9 ms·

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses?

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, businesses have portable readers. The card companies just sent them new readers and they were accepting chips overnight. Same when NFC was introduced. The US payment and banking systems are truly maddening.

bobsmooth 4y ago
It's because of tiny gas stations in the middle of nowhere.
- Mister_Snuggles 4y ago
  Gas stations are interesting here. Here in Alberta, it's the law that you need to pay before you pump[0]. If you're at a modern pump you insert your card, it does a preauth for some amount (you can select common amounts, like $20 of fuel, or "fill up" which is like $125 or $250 depending on the station), then when you're done it does a purchase for the exact amount. If you're not at a modern pump, or you're paying cash, you have to go into the store, prepay for something that you think will fill your tank, fill your car, then go back into the store and get your change. [0] https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-victims-loved-ones-welcome-alberta-s-mandatory-prepay-legislation-1.3952349 https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-v...
  - aidenn0 4y ago
    US is the same, except the pre-auth is set by the gas station owner, so you may need to go inside to pay with a debit card with less than that amount, and large trucks need two transactions to fill up
- dymk 4y ago
  USPS delivers to them, guaranteed
  - derefr 4y ago
    Delivers... new gas pumps? Because often with self-serve pumps, the pump and the card reader are one-and-the-same. Probably modular in some internal sense, but not with an expectation of owner serviceability; more "call the manufacturer" serviceability.
    - dymk 4y ago
      Delivers card readers... Gas pumps aren't a single monolithic unit.
- jdeibele 4y ago
  I added some gas in Frenchglen, Oregon. Population 11. You went into the store, told the clerk (owner in this case, I'm sure) that you wanted gas, she turned on the pump, then you took a photo with your phone and took it back to her so she could charge you. $6.75/gallon, which was about $2 more than in Burns (population 2766). She didn't have any problem taking a chipped card but I imagine there are self-serve places that can't. It was only in 2018 that Oregon allowed self-serve in counties with less than 40,000 people. 17 of the 36 counties qualify. The advice I've seen with credit cards seems to be "always tap if you can" since that's not subject to skimming or stealing a PIN.
- inquirerGeneral 4y ago
  There are not many anymore without a CHIP reader, because VISA and Mastercard FINALLY stopped the delay of shifting liability for all fraud to the individual gas station in summer 2021.
  - kevin_thibedeau 4y ago
    All my local stations are still on mag stripes.
    - ThePowerOfFuet 4y ago
      > All my local stations are still on mag stripes. Then they continue to be part of the problem (and liability for fraud is on them).
Mister_Snuggles 4y ago
When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virtual non-event. When the credit card companies moved the issuing banks had to issue PINs, but everyone already knew the mechanics of using it. The most interesting part is that the US already has the infrastructure to support this. I went to a Walmart in the US and paying with my Canadian credit card worked EXACTLY like it does in Canada - insert card, confirm amount, enter PIN, done. The cashier was a little confused that I didn't need to sign for it, but ultimately they just went with it. The introduction of NFC was a similar non-event.
- derefr 4y ago
  The problem is that there's no equivalent party in the "infrastructure" position in the US that Interac occupies in Canada. There's just 500 different state-level banks, who all license different companies to make their ATM cards. (This is the same reason it took so long for the US to get past two-day ACH settlement.)
  - cmeacham98 4y ago
    For the purposes of accepting these cards as payment (which seems to be a much more common skimmer threat, for example at gas pumps) don't MasterCard and Visa fill this role?
- canadianwatcher 4y ago
  "When Canada" I want to call out this country wide edict. I've seen this done in both the United States and Canada. I do not know your personal situation, but I'm fairly sure it wasn't across the entire country of Canada.
  - ThePowerOfFuet 4y ago
    It sure was.
theshrike79 4y ago
> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Over here they just moved the burden of fraudulent transactions to the merchant if they still swiped instead of using the chip. Shops upgraded their equipment real f'n fast.
- HWR_14 4y ago
  That's what they did in the US as well. Although maybe that's what you meant.
mepiethree 4y ago
> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks
- kibibyte 4y ago
  With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062 https://news.ycombinator.com/item?id=28207062
  - ki85squared 4y ago
    Thank you for this. How much of an impact is this having 1+ years on? I'm sure it's still substantial but wanted to ask if you had any current data.
  - pinebox 4y ago
    Thanks, but the post you linked is making me irrationally angry. Why does a gas pump card reader need full internet connectivity?! It's outrageous! Just use the two wires to talk to a head unit in the building! Then it brings up the gas pump advertising screens which are already a sore point for me (two conveniently located stations have these, so I can't go there anymore because I find the accompanying audio intolerable). The whole situation smells like it involves a lot of vendor lock-in, too (which I always hate to see).
    - kibibyte 4y ago
      EMV is a very very chatty protocol, basically.
- qazxcvbnmlp 4y ago
  > Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.
tehaugmenter 4y ago
What is scary though is how easily the rfid can be read off of a person. It's a great thing to have but card issuers should include some kind of protective sleeve with every card rather than relying on the consumer to be both aware of and able to use an rfid blocking wallet.
- kibibyte 4y ago
  Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.
  - mcv 4y ago
    If payment can be authorized through the chip by mere proximity, without any explicit authorization by the owner, then it's still insecure. Of course the thief would need to have an official payment terminal, but those are everywhere. I use my app, not my card, for this reason.
    - kibibyte 4y ago
      Technically yes you are correct, but the threat model here is similar to someone grabbing a card from you and dipping it into a terminal chip reader without your permission. This is what the PIN part of chip-and-PIN protects against; the chip part (also applicable to EMV contactless) protects against card duplication and transaction replay. There is a huge difference between this kind of attack and what an attacker can do with the old scheme of magnetic swipe data over RFID. With the former, the only thing an attacker can do is perform a real transaction in that moment; this transaction leaves behind an audit trail tied to a real merchant (the operator of the terminal) and their bank account. An attacker cannot, however, initiate additional payments without accessing the payment card again, and without access to the cryptographic secrets held by the payment service provider, they cannot extract the card number to use for online transactions. With the latter, it's equivalent to skimming a the magnetic stripe: an attacker can clone the card and reuse it for transactions as often as they'd like for whatever amounts they can authorize. In addition, they will have access to the plaintext card number, which would allow them to use it for online transactions. And absolutely none of this leaves behind an audit trail of how the attacker got your card.
gumby 4y ago
Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.
- trasz 4y ago
  NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.
  - aembleton 4y ago
    NFC means I can pay with my watch. I think in China they rely upon phone cameras and QR codes. Great if you've got your phone with you, but I can go out for a run with just my watch and pay using NFC.
    - fennecfoxy 4y ago
      Yeah this is what I do, taking my watch out for a run and being able to track my run, etc. Then being able to stop at a shop on the way back for a cold drink or to pick up some groceries and just pay with the watch is so convenient. Sucks that everything else about smart watches sucks tho. Thanks to Apple making the "pretty" Apple watch, other brands have forgone things like eink/mip displays that get better battery life. :/
  - ginko 4y ago
    NFC seems strictly better than QR code payments to me.
Closi 4y ago
> Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Alternatively - do what Monzo does in the UK and issue cards with a magnetic stripe that is disabled in the backend by default. If you try to use the magnetic stripe, it sends you an alert that says "Someone (possibly you) tried to pay using the magnetic stripe. Do you want to allow the magnetic stripe for the next hour?" Then if you travel to a country that relies on magnetic stripe, similarly it sends you a message saying "You have travelled to X - sometimes you may need to enable the magnetic stripe in order to use an ATM. Do you want to temporarily enable the magnetic stripe?"
Merad 4y ago
This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change.
- ThePowerOfFuet 4y ago
  > This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change. In Europe you can buy card terminals for €30 with no monthly fee, and you don't even have to be a registered business entity. Now that I check, that same company exists in the US too: https://sumup.com/ https://sumup.com/
  - gtirloni 4y ago
    > great many self storage companies are mom and pop operations that only have one or two locations Exactly the type of company that should be getting one of those portable card readers that can be easily replaced. It can't be harder to enter an amount in the device and ask the customer to insert card and type pin than typing numbers or swiping many times, getting signatures, etc.
  - Merad 4y ago
    We're talking about people often in their 60s or 70s who quite literally hate technology and don't want to spend any money on it unless someone puts a gun to their head. Seriously, the company I worked for had dropped support for windows XP before I ever started there, but they still had some customers running it when I left (this year). From the POV of these small business owners that Sumup terminal doesn't do anything to help them and if anything makes their life harder. It won't integrate with their business management software (our product) and most likely will have higher transaction fees than their current payment processor. The company I was with offered EMV terminals that were fully integrated with the management software (I helped write the integration), but there wasn't a lot of interest in them outside of larger companies. The small guys in general don't have a lot of incentive to care about information security. One of the other projects I worked on was migrating the management software from using encrypted CC numbers stored in its database to using tokens. When we took away the ability for users to unmask and view the full CC number some of them started saving saving card numbers in the plain text customer info fields (address, etc.).
jamesbfb 4y ago
I’m in Australia and an American friend who is visiting was shocked at how nearly everywhere from small cafes to supermarkets all support payments with Apple/Google pay and tap and go.
- JohnFen 4y ago
  Pretty much everywhere I go in the US supports these as well. I rarely see anyone use them, though.
FuriouslyAdrift 4y ago
After the Target breach, the laws were finally changed and chip and signature was rolled out. The deal with processors is this: if you use chip + PIN or sig and there is fraud, it's on the processor (Visa/Mastercard, etc) if you use swipe, it's on the retailer directly.
aunterste 4y ago
maddening maybe, but because of the simple equation that the fraud losses from continuing to use swipe and issue cards without chip are high, but the margins on credit cards, due to the high rates are high enough to cover it. Carrying a balance on a credit card in Europe and South America is not very common (your account bank will grant a decently priced overdraft facility (not the crazy US fees there), rebates/points/miles are lower - so it just pays to be complacent here for the industry.
JohnFen 4y ago
I just got a replacement card from my bank. It still has no chip in it.
- stolsvik 4y ago
  Wow. May I ask what country and what bank? Do you know why they do this?

bobsmooth 4y ago

It's because of tiny gas stations in the middle of nowhere.

Mister_Snuggles 4y ago
Gas stations are interesting here. Here in Alberta, it's the law that you need to pay before you pump[0]. If you're at a modern pump you insert your card, it does a preauth for some amount (you can select common amounts, like $20 of fuel, or "fill up" which is like $125 or $250 depending on the station), then when you're done it does a purchase for the exact amount. If you're not at a modern pump, or you're paying cash, you have to go into the store, prepay for something that you think will fill your tank, fill your car, then go back into the store and get your change. [0] https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-victims-loved-ones-welcome-alberta-s-mandatory-prepay-legislation-1.3952349 https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-v...
- aidenn0 4y ago
  US is the same, except the pre-auth is set by the gas station owner, so you may need to go inside to pay with a debit card with less than that amount, and large trucks need two transactions to fill up
dymk 4y ago
USPS delivers to them, guaranteed
- derefr 4y ago
  Delivers... new gas pumps? Because often with self-serve pumps, the pump and the card reader are one-and-the-same. Probably modular in some internal sense, but not with an expectation of owner serviceability; more "call the manufacturer" serviceability.
  - dymk 4y ago
    Delivers card readers... Gas pumps aren't a single monolithic unit.
jdeibele 4y ago
I added some gas in Frenchglen, Oregon. Population 11. You went into the store, told the clerk (owner in this case, I'm sure) that you wanted gas, she turned on the pump, then you took a photo with your phone and took it back to her so she could charge you. $6.75/gallon, which was about $2 more than in Burns (population 2766). She didn't have any problem taking a chipped card but I imagine there are self-serve places that can't. It was only in 2018 that Oregon allowed self-serve in counties with less than 40,000 people. 17 of the 36 counties qualify. The advice I've seen with credit cards seems to be "always tap if you can" since that's not subject to skimming or stealing a PIN.
inquirerGeneral 4y ago
There are not many anymore without a CHIP reader, because VISA and Mastercard FINALLY stopped the delay of shifting liability for all fraud to the individual gas station in summer 2021.
- kevin_thibedeau 4y ago
  All my local stations are still on mag stripes.
  - ThePowerOfFuet 4y ago
    > All my local stations are still on mag stripes. Then they continue to be part of the problem (and liability for fraud is on them).

Mister_Snuggles 4y ago

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virtual non-event. When the credit card companies moved the issuing banks had to issue PINs, but everyone already knew the mechanics of using it. The most interesting part is that the US already has the infrastructure to support this. I went to a Walmart in the US and paying with my Canadian credit card worked EXACTLY like it does in Canada - insert card, confirm amount, enter PIN, done. The cashier was a little confused that I didn't need to sign for it, but ultimately they just went with it. The introduction of NFC was a similar non-event.

derefr 4y ago
The problem is that there's no equivalent party in the "infrastructure" position in the US that Interac occupies in Canada. There's just 500 different state-level banks, who all license different companies to make their ATM cards. (This is the same reason it took so long for the US to get past two-day ACH settlement.)
- cmeacham98 4y ago
  For the purposes of accepting these cards as payment (which seems to be a much more common skimmer threat, for example at gas pumps) don't MasterCard and Visa fill this role?
canadianwatcher 4y ago
"When Canada" I want to call out this country wide edict. I've seen this done in both the United States and Canada. I do not know your personal situation, but I'm fairly sure it wasn't across the entire country of Canada.
- ThePowerOfFuet 4y ago
  It sure was.

theshrike79 4y ago

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Over here they just moved the burden of fraudulent transactions to the merchant if they still swiped instead of using the chip. Shops upgraded their equipment real f'n fast.

HWR_14 4y ago
That's what they did in the US as well. Although maybe that's what you meant.

mepiethree 4y ago

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

kibibyte 4y ago
With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062 https://news.ycombinator.com/item?id=28207062
- ki85squared 4y ago
  Thank you for this. How much of an impact is this having 1+ years on? I'm sure it's still substantial but wanted to ask if you had any current data.
- pinebox 4y ago
  Thanks, but the post you linked is making me irrationally angry. Why does a gas pump card reader need full internet connectivity?! It's outrageous! Just use the two wires to talk to a head unit in the building! Then it brings up the gas pump advertising screens which are already a sore point for me (two conveniently located stations have these, so I can't go there anymore because I find the accompanying audio intolerable). The whole situation smells like it involves a lot of vendor lock-in, too (which I always hate to see).
  - kibibyte 4y ago
    EMV is a very very chatty protocol, basically.
qazxcvbnmlp 4y ago
> Who are these businesses? Airline ticket counters… Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad. Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

tehaugmenter 4y ago

What is scary though is how easily the rfid can be read off of a person. It's a great thing to have but card issuers should include some kind of protective sleeve with every card rather than relying on the consumer to be both aware of and able to use an rfid blocking wallet.

kibibyte 4y ago
Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.
- mcv 4y ago
  If payment can be authorized through the chip by mere proximity, without any explicit authorization by the owner, then it's still insecure. Of course the thief would need to have an official payment terminal, but those are everywhere. I use my app, not my card, for this reason.
  - kibibyte 4y ago
    Technically yes you are correct, but the threat model here is similar to someone grabbing a card from you and dipping it into a terminal chip reader without your permission. This is what the PIN part of chip-and-PIN protects against; the chip part (also applicable to EMV contactless) protects against card duplication and transaction replay. There is a huge difference between this kind of attack and what an attacker can do with the old scheme of magnetic swipe data over RFID. With the former, the only thing an attacker can do is perform a real transaction in that moment; this transaction leaves behind an audit trail tied to a real merchant (the operator of the terminal) and their bank account. An attacker cannot, however, initiate additional payments without accessing the payment card again, and without access to the cryptographic secrets held by the payment service provider, they cannot extract the card number to use for online transactions. With the latter, it's equivalent to skimming a the magnetic stripe: an attacker can clone the card and reuse it for transactions as often as they'd like for whatever amounts they can authorize. In addition, they will have access to the plaintext card number, which would allow them to use it for online transactions. And absolutely none of this leaves behind an audit trail of how the attacker got your card.

gumby 4y ago

Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.

trasz 4y ago
NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.
- aembleton 4y ago
  NFC means I can pay with my watch. I think in China they rely upon phone cameras and QR codes. Great if you've got your phone with you, but I can go out for a run with just my watch and pay using NFC.
  - fennecfoxy 4y ago
    Yeah this is what I do, taking my watch out for a run and being able to track my run, etc. Then being able to stop at a shop on the way back for a cold drink or to pick up some groceries and just pay with the watch is so convenient. Sucks that everything else about smart watches sucks tho. Thanks to Apple making the "pretty" Apple watch, other brands have forgone things like eink/mip displays that get better battery life. :/
- ginko 4y ago
  NFC seems strictly better than QR code payments to me.

Closi 4y ago

> Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Alternatively - do what Monzo does in the UK and issue cards with a magnetic stripe that is disabled in the backend by default. If you try to use the magnetic stripe, it sends you an alert that says "Someone (possibly you) tried to pay using the magnetic stripe. Do you want to allow the magnetic stripe for the next hour?" Then if you travel to a country that relies on magnetic stripe, similarly it sends you a message saying "You have travelled to X - sometimes you may need to enable the magnetic stripe in order to use an ATM. Do you want to temporarily enable the magnetic stripe?"

Merad 4y ago

This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change.

ThePowerOfFuet 4y ago
> This spring I left a job working with payments in a SaaS for the self storage industry. I don't remember exact numbers but the overwhelming majority of the card present payments we processed were either keyed by hand or swiped with a magtek reader. A great many self storage companies are mom and pop operations that only have one or two locations, often run by retirees to supplement their retirement income. Needless to say they (and the industry as a whole) are highly resistant to change. In Europe you can buy card terminals for €30 with no monthly fee, and you don't even have to be a registered business entity. Now that I check, that same company exists in the US too: https://sumup.com/ https://sumup.com/
- gtirloni 4y ago
  > great many self storage companies are mom and pop operations that only have one or two locations Exactly the type of company that should be getting one of those portable card readers that can be easily replaced. It can't be harder to enter an amount in the device and ask the customer to insert card and type pin than typing numbers or swiping many times, getting signatures, etc.
- Merad 4y ago
  We're talking about people often in their 60s or 70s who quite literally hate technology and don't want to spend any money on it unless someone puts a gun to their head. Seriously, the company I worked for had dropped support for windows XP before I ever started there, but they still had some customers running it when I left (this year). From the POV of these small business owners that Sumup terminal doesn't do anything to help them and if anything makes their life harder. It won't integrate with their business management software (our product) and most likely will have higher transaction fees than their current payment processor. The company I was with offered EMV terminals that were fully integrated with the management software (I helped write the integration), but there wasn't a lot of interest in them outside of larger companies. The small guys in general don't have a lot of incentive to care about information security. One of the other projects I worked on was migrating the management software from using encrypted CC numbers stored in its database to using tokens. When we took away the ability for users to unmask and view the full CC number some of them started saving saving card numbers in the plain text customer info fields (address, etc.).

jamesbfb 4y ago

I’m in Australia and an American friend who is visiting was shocked at how nearly everywhere from small cafes to supermarkets all support payments with Apple/Google pay and tap and go.

JohnFen 4y ago
Pretty much everywhere I go in the US supports these as well. I rarely see anyone use them, though.

FuriouslyAdrift 4y ago

After the Target breach, the laws were finally changed and chip and signature was rolled out. The deal with processors is this: if you use chip + PIN or sig and there is fraud, it's on the processor (Visa/Mastercard, etc) if you use swipe, it's on the retailer directly.

aunterste 4y ago

maddening maybe, but because of the simple equation that the fraud losses from continuing to use swipe and issue cards without chip are high, but the margins on credit cards, due to the high rates are high enough to cover it. Carrying a balance on a credit card in Europe and South America is not very common (your account bank will grant a decently priced overdraft facility (not the crazy US fees there), rebates/points/miles are lower - so it just pays to be complacent here for the industry.

JohnFen 4y ago

I just got a replacement card from my bank. It still has no chip in it.

stolsvik 4y ago
Wow. May I ask what country and what bank? Do you know why they do this?