10 ms·

CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. Or that it would take too much ed

CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. Or that it would take too much education and infrastructure change to get that to work. So we had a dumb hybrid approach, and usually the retailer pays for the fallout of this decision. Secondly, I (and others) will not use my debit card for transactions (to the full extent that I can take this position practically), as debit cards do not have the same protections against fraud as CCs do. Lastly, an observation, I'm surprised that given the potential penalties (in fraudulent charges), restaurants and other retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system. Maybe it's a little more expensive if they have to replace those big clunky POS / order taking machines. But this technology always ends up costing cheaper than what the complaining businesses say they will have to pay in the beginning.

alextheparrot 6y ago
The movement towards eWallets is a better UX than a pin, as the device is a witness factor (chip) while the device-level auth (passcode or <body part>Id) represents similar proof as a pin. The added benefit, here, is that users can order online with as much safety as at a terminal (Maybe I'm missing a nuance or two here?) and no terminal is necessary.
AdamJacobMuller 6y ago
> retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system I think its been about a year or more for me since I last swiped my card (or saw it swiped). 100% chip/EMV or Apple Wallet here.
- jimmaswell 6y ago
  I severely miss swiping every time I have to sit there for ten seconds staring at a terminal with the chip in, waiting for it to obnoxiously beep. Phone NFC is a bit nicer when it works (often doesn't) but I wish it didn't require authentication. Swiping feels like the golden age of shopping convenience.
gruez 6y ago
>CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. [...] So we had a dumb hybrid approach, and usually the retailer pays for the fallout of this decision. I don't think there's anything specifically wrong (security-wise) with chip + sign for processing. Sure, you don't need to enter a pin to verify the transaction, but it's not like you can clone the chip, so there isn't any security issues there. AFAIK the only issue is that for some banks, the magstripe information can be read off the chip, that can be used afterwards to spoof a magstripe transaction, which the bank allows (for legacy reasons). The core problem is allowing legacy transactions, not in not having a pin.
- katbyte 6y ago
  If you lose the card someone can just use it if there is no pin. Lose a card with a pin it can’t be used.
  - gruez 6y ago
    I do agree that it's one deficiency, but it doesn't matter much. The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it. There aren't organized criminal rings for it because it simply doesn't scale. Not to mention that you have a very limited window to spend it compared to a skimmed card. The banks probably figured that adding pin adds marginal security for significantly more hassle.
    - tzs 6y ago
      > The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it I must confess that I actually did once find a credit card on the ground while walking through an outdoor parking lot--and I did start using it in stores. It was one of those mini cards some banks issued that were designed to go on a key ring for convenience. From the wear on it, it had been out there at least a couple days. When I picked it up I had every intention of reporting it to the bank. However, when I picked it up and saw the name and photo--they were mine! I pulled out my key ring and sure enough, my card was missing. I didn't use that card much, but still, I used my key ring several times a day so I have no idea how I failed to notice that it was missing. As to how it fell off, there was a hole in the corner for the key ring to go through, and the card had cracked between the hole and the edge. The next two times my bank issues to me new cards and included a key right card, the same kind of crack developed. I stopped using them after that as the risk of losing them seemed to high. Bank of America stopped issuing them in 2010, after 8 years. I wonder if it had anything to do with a high lost card rate?
rini17 6y ago
Most of Europe is moving to contactless card payments and PIN is needed only for large amounts (over 20 euro, recently raised to 60 euro) and for cash withdrawals. The result is I already happened to forget the PIN, fortunately I had another card. So, stolen card can be used for small payments, but there's easy process to immediately block it (via app or internet banking).
- ulfw 6y ago
  Good banks allow you to pick your own PIN. For some reason in Europe few do that.
  - fomine3 6y ago
    Looks strange. All my 10+ cards in Japan allow to pick a PIN.
    - _trampeltier 6y ago
      Japan is funny anyway. 15 years ago I could go to every ATM to get cash. Now I think it is just possible to get cash from a 7-Eleven ATM with a non japanese card.
      - fomine3 6y ago
        Now we can withdraw cash from ticket vending machine on train station but maybe no one actually use it. https://www.gmo-pg.com/en/corp/newsroom/press/gmo-paymentgateway/2019/0424.html https://www.gmo-pg.com/en/corp/newsroom/press/gmo-paymentgat...
  - watwut 6y ago
    Really only few? I thought it normal to change your pin in the ATM.
- tjoff 6y ago
  Since it often is completely unencrypted just use an android phone or whatever to get the details. And since the small-payment-limitation is just in the payment terminal you don't have to care about that either. And blocking the card isn't even immediate. Card doesn't even need to leave victims pocket to read it. You can't make this stuff up.
bsder 6y ago
> restaurants and other retailers don't just bite the bullet and buy the $100 terminals Because it's never $100 cash. It's $100, and a subscription fee for the service, and a percentage of the transaction. Indefinitely. If you already have a really good deal with your provider, this may be a more significant hit to profit than fraud--especially for a restaurant (where fraud is less because you can't reconvert the food into cash unlike merchandise). I hate the "SaaS" subscription model, but it's infected everything.
- fragmede 6y ago
  That's fair to complain about rent-seeking aspects of SaaS, but credit cards existed before the word SaaS was ever used, and subscription services existed long before computers did. Thing is, even if merchants didn't buy a new $100 terminal, if they're already accepting credit cards with an old terminal, they're already paying a subscription fee and a percentage of transaction, so in this specific case, it is $100 cash. (Pedantically, it's closer to $300 https://www.merchantequip.com/processing-equipment/wireless-terminals/ https://www.merchantequip.com/processing-equipment/wireless-...)
rohansingh 6y ago
> CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN Or maybe they did the math, found that the average US consumer has a handful of credit cards, and figured that if they put a PIN on their card it would get used less. Resulting in less profit for the credit card company.
- amiga_500 6y ago
  I don't think this is correct, because competition hasn't created a better outcome.
  - kerkeslager 6y ago
    Competition doesn't produce good outcomes, it produces winners who then have a monopoly and can create barriers to entry so that competition no longer exists.
    - ricardbejarano 6y ago
      Ever heard of market regulation? Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it? Are consumers supposed to skip the best option just because the company behind it is getting too big?
      - kerkeslager 6y ago
        > Ever heard of market regulation? Yes, that's what I'm suggesting. > Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it? Ever heard of market regulation? Shifting blame onto consumers doesn't fix the problem. Instead of establishing who is to blame, we could fix the problem. > Are consumers supposed to skip the best option just because the company behind it is getting too big? This is exactly why blaming consumers doesn't fix the problem.
    - amiga_500 6y ago
floatboth 6y ago
Retailers buy POS terminals? Not rent them from their bank?
tyoma 6y ago
The average US card user has something like 5+ cards. You are not supposed to re-use or write down pins. PIN use would not scale past one or two cards.
tluyben2 6y ago
> as debit cards do not have the same protections against fraud as CCs do. I am curious: how often were you defrauded, how and where?
- nextweek2 6y ago
  Doesn't matter, what matters is sleeping safely at night that if a company gets hacked and loses card details, my credit card being fraudulently used is the banks problem. With a debit card it's my problem that the bank isn't legally required to help with.
  - aljarry 6y ago
    In Europe (at least in some countries) local law dictates that unauthorized debit card payments are to be reimbursed by banks.
    - sgerenser 6y ago
      Reimbursed, sure. After the money is already out of your account for potentially multiple days, while your other payments bounce. With a credit card the only thing stolen is the bank’s money.
      - tluyben2 6y ago
        You are saying that poor people (as in, people who have not enough money in their account to sustain living after a fraudulent transaction) should have creditcards instead of debitcards? Here I would not even be able to get a cc if I made under a certain amount/month which would not make me poor enough for that. Or do you mean something else? Cards (debit/credit) normally (and for good reasons like this) have limits far below what I have in my account and the bank is good at detecting fraudulent transactions. Credit is considered not good for people who are not well off here; there are entire tv campaigns to dissuade them from it so I am curious if you are recommending it and if that is normal in, presumably, the US.
baby 6y ago
What’s the difference in fraud protection debit vs credit? I’m not a fan of using credit cards as you’re constantly in debt and need to make sure you’re paying back your balance.
- nextweek2 6y ago
  You are protected by consumer credit laws with a credit card which puts responsibility on the retailer and card issuer. You can issue a charge back and it's their mess to sort out. A debit card puts the onus on you. Your bank will probably help you but they're doing so for good customer service, not because the law tells them to. If you are the victim of fraud or faulty goods, a credit card is on your side. Otherwise with a debit card you may have to rely on the courts. Rule of thumb, use a credit card for everything but set it to clear the balance every month.
  - shock 6y ago
    > You are protected by consumer credit laws What country are you referring to? Is it a widespread thing?
- 0n0n0m0uz 6y ago
  Better protected with a CC because you are spending a banks money and not your own. Obviously they will care alot more about theirs, however nowadays Debit Cards have very similar protections. Just pay the full balance every month and you never go into debt and with the right card you will earn a free vacation once a year with the bonuses.
krebsonsecurity 6y ago
With the exception of Amex and Discover and a few others that issue their own cards, Visa and MasterCard don't issue the cards. Thousands of banks and credit unions do. They're the ones responsible for managing fraud on those accounts. The banks decided the PIN part of chip and PIN only protects against physical theft -- what they call "lost and stolen" fraud. Assuming that is accurate, given the costs associated in dealing with customers who forget their PINs, and the fact that Visa massively pushed for chip and signature, it's not hard to see why none of the banks wanted to be the hardest card to use in the wallet: Lost and stolen is an infinitesimal amount of loss for them when compared to counterfeits and e-commerce fraud.

alextheparrot 6y ago

The movement towards eWallets is a better UX than a pin, as the device is a witness factor (chip) while the device-level auth (passcode or <body part>Id) represents similar proof as a pin. The added benefit, here, is that users can order online with as much safety as at a terminal (Maybe I'm missing a nuance or two here?) and no terminal is necessary.

AdamJacobMuller 6y ago

> retailers don't just bite the bullet and buy the $100 terminals to get off the swipe system I think its been about a year or more for me since I last swiped my card (or saw it swiped). 100% chip/EMV or Apple Wallet here.

jimmaswell 6y ago
I severely miss swiping every time I have to sit there for ten seconds staring at a terminal with the chip in, waiting for it to obnoxiously beep. Phone NFC is a bit nicer when it works (often doesn't) but I wish it didn't require authentication. Swiping feels like the golden age of shopping convenience.

gruez 6y ago

>CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN. [...] So we had a dumb hybrid approach, and usually the retailer pays for the fallout of this decision. I don't think there's anything specifically wrong (security-wise) with chip + sign for processing. Sure, you don't need to enter a pin to verify the transaction, but it's not like you can clone the chip, so there isn't any security issues there. AFAIK the only issue is that for some banks, the magstripe information can be read off the chip, that can be used afterwards to spoof a magstripe transaction, which the bank allows (for legacy reasons). The core problem is allowing legacy transactions, not in not having a pin.

katbyte 6y ago
If you lose the card someone can just use it if there is no pin. Lose a card with a pin it can’t be used.
- gruez 6y ago
  I do agree that it's one deficiency, but it doesn't matter much. The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it. There aren't organized criminal rings for it because it simply doesn't scale. Not to mention that you have a very limited window to spend it compared to a skimmed card. The banks probably figured that adding pin adds marginal security for significantly more hassle.
  - tzs 6y ago
    > The vast majority of fraud isn't from people finding credit cards off the ground and going into stores with it I must confess that I actually did once find a credit card on the ground while walking through an outdoor parking lot--and I did start using it in stores. It was one of those mini cards some banks issued that were designed to go on a key ring for convenience. From the wear on it, it had been out there at least a couple days. When I picked it up I had every intention of reporting it to the bank. However, when I picked it up and saw the name and photo--they were mine! I pulled out my key ring and sure enough, my card was missing. I didn't use that card much, but still, I used my key ring several times a day so I have no idea how I failed to notice that it was missing. As to how it fell off, there was a hole in the corner for the key ring to go through, and the card had cracked between the hole and the edge. The next two times my bank issues to me new cards and included a key right card, the same kind of crack developed. I stopped using them after that as the risk of losing them seemed to high. Bank of America stopped issuing them in 2010, after 8 years. I wonder if it had anything to do with a high lost card rate?

rini17 6y ago

Most of Europe is moving to contactless card payments and PIN is needed only for large amounts (over 20 euro, recently raised to 60 euro) and for cash withdrawals. The result is I already happened to forget the PIN, fortunately I had another card. So, stolen card can be used for small payments, but there's easy process to immediately block it (via app or internet banking).

ulfw 6y ago
Good banks allow you to pick your own PIN. For some reason in Europe few do that.
- fomine3 6y ago
  Looks strange. All my 10+ cards in Japan allow to pick a PIN.
  - _trampeltier 6y ago
    Japan is funny anyway. 15 years ago I could go to every ATM to get cash. Now I think it is just possible to get cash from a 7-Eleven ATM with a non japanese card.
    - fomine3 6y ago
      Now we can withdraw cash from ticket vending machine on train station but maybe no one actually use it. https://www.gmo-pg.com/en/corp/newsroom/press/gmo-paymentgateway/2019/0424.html https://www.gmo-pg.com/en/corp/newsroom/press/gmo-paymentgat...
- watwut 6y ago
  Really only few? I thought it normal to change your pin in the ATM.
tjoff 6y ago
Since it often is completely unencrypted just use an android phone or whatever to get the details. And since the small-payment-limitation is just in the payment terminal you don't have to care about that either. And blocking the card isn't even immediate. Card doesn't even need to leave victims pocket to read it. You can't make this stuff up.

bsder 6y ago

> restaurants and other retailers don't just bite the bullet and buy the $100 terminals Because it's never $100 cash. It's $100, and a subscription fee for the service, and a percentage of the transaction. Indefinitely. If you already have a really good deal with your provider, this may be a more significant hit to profit than fraud--especially for a restaurant (where fraud is less because you can't reconvert the food into cash unlike merchandise). I hate the "SaaS" subscription model, but it's infected everything.

fragmede 6y ago
That's fair to complain about rent-seeking aspects of SaaS, but credit cards existed before the word SaaS was ever used, and subscription services existed long before computers did. Thing is, even if merchants didn't buy a new $100 terminal, if they're already accepting credit cards with an old terminal, they're already paying a subscription fee and a percentage of transaction, so in this specific case, it is $100 cash. (Pedantically, it's closer to $300 https://www.merchantequip.com/processing-equipment/wireless-terminals/ https://www.merchantequip.com/processing-equipment/wireless-...)

rohansingh 6y ago

> CC companies in the US made the moronic determination that the American consumer could not handle the complexity of the PIN Or maybe they did the math, found that the average US consumer has a handful of credit cards, and figured that if they put a PIN on their card it would get used less. Resulting in less profit for the credit card company.

amiga_500 6y ago
I don't think this is correct, because competition hasn't created a better outcome.
- kerkeslager 6y ago
  Competition doesn't produce good outcomes, it produces winners who then have a monopoly and can create barriers to entry so that competition no longer exists.
  - ricardbejarano 6y ago
    Ever heard of market regulation? Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it? Are consumers supposed to skip the best option just because the company behind it is getting too big?
    - kerkeslager 6y ago
      > Ever heard of market regulation? Yes, that's what I'm suggesting. > Also, don't forget the "winners" are appointed by the consumers, if everyone likes your product what can you do about it? Ever heard of market regulation? Shifting blame onto consumers doesn't fix the problem. Instead of establishing who is to blame, we could fix the problem. > Are consumers supposed to skip the best option just because the company behind it is getting too big? This is exactly why blaming consumers doesn't fix the problem.
  - amiga_500 6y ago

floatboth 6y ago

Retailers buy POS terminals? Not rent them from their bank?

tyoma 6y ago

The average US card user has something like 5+ cards. You are not supposed to re-use or write down pins. PIN use would not scale past one or two cards.

tluyben2 6y ago

> as debit cards do not have the same protections against fraud as CCs do. I am curious: how often were you defrauded, how and where?

nextweek2 6y ago
Doesn't matter, what matters is sleeping safely at night that if a company gets hacked and loses card details, my credit card being fraudulently used is the banks problem. With a debit card it's my problem that the bank isn't legally required to help with.
- aljarry 6y ago
  In Europe (at least in some countries) local law dictates that unauthorized debit card payments are to be reimbursed by banks.
  - sgerenser 6y ago
    Reimbursed, sure. After the money is already out of your account for potentially multiple days, while your other payments bounce. With a credit card the only thing stolen is the bank’s money.
    - tluyben2 6y ago
      You are saying that poor people (as in, people who have not enough money in their account to sustain living after a fraudulent transaction) should have creditcards instead of debitcards? Here I would not even be able to get a cc if I made under a certain amount/month which would not make me poor enough for that. Or do you mean something else? Cards (debit/credit) normally (and for good reasons like this) have limits far below what I have in my account and the bank is good at detecting fraudulent transactions. Credit is considered not good for people who are not well off here; there are entire tv campaigns to dissuade them from it so I am curious if you are recommending it and if that is normal in, presumably, the US.

baby 6y ago

What’s the difference in fraud protection debit vs credit? I’m not a fan of using credit cards as you’re constantly in debt and need to make sure you’re paying back your balance.

nextweek2 6y ago
You are protected by consumer credit laws with a credit card which puts responsibility on the retailer and card issuer. You can issue a charge back and it's their mess to sort out. A debit card puts the onus on you. Your bank will probably help you but they're doing so for good customer service, not because the law tells them to. If you are the victim of fraud or faulty goods, a credit card is on your side. Otherwise with a debit card you may have to rely on the courts. Rule of thumb, use a credit card for everything but set it to clear the balance every month.
- shock 6y ago
  > You are protected by consumer credit laws What country are you referring to? Is it a widespread thing?
0n0n0m0uz 6y ago
Better protected with a CC because you are spending a banks money and not your own. Obviously they will care alot more about theirs, however nowadays Debit Cards have very similar protections. Just pay the full balance every month and you never go into debt and with the right card you will earn a free vacation once a year with the bonuses.

krebsonsecurity 6y ago

With the exception of Amex and Discover and a few others that issue their own cards, Visa and MasterCard don't issue the cards. Thousands of banks and credit unions do. They're the ones responsible for managing fraud on those accounts. The banks decided the PIN part of chip and PIN only protects against physical theft -- what they call "lost and stolen" fraud. Assuming that is accurate, given the costs associated in dealing with customers who forget their PINs, and the fact that Visa massively pushed for chip and signature, it's not hard to see why none of the banks wanted to be the hardest card to use in the wallet: Lost and stolen is an infinitesimal amount of loss for them when compared to counterfeits and e-commerce fraud.