6 ms·
>The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they
by drbawb 9y ago
>The reason the crooks don’t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that.
I guess I'm a little confused as to how this works. In the case of my two card issuers "activating" the card means performing at least one fully online transaction at a chip-enabled merchant. (e.g: card present, chip used, pin entered.) If the card's chip were replaced in transit then I wouldn't be able to activate the new card. I'm guessing they are targeting card issuers that have a different activation scheme; but I'm a bit surprised that my extremely small midwestern bank is actually ahead of the curve on card security.
- mikeash 9y agoSounds like they’re way ahead of the curve. My debit cards activate over the phone just like credit cars.
- dragonwriter 9y agoMine have (in the past, may have changed since the last one was issued) permitted both forms.
- criley2 9y agoMine have the strip that says "call" but they work on first chip use...
- paulie_a 9y agoI've forgotten to activate a card and it still worked, complete with the sticker still on it... And no signature on the back. Hell I don't think a single card I have is actually signed.
- reaperducer 9y agoLately the way to activate the cards I've received is to use them at one of the bank's ATM's. Checking a balance is enough.
- ghostly_s 9y ago'Activation' for some cards entails calling a number included in the literature; you don't need to do anything further, so I presume they just confirm the call is coming from the phone number you have on file?
- dalore 9y agoThese days you can do some of them online. You get a website and a code.
- tialaramex 9y agoMy bank would do normal phone banking authentication, so that means I need to know my name and address (which someone who had intercepted the card has) and then I need to know a password (from which I will be asked random letters) and for some other thing I told them like "my favourite food is Apple pie" or "I secretly hate owls". No idea what would happen for a company, but I wouldn't be surprised if some PA picked the answers and wrote them down. Which still makes it hard for a random crook to have them.
- ChuckMcM 9y agoThat is the 'non US' view sadly. You see we didn't get "chip AND PIN" in the US. We got "chip to send the magnetic stripe". If you use a US chipped credit card in a terminal it doesn't ask for a pin, it just wants an unintelligible signature and you're done. I'm more than a bit irritated with this since without the pin you can 'skim' chip cards just as easily as you can magnetic cards.
- hueving 9y agoWhat do you mean by skim in this context? Many card skimmers can also capture the PIN entered on the pad.
- oneplane 9y agoBut then what's the point? The whole signature scheme is not making much sense anyway, and pretending that no change is better because it is cheaper just gives you technical debt in the long run. Would probably be better if at some point it was decided that using a signature is stupid and a deadline for using a PIN was set. But then again, the US hasn't been able to fix the date naming scheme, the measurement system or the temperature system (and it's just 4% of the world that is still using the old ones). I doubt this will ever be fixed.
- bobthepanda 9y agoSignature is not proof of identity, you are essentially signing a contract. The US model does not have any actual form of identity verification.
- mjevans 9y agoPrecisely correct. The legal model is a contract and you can't sign one of those with just a (short) pin.
- leesalminen 9y agoThe card brands are dropping the signature requirement for EMV transactions in the US this month. https://cardconnect.com/company/blog/no-more-signing-for-purchases https://cardconnect.com/company/blog/no-more-signing-for-pur...