11 ms·

To those asking “Why doesn’t the US use chip+PIN?” there is a good article from the same source: https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/

by gok 9y ago

To those asking “Why doesn’t the US use chip+PIN?” there is a good article from the same source: https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatu... Basically: the form of fraud it protects against is very rare in the US, and consumers find memorizing another number painful. Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective.

pieguy 9y ago
Computerphile video on Chip+PIN fraud: https://www.youtube.com/watch?v=Ks0SOn8hjG8 https://www.youtube.com/watch?v=Ks0SOn8hjG8
fyfy18 9y ago
Are ATMs not used much in the US? In Europe the same PIN is used for ATMs and Chip & PIN transactions, so you don't need to remember another code.
- cstejerean 9y ago
  They are, but people use their debit cards for ATMs and mostly use credit cards for other transactions (for those that do have credit cards, which is a majority of people). All of my credit cards same with some type of pin for using them at ATMs for cash advances. I couldn’t tell you a single one of them.
  - toomanybeersies 9y ago
    I know it's piss poor security, but I just have the same PIN for my debit and credit cards. At one point, I actually just had a single, combined debit and credit card. It worked for both, so I could use it at an ATM, as well as use it as a CC.
    - TylerE 9y ago
      I don't carry (or have) a debit card, and recommend that others do not as well. You have _much_ less fraud protection with a debit card.
      - ghaff 9y ago
        In the US, your ATM card is (at least) often a debit card. Perhaps there's some way to flag them so they can be used only as an ATM card up to the usual daily limits. I agree with your basic point though. I have the card but essentially never use it except for withdrawing cash.
        TylerE 9y ago
        That's what I mean, I don't have any sort of ATM card. If I'm really stuck for cash I can do a cash advance on a CC or walk into a branch.
        comex 9y ago
        My standard Chase ATM card can be used at stores as either credit or debit. Some payment terminals say "enter PIN for debit, or press continue for credit". Some don't, but at at least one store, despite the prompt just saying "Enter PIN", I was able to pay by pressing continue without entering a PIN, so I think the terminal has the same functionality, just not advertised.
        bscphil 9y ago
        Do you mean (a) you convinced your bank to not issue you one, (b) you shredded the card, or (c) you don't have a savings / checking account?
        TylerE 9y ago
        (B), with (unsuccessful attempts at (A))
        bencollier49 9y ago
  - krzyk 9y ago
    Maybe the difference is that more Americans have credit cards than Europeans. This is particularly evident in East European countries, e.g. here in Poland credit cards are far less common than debit cards. And so people use them to pay in their grocery store as well as in ATMs. I for example didn't had a credit card until recently, when I wanted to rent a car, it looks like credit card is (almost) mandatory and I use it only for that purpose. So it just sits in my drawer until once a year I take it out when I go on vacation and rent a car there.
  - e12e 9y ago
    And debit cards don't use chip and pin? What's the distinction here? I recently got a new debit card which has the usual (European) chip and pin - but also annoyingly has contactless payment (aka "leech my money"). Sadly the only way to opt out might be to switch banks...
- tallanvor 9y ago
  Of course most Americans have both debit cards and credit cards. I think that debit cards (as opposed to cards that can only be used at ATMs) didn't really start to become common until the late 90s. I expect that you'll find that older people don't use them as often out of habit.
zwily 9y ago
I still don’t understand why we bother with signature at all though. Nobody checks it. Why not just “chip” if “chip+pin” doesn’t add anything?
- ejo4041 9y ago
  I was under the impression this was used in case of a dispute, they could go back to the receipt to determine if it was your signature or not. Not sure how often that is actually used. Apparently a lot of cards are dropping the requirement anyway. [1] [1] - https://www.creditcards.com/credit-card-news/signatures-soon-may-not-be-required.php https://www.creditcards.com/credit-card-news/signatures-soon...
  - leesalminen 9y ago
    That’s correct. This new policy from the card brands begins this month for EMV transactions. My customers are excited to reduce check out time by dropping the signature requirement.
- reaperducer 9y ago
  The signature signifies intent. You understand the charges on the receipt. You can't say "I didn't know I bought that" when the list of things you bought is right there and you signed your name.
  - amaccuish 9y ago
    You paying signifies intent. If I use Google Pay to pay for something, I've shown that I agree with the charge. The signature is just useless hassle. I've had to do it it twice in my life and they never seemed to be pens around just when you need them...
    - reaperducer 9y ago
      Lawyers disagree. Moreover, if you think that retailers are making you sign a piece of paper because they want to hassle you and make you take your money elsewhere, you need to rethink the situation.
alecco 9y ago
> Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective. At least in UK it was a sort of anti-consumer Trojan horse. Theft decreased by 80% or more, but now the responsibility of the remaining part lays on the user instead of the bank. I remember UK consumer groups quite upset about this ~12 years ago.
- joosters 9y ago
  I can't see how that can be true. Prior to chip+pin, you could still withdraw money from an ATM with a card+pin, so how exactly did the security change? In both cases, you can dispute transactions with the banks, and in both cases, the banks are going to open their defence with "but how did the thief know your PIN?" but that does not make it clear-cut, nor does it mean the banks will always win their argument.
  - praseodym 9y ago
    Before Chip+PIN was introduced, card cloning or ‘skimming’ was a very common fraud method. An ATM would be modified with a device to copy the magnetic strip and register the associated PIN with a keypad overlay or a pinhole camera. This data could then be used to create a cloned card to withdraw money with, sometimes even in another continent. Chip+PIN (EMV) prevents this because the chip cannot be cloned, and so it completely eliminates this form of fraud. However, banks also used the introduction of Chip+PIN to move liability of any fraud to the customer, whereas before the banks would fully refund any fraud.
    - joosters 9y ago
      From http://www.theukcardsassociation.org.uk/faqs/ http://www.theukcardsassociation.org.uk/faqs/ : With chip and PIN, who is liable for card fraud? Consumers remain fully protected from the cost of card fraud and are covered under The Lending Code. From 1 January 2005 there was a shift in liability for some types of card fraud from banks to retailers, but this will not affect cardholders in any way. If businesses have chip and PIN terminals in store, they are covered for the cost of card fraud whether customers enter their PIN or their signature, just so long as staff follow the on-screen prompts and carry out the routine checks to ensure cards have not already been reported lost or stolen. Banks will continue to be liable for the cost of card fraud committed on old-style non-chip and PIN cards, so by accepting them businesses are not putting themselves at risk in any way So in what way has fraud liability shifted on to the customer?
gascan 9y ago
I've also heard before (anecdotal) that in general in the EU, people have far fewer credit cards. As someone with several chip+pin cards in the US, it can be a bit of a chore ensuring they all have the same pin, and I wouldn't even want to try having five different cards with five different pins.
- JoeMalt 9y ago
  It's definitely true that in the EU we tend to make most day-to-day purchases with debit cards.
- toomanybeersies 9y ago
  I used to live in New Zealand, and now in Australia, both countries with widespread adoption of chip and pin. I don't know a single person with more than one credit card. Why would you even need more than one credit card?
  - ghaff 9y ago
    Different cards offer different benefits. At a minimum, I want to have one backup in case I leave one at a restaurant or something wonky happens with fraud systems. So, yeah, I have multiple cards although I mostly only use two of them.
  - astura 9y ago
    Different cards offer different reward structures. I currently have sixteen (16) credit cards, but I'm certainly an outlier. For everyday purchases I use one card for restaurants and gas, another card for groceries and yet another for everything else. Then two other of my cards have rotating bonus categories, so I may use one of those for gas one quarter and for restaurants next quarter. And, at minimum, you should always have a backup, like a sibling comment points out. Especially when travelling, you don't want to be in the middle of nowhere trying to buy meal only to find out your card has fraudulent transactions and the new one has to be mailed to your house.
    - dagw 9y ago
acchow 9y ago
Can we just have chip then? I noticed Walgreens does this. Chip+sig is so stupid. What is the sig supposed to be helpful for?

by gok 9y ago

pieguy 9y ago

Computerphile video on Chip+PIN fraud: https://www.youtube.com/watch?v=Ks0SOn8hjG8 https://www.youtube.com/watch?v=Ks0SOn8hjG8

fyfy18 9y ago

Are ATMs not used much in the US? In Europe the same PIN is used for ATMs and Chip & PIN transactions, so you don't need to remember another code.

cstejerean 9y ago
They are, but people use their debit cards for ATMs and mostly use credit cards for other transactions (for those that do have credit cards, which is a majority of people). All of my credit cards same with some type of pin for using them at ATMs for cash advances. I couldn’t tell you a single one of them.
- toomanybeersies 9y ago
  I know it's piss poor security, but I just have the same PIN for my debit and credit cards. At one point, I actually just had a single, combined debit and credit card. It worked for both, so I could use it at an ATM, as well as use it as a CC.
  - TylerE 9y ago
    I don't carry (or have) a debit card, and recommend that others do not as well. You have _much_ less fraud protection with a debit card.
    - ghaff 9y ago
      In the US, your ATM card is (at least) often a debit card. Perhaps there's some way to flag them so they can be used only as an ATM card up to the usual daily limits. I agree with your basic point though. I have the card but essentially never use it except for withdrawing cash.
      - TylerE 9y ago
        That's what I mean, I don't have any sort of ATM card. If I'm really stuck for cash I can do a cash advance on a CC or walk into a branch.
        comex 9y ago
        My standard Chase ATM card can be used at stores as either credit or debit. Some payment terminals say "enter PIN for debit, or press continue for credit". Some don't, but at at least one store, despite the prompt just saying "Enter PIN", I was able to pay by pressing continue without entering a PIN, so I think the terminal has the same functionality, just not advertised.
        bscphil 9y ago
        Do you mean (a) you convinced your bank to not issue you one, (b) you shredded the card, or (c) you don't have a savings / checking account?
        TylerE 9y ago
        (B), with (unsuccessful attempts at (A))
        bencollier49 9y ago
- krzyk 9y ago
  Maybe the difference is that more Americans have credit cards than Europeans. This is particularly evident in East European countries, e.g. here in Poland credit cards are far less common than debit cards. And so people use them to pay in their grocery store as well as in ATMs. I for example didn't had a credit card until recently, when I wanted to rent a car, it looks like credit card is (almost) mandatory and I use it only for that purpose. So it just sits in my drawer until once a year I take it out when I go on vacation and rent a car there.
- e12e 9y ago
  And debit cards don't use chip and pin? What's the distinction here? I recently got a new debit card which has the usual (European) chip and pin - but also annoyingly has contactless payment (aka "leech my money"). Sadly the only way to opt out might be to switch banks...
tallanvor 9y ago
Of course most Americans have both debit cards and credit cards. I think that debit cards (as opposed to cards that can only be used at ATMs) didn't really start to become common until the late 90s. I expect that you'll find that older people don't use them as often out of habit.

zwily 9y ago

I still don’t understand why we bother with signature at all though. Nobody checks it. Why not just “chip” if “chip+pin” doesn’t add anything?

ejo4041 9y ago
I was under the impression this was used in case of a dispute, they could go back to the receipt to determine if it was your signature or not. Not sure how often that is actually used. Apparently a lot of cards are dropping the requirement anyway. [1] [1] - https://www.creditcards.com/credit-card-news/signatures-soon-may-not-be-required.php https://www.creditcards.com/credit-card-news/signatures-soon...
- leesalminen 9y ago
  That’s correct. This new policy from the card brands begins this month for EMV transactions. My customers are excited to reduce check out time by dropping the signature requirement.
reaperducer 9y ago
The signature signifies intent. You understand the charges on the receipt. You can't say "I didn't know I bought that" when the list of things you bought is right there and you signed your name.
- amaccuish 9y ago
  You paying signifies intent. If I use Google Pay to pay for something, I've shown that I agree with the charge. The signature is just useless hassle. I've had to do it it twice in my life and they never seemed to be pens around just when you need them...
  - reaperducer 9y ago
    Lawyers disagree. Moreover, if you think that retailers are making you sign a piece of paper because they want to hassle you and make you take your money elsewhere, you need to rethink the situation.

alecco 9y ago

> Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective. At least in UK it was a sort of anti-consumer Trojan horse. Theft decreased by 80% or more, but now the responsibility of the remaining part lays on the user instead of the bank. I remember UK consumer groups quite upset about this ~12 years ago.

joosters 9y ago
I can't see how that can be true. Prior to chip+pin, you could still withdraw money from an ATM with a card+pin, so how exactly did the security change? In both cases, you can dispute transactions with the banks, and in both cases, the banks are going to open their defence with "but how did the thief know your PIN?" but that does not make it clear-cut, nor does it mean the banks will always win their argument.
- praseodym 9y ago
  Before Chip+PIN was introduced, card cloning or ‘skimming’ was a very common fraud method. An ATM would be modified with a device to copy the magnetic strip and register the associated PIN with a keypad overlay or a pinhole camera. This data could then be used to create a cloned card to withdraw money with, sometimes even in another continent. Chip+PIN (EMV) prevents this because the chip cannot be cloned, and so it completely eliminates this form of fraud. However, banks also used the introduction of Chip+PIN to move liability of any fraud to the customer, whereas before the banks would fully refund any fraud.
  - joosters 9y ago
    From http://www.theukcardsassociation.org.uk/faqs/ http://www.theukcardsassociation.org.uk/faqs/ : With chip and PIN, who is liable for card fraud? Consumers remain fully protected from the cost of card fraud and are covered under The Lending Code. From 1 January 2005 there was a shift in liability for some types of card fraud from banks to retailers, but this will not affect cardholders in any way. If businesses have chip and PIN terminals in store, they are covered for the cost of card fraud whether customers enter their PIN or their signature, just so long as staff follow the on-screen prompts and carry out the routine checks to ensure cards have not already been reported lost or stolen. Banks will continue to be liable for the cost of card fraud committed on old-style non-chip and PIN cards, so by accepting them businesses are not putting themselves at risk in any way So in what way has fraud liability shifted on to the customer?

gascan 9y ago

I've also heard before (anecdotal) that in general in the EU, people have far fewer credit cards. As someone with several chip+pin cards in the US, it can be a bit of a chore ensuring they all have the same pin, and I wouldn't even want to try having five different cards with five different pins.

JoeMalt 9y ago
It's definitely true that in the EU we tend to make most day-to-day purchases with debit cards.
toomanybeersies 9y ago
I used to live in New Zealand, and now in Australia, both countries with widespread adoption of chip and pin. I don't know a single person with more than one credit card. Why would you even need more than one credit card?
- ghaff 9y ago
  Different cards offer different benefits. At a minimum, I want to have one backup in case I leave one at a restaurant or something wonky happens with fraud systems. So, yeah, I have multiple cards although I mostly only use two of them.
- astura 9y ago
  Different cards offer different reward structures. I currently have sixteen (16) credit cards, but I'm certainly an outlier. For everyday purchases I use one card for restaurants and gas, another card for groceries and yet another for everything else. Then two other of my cards have rotating bonus categories, so I may use one of those for gas one quarter and for restaurants next quarter. And, at minimum, you should always have a backup, like a sibling comment points out. Especially when travelling, you don't want to be in the middle of nowhere trying to buy meal only to find out your card has fraudulent transactions and the new one has to be mailed to your house.
  - dagw 9y ago

acchow 9y ago

Can we just have chip then? I noticed Walgreens does this. Chip+sig is so stupid. What is the sig supposed to be helpful for?