows the extent to which some thieves will go to target high-value customers. The idea that employees of delivery companies might be conspiring to do these large scale scams is terrifying.
- lightedman 9y agoOh, this is nothing. You don't realize just how much stuff 'drops off the docks' or is 'beyond economical repair' in logistics. I remember when a ton of Sony stuff disappeared from the repair depot I worked at. Boy that was a fun day. 300 laptops, freshly repaired that week, gone from the warehouse. Never even made it to the shipping lanes on the other side of the warehouse. And no camera footage despite every angle being covered from the repair store cage to the shipping lanes.
- calvinbhai 9y agoIn US, chip cards are activated on phone/web. A simple way to solve this issue is ask for a pin only for first use (provided at the time of activation). That way users will have to use pin only once, after which it can be used like a regular chip card. Ideally, pin should be asked for each transaction. But I’m the land of the free, PIN is an outcast.
- criddell 9y agoI wouldn't be surprised if they thought of this then decided not to because the customer support cost of people that don't pay attention and try to use the card without the pin would be higher than the expected losses.
- furyg3 9y agoI don't understand how this can be implemented so badly. It's like someone looked at a European system, said "that Chip+PIN system sure looks great. What if we copied it, but then removed the security and increased the hassle."
- exabrial 9y agoFrom the article: > It could well involve U.S. Postal Service employees (or another delivery service) I find older generations put a lot of faith in the post office. For instance, one of my investment banks, "in order to securely reset your online password", literally snail-mailed me a new pin number. Some day, I'd like to be able to able to register public keys with my bank's blockchain and have them only authorize purchases if the itemized invoice is signed by an active private key. One can dream.
- excalibur 9y agoProblem: Chips are too easily removed from and transferred between cards. Solution: Put chips in humans instead. https://pbs.twimg.com/media/DQLzlRcX0AABygD.jpg https://pbs.twimg.com/media/DQLzlRcX0AABygD.jpg
- theandrewbailey 9y agoNext problem: Chips are too easily removed from and transferred between humans. Solution: ???
- TheBeardKing 9y agoSounds like credit cards need to come with some sort of "tampered with" mechanism covering the chip, sort of like scratch off to reveal numbers on gift cards.
- astura 9y agoThat's very easily circumvented: 1) Remove scratch off tape 2) Tamper with card 3) Replace scratch off tape You can get scratch off tape from here: https://www.amazon.com/Security-Evident-Scratch-Stickers-Scratch-Off/dp/B00MW1ZCJE https://www.amazon.com/Security-Evident-Scratch-Stickers-Scr... People tamper with giftcards this way too.
- oneplane 9y agoI wonder why they chose a system or workflow that breaks with what we are pretty much doing everywhere else in the world: chip + PIN. It works, it's fast and reliable. And with optional NFC it's even faster. While people can always make up arguments for some edge case where it wouldn't work for them, that is anecdotal at best. Resisting change it only going to hurt (economically, technically, knowledge-wise) in the long run. I know that learning from history is not humanity's greatest skill, but actively working against what turned out to be a bad practise seems rather.. strange. And at the same time, some commercial services jump in to fill the void, which is not something you probably want either due to the risk of monopoly, data sharing and other privacy concerns.
- biafra 9y agoWouldn't the criminal in this case be able to intercept the letter with the PIN also and replace it with a letter that looks the same but has the wrong PIN? The receiver would not be able to find out the PIN is wrong because the cards chip does not work at all.
- juvinious 9y agoPins are generally mailed separately before after mailing the cards. (In this case I'm speaking of debit cards) It might make it difficult to map the pins to the chips, but maybe not since it seems these are bulk mailings.
- doikor 9y agoSome banks allow the user to choose the pin when ordering the card so they can save the postage on one extra letter.
- gambiting 9y agoI have never received the pin by post. My bank sends me the card, then I have to go online to activate it and set the pin on the website - the card never has a pin assigned to it by default.
- 9y ago
- gok 9y agoTo those asking “Why doesn’t the US use chip+PIN?” there is a good article from the same source: https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatu... Basically: the form of fraud it protects against is very rare in the US, and consumers find memorizing another number painful. Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective.
- pieguy 9y agoComputerphile video on Chip+PIN fraud: https://www.youtube.com/watch?v=Ks0SOn8hjG8 https://www.youtube.com/watch?v=Ks0SOn8hjG8
- fyfy18 9y agoAre ATMs not used much in the US? In Europe the same PIN is used for ATMs and Chip & PIN transactions, so you don't need to remember another code.
- cstejerean 9y agoThey are, but people use their debit cards for ATMs and mostly use credit cards for other transactions (for those that do have credit cards, which is a majority of people). All of my credit cards same with some type of pin for using them at ATMs for cash advances. I couldn’t tell you a single one of them.
- toomanybeersies 9y agoI know it's piss poor security, but I just have the same PIN for my debit and credit cards. At one point, I actually just had a single, combined debit and credit card. It worked for both, so I could use it at an ATM, as well as use it as a CC.
- TylerE 9y agoI don't carry (or have) a debit card, and recommend that others do not as well. You have _much_ less fraud protection with a debit card.
- rootedbox 9y agothe physical man in the middle attack