26 ms·

Or, you could go for a debit card with a pin, like in good old Germany. Credit cards require artificial fraud protection just because it's literally unprotected

• amelius 6y ago
  And why not make the secret mandatory only for amounts > $THRESHOLD
  • marvinblum 6y ago
    Well, that has become a practice already, even in countries like Germany where most people still prefer cash. I think it's < 50€ for my card, but even then I usually get asked for the pin.
  • alkonaut 6y ago
    Pin limit was raised from €20 to €40 for my card due to Corona (slightly higher risk to have fewer people touch the keypads).
• metaphor 6y ago
  https://krebsonsecurity.com/all-about-skimmers/ https://krebsonsecurity.com/all-about-skimmers/ ...and if your bank happens to suck, then the loss of getting owned by one is now your problem, not theirs.
• alkonaut 6y ago
  Does debit vs credit really matter? I have a pin for both my MC debit and credit cards (same with Visa earlier) and any online purchase requires 2FA (MasterCard SecureCode and VerifiedByVisa respectively). I wouldn’t make a transaction online without those 2FA measures and I wouldn’t make an in person transaction without pin. I haven’t checked actually but I assume the cards can’t be used without pin/2FA e.g if the details were leaked.
  • marvinblum 6y ago
    With the new 3D secure EU regulation this will become the standard in Europe. My credit card works without that security measurements at the moment.
  • ckorhonen 6y ago
    I don't know how much stock I'd put into SecureCode etc. Recently I discovered that American Express's SafeKey could easily bypassed on BestBuy.com by leaving the browser tab open for ~15 minutes. I assume it's up to the e-commerce site to implement the check, and in this case it had timed out and they decided to process the order anyway. Sure, you'll probably win any chargeback, but they don't necessarily prevent the charges in the first place.
    • manuelmagic 6y ago
      2FA doesn't always ask for a PIN, depending on some fingerprinting the payment can be processed without further checks.
  • lxgr 6y ago
    > I wouldn’t make a transaction online without those 2FA measures and I wouldn’t make an in person transaction without pin. Even if you don't, if your card details get leaked, fraudsters definitely will. You can't prevent that by shopping selectively.
    • alkonaut 6y ago
      Hopefully they can soon block non-SecureCode transactions soon, since there are almost no such stores now. I haven’t seen one for years. Same that happened with pins 20 years ago, once all stores had them, you could no longer make a purchase with just card+signature. What’s needed is a block for use in countries where this hasn’t happened. Not sure if that’s the case.
      • lxgr 6y ago
        In the EU, it will soon be mandatory for both merchants and issuers to support 3DS, whereas in the US it is still pretty uncommon – and card details work worldwide. A geo block could theoretically work, and I know of some issuers doing just that, but it's also pretty inconvenient when traveling or shopping online.
• Shivetya 6y ago
  Both my Debit and CC have pins. However there does not seem a means by which I can force my bank to only accept purchases which provide it. Let alone have a SMS mode where I have to approve all purchases made on the card. Provide retailer, state, and cost.
  • throwaway744678 6y ago
    In this case, the bank is defrauded, not you.
• gruez 6y ago
  Having chip/pin is orthogonal to the card being a credit or debit card. If anything, at least in the US a credit card has better protections in the event you are defrauded. If a fraudster drains your debit card, your money will be gone until they reverse the charges which can be days or weeks. In the meantime you won't be able to pay your bills or your rent, which can cause you to rack up late fees. On the other hand, if a fraudster drains your credit card, they stole your bank's money, not your money. The money is still in your account.
  • toohotatopic 6y ago
    As you say, it is orthogonal. Why not have both? You pay for the fraud with higher fees compared to a system where fraud is prevented by additional security.
    • alextheparrot 6y ago
      Credit cards do have this, that's one of the use-cases of the pin on the back. The eWallet products being pushed by various companies neatly bridges the chip/pin to the card, giving chip/pin style protections digitally. Most phones require you to use some form of passcode (6 digits, TouchId, FaceId) which are effectively pins prior to using a payment method. Additionally, there are secure chips in your devices to do the actual processing. This means that digital purchases through eWallet methods are effectively chip + pin while still getting credit card fraud protections.
  • llsf 6y ago
    I have never used a credit card when living in Europe, it was a debit card... but it is effectively debited at the end of the month only. So you have to pay in full at the end of the month. And the bank is responsible for the security on the card, so if it is hacked somehow, the bank has to fix/pay for it. So, it is a bit strange when moving to US, and then being responsible for the poor security of the cards (debits or credits) provided by my US bank. Now the anti-fraud system is pretty sophisticated. I once got my CC being copied at a fast food, charged fraudulently like less than 30min after my order at the fast food, and have the CC company called and asked to verify the fraudulent charge. It is just strange not spend that money upfront with better security on the cards, rather than let it wide open and then build complex/velocity/AI system to point potential fraudulent charges, call me, cancel charges, and send me a new CC.
• supernova87a 6y ago
  CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. Or that it would take too much education and infrastructure change to get that to work. So we had a dumb hybrid approach, and usually the retailer pays for the fallout of this decision. Secondly, I (and others) will not use my debit card for transactions (to the full extent that I can take this position practically), as debit cards do not have the same protections against fraud as CCs do. Lastly, an observation, I'm surprised that given the potential penalties (in fraudulent charges), restaurants and other retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system. Maybe it's a little more expensive if they have to replace those big clunky POS / order taking machines. But this technology always ends up costing cheaper than what the complaining businesses say they will have to pay in the beginning.
  • alextheparrot 6y ago
    The movement towards eWallets is a better UX than a pin, as the device is a witness factor (chip) while the device-level auth (passcode or <body part>Id) represents similar proof as a pin. The added benefit, here, is that users can order online with as much safety as at a terminal (Maybe I'm missing a nuance or two here?) and no terminal is necessary.
  • AdamJacobMuller 6y ago
    > retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system I think its been about a year or more for me since I last swiped my card (or saw it swiped). 100% chip/EMV or Apple Wallet here.
    • jimmaswell 6y ago
      I severely miss swiping every time I have to sit there for ten seconds staring at a terminal with the chip in, waiting for it to obnoxiously beep. Phone NFC is a bit nicer when it works (often doesn't) but I wish it didn't require authentication. Swiping feels like the golden age of shopping convenience.
  • 6y ago
• atombender 6y ago
  When I lived in Europe, all my cards required 2FA via 3-D Secure for online orders (variously marketed as Verified by Visa and so on). This would ask me to use my bank's authenticator to generate a one-time code. I've seen 3-D Secure flash by when doing online orders in the US, but it's never required any authentication. It just says "3-D Secure" briefly and then it's seemingly skipped. This banks simply not roll it out?
  • dylz 6y ago
    It's rolled out, they're typically incredibly invasive fingerprinting scripts that also port scan you/your LAN. Amex's 3D implementation seems to consistently ask for a 6-character passcode if it doesn't pass through.
    • rconti 6y ago
      Yeah, I worked for a certain security company, and it took me way too long to realize the reason "3d Secure never effing works" was because I was using it from my corporate LAN, which was blocked/flagged due to scanning activity.
• maxerickson 6y ago
  What's artificial about fraud protection that doesn't depend on a pin? A pin verifies the bearer, systems that don't require them evaluate each transaction. It's not like US merchants are all choosing to stop accepting credit cards, so fraud probably isn't that big a problem.
• chrismcb 6y ago
  How is that different than other debit cards? It shouldn't be possible to go into debt with a debit card. And, typically you need to used your pin to use a debit card. These is different than a credit card.
• cortesoft 6y ago
  A chip is much better than a pin. A pin can be stolen, just like the card. With a chip, the secret data never leaves the card during a transaction. Even if the business is hacked, or if the POS system is compromised, the stolen data can't be used for anything. With a pin, if someone hacks a POS system (or installs a fraudulent one over it), they can capture both the number AND the pin at the same time.
  • ratww 6y ago
    Germany also uses chips. In fact every country I ever lived used chips + pins.
• jonkoops 6y ago
  I really never got credit cards, I didn't even own one until I had to make some purchases on American websites. In the Netherlands and most EU countries we all have debit cards protected by a pin, and all transactions are basically instant and increasingly contactless. As for purchasing stuff on-line we have a system called 'iDeal' which is supported by every bank. You just go the the checkout, scan a QR code with your banking app, accept the purchase in the app and it's done. It still comes to me as a surprise that in a connected world like today you can make a purchase in someone's name by just knowing a bunch of numbers on a piece of plastic, no verification needed.
  • ars 6y ago
    You can make a purchase on an American website with a debit card. The point of the credit card is to borrow money and pay it back later. That's all. Most Americans have both Debit and Credit cards and will switch between them based on their financial need. > You just go the the checkout, scan a QR code with your banking app, accept the purchase in the app and it's done. And those people who don't have data for their phone? > that in a connected world like today Not everyone is connected.
    • Denvercoder9 6y ago
      > And those people who don't have data for their phone? It works fine over wifi. For those without internet at all, well, then you can't order anything online either ;) (I know of at least one bank, but there are probably more, that also offers a (free) hardware device for people without a smartphone.)
  • thewebcount 6y ago
    > You just go the the checkout, scan a QR code with your banking app Ugh, no thank you. I just wave my watch over the device and I'm done. Nothing to take out, no apps involved.
    • innocenat 6y ago
      For online purchase?
• LargoLasskhyfv 6y ago
  Hrm. No. At least for Deutsche Bank Privatkunden it is real-time. I guess it has to be for the others too, because how else can you ensure not going into debt? Incoming money could take a while, but no longer than a full workday either.
• dudul 6y ago
  I don't understand your [Edit]. Of course that's how debit cards work. Debit cards exist in the US too, and they work exactly like that, with a chip, a PIN and withdrawal on the same day.
• beached_whale 6y ago
  Many people miss the fact that fraudulent purchases are not their problem. Adding a pin, at least in Canada, potentially puts the onus on the cardholder to prove they didn't make the purchase. Although, even though the language of the contract says this, the companies generally don't enforce that. But chip/signature still means the store and the credit card company are risk managing it as part of the cost.
• adrr 6y ago
  CVV is suppose to be the secret that no merchant is suppose to store. It doesn't work. It can be easily be skimmed from a hacked site and users can be tricked to give it up with a phishing site. Want to fix credit card fraud online. Make the banks require support for extended address verification so merchants can verify the email address is connected to the credit card. Credit card fraud will be caught faster with less risk to the merchant and credit card holder. People will notice the order confirmation email of fraudulent purchase and reach out to the bank and merchant instead of the old way of waiting till you get your credit card statement. Also for high risk orders(eg: billing doesn't match shipping or digital goods), having a known email helps mitigate risk because they can confirm that the order legitimate before fulfillment.
• novalis78 6y ago
  95% of all Enterprise car rental fraud occurs with debit cards (as per a recent conversation with a manager) http://www.city-data.com/forum/automotive/2750797-rental-agencies-wont-accept-debit-card.html http://www.city-data.com/forum/automotive/2750797-rental-age...
• sombremesa 6y ago
  Another ridiculous fact - a legitimate cardholder cannot use the card if they haven't got the physical card with them for the pin on the back (unless they wrote that down somewhere). The bank will not give it to you (and may not have it). Ironic, considering an attacker would have that pin 100% of the time, whereas the legitimate cardholder might not.
• charrondev 6y ago
  Idk in Canada all visas and MasterCards have PINs. They can be tapped at most retailers for dollar amounts under $100, but there is an extra charge for the merchant (likely due to the risk?). My partner owns a clinic and we don’t allow taps as a result. We also only ever do card present, chip + pin transactions. This means we save between 0.4-0.8% of the transaction price depending on the card.
• ulfw 6y ago
  That is literally how almost every country’s debit card works
• dahfizz 6y ago
  > Here, the money is withdrawn from your bank account on the same day (most of the time), and you cannot go into debt. Where do debit cards not work like this?
• brianwawok 6y ago
  I will not use my debit card at anything other than an ATM. If someone steals my credit card (happens on average once a year), the missing money is the banks problem. If someone steals my debit card, the missing money is my problem. Oh can’t pay my mortgage because my checking got drained? Sucks to be me...