8 ms·

In the UK cards moved to 'chip and pin' in 2006! Fraud in a 'customer present' scenario is very low at our stores. The last fraud in fact was a foreign card tha

In the UK cards moved to 'chip and pin' in 2006! Fraud in a 'customer present' scenario is very low at our stores. The last fraud in fact was a foreign card that didn't support chip and pin. I can't believe Visa and MasterCard have not made it mandatory world wide... ...except card fraud lossed are recharged to the merchant so perhaps they don't care? Out of interest there is a special exception for disabled people who cannot use a pin pad btw...

rollthehard6 9y ago
And even earlier in other EU countries I imagine, as I was in Luxembourg in 2001 and used pin to pay in supermnarkets with my UK card.
- hadrien01 9y ago
  Yes, I think it was way earlier than 2006. In France, every card in 1995 had chip and pin.
  - MatthewWilkes 9y ago
    The UK was relatively late to the party, some large retailers here campaigned against it as they were afraid that going online for authorisations would increase the time it took to serve people. I believe that the offline mode was enough to appease them, even now you occasionally run up against offline-only EMV terminals.
  - jimnotgym 9y ago
    I think there were a few years where both chip & pin and signatures were in use, but 2006 was the date that chip and pin was mandatory http://www.theukcardsassociation.org.uk/news/10yearschipandpinnews.asp http://www.theukcardsassociation.org.uk/news/10yearschipandp...
ashleyn 9y ago
AFAIK chip and pin shifts liability for fraud onto the credit customer. While banks may be more than eager to do so, they may also be wary of a customer backlash over this.
- lmm 9y ago
  In the UK the law remains what it always was - the customer is not liable unless they enabled the fraud. (I'm right now in the process of getting my card replaced after fraudulent charges that I can only assume were put through as though they were chip and pin). In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now.
  - chimeracoder 9y ago
    > In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now. This actually was true across Europe for the first few years when EMV chips were rolled out. It took some time before they passed a law which absolved customers of liability for fraud processed as EMV transactions.
  - mannykannot 9y ago
    There are well-documented cases where liability had been shifted to the customer, and which was only reversed through there being evidence that is not normally available in these cases: "In one disputed transaction case we assisted in, the customer had his card stolen while on holiday, and then used in an EMV transaction. The issuer refused to refund this customer on the basis that their records showed the PIN was used. Luckily, the customer managed to obtain the merchant receipts, and these contained the TVR. This indicated that the PIN was not used, and the merchant opted to fall back to signature. We decoded the TVR and informed the customer, who was then able to get a refund. Other customers are less fortunate: it is unusual for the TVR to be included on the receipt, and often the merchant receipt has been destroyed by the time the dispute is being considered." https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... The law may always have been that the customer is not liable unless they enabled the fraud, but I hope the rules of evidence and/or practices of dispute resolution have changed so that the infallibility of the system is no longer tacitly assumed.
criddell 9y ago
I'm visiting London this summer (I'm from Texas). Normally, I pay for everything with American Express. Would you recommend I get a different card for London? I wonder if there's a US card that support chip and pin?
- kozhevnikov 9y ago
  A lot of businesses in the UK/Europe do not accept American Express due to higher fees. You would be better off getting a different card preferably that supports contactless payments so you could use it on the tube and buses instead of an Oyster card (remember to touch it on the way out as well). https://tfl.gov.uk/fares-and-payments/contactless https://tfl.gov.uk/fares-and-payments/contactless
  - cjrp 9y ago
    A Revolut card supports chip and pin and contactless, I'm not sure if it's 100% launched for US customers yet though: https://www.revolut.com/us/ https://www.revolut.com/us/
    - letsgetphysITal 9y ago
      Upvote and reply, because Revolut is a dream. Prepaid so fraud is minimum risk (no possible overdraft), top up via mobile app, disable the card when you're not using it. It's so convenient that I use it to buy from shady sites (game keys, in game currency etc) and just disable the card once the purchase is complete. I can't believe it's still free. Sorry for gushing. I love Revolut.
  - ciaranm 9y ago
    Mostly it's fine using AMEX. There's enough exceptions I carry another card, but it's not that bad. Also: TFL accept AMEX contactless as payment/oyster equivalent.
  - bruceboughton 9y ago
    Most businesses now do support Amex -- there's been a major shift in the last few years.
criddell 9y ago
I was just looking for a chip-and-pin card that I (as an American) could get for traveling to the UK and apparently there really isn't much out there. I think all of the US cards that support chip and pin prioritize signature over pin. I also found this Visa page explaining that PIN isn't used in the US because it's too expensive: https://usa.visa.com/visa-everywhere/security/the-cost-of-pin.html https://usa.visa.com/visa-everywhere/security/the-cost-of-pi...
- lh7777 9y ago
  FirstTech's credit card is PIN priority. I've only used it in Canada so far, but it works as expected there.
  - criddell 9y ago
    Do you know if you have to join the credit union to get a card, or do they issue them to anybody? Edit: I just contact them and you do indeed have to become a member first.
    - StudentStuff 9y ago
      First Tech's membership bar is quite low, I was surprised how easy it was to get my SO an account. The Zelle integration on the mobile app is pretty slick too!
- hackeyed 9y ago
  Might check some of the credit unions you can join. I know at least FirstTech uses chip and pin for their credit cards.
  - nojvek 9y ago
    First Tech security is pretty top notch. For online trnsacations over a certain amount they would ask for password verification. I just wished online transactions owned it up for optional two factor online transactions, pin card transactions and SMS verifications for all transactions above $500. That would drop fraud significantly.
cup-of-tea 9y ago
I rarely use chip and pin any more. Contactless is everywhere. The UK is the most advanced in this regard, though.
- letsgetphysITal 9y ago
  Contactless is useless for fuel unless you top up with over half a tank remaining. ApplePay / Google Pay work sometimes, but retailers put arbitrary limits on despite payment being authenticated (Pay for my £60 weekly shop in the store but maximum £30 in the petrol station, Sainsburys? I didn't bring my wallet, looks like I'm coming back. Thanks for that.)
- notoverthere 9y ago
  Is the UK most advanced? In Australia they can pay for anything up to $100 with tap. Over $100, they can still tap, but then need to enter their PIN into the terminal (i.e. no need to insert the card for PIN entry – a tap is sufficient). We don't have that in the UK.
  - cja 9y ago
    Similar in Poland. You can always tap and then it asks for PIN or it doesn't. I expect this decision is based on the amount of the purchase and maybe some other factors.
  - Grangar 9y ago
    This is how it works in the Netherlands as well, but below €25.
  - cup-of-tea 9y ago
    Most advanced in Europe maybe. I rarely use anything but contactless in the UK (where I live), but often find no option for contactless elsewhere in Europe. I've never had to swipe and sign anywhere in my whole life, though.
  - lavezzi 9y ago
    I don't think having a higher limit makes anything more advanced. I'm fine with having a lower limit for cards, and then switching to Apple/Samsung/Google Pay for higher priced transactions.
chimeracoder 9y ago
> ...except card fraud lossed are recharged to the merchant so perhaps they don't care? For a long time after EMV chips were introduced, the liability was actually shifted back to the customer. EMV chips were initially a huge step backwards for customer protection, and it took some years before this was fixed in law across Europe. Nowadays, if you see a merchant who can't accept EMV chips, it's likely their POS vendor who's liable. The merchant is liable in theory, but some vendors still don't provide EMV-capable terminals, so they've agreed to assume the risk until they do.
tome 9y ago
> The last fraud in fact was a foreign card that didn't support chip and pin. "The last fraud"? Are frauds so rare that it's meaningful to talk about the last one?!
- Qub3d 9y ago
  Last in this case means "previous" or "most recent". Its just ambiguous English.
  - tome 9y ago
    Oh yes, I understood that. I still can't believe they're so rare that you can talk about the "most recent" one. And how would jimnotgym know? Most puzzling.
    - mannykannot 9y ago
      Note the phrase 'at our stores' in the preceding sentence. We don't know whether it's a couple of stores or a supermarket chain, but either way, it is likely that someone knows within any given enterprise.
      - tome 9y ago
        Oh, I interpreted that as a patriotic way of saying "at British stores". Thanks for explaining!
handbanana 9y ago
Also, I believe contactless is something the US is behind on too

rollthehard6 9y ago

And even earlier in other EU countries I imagine, as I was in Luxembourg in 2001 and used pin to pay in supermnarkets with my UK card.

hadrien01 9y ago
Yes, I think it was way earlier than 2006. In France, every card in 1995 had chip and pin.
- MatthewWilkes 9y ago
  The UK was relatively late to the party, some large retailers here campaigned against it as they were afraid that going online for authorisations would increase the time it took to serve people. I believe that the offline mode was enough to appease them, even now you occasionally run up against offline-only EMV terminals.
- jimnotgym 9y ago
  I think there were a few years where both chip & pin and signatures were in use, but 2006 was the date that chip and pin was mandatory http://www.theukcardsassociation.org.uk/news/10yearschipandpinnews.asp http://www.theukcardsassociation.org.uk/news/10yearschipandp...

ashleyn 9y ago

AFAIK chip and pin shifts liability for fraud onto the credit customer. While banks may be more than eager to do so, they may also be wary of a customer backlash over this.

lmm 9y ago
In the UK the law remains what it always was - the customer is not liable unless they enabled the fraud. (I'm right now in the process of getting my card replaced after fraudulent charges that I can only assume were put through as though they were chip and pin). In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now.
- chimeracoder 9y ago
  > In the early days there was a concern that the courts would believe that chip and pin proved the customer was responsible (i.e. that the mere fact of a successful transaction with chip and pin technology necessarily proved the customer had told the fraudster their pin), but it seems fair to say the reality of chip and pin fraud has set in now. This actually was true across Europe for the first few years when EMV chips were rolled out. It took some time before they passed a law which absolved customers of liability for fraud processed as EMV transactions.
- mannykannot 9y ago
  There are well-documented cases where liability had been shifted to the customer, and which was only reversed through there being evidence that is not normally available in these cases: "In one disputed transaction case we assisted in, the customer had his card stolen while on holiday, and then used in an EMV transaction. The issuer refused to refund this customer on the basis that their records showed the PIN was used. Luckily, the customer managed to obtain the merchant receipts, and these contained the TVR. This indicated that the PIN was not used, and the merchant opted to fall back to signature. We decoded the TVR and informed the customer, who was then able to get a refund. Other customers are less fortunate: it is unusual for the TVR to be included on the receipt, and often the merchant receipt has been destroyed by the time the dispute is being considered." https://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf https://www.cl.cam.ac.uk/research/security/banking/nopin/oak... The law may always have been that the customer is not liable unless they enabled the fraud, but I hope the rules of evidence and/or practices of dispute resolution have changed so that the infallibility of the system is no longer tacitly assumed.

criddell 9y ago

I'm visiting London this summer (I'm from Texas). Normally, I pay for everything with American Express. Would you recommend I get a different card for London? I wonder if there's a US card that support chip and pin?

kozhevnikov 9y ago
A lot of businesses in the UK/Europe do not accept American Express due to higher fees. You would be better off getting a different card preferably that supports contactless payments so you could use it on the tube and buses instead of an Oyster card (remember to touch it on the way out as well). https://tfl.gov.uk/fares-and-payments/contactless https://tfl.gov.uk/fares-and-payments/contactless
- cjrp 9y ago
  A Revolut card supports chip and pin and contactless, I'm not sure if it's 100% launched for US customers yet though: https://www.revolut.com/us/ https://www.revolut.com/us/
  - letsgetphysITal 9y ago
    Upvote and reply, because Revolut is a dream. Prepaid so fraud is minimum risk (no possible overdraft), top up via mobile app, disable the card when you're not using it. It's so convenient that I use it to buy from shady sites (game keys, in game currency etc) and just disable the card once the purchase is complete. I can't believe it's still free. Sorry for gushing. I love Revolut.
- ciaranm 9y ago
  Mostly it's fine using AMEX. There's enough exceptions I carry another card, but it's not that bad. Also: TFL accept AMEX contactless as payment/oyster equivalent.
- bruceboughton 9y ago
  Most businesses now do support Amex -- there's been a major shift in the last few years.

criddell 9y ago

I was just looking for a chip-and-pin card that I (as an American) could get for traveling to the UK and apparently there really isn't much out there. I think all of the US cards that support chip and pin prioritize signature over pin. I also found this Visa page explaining that PIN isn't used in the US because it's too expensive: https://usa.visa.com/visa-everywhere/security/the-cost-of-pin.html https://usa.visa.com/visa-everywhere/security/the-cost-of-pi...

lh7777 9y ago
FirstTech's credit card is PIN priority. I've only used it in Canada so far, but it works as expected there.
- criddell 9y ago
  Do you know if you have to join the credit union to get a card, or do they issue them to anybody? Edit: I just contact them and you do indeed have to become a member first.
  - StudentStuff 9y ago
    First Tech's membership bar is quite low, I was surprised how easy it was to get my SO an account. The Zelle integration on the mobile app is pretty slick too!
hackeyed 9y ago
Might check some of the credit unions you can join. I know at least FirstTech uses chip and pin for their credit cards.
- nojvek 9y ago
  First Tech security is pretty top notch. For online trnsacations over a certain amount they would ask for password verification. I just wished online transactions owned it up for optional two factor online transactions, pin card transactions and SMS verifications for all transactions above $500. That would drop fraud significantly.

cup-of-tea 9y ago

I rarely use chip and pin any more. Contactless is everywhere. The UK is the most advanced in this regard, though.

letsgetphysITal 9y ago
Contactless is useless for fuel unless you top up with over half a tank remaining. ApplePay / Google Pay work sometimes, but retailers put arbitrary limits on despite payment being authenticated (Pay for my £60 weekly shop in the store but maximum £30 in the petrol station, Sainsburys? I didn't bring my wallet, looks like I'm coming back. Thanks for that.)
notoverthere 9y ago
Is the UK most advanced? In Australia they can pay for anything up to $100 with tap. Over $100, they can still tap, but then need to enter their PIN into the terminal (i.e. no need to insert the card for PIN entry – a tap is sufficient). We don't have that in the UK.
- cja 9y ago
  Similar in Poland. You can always tap and then it asks for PIN or it doesn't. I expect this decision is based on the amount of the purchase and maybe some other factors.
- Grangar 9y ago
  This is how it works in the Netherlands as well, but below €25.
- cup-of-tea 9y ago
  Most advanced in Europe maybe. I rarely use anything but contactless in the UK (where I live), but often find no option for contactless elsewhere in Europe. I've never had to swipe and sign anywhere in my whole life, though.
- lavezzi 9y ago
  I don't think having a higher limit makes anything more advanced. I'm fine with having a lower limit for cards, and then switching to Apple/Samsung/Google Pay for higher priced transactions.

chimeracoder 9y ago

> ...except card fraud lossed are recharged to the merchant so perhaps they don't care? For a long time after EMV chips were introduced, the liability was actually shifted back to the customer. EMV chips were initially a huge step backwards for customer protection, and it took some years before this was fixed in law across Europe. Nowadays, if you see a merchant who can't accept EMV chips, it's likely their POS vendor who's liable. The merchant is liable in theory, but some vendors still don't provide EMV-capable terminals, so they've agreed to assume the risk until they do.

tome 9y ago

> The last fraud in fact was a foreign card that didn't support chip and pin. "The last fraud"? Are frauds so rare that it's meaningful to talk about the last one?!

Qub3d 9y ago
Last in this case means "previous" or "most recent". Its just ambiguous English.
- tome 9y ago
  Oh yes, I understood that. I still can't believe they're so rare that you can talk about the "most recent" one. And how would jimnotgym know? Most puzzling.
  - mannykannot 9y ago
    Note the phrase 'at our stores' in the preceding sentence. We don't know whether it's a couple of stores or a supermarket chain, but either way, it is likely that someone knows within any given enterprise.
    - tome 9y ago
      Oh, I interpreted that as a patriotic way of saying "at British stores". Thanks for explaining!

handbanana 9y ago

Also, I believe contactless is something the US is behind on too