4 ms·

> if you manage to steal my european bank card, you still can't use it without the pin. If you get all the numbers on it, you still have nothing usefull. You c

> if you manage to steal my european bank card, you still can't use it without the pin. If you get all the numbers on it, you still have nothing usefull. You can absolutely use a credit card online if you get the card number, date and those last three numbers on the back. No need for a pin there. You can even use a stolen credit card these days in physical stores, because of the Contactless Payment on most new cards. As long as you don't spend too much, you won't need the pin.

rmccue 6y ago
Not entirely. Since Strong Customer Authentication took effect in Europe, 2FA is now required in most places for most purchases. Additionally, contactless now "expires" occasionally, and requires you to put your PIN in after spending €150 since the last time you entered your PIN.
- xdrosenheim 6y ago
  I have manage to go a few weeks without putting in my pin. I don't think there is a set limit. Not for my bank/card at least.
gambiting 6y ago
In fact, you don't need a pin and you don't need the last three digits either. Pretty much every terminal can do a "card not present" transaction where you only need the long card number and the amount. My bank classes those as "telephone transactions" and I can disable them entirely on my card, but they are enabled by default.
hyperman1 6y ago
That's more or less what I was saying? My european bank card is a debet card. If I pay online, it redirects to a page for my bank. This does a 2 factor authentication. The 2FA challenge contains the monetary amount and the IBAN check digits, so even MITM is hard.
- guitarbill 6y ago
  There's also 3-D Secure, which e.g. UK banks have implemented. This is a solved problem with sane solutions, just like chip&pin, and not using cheques. [0] https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
  - ryanlol 6y ago
    3-D secure is still extremely vulnerable to phishing. And when you do get phished, you’ll generally be in a far worse position than you’d be without it. Sane solution? For merchants, maybe. For consumers, no.
- ryanlol 6y ago
  Your bank doesn’t enforce this, the merchant accepting the payment chooses to require this.

rmccue 6y ago

Not entirely. Since Strong Customer Authentication took effect in Europe, 2FA is now required in most places for most purchases. Additionally, contactless now "expires" occasionally, and requires you to put your PIN in after spending €150 since the last time you entered your PIN.

xdrosenheim 6y ago
I have manage to go a few weeks without putting in my pin. I don't think there is a set limit. Not for my bank/card at least.

gambiting 6y ago

In fact, you don't need a pin and you don't need the last three digits either. Pretty much every terminal can do a "card not present" transaction where you only need the long card number and the amount. My bank classes those as "telephone transactions" and I can disable them entirely on my card, but they are enabled by default.

hyperman1 6y ago

That's more or less what I was saying? My european bank card is a debet card. If I pay online, it redirects to a page for my bank. This does a 2 factor authentication. The 2FA challenge contains the monetary amount and the IBAN check digits, so even MITM is hard.

guitarbill 6y ago
There's also 3-D Secure, which e.g. UK banks have implemented. This is a solved problem with sane solutions, just like chip&pin, and not using cheques. [0] https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
- ryanlol 6y ago
  3-D secure is still extremely vulnerable to phishing. And when you do get phished, you’ll generally be in a far worse position than you’d be without it. Sane solution? For merchants, maybe. For consumers, no.
ryanlol 6y ago
Your bank doesn’t enforce this, the merchant accepting the payment chooses to require this.