3 ms·

PINs ARE required. It's just American banks pressure Visa and Mastercard not to implement and so they get waivers after waivers to postpone implementation. He

PINs ARE required. It's just American banks pressure Visa and Mastercard not to implement and so they get waivers after waivers to postpone implementation. Here in Poland and everywhere else in the world PINs have been absolutely required on new cards for over a decade.

deleted 6y ago
[deleted]
SOLAR_FIELDS 6y ago
I thought (but don’t quote me on this) it was actually Visa and MasterCard that campaigned to keep chip-and-signature over chip-and-pin so that they could charge higher fees for “fraud prevention”. Which I find a bit amusing as I’ve been signing my card transactions with a literal smiley face as of late.
- lmilcin 6y ago
  Well, as a guy who spend couple of years actually implementing chip & pin terminal credit card application from scratch, for a Polish acquirer, and a security officer at the same company, who had to read and internalize 17 thousand pages of documentation from Visa, Mastercard, PCI and EMV to do so, I can confidently say this is complete and utter nonsense (and it already was 10 years ago when I have stopped working with credit cards). At every step Visa and MasterCard promotes highest possible level of security. To give you an example, when implementing the terminal application you have to be able to support a range of CVMs (Cardholder Verification Methods) that might be presented by the card. The CVM list is a detail personalized on the card by the Bank, issuer of the card. The algorithm actively promotes selecting the strongest authentication method that is supported by the card and always prefers PIN over signature (ie if PIN CVM is available it should not be possible to normally use signature). This is verified during certification process and applications that don't meet this requirement fail certification. There are also rules and internal memos which are sent to both acquirers and issuers, to which I have been privy to, which exert pressure on issuers to improve their security to deal with frauds. We were also regularly notified on new types of frauds detected and how to help preventing them. The terminal application should also always prefers chip over magnetic stripe up to the point where magnetic stripe transaction is only allowed as a fallback after chip is found to be inoperable. So on a well implemented terminal you have to try chip first and only if it doesn't work the terminal should allow you to try with magstripe, if the magstripe says that the card is chip-capable. Additionally, Visa and Mastercard both monitor rates of fallbacks (situations where magstripe is used with chip-capable cards) and issues penalties to entities that cross specific thresholds.
  - tialaramex 6y ago
    > At every step Visa and MasterCard promotes highest possible level of security. No doubt you've drunk the Kool-Aid but this isn't true. EMV rests heavily upon cryptographic protocols, we know the highest possible level of security is achieved for such protocols by publishing them for evaluation and improvement by independent researchers. EMV didn't do that. There are many but here's a particularly low hanging piece of fruit that results from not having independent researchers looking over what you've done: It is critical to the EMV design that the payment terminal picks unpredictable numbers. These aren't just nonces, where it only matters that they're different, they must be random or a relatively cheap (worth doing to forge credit card transactions) attack succeeds. So what do you suppose those standards documents require? You might even have read it. The certification document says for testing read two of these "unpredictable" values. Ensure they are different. Guess what lots of real hardware actually deployed in the wild does to achieve that requirement? It uses a counter. Because random numbers might sometimes not be different leading to a tiny chance of failing the mandatory test, but a counter will reliably pass the test even though it's insecure. Genius. So you go from "Hypothetical adversary needs to guess a large random number" to "It's just a counter" and attack cost falls from billions of dollars to a few cents per transaction on top of R&D.
m463 6y ago
There is one fundamental difference between credit cards in the US vs the rest of the world. The United States has legislation protecting credit card holders. It limits out-of-pocket expenses for any fraud to $50. In practical terms, you notify your credit card company and they just remove the charge and there is no cost and very little hassle or drama. A similar situation is probably car insurance and car theft. I think because we have car insurance, we probably have higher levels of car theft. It has probably become sort of decriminalized because the harm is likely less and the insurance companies treat it as a cost of doing business. Meanwhile 200 years ago horse thieves, who were probably not caught, did real damage to people even though the penalties of being caught was probably hanging.
- lmilcin 6y ago
  See my other reply, I was actually my job to know this stuff. As to fraud, you might be misunderstanding this. There are different types of fraud and not all are covered the same. I don't know US legislation, but what you should know, legislation or not, Visa and Mastercard offer chargeback program (don't mistake with cashback) where you can notify your bank when the transaction was not authorized by you or when you have authorized but not received the service or the goods or services did not agree with the what you agreed with the merchant (ie. when you got blue shirt when ordered green one). This is NO QUESTIONS ASKED, ie. now it is up to the Merchant to prove that they are in the right and if they can't prove it, you are credited with the amount automatically. Now, this happens when the transaction happened through Visa/Mastercard network. When you are using the card at ATM this is fundamentally different thing. The ATM is most likely operated by your own bank or through an agreement with some other entity that is not Visa/Mastercard. You can think of this, that the card functions as an identifier that can be used to run transactions using completely different systems.
  - m463 6y ago
    If you use your card at an ATM there is a pin. Also there are a different kind of card called a debit cards (or an atm card). These are not credit cards and withdraw money from your bank account. They require a pin as well. You can use a debit card to purchase something at a point of sale - but you must give a pin. The money is taken from your bank account (and visa/mastercard are involved) However the vast majority of point of sale transactions are credit card transactions and go through the visa/mastercard network. I used to have a debit card (decades ago) and had one fraudulent transaction. I called my bank, they credited me the money, investigated, and then made it final.

deleted 6y ago

[deleted]

SOLAR_FIELDS 6y ago

I thought (but don’t quote me on this) it was actually Visa and MasterCard that campaigned to keep chip-and-signature over chip-and-pin so that they could charge higher fees for “fraud prevention”. Which I find a bit amusing as I’ve been signing my card transactions with a literal smiley face as of late.

lmilcin 6y ago
Well, as a guy who spend couple of years actually implementing chip & pin terminal credit card application from scratch, for a Polish acquirer, and a security officer at the same company, who had to read and internalize 17 thousand pages of documentation from Visa, Mastercard, PCI and EMV to do so, I can confidently say this is complete and utter nonsense (and it already was 10 years ago when I have stopped working with credit cards). At every step Visa and MasterCard promotes highest possible level of security. To give you an example, when implementing the terminal application you have to be able to support a range of CVMs (Cardholder Verification Methods) that might be presented by the card. The CVM list is a detail personalized on the card by the Bank, issuer of the card. The algorithm actively promotes selecting the strongest authentication method that is supported by the card and always prefers PIN over signature (ie if PIN CVM is available it should not be possible to normally use signature). This is verified during certification process and applications that don't meet this requirement fail certification. There are also rules and internal memos which are sent to both acquirers and issuers, to which I have been privy to, which exert pressure on issuers to improve their security to deal with frauds. We were also regularly notified on new types of frauds detected and how to help preventing them. The terminal application should also always prefers chip over magnetic stripe up to the point where magnetic stripe transaction is only allowed as a fallback after chip is found to be inoperable. So on a well implemented terminal you have to try chip first and only if it doesn't work the terminal should allow you to try with magstripe, if the magstripe says that the card is chip-capable. Additionally, Visa and Mastercard both monitor rates of fallbacks (situations where magstripe is used with chip-capable cards) and issues penalties to entities that cross specific thresholds.
- tialaramex 6y ago
  > At every step Visa and MasterCard promotes highest possible level of security. No doubt you've drunk the Kool-Aid but this isn't true. EMV rests heavily upon cryptographic protocols, we know the highest possible level of security is achieved for such protocols by publishing them for evaluation and improvement by independent researchers. EMV didn't do that. There are many but here's a particularly low hanging piece of fruit that results from not having independent researchers looking over what you've done: It is critical to the EMV design that the payment terminal picks unpredictable numbers. These aren't just nonces, where it only matters that they're different, they must be random or a relatively cheap (worth doing to forge credit card transactions) attack succeeds. So what do you suppose those standards documents require? You might even have read it. The certification document says for testing read two of these "unpredictable" values. Ensure they are different. Guess what lots of real hardware actually deployed in the wild does to achieve that requirement? It uses a counter. Because random numbers might sometimes not be different leading to a tiny chance of failing the mandatory test, but a counter will reliably pass the test even though it's insecure. Genius. So you go from "Hypothetical adversary needs to guess a large random number" to "It's just a counter" and attack cost falls from billions of dollars to a few cents per transaction on top of R&D.

m463 6y ago

There is one fundamental difference between credit cards in the US vs the rest of the world. The United States has legislation protecting credit card holders. It limits out-of-pocket expenses for any fraud to $50. In practical terms, you notify your credit card company and they just remove the charge and there is no cost and very little hassle or drama. A similar situation is probably car insurance and car theft. I think because we have car insurance, we probably have higher levels of car theft. It has probably become sort of decriminalized because the harm is likely less and the insurance companies treat it as a cost of doing business. Meanwhile 200 years ago horse thieves, who were probably not caught, did real damage to people even though the penalties of being caught was probably hanging.

lmilcin 6y ago
See my other reply, I was actually my job to know this stuff. As to fraud, you might be misunderstanding this. There are different types of fraud and not all are covered the same. I don't know US legislation, but what you should know, legislation or not, Visa and Mastercard offer chargeback program (don't mistake with cashback) where you can notify your bank when the transaction was not authorized by you or when you have authorized but not received the service or the goods or services did not agree with the what you agreed with the merchant (ie. when you got blue shirt when ordered green one). This is NO QUESTIONS ASKED, ie. now it is up to the Merchant to prove that they are in the right and if they can't prove it, you are credited with the amount automatically. Now, this happens when the transaction happened through Visa/Mastercard network. When you are using the card at ATM this is fundamentally different thing. The ATM is most likely operated by your own bank or through an agreement with some other entity that is not Visa/Mastercard. You can think of this, that the card functions as an identifier that can be used to run transactions using completely different systems.
- m463 6y ago
  If you use your card at an ATM there is a pin. Also there are a different kind of card called a debit cards (or an atm card). These are not credit cards and withdraw money from your bank account. They require a pin as well. You can use a debit card to purchase something at a point of sale - but you must give a pin. The money is taken from your bank account (and visa/mastercard are involved) However the vast majority of point of sale transactions are credit card transactions and go through the visa/mastercard network. I used to have a debit card (decades ago) and had one fraudulent transaction. I called my bank, they credited me the money, investigated, and then made it final.