5 ms·

> Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective. At least in

by alecco 9y ago

> Europe adopted chip+PIN not because anyone really wanted it but because it was mandated by law. It’s unclear that it has actually been effective. At least in UK it was a sort of anti-consumer Trojan horse. Theft decreased by 80% or more, but now the responsibility of the remaining part lays on the user instead of the bank. I remember UK consumer groups quite upset about this ~12 years ago.

joosters 9y ago
I can't see how that can be true. Prior to chip+pin, you could still withdraw money from an ATM with a card+pin, so how exactly did the security change? In both cases, you can dispute transactions with the banks, and in both cases, the banks are going to open their defence with "but how did the thief know your PIN?" but that does not make it clear-cut, nor does it mean the banks will always win their argument.
- praseodym 9y ago
  Before Chip+PIN was introduced, card cloning or ‘skimming’ was a very common fraud method. An ATM would be modified with a device to copy the magnetic strip and register the associated PIN with a keypad overlay or a pinhole camera. This data could then be used to create a cloned card to withdraw money with, sometimes even in another continent. Chip+PIN (EMV) prevents this because the chip cannot be cloned, and so it completely eliminates this form of fraud. However, banks also used the introduction of Chip+PIN to move liability of any fraud to the customer, whereas before the banks would fully refund any fraud.
  - joosters 9y ago
    From http://www.theukcardsassociation.org.uk/faqs/ http://www.theukcardsassociation.org.uk/faqs/ : With chip and PIN, who is liable for card fraud? Consumers remain fully protected from the cost of card fraud and are covered under The Lending Code. From 1 January 2005 there was a shift in liability for some types of card fraud from banks to retailers, but this will not affect cardholders in any way. If businesses have chip and PIN terminals in store, they are covered for the cost of card fraud whether customers enter their PIN or their signature, just so long as staff follow the on-screen prompts and carry out the routine checks to ensure cards have not already been reported lost or stolen. Banks will continue to be liable for the cost of card fraud committed on old-style non-chip and PIN cards, so by accepting them businesses are not putting themselves at risk in any way So in what way has fraud liability shifted on to the customer?
    - blibble 9y ago
      certain banks did try for a while after the chip and pin rollout to try to pass liability onto the consumer with statements like: "our systems are foolproof, and as you can only withdraw money with your PIN, you must have given your PIN out, so it's your problem" this was mostly ineffective against people that knew the law http://www.phantomwithdrawals.com/ http://www.phantomwithdrawals.com/
    - tialaramex 9y ago
      Much as juries tend to believe a cop even though data suggests cops aren't very reliable even when they aren't actively lying, so they also tend to believe a smartly dressed bank official. Victims of fraud who end up on trial (either tacitly after they have to sue the bank for their money, or more rarely literally after the bank tells police they committed fraud) are disproportionally female, elderly and non-white, all factors that make them less believable to a jury, almost as if those trying this on know that... Juries are rarely told, and bank officials would hardly volunteer that big frauds often involve a bank insider, and sometimes even an insider the bank has since caught and fired. You won't get the money back from an insider who was taking 10% but you can make a victim of the individual account holder rather than eat the loss at your multi-billion dollar bank. And all you have to do is pretend systems you know are all too fallible are instead perfect. Ross Anderson has written about some of this on Light Blue Touchpaper
      - joosters 9y ago
        Again, I can't see how anything changed. You have a card and you needed a PIN to use it, before and after the chip was added. Smartly dressed bank officials were around in both times. In either situation/time period, banks would claim "how could someone possibly have got cash/goods without you disclosing your PIN? Our systems are secure!" whereas we know that the systems, before and after the chip, are not 100% secure. Ross Anderson has been instrumental in demonstrating this, for sure. As I've quoted from the website, there was no change to the consumer protection in the introduction of the chip. Your description applies equally well to court cases before and after the technology changed.
  - chrischen 9y ago
    Contrary to popular belief, merchants are responsible for frauduluent charges, big or small. They pay not only in any lost merchandise or services, but also in losing the payment. This shifting of burden ultimately comes back to the consumer in higher costs and fees, and is just a cost of business for the merchants. The credit card company beneifts because they make money regardless of fraud, and they’ll make increased money from the detachment of the feedback loop from the consumer. Merchants don’t pursue fraud because they simply increase costs to cover it. In this scenario merchants lose, consumers lose, credit card companies win from increased usage.
    - joosters 9y ago
      See the text I cited from the card association’s website. Merchants are only responsible for fraud (in the U.K. at least) if they did not use chip + PIN properly. Who pays for fraud, in the end? Well, the customers pay, of course, since they are ultimately the only source of funds. Regardless of whether or not the merchant or bank eats the fraud, they are going to recoup the cost through their charges to customers.
eterm 9y ago
But in the UK banks still cover fraudulent transactions at no cost to the consumer.
- fra 9y ago
  Not the banks, the vendors. It’s a great coup that banks have convinced customers they cover credit card fraud when really visa/MasterCard go and take the money back from the seller.
  - celticninja 9y ago
    That's with credit cards which are owned and run by VISA/MasterCard. If your debit card is used to take money from your bank, then the bank pays.
- alecco 9y ago
  Perhaps after the outrage they changed. I remember the articles clearly.
chrischen 9y ago
I find shifting the burden to the merchant or card processor to be ultimately anti-consumer. It hides the true cost of financial crimes from consumers and ultimately manifests in increased costs, while to the merchants or banks it’s just a cost of business. In the end the consumer is shielded from fraud but ultimately pays for it.
- stordoff 9y ago
  The merchant/processor are better placed to take the burden though - it may increase the fees, but to me, an ongoing marginal increase is preferable to the risk of being cleaned out in the case of fraud. It's also pro-consumer in that it lets you use your debit cards without much fear of fraud -- if I were liable for fraudulent charges, I would be _much_ more reluctant to use it anywhere (especially as the bank may not be as incentivised to provide as good a fraud protection), drastically reducing its utility.
  - chrischen 9y ago
    The reason why I think it's anti-consumer is that by detaching the liability of fraud from the end consumer means detaching it from the whole system. No one really cares about the fraud if the consumer doesn't. The credit card company profits either way, but by removing any concern for fraud it makes more money. I think a sensible solution is to split the liability between the merchant and consumer. Hiding it from the consumer hides it from the one party that would even care about prosecuting fraud.

by alecco 9y ago

joosters 9y ago

I can't see how that can be true. Prior to chip+pin, you could still withdraw money from an ATM with a card+pin, so how exactly did the security change? In both cases, you can dispute transactions with the banks, and in both cases, the banks are going to open their defence with "but how did the thief know your PIN?" but that does not make it clear-cut, nor does it mean the banks will always win their argument.

praseodym 9y ago
Before Chip+PIN was introduced, card cloning or ‘skimming’ was a very common fraud method. An ATM would be modified with a device to copy the magnetic strip and register the associated PIN with a keypad overlay or a pinhole camera. This data could then be used to create a cloned card to withdraw money with, sometimes even in another continent. Chip+PIN (EMV) prevents this because the chip cannot be cloned, and so it completely eliminates this form of fraud. However, banks also used the introduction of Chip+PIN to move liability of any fraud to the customer, whereas before the banks would fully refund any fraud.
- joosters 9y ago
  From http://www.theukcardsassociation.org.uk/faqs/ http://www.theukcardsassociation.org.uk/faqs/ : With chip and PIN, who is liable for card fraud? Consumers remain fully protected from the cost of card fraud and are covered under The Lending Code. From 1 January 2005 there was a shift in liability for some types of card fraud from banks to retailers, but this will not affect cardholders in any way. If businesses have chip and PIN terminals in store, they are covered for the cost of card fraud whether customers enter their PIN or their signature, just so long as staff follow the on-screen prompts and carry out the routine checks to ensure cards have not already been reported lost or stolen. Banks will continue to be liable for the cost of card fraud committed on old-style non-chip and PIN cards, so by accepting them businesses are not putting themselves at risk in any way So in what way has fraud liability shifted on to the customer?
  - blibble 9y ago
    certain banks did try for a while after the chip and pin rollout to try to pass liability onto the consumer with statements like: "our systems are foolproof, and as you can only withdraw money with your PIN, you must have given your PIN out, so it's your problem" this was mostly ineffective against people that knew the law http://www.phantomwithdrawals.com/ http://www.phantomwithdrawals.com/
  - tialaramex 9y ago
    Much as juries tend to believe a cop even though data suggests cops aren't very reliable even when they aren't actively lying, so they also tend to believe a smartly dressed bank official. Victims of fraud who end up on trial (either tacitly after they have to sue the bank for their money, or more rarely literally after the bank tells police they committed fraud) are disproportionally female, elderly and non-white, all factors that make them less believable to a jury, almost as if those trying this on know that... Juries are rarely told, and bank officials would hardly volunteer that big frauds often involve a bank insider, and sometimes even an insider the bank has since caught and fired. You won't get the money back from an insider who was taking 10% but you can make a victim of the individual account holder rather than eat the loss at your multi-billion dollar bank. And all you have to do is pretend systems you know are all too fallible are instead perfect. Ross Anderson has written about some of this on Light Blue Touchpaper
    - joosters 9y ago
      Again, I can't see how anything changed. You have a card and you needed a PIN to use it, before and after the chip was added. Smartly dressed bank officials were around in both times. In either situation/time period, banks would claim "how could someone possibly have got cash/goods without you disclosing your PIN? Our systems are secure!" whereas we know that the systems, before and after the chip, are not 100% secure. Ross Anderson has been instrumental in demonstrating this, for sure. As I've quoted from the website, there was no change to the consumer protection in the introduction of the chip. Your description applies equally well to court cases before and after the technology changed.
- chrischen 9y ago
  Contrary to popular belief, merchants are responsible for frauduluent charges, big or small. They pay not only in any lost merchandise or services, but also in losing the payment. This shifting of burden ultimately comes back to the consumer in higher costs and fees, and is just a cost of business for the merchants. The credit card company beneifts because they make money regardless of fraud, and they’ll make increased money from the detachment of the feedback loop from the consumer. Merchants don’t pursue fraud because they simply increase costs to cover it. In this scenario merchants lose, consumers lose, credit card companies win from increased usage.
  - joosters 9y ago
    See the text I cited from the card association’s website. Merchants are only responsible for fraud (in the U.K. at least) if they did not use chip + PIN properly. Who pays for fraud, in the end? Well, the customers pay, of course, since they are ultimately the only source of funds. Regardless of whether or not the merchant or bank eats the fraud, they are going to recoup the cost through their charges to customers.

eterm 9y ago

But in the UK banks still cover fraudulent transactions at no cost to the consumer.

fra 9y ago
Not the banks, the vendors. It’s a great coup that banks have convinced customers they cover credit card fraud when really visa/MasterCard go and take the money back from the seller.
- celticninja 9y ago
  That's with credit cards which are owned and run by VISA/MasterCard. If your debit card is used to take money from your bank, then the bank pays.
alecco 9y ago
Perhaps after the outrage they changed. I remember the articles clearly.

chrischen 9y ago

I find shifting the burden to the merchant or card processor to be ultimately anti-consumer. It hides the true cost of financial crimes from consumers and ultimately manifests in increased costs, while to the merchants or banks it’s just a cost of business. In the end the consumer is shielded from fraud but ultimately pays for it.

stordoff 9y ago
The merchant/processor are better placed to take the burden though - it may increase the fees, but to me, an ongoing marginal increase is preferable to the risk of being cleaned out in the case of fraud. It's also pro-consumer in that it lets you use your debit cards without much fear of fraud -- if I were liable for fraudulent charges, I would be _much_ more reluctant to use it anywhere (especially as the bank may not be as incentivised to provide as good a fraud protection), drastically reducing its utility.
- chrischen 9y ago
  The reason why I think it's anti-consumer is that by detaching the liability of fraud from the end consumer means detaching it from the whole system. No one really cares about the fraud if the consumer doesn't. The credit card company profits either way, but by removing any concern for fraud it makes more money. I think a sensible solution is to split the liability between the merchant and consumer. Hiding it from the consumer hides it from the one party that would even care about prosecuting fraud.