5 ms·

This sounds like the same fallacy the UK had with chip transactions. The magical fallacy that they're infallible and totally secure, thus all fraudulent transa

This sounds like the same fallacy the UK had with chip transactions. The magical fallacy that they're infallible and totally secure, thus all fraudulent transactions are automatically your fault.

briandear 7y ago
It’s interesting that there was quite the criticism of the US “mag stripe” cards when Europe was chip and pin. I recall many Europeans claiming that their system was far more secure and “better.” However, chip and pin puts liability on the customer for fraudulent transactions, while in the US, the liability is on the merchant.
- pbhjpbhj 7y ago
  They seem to be orthogonal, if we still just had magstripes then it would be super easy to clone your card and make transactions using it because there's no second factor needed. At least the criminals now have to be organised. The response to the fraudulent transaction would surely be the same as that's either the bank's call or/legislative.
- Nursie 7y ago
  This is not really true. The merchant takes liability on some transaction types. In the UK, any credit card transaction that is flagged by the customer, regardless of chip and pin, is immediately refunded and investigated. However - as card cloning of chip and pin cards is still effectively at zero, it's very unlikely that fraudulent chip and pin transactions ever take place without, say, the card being stolen as well.
  - perl4ever 7y ago
    I've got nothing to contribute, except that pretty much every time I ask a PM for clarification on a concern I have at work and they say "oh, that can't happen/never happens" it happens about 30 seconds later. Or it happened 30 seconds ago, which is why I was asking.
    - Nursie 7y ago
      Chip and Pin has been out in the wild for what ... 17 years in the UK where I am? And round a lot of the world. So far it has resisted cloning admirably. I'm not saying Card-present fraud can't ever happen with EMV cards, or that customer liability is the right thing to have, but this technology really does seem to have held up well to attack. Possibly because there are just easier ways to defraud people...
repolfx 7y ago
They are a lot more secure. Magstripe fraud is rampant, an accepted fact of life. Breaches of chip cards are extremely rare and not a fact of life. Or can you back up this insinuation that smartcard chips that digitally sign transactions are no more secure than magstripes anyone can duplicate?
- PhasmaFelis 7y ago
  No one claimed they're as bad as magstripes, only that they are not 100% perfectly secure.
  - orf 7y ago
    Nobody claimed they where 100% secure, at any point in this thread, during the development of the technology or during the rollout.
    - PhasmaFelis 7y ago
      Then we're all agreed, and I have no idea what repolfx is so indignant about.
  - repolfx 7y ago
    But if chip cards are much, much more secure than before and chip breaches are negligable (which they are), then why is the default presumption of fraud being the user's fault unfair? Users can and do write their PINs down, give them to other people and engage in other unsafe practices. That's by far the most common way chip cards are breached: social engineering. I think there's a limit to how much liability system vendors should be expected to take. Insisting on all-corporate liability all the time, even for cases that are basically unsolvable like users deliberately giving away credentials, just socialises the cost of careless behaviour on all card users. Why bother upgrading security at all, in that case?
- novok 7y ago
  You can duplicate chip & pin EMV cards too. They are prone to fraud just like mag stripe cards. https://www.consumerismcommentary.com/chip-credit-cards-fraud/ https://www.consumerismcommentary.com/chip-credit-cards-frau...
londons_explore 7y ago
In the UK, the law is 100% on your side for credit cards. Just raise a consumer credit act claim, and unless the bank can show serious failings on your part, you'll have the money back. "proving" that there hasn't been a security breach somewhere in their infrastructure is impossible, so you'll pretty much always win.

This sounds like the same fallacy the UK had with chip transactions. The magical fallacy that they're infallible and totally secure, thus all fraudulent transactions are automatically your fault.

briandear 7y ago

It’s interesting that there was quite the criticism of the US “mag stripe” cards when Europe was chip and pin. I recall many Europeans claiming that their system was far more secure and “better.” However, chip and pin puts liability on the customer for fraudulent transactions, while in the US, the liability is on the merchant.

pbhjpbhj 7y ago
They seem to be orthogonal, if we still just had magstripes then it would be super easy to clone your card and make transactions using it because there's no second factor needed. At least the criminals now have to be organised. The response to the fraudulent transaction would surely be the same as that's either the bank's call or/legislative.
Nursie 7y ago
This is not really true. The merchant takes liability on some transaction types. In the UK, any credit card transaction that is flagged by the customer, regardless of chip and pin, is immediately refunded and investigated. However - as card cloning of chip and pin cards is still effectively at zero, it's very unlikely that fraudulent chip and pin transactions ever take place without, say, the card being stolen as well.
- perl4ever 7y ago
  I've got nothing to contribute, except that pretty much every time I ask a PM for clarification on a concern I have at work and they say "oh, that can't happen/never happens" it happens about 30 seconds later. Or it happened 30 seconds ago, which is why I was asking.
  - Nursie 7y ago
    Chip and Pin has been out in the wild for what ... 17 years in the UK where I am? And round a lot of the world. So far it has resisted cloning admirably. I'm not saying Card-present fraud can't ever happen with EMV cards, or that customer liability is the right thing to have, but this technology really does seem to have held up well to attack. Possibly because there are just easier ways to defraud people...

repolfx 7y ago

They are a lot more secure. Magstripe fraud is rampant, an accepted fact of life. Breaches of chip cards are extremely rare and not a fact of life. Or can you back up this insinuation that smartcard chips that digitally sign transactions are no more secure than magstripes anyone can duplicate?

PhasmaFelis 7y ago
No one claimed they're as bad as magstripes, only that they are not 100% perfectly secure.
- orf 7y ago
  Nobody claimed they where 100% secure, at any point in this thread, during the development of the technology or during the rollout.
  - PhasmaFelis 7y ago
    Then we're all agreed, and I have no idea what repolfx is so indignant about.
- repolfx 7y ago
  But if chip cards are much, much more secure than before and chip breaches are negligable (which they are), then why is the default presumption of fraud being the user's fault unfair? Users can and do write their PINs down, give them to other people and engage in other unsafe practices. That's by far the most common way chip cards are breached: social engineering. I think there's a limit to how much liability system vendors should be expected to take. Insisting on all-corporate liability all the time, even for cases that are basically unsolvable like users deliberately giving away credentials, just socialises the cost of careless behaviour on all card users. Why bother upgrading security at all, in that case?
novok 7y ago
You can duplicate chip & pin EMV cards too. They are prone to fraud just like mag stripe cards. https://www.consumerismcommentary.com/chip-credit-cards-fraud/ https://www.consumerismcommentary.com/chip-credit-cards-frau...

londons_explore 7y ago

In the UK, the law is 100% on your side for credit cards. Just raise a consumer credit act claim, and unless the bank can show serious failings on your part, you'll have the money back. "proving" that there hasn't been a security breach somewhere in their infrastructure is impossible, so you'll pretty much always win.