6 ms·

People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-c

by gcbw3 6y ago

People seem to forget why credit cards came into existence. It was not for security. Ever. Credit Cards were introduced as a less-secure-but-more-convenient-check. The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot. Over time the raised letters for the crude minting press morphed into a magnetic strip, but the process was still 100% the same. Outside of the US in the last decade (2yrs in the US) some little security was added with encryption keys and PINs. Which is nothing more than a digital signature the bank may or may not check (like it did with the actual signature on the previous mentioned blank checks minted by the store). This is the step that was compromised with the stolen keys. In other words, the few places where you have to insert your card chip into a reader and type a pin had their security degraded to the same level as places where you simply use your magnetic strip or type your numbers on an online store.

celticninja 6y ago
The few places is everywhere in the EU at least. Signing card transactions is very last century in more advanced nations. ;) Edit: also the pin is verified each Transaction unlike with receipt signatures, which as you say were rarely checked by anyone.
- duxup 6y ago
  >also the pin is verified each Transaction unlike with receipt signatures At least in my experience this has increased a great deal more in the US in recent years.
- munk-a 6y ago
  Also, nearly everywhere in Canada, the interac system really has it together up here.
  - joecool1029 6y ago
    It helps having one debit card system to support. The US has like 7 and I couldn't begin to name most of them (Interlink is one of them, I think Maestro is another)
    - munk-a 6y ago
      I don't really buy that though. The banks may have an easy time talking to other Canadian banks but they also need to talk with American banks and Canadian PoS terminals often support US debit cards. Perhaps Euro PoS terminals just refuse to work with US debit cards but Canada gets a lot of those American tourist dollars and doesn't want to make it hard for you to spend your money up here.
      - joecool1029 6y ago
        > Canadian PoS terminals often support US debit cards. Unless something changed in the past few years, this is not the case. US debit cards are accepted through Visa or Mastercard's payment network which doesn't require a PIN (this is what it means when you process as credit in the US). Those transactions do not use the debit payment network. https://en.wikipedia.org/wiki/Interlink_(interbank_network) https://en.wikipedia.org/wiki/Interlink_(interbank_network). EDIT: I will add that while POS systems don't have a way to do this up there, ATM's with their notoriously high fees do support cash access through a US debit card.
aerostable_slug 6y ago
Even more fun fact: we rely on mag stripes (vs. chip n pin / nfc / etc) because of gas pumps. The cost of refitting gas pumps holds us back. Yay.
- mschuster91 6y ago
  So why not limit the magstripe to gas pumps and give them a time frame of 5-10 years to upgrade existing pumps, and mandate chip capable card readers in new pumps? At the same time fees could be raised 2% for non-chip transactions to incentivize upgrades.
  - AaronM 6y ago
    Looks like they have deadline of 10/2020 before visa and mastercard start holding owners liable for fraud if they haven't upgraded to chip readers. https://www.latimes.com/business/technology/story/2020-01-07/gas-stations-rush-to-adopt-chip-card-readers-at-fuel-pumps https://www.latimes.com/business/technology/story/2020-01-07...
    - GoblinSlayer 6y ago
      That's stupid. Just issue cards without stripe and the problem will solve itself.
      - twunde 6y ago
        It's a chicken and egg problem. Gas purchases are on the of the most common purchases in the US. Removing the ability to pay using a credit card would a) piss of owners of the new credit cards, b) likely cause people to use their old credit cards for longer and still wouldn't push gas stations to switch over quickly as most have atms and gas stations could insist on cash payments. Keep in mind that at least some of these gas pumps can't be upgraded but have to be replaced in order to support the new chip cards. What should have been done is a combination of good incentives for upgrading early (maybe reduced fees?) and penalties for not upgrading within a time frame (fraud payments are owners responsibility after n amount of time, increased fees for dealing with fraud)
roywiggins 6y ago
Maybe 5 years ago or so a store in London pulled out their carbon copy machine from under the counter to accept my American credit card.
- reaperducer 6y ago
  Happened to my wife about 10 months ago when there was a power failure in a department store while she was in the middle of a transaction.
- selimthegrim 6y ago
  I've seen them in taxis once in a blue moon if their card reader is broken.
joecool1029 6y ago
>Credit Cards were introduced as a less-secure-but-more-convenient-check. Yeah, no. Diners Club was the first credit card and was released in the 1950's to aggregate and streamline paying for things on account. It was, as the name suggests a line of credit. Checking accounts could become credit accounts if they allow overdrafts but this is not the normal intent. It was not until First National of Seattle released a debit card (also now known as a check card) in 1978 that any of those plastic cards behaved as a check. It's an important distinction because in one case (credit) the money transferred first is the bank's. This has important implications on who holds the liability and how long investigstions take into fraud allegations. Chip security was added first overseas because online authorization was less ubiquitous. The US was able to have online terminals pretty much everywhere since the 1980's and knucklebusters became a rare sight in the 1990's. The chip security now is less to prevent card-present fraud in the US, more to prevent reauthorizations of stored CC information (see, target breach). With a chip or NFC the card generates a unique signature for every transaction so there's nothing a POS system could store to reauthorize future transactions. This is why in the US for credit cards a pin is mostly unheard of and we are finally moving away from signatures which have been obsolete since the time offline batching mostly went away. Edit: Consider 1980's America was under the monopoly of AT&T. This greatly influenced the design of payment card networks. Europe, for example, probably had probably over 100 different companies in dozens of countries, so universal online authorization was less feasible.
- gcbw3 6y ago
  You are completely missing the point by an internal bank semantic. Credit cards, yes, started replacing the high APR credit-checks. And then moved to a mix of this and regular debit checks. But the actual process, which was what i was describing, was still pretty much exactly the same used to validate a check (whichever type) at the bank branch. Where the bank will draw the funds from is not a important topic when we are talking about process of the transaction itself.

by gcbw3 6y ago

celticninja 6y ago

The few places is everywhere in the EU at least. Signing card transactions is very last century in more advanced nations. ;) Edit: also the pin is verified each Transaction unlike with receipt signatures, which as you say were rarely checked by anyone.

duxup 6y ago
>also the pin is verified each Transaction unlike with receipt signatures At least in my experience this has increased a great deal more in the US in recent years.
munk-a 6y ago
Also, nearly everywhere in Canada, the interac system really has it together up here.
- joecool1029 6y ago
  It helps having one debit card system to support. The US has like 7 and I couldn't begin to name most of them (Interlink is one of them, I think Maestro is another)
  - munk-a 6y ago
    I don't really buy that though. The banks may have an easy time talking to other Canadian banks but they also need to talk with American banks and Canadian PoS terminals often support US debit cards. Perhaps Euro PoS terminals just refuse to work with US debit cards but Canada gets a lot of those American tourist dollars and doesn't want to make it hard for you to spend your money up here.
    - joecool1029 6y ago
      > Canadian PoS terminals often support US debit cards. Unless something changed in the past few years, this is not the case. US debit cards are accepted through Visa or Mastercard's payment network which doesn't require a PIN (this is what it means when you process as credit in the US). Those transactions do not use the debit payment network. https://en.wikipedia.org/wiki/Interlink_(interbank_network) https://en.wikipedia.org/wiki/Interlink_(interbank_network). EDIT: I will add that while POS systems don't have a way to do this up there, ATM's with their notoriously high fees do support cash access through a US debit card.

aerostable_slug 6y ago

Even more fun fact: we rely on mag stripes (vs. chip n pin / nfc / etc) because of gas pumps. The cost of refitting gas pumps holds us back. Yay.

mschuster91 6y ago
So why not limit the magstripe to gas pumps and give them a time frame of 5-10 years to upgrade existing pumps, and mandate chip capable card readers in new pumps? At the same time fees could be raised 2% for non-chip transactions to incentivize upgrades.
- AaronM 6y ago
  Looks like they have deadline of 10/2020 before visa and mastercard start holding owners liable for fraud if they haven't upgraded to chip readers. https://www.latimes.com/business/technology/story/2020-01-07/gas-stations-rush-to-adopt-chip-card-readers-at-fuel-pumps https://www.latimes.com/business/technology/story/2020-01-07...
  - GoblinSlayer 6y ago
    That's stupid. Just issue cards without stripe and the problem will solve itself.
    - twunde 6y ago
      It's a chicken and egg problem. Gas purchases are on the of the most common purchases in the US. Removing the ability to pay using a credit card would a) piss of owners of the new credit cards, b) likely cause people to use their old credit cards for longer and still wouldn't push gas stations to switch over quickly as most have atms and gas stations could insist on cash payments. Keep in mind that at least some of these gas pumps can't be upgraded but have to be replaced in order to support the new chip cards. What should have been done is a combination of good incentives for upgrading early (maybe reduced fees?) and penalties for not upgrading within a time frame (fraud payments are owners responsibility after n amount of time, increased fees for dealing with fraud)

roywiggins 6y ago

Maybe 5 years ago or so a store in London pulled out their carbon copy machine from under the counter to accept my American credit card.

reaperducer 6y ago
Happened to my wife about 10 months ago when there was a power failure in a department store while she was in the middle of a transaction.
selimthegrim 6y ago
I've seen them in taxis once in a blue moon if their card reader is broken.

joecool1029 6y ago

>Credit Cards were introduced as a less-secure-but-more-convenient-check. Yeah, no. Diners Club was the first credit card and was released in the 1950's to aggregate and streamline paying for things on account. It was, as the name suggests a line of credit. Checking accounts could become credit accounts if they allow overdrafts but this is not the normal intent. It was not until First National of Seattle released a debit card (also now known as a check card) in 1978 that any of those plastic cards behaved as a check. It's an important distinction because in one case (credit) the money transferred first is the bank's. This has important implications on who holds the liability and how long investigstions take into fraud allegations. Chip security was added first overseas because online authorization was less ubiquitous. The US was able to have online terminals pretty much everywhere since the 1980's and knucklebusters became a rare sight in the 1990's. The chip security now is less to prevent card-present fraud in the US, more to prevent reauthorizations of stored CC information (see, target breach). With a chip or NFC the card generates a unique signature for every transaction so there's nothing a POS system could store to reauthorize future transactions. This is why in the US for credit cards a pin is mostly unheard of and we are finally moving away from signatures which have been obsolete since the time offline batching mostly went away. Edit: Consider 1980's America was under the monopoly of AT&T. This greatly influenced the design of payment card networks. Europe, for example, probably had probably over 100 different companies in dozens of countries, so universal online authorization was less feasible.

gcbw3 6y ago
You are completely missing the point by an internal bank semantic. Credit cards, yes, started replacing the high APR credit-checks. And then moved to a mix of this and regular debit checks. But the actual process, which was what i was describing, was still pretty much exactly the same used to validate a check (whichever type) at the bank branch. Where the bank will draw the funds from is not a important topic when we are talking about process of the transaction itself.