6 ms·
And yet, PINs are still not required.
by outworlder 6y ago
And yet, PINs are still not required.
- ihuman 6y agoDo US credit cards even have PINs?
- milkytron 6y agoNone of mine have a PIN as far as I'm aware.
- chrisseaton 6y agoHow do you authorise payment?
- pyromine 6y agoYou have the card. Not a joke, that's really it
- umanwizard 6y agoDebit cards have PINs; credit cards don’t (edit: or maybe they do, but I don’t know what mine is). For credit cards usually just presenting it physically is enough to authorize anything. Online you usually have to provide the card number, verification code (printed on the back of most cards), and postal code of the billing address.
- SaintGhurka 6y agoJust insert your card. That's it. Occasionally they ask you to sign on the past or hit the ok button but usually not even that.
- chrisseaton 6y agoIf someone steals your wallet, or just picks it up off the street after you drop it, what stops them burning through tens of thousands of dollars before anyone notices? I know you can claim it back due to consumer laws... but who's covering the actual goods and services that are consumed until they get to your credit limit?
- SaintGhurka 6y agoNothing. And algorithms. I've had a card number ripped off via an online retailer and Visa figured it out on the first fraudulent charge.
- chrisseaton 6y agoRight... but someone somewhere must be paying the bill? If I buy a sandwich with a card I found on the ground and get away with it who's paying for that sandwich? The card owner? The store owner? The card provider? In the UK it's the store... unless they made you use chip and a PIN. Which is why they all use the chip and a PIN. Then it's the card provider, but it's not because the chip and PIN prevents fraud before that point. I think the card provider eats contactless payments because they encourage more of them so it adds up in the end.
- toast0 6y agoIn the US, if it was a chip and nothing transaction, the bank probably covers it. If it was a magstripe transaction not at a gas pump, the merchant covers it. Card holder liability on timely reported loss or stolen card is capped at $50 or something.
- dylz 6y agoUS only uses chip (and chip is optional in many places!!!! , if you scratch it out it'll fail a few times then let you swipe) (and signature). There is generally no chip and pin. Some older terminals hard crash on PINs on credit. Some older terminals hard crash on PINs exceeding 4 chars
- ars 6y agoThey do have a PIN, you probably just don't know the number. Go on your Credit Card website and there will be a place to request that they send you the number.
- beckler 6y agoMine has a PIN, but I only have to use it if I'm calling support, getting a gift card, or trying to use it at an ATM to get a cash advance. I'm not 100% sure about the ATM though, I've never tried to use it, plus the interest rate for a cash advance is nuts.
- bergstromm466 6y ago> Mine has a PIN, but I only have to use it if I'm calling support Really? You say your pin code over the phone?
- phatfish 6y agoI think we have found the reason for all the credit card fraud in the US ;)
- minitoar 6y agoUsually they have some sort of system where you use touch tone.
- jessaustin 6y agoSome humans may have a hard time deciphering touch tone by ear, but anyone who can eavesdrop a phone conversation can use a program to do the translation.
- Godel_unicode 6y agoNo we don't.
- phatfish 6y agoIn Europe at least the PIN for making payments on your "Chip & PIN" card is to NEVER be given to anyone (or typed on a phone call). Banks will make this very clear. A security "password" for doing phone banking is different.
- testplzignore 6y agoMine has a PIN. Only place that ever asks for it are gas pumps.
- deleted 6y ago[deleted]
- robotnikman 6y agoCredit Card, no Debit Card, yes
- blackaspen 6y agoIt's very few and far between. I have a US-bank issues commercial card that requires a PIN. At least circa a year ago or so I hadn't found a personal one that did.
- CincinnatiMan 6y agoPIN isn't really needed. PINs are only more secure than chip in scenarios where the physical card is stolen, which is an extremely small portion of credit card fraud. Most physical fraud was from skimming, which chip blocks equally well as a PIN, but chip is more convenient. Using a chip reader for their point of sale system would have prevented the breach in this article. Source: used to work adjacent to the fraud analysis group at a large bank.
- dwighttk 6y agoMine does not.
- abawany 6y agoMy MC, issued by a US credit union, does require PINs. Most checkouts in the US or Canada require me to enter a PIN when using this card, though this somewhat seems to also be a function of the purchase amount.
- dragonwriter 6y ago> My MC, issued by a US credit union, does require PINs. Most checkouts in the US or Canada require me to enter a PIN when using this card If you can checkout some places without it, the card does not require a PIN, it provides it as an option.
- tialaramex 6y agoEMV has a negotiation step. As is often the case this step is flawed, but generally the idea is the card (well the chip on the card) and the terminal get to negotiate about what's going to happen next. So I think it's possible for a card to insist upon doing a PIN transaction if that's possible, while still retaining the ability to authorize a no-PIN transaction if the terminal says it doesn't do PINs. It's also possible for the card or the terminal to have value-related thresholds, in line with the issuer's appetite for risk so e.g. maybe a bag of chips from a vending machine with no PIN is a risk the bank can live with, but a $3000 diamond engagement ring not so much. Because the chip has (some) memory it can even have state, maybe one $1.50 bag of popcorn from an offline no-PIN terminal is fine, and so is two, but before you can do a third tiny off-line transaction you'll need to do a real transaction or visit an ATM or other online system with the card so it be reassured everything is on the up-and-up.
- lmilcin 6y agoPINs ARE required. It's just American banks pressure Visa and Mastercard not to implement and so they get waivers after waivers to postpone implementation. Here in Poland and everywhere else in the world PINs have been absolutely required on new cards for over a decade.
- deleted 6y ago[deleted]
- SOLAR_FIELDS 6y agoI thought (but don’t quote me on this) it was actually Visa and MasterCard that campaigned to keep chip-and-signature over chip-and-pin so that they could charge higher fees for “fraud prevention”. Which I find a bit amusing as I’ve been signing my card transactions with a literal smiley face as of late.
- lmilcin 6y agoWell, as a guy who spend couple of years actually implementing chip & pin terminal credit card application from scratch, for a Polish acquirer, and a security officer at the same company, who had to read and internalize 17 thousand pages of documentation from Visa, Mastercard, PCI and EMV to do so, I can confidently say this is complete and utter nonsense (and it already was 10 years ago when I have stopped working with credit cards). At every step Visa and MasterCard promotes highest possible level of security. To give you an example, when implementing the terminal application you have to be able to support a range of CVMs (Cardholder Verification Methods) that might be presented by the card. The CVM list is a detail personalized on the card by the Bank, issuer of the card. The algorithm actively promotes selecting the strongest authentication method that is supported by the card and always prefers PIN over signature (ie if PIN CVM is available it should not be possible to normally use signature). This is verified during certification process and applications that don't meet this requirement fail certification. There are also rules and internal memos which are sent to both acquirers and issuers, to which I have been privy to, which exert pressure on issuers to improve their security to deal with frauds. We were also regularly notified on new types of frauds detected and how to help preventing them. The terminal application should also always prefers chip over magnetic stripe up to the point where magnetic stripe transaction is only allowed as a fallback after chip is found to be inoperable. So on a well implemented terminal you have to try chip first and only if it doesn't work the terminal should allow you to try with magstripe, if the magstripe says that the card is chip-capable. Additionally, Visa and Mastercard both monitor rates of fallbacks (situations where magstripe is used with chip-capable cards) and issues penalties to entities that cross specific thresholds.
- tialaramex 6y agoPINs seem like the wrong focus? The first thing to know is that payment cards have two almost unrelated systems, named Authorization and Settlement. Authorization is about protecting the card company from crooked card holders by validating that the card holder authorized this transaction. It's optional, and it has some modern technologies like EMV (Europay/Mastercard/Visa the joint system known for the presence of a chip on your card) which could enable PIN verification if you wanted. Settlement is the part that moves money from your account to a merchant's account, it's childishly simple and it is run almost entirely on the honour system like it was when it was invented last century. A merchant says card 1234 5678 9012 3456 was used to pay them $280, the card company either accepts that and moves $280 from the account associated with that card to the account for the merchant, or they refuse. The merchant can provide more information, but they don't have to and will usually get paid regardless. The fancy modern technology for Authorization makes no difference to Settlement. If the bank receives a Settlement for a transaction supposedly made with a card you actually tossed into the mouth of an active volcano a month earlier, the only thing likely to stop that getting paid is if you call the bank and insist you made no such transaction, confident that the merchant doesn't have evidence to the contrary because duh, that card was destroyed a month ago. Check your statements. Read every line item, dispute anything you don't recognise. Even if you use (for example) Apple Pay every single time, your bank is under no obligation to treat a $150 payment for scratch offs supposedly made with a mag stripe card on the far side of the country as suspicious and block it. They might, but they might not, that's on you. The volume of fraud is driven by easy ways to steal a shared "secret" that should never have existed (a card number, the only thing truly needed for Settlement) and then use that to fraudulently obtain things of value. PINs don't really impact that, they're a defence against a much rarer crime - theft of the card. A pickpocket or burglar doesn't know your PIN. But pickpockets do not steal millions of cards at a time. If you have a card, with a PIN, and you used that card, with a PIN, at Dickey's, there is every chance you're vulnerable as a result of this anyway. Do the crooks get your PIN? Nope. But chances are your priority wasn't keeping a four digit number secret but not losing your money.
- zxcvbn4038 6y agoLast time I looked at card processor you had to echo back the approval numbers with the other information when you did your batch close transaction, so the card processor should be able to reconcile the batch record with the original approval record and stop arbitrary new data being introduced. Plus not every card processor I looked at used batches. At one point the card processors had a very nice crypto protocol called SET that kept the card numbers out of everyone’s hands. At the time the crypto was really overwhelming and it would take like twenty seconds to do all the math on a high end (for the time) processor. The other problem was that the reference implementation was done by an absolute c++ zealot who was furious he had to write the code in C so tens of thousands of lines of code was dedicated to implementing all the c++ features in C which pretty much made the reference useless except for interoperability testing. Unfortunately the standard never took off and you can’t find it anymore.
- HeavenFox 6y agoThe flip side is if you lost your card AND the thief guessed your PIN, it might be a lot harder to convince the bank you didn't authorize the purchase.
- MeinBlutIstBlau 6y agoYour phone you could show your gps location at the time.