6 ms·

Even more fun fact: we rely on mag stripes (vs. chip n pin / nfc / etc) because of gas pumps. The cost of refitting gas pumps holds us back. Yay.

mschuster91 6y ago
So why not limit the magstripe to gas pumps and give them a time frame of 5-10 years to upgrade existing pumps, and mandate chip capable card readers in new pumps? At the same time fees could be raised 2% for non-chip transactions to incentivize upgrades.
- AaronM 6y ago
  Looks like they have deadline of 10/2020 before visa and mastercard start holding owners liable for fraud if they haven't upgraded to chip readers. https://www.latimes.com/business/technology/story/2020-01-07/gas-stations-rush-to-adopt-chip-card-readers-at-fuel-pumps https://www.latimes.com/business/technology/story/2020-01-07...
  - GoblinSlayer 6y ago
    That's stupid. Just issue cards without stripe and the problem will solve itself.
    - twunde 6y ago
      It's a chicken and egg problem. Gas purchases are on the of the most common purchases in the US. Removing the ability to pay using a credit card would a) piss of owners of the new credit cards, b) likely cause people to use their old credit cards for longer and still wouldn't push gas stations to switch over quickly as most have atms and gas stations could insist on cash payments. Keep in mind that at least some of these gas pumps can't be upgraded but have to be replaced in order to support the new chip cards. What should have been done is a combination of good incentives for upgrading early (maybe reduced fees?) and penalties for not upgrading within a time frame (fraud payments are owners responsibility after n amount of time, increased fees for dealing with fraud)
    - reaperducer 6y ago
      That's stupid. Just issue cards without stripe and the problem will solve itself. I don't see a bank replacing its customers' forms of payment with a new form that isn't accepted in as many places as the old one.
- cocoa19 6y ago
  We already have incentives in place in the US to stop using mag stripe. Shops accepting mag stripe payments are liable for counterfeit fraud. If you use EMV (chip cards), then card brands protect you (Visa, MasterCard, etc. You can Google it as "EMV liability shift" if you're interested in more details.
kevin_thibedeau 6y ago
I'm starting to see chip enabled pumps. Unfortunately they aren't obviously labeled so you assume it needs a swipe and have to wait to restart when it complains about not reading the chip.
- moftz 6y ago
  At the chip gas pumps, I'm seeing paper signs left by the owner that say "Leave card inserted". I'm glad everyone is going the chip route but I still wish that pins would be required for credit cards. Just having a 4 digit pin is loads more secure than expecting some cashier to verify a signature on the back of the card (which never happens). I can still bypass the pin on my debit card in most situations by just entering in nothing unless I'm doing cash back. I'm not really sure how that's supposed to protect me, whats the point of a pin if you don't need to type it in? Card companies are quick to refund you for any fraud but it creates an inconvenience for the user that really just isn't necessary. I've been on vacation abroad when my credit card was used fraudulently which I had to cancel immediately. Luckily I had access to my corporate credit card I could use to pay my hotel bill since that was the only thing I couldn't afford with the cash I had on me but I very well could have been shit out of luck. I paid the charges off myself and wasn't in too much trouble after I explained the situation.
- reaperducer 6y ago
  I'm starting to see chip enabled pumps. Exxon (pre-ExxonMobil) had chip-enabled pumps in the early 90's. Instead of a card, you had a little cylinder-shaped keyfob about the size of a few Tylenols strung together. I'm not sure what happened to that, I ended up moving out of an area served by Exxon. These days I see gas pumps with the little wireless payment logo, and I have a card with the same logo, but it's never worked for me.
jrockway 6y ago
I am not sure that is the problem. Timing was a big problem. When NFC showed up, it was intended for plastic cards. This was pretty widely deployed. Then software companies integrated it with phones. This made the telcos unhappy, because these phones had a "secure element" that they did not control (traditionally the SIM card was the secure element, but these phones ignored that and that upset them; back then, a carrier being upset meant that your phone could not be used on their network). It also made processing networks unhappy, because they saw that they were losing control. (You don't need Mastercard and Visa when the phone can just use the Internet to ask Apple to authorize the transaction, after all.) So they flat-out stopped issuing cards with NFC. Then the final blow is that merchants were tired of paying credit card transaction fees, so they removed NFC readers from their stores, and banded together to make some shitty system to bill your purchase directly to your checking account. No more paying fees or pesky chargebacks. The retail side blew up -- no consumer wanted it, and it was technologically bad. NFC readers are back in stores. The carrier side blew up -- SIM cards are gone and Apple or Samsung is your secure element provider. I am not sure what happened on the processing card network. I'm guessing they made some private deal with the NFC payment providers (Apple, Google, Garmin, Fitbit, etc.; enough companies in on the game that they can sit back and watch them fight each other while they profit). I kind of got to watch this from both sides. I worked on Google Wallet when I started at Google in 2012. Used it pretty much every time I went to CVS. Then CVS removed their readers. Then Apple entered the market, and CVS once again accepts NFC cards. So maybe gas pumps played a role; I don't drive so I don't interact with gas pumps ever. But there were much deeper problems. A lot of entrenched monopolies stood to lose a lot, so they were happy to impede progress wherever possible. There was never a good possible outcome, though -- let the incumbents keep their power, or let the upstart megacorps become the new incumbent. Plenty of VC money available if you think you can fix this problem, or become the new big guy ;)
- joecool1029 6y ago
  >The retail side blew up -- no consumer wanted it, and it was technologically bad. Didn't help that thr superior user experience of NFC built into cards was drowned out by the klaxons of the media continuously warning customers of proximity theft. Wrong threat model, the cheap mag skimmer or camera or unsecured database models were the real risks. It wasn't that someone will stand butt-to-butt with you to steal a NFC token.
tialaramex 6y ago
Liability shift for gas pumps has been pushed back (October 2020 I think) but not eliminated. Liability shift works like this: Historically the merchant is protected if they had good faith belief that the payment card was authorised via things like a mag stripe. After liability shift that goes away unless you use EMV. You checked the card was "real" with just a mag stripe? Not interested, the chargeback comes out of your money. Your local gas station can keep using mag stripe readers for another decade if they like. But liability shift means places that see significant fraud will have an obvious economic incentive to go EMV, and that shifts the fraud onto nearby stations that didn't have fraud problems, so they go EMV and so on. If you're a merchant with very low fraud rates it can make sense to do no Authorization step whatsoever. Any merchant, anywhere in the world, can do Settlement, which is the step that moves money from your account to theirs, based just on the card number. Only if it becomes a question as to whether this payment was authorized does it matter whether they did the Authorization step, a mag stripe read, the old fashioned impression machines, or a chip-and-PIN terminal. Certain types of companies can find it makes sense to do no Authorization for groups of customers. One Click may be an example of that. You did a bunch of transactions, with a physical delivery address, what are the chances that a new transaction with the same delivery address and card details is fraud while the previous ones were not?
- selimthegrim 6y ago
  Liability shift or not some of these gas stations keep insisting on ID with credit cards.

mschuster91 6y ago

So why not limit the magstripe to gas pumps and give them a time frame of 5-10 years to upgrade existing pumps, and mandate chip capable card readers in new pumps? At the same time fees could be raised 2% for non-chip transactions to incentivize upgrades.

AaronM 6y ago
Looks like they have deadline of 10/2020 before visa and mastercard start holding owners liable for fraud if they haven't upgraded to chip readers. https://www.latimes.com/business/technology/story/2020-01-07/gas-stations-rush-to-adopt-chip-card-readers-at-fuel-pumps https://www.latimes.com/business/technology/story/2020-01-07...
- GoblinSlayer 6y ago
  That's stupid. Just issue cards without stripe and the problem will solve itself.
  - twunde 6y ago
    It's a chicken and egg problem. Gas purchases are on the of the most common purchases in the US. Removing the ability to pay using a credit card would a) piss of owners of the new credit cards, b) likely cause people to use their old credit cards for longer and still wouldn't push gas stations to switch over quickly as most have atms and gas stations could insist on cash payments. Keep in mind that at least some of these gas pumps can't be upgraded but have to be replaced in order to support the new chip cards. What should have been done is a combination of good incentives for upgrading early (maybe reduced fees?) and penalties for not upgrading within a time frame (fraud payments are owners responsibility after n amount of time, increased fees for dealing with fraud)
  - reaperducer 6y ago
    That's stupid. Just issue cards without stripe and the problem will solve itself. I don't see a bank replacing its customers' forms of payment with a new form that isn't accepted in as many places as the old one.
cocoa19 6y ago
We already have incentives in place in the US to stop using mag stripe. Shops accepting mag stripe payments are liable for counterfeit fraud. If you use EMV (chip cards), then card brands protect you (Visa, MasterCard, etc. You can Google it as "EMV liability shift" if you're interested in more details.

kevin_thibedeau 6y ago

I'm starting to see chip enabled pumps. Unfortunately they aren't obviously labeled so you assume it needs a swipe and have to wait to restart when it complains about not reading the chip.

moftz 6y ago
At the chip gas pumps, I'm seeing paper signs left by the owner that say "Leave card inserted". I'm glad everyone is going the chip route but I still wish that pins would be required for credit cards. Just having a 4 digit pin is loads more secure than expecting some cashier to verify a signature on the back of the card (which never happens). I can still bypass the pin on my debit card in most situations by just entering in nothing unless I'm doing cash back. I'm not really sure how that's supposed to protect me, whats the point of a pin if you don't need to type it in? Card companies are quick to refund you for any fraud but it creates an inconvenience for the user that really just isn't necessary. I've been on vacation abroad when my credit card was used fraudulently which I had to cancel immediately. Luckily I had access to my corporate credit card I could use to pay my hotel bill since that was the only thing I couldn't afford with the cash I had on me but I very well could have been shit out of luck. I paid the charges off myself and wasn't in too much trouble after I explained the situation.
reaperducer 6y ago
I'm starting to see chip enabled pumps. Exxon (pre-ExxonMobil) had chip-enabled pumps in the early 90's. Instead of a card, you had a little cylinder-shaped keyfob about the size of a few Tylenols strung together. I'm not sure what happened to that, I ended up moving out of an area served by Exxon. These days I see gas pumps with the little wireless payment logo, and I have a card with the same logo, but it's never worked for me.

jrockway 6y ago

I am not sure that is the problem. Timing was a big problem. When NFC showed up, it was intended for plastic cards. This was pretty widely deployed. Then software companies integrated it with phones. This made the telcos unhappy, because these phones had a "secure element" that they did not control (traditionally the SIM card was the secure element, but these phones ignored that and that upset them; back then, a carrier being upset meant that your phone could not be used on their network). It also made processing networks unhappy, because they saw that they were losing control. (You don't need Mastercard and Visa when the phone can just use the Internet to ask Apple to authorize the transaction, after all.) So they flat-out stopped issuing cards with NFC. Then the final blow is that merchants were tired of paying credit card transaction fees, so they removed NFC readers from their stores, and banded together to make some shitty system to bill your purchase directly to your checking account. No more paying fees or pesky chargebacks. The retail side blew up -- no consumer wanted it, and it was technologically bad. NFC readers are back in stores. The carrier side blew up -- SIM cards are gone and Apple or Samsung is your secure element provider. I am not sure what happened on the processing card network. I'm guessing they made some private deal with the NFC payment providers (Apple, Google, Garmin, Fitbit, etc.; enough companies in on the game that they can sit back and watch them fight each other while they profit). I kind of got to watch this from both sides. I worked on Google Wallet when I started at Google in 2012. Used it pretty much every time I went to CVS. Then CVS removed their readers. Then Apple entered the market, and CVS once again accepts NFC cards. So maybe gas pumps played a role; I don't drive so I don't interact with gas pumps ever. But there were much deeper problems. A lot of entrenched monopolies stood to lose a lot, so they were happy to impede progress wherever possible. There was never a good possible outcome, though -- let the incumbents keep their power, or let the upstart megacorps become the new incumbent. Plenty of VC money available if you think you can fix this problem, or become the new big guy ;)

joecool1029 6y ago
>The retail side blew up -- no consumer wanted it, and it was technologically bad. Didn't help that thr superior user experience of NFC built into cards was drowned out by the klaxons of the media continuously warning customers of proximity theft. Wrong threat model, the cheap mag skimmer or camera or unsecured database models were the real risks. It wasn't that someone will stand butt-to-butt with you to steal a NFC token.

tialaramex 6y ago

Liability shift for gas pumps has been pushed back (October 2020 I think) but not eliminated. Liability shift works like this: Historically the merchant is protected if they had good faith belief that the payment card was authorised via things like a mag stripe. After liability shift that goes away unless you use EMV. You checked the card was "real" with just a mag stripe? Not interested, the chargeback comes out of your money. Your local gas station can keep using mag stripe readers for another decade if they like. But liability shift means places that see significant fraud will have an obvious economic incentive to go EMV, and that shifts the fraud onto nearby stations that didn't have fraud problems, so they go EMV and so on. If you're a merchant with very low fraud rates it can make sense to do no Authorization step whatsoever. Any merchant, anywhere in the world, can do Settlement, which is the step that moves money from your account to theirs, based just on the card number. Only if it becomes a question as to whether this payment was authorized does it matter whether they did the Authorization step, a mag stripe read, the old fashioned impression machines, or a chip-and-PIN terminal. Certain types of companies can find it makes sense to do no Authorization for groups of customers. One Click may be an example of that. You did a bunch of transactions, with a physical delivery address, what are the chances that a new transaction with the same delivery address and card details is fraud while the previous ones were not?

selimthegrim 6y ago
Liability shift or not some of these gas stations keep insisting on ID with credit cards.