4 ms·

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring

> 2. (As mentioned in the article) issuers accept transactions from EMV (chip)-capable readers that nominally originate from EMV-capable cards without requiring the chip to be used. Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". > 3. The information leaked in #1 is enough to buy things online (as long as the CVV2 can be found or guessed). Wtf? 3DSecure is a thing and its job is to prevent this exact situation. So credit card security is comically poor, but only in the US. You were somehow still using the magstripe until recently and probably still do sometimes at places that didn't upgrade their readers in time.

iudqnolq 4y ago
> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". I think it's configurable depending on merchant risk tolerance. I've seen cases where the terminal lets you swipe after three failed chip reads, for example.
- pinko 4y ago
  Almost every terminal will fall back to mag-swipe if the chip fails to read 3 times. I had an Amex with a faulty chip and had to do this every time. Terminal (every single one) would refuse to allow me to pay with a swipe initially, insisting on chip -- but once the chip failed 3 times, they'd all happily take the swipe.
  - kalleboo 4y ago
    The terminal may try, but in Europe since about a decade ago most card issuers will reject stripe transactions on a terminal with a chip reader when the card also has a chip, to prevent downgrade attacks.
    - pinko 4y ago
      Ah yes, my comment was totally US-centric, which is dumb of me.
hamburglar 4y ago
> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". The problem is that the way the terminal knows "this card has a chip" is that information is encoded on the magstripe. So rewriting the magstripe can just disable that functionality. I assume the merchant could configure their terminals to insist on using the chip no matter what, but it's extremely rare in the US. One thing I don't get is how other countries require chip+pin for all transactions, but a high percentage of the US terminals I read are comically unreliable for using the chip. If we switched to "always require chip", half my typical transactions would fail because of broken chip readers. Why is there such a discrepancy in the quality of the terminals here vs elsewhere?
- grishka 4y ago
  Huh? I don't know what's the situation now because I hardly use the chip any more, I mostly tap (the card itself, we no longer have Google Pay), but I don't remember a single time when the chip wouldn't work. The terminals around here look like any mass-produced electronic device, nothing special about them. Though they are old — I do sometimes see newer fancier all-touchscreen ones when I travel to other countries. There's also one weird model with a secondary keypad on a curly cable that they usually put on the counter, with the main unit somewhere out of sight. It has a small screen and can accept taps. But if you want to use the chip, you have to hand your card over to the cashier to have them insert it into the main unit. > So rewriting the magstripe can just disable that functionality. That feels strange to me. If I were designing this protocol, it'd have to first ask the issuing bank whether using the magstripe is ok.
  - deleted 4y ago
    [deleted]
  - hamburglar 4y ago
    > Huh? I don't know what's the situation now because I hardly use the chip any more, I mostly tap (the card itself, we no longer have Google Pay), but I don't remember a single time when the chip wouldn't work. Wow. My main card doesn't have tap capability, so I'm forced to use the chip all the time. Read failures are extremely common. I even have my own protocol for when it fails: take it out and shove it back in while holding it firmly to the left edge of the slot. If that doesn't work, try again holding it against the right edge of the slot. Sometimes, it's just sloppy alignment in the slot and doing one of those will fix it. If normal, left-aligned and right-aligned all fail, that makes three attempts so the machine will give up and have you swipe it anyway.
toast0 4y ago
> 3DSecure is a thing and its job is to prevent this exact situation. 3DSecure ticks all the boxes for what you're not supposed to do. Popup window: check, put in your banking username and password while using a merchant site, not your bank's site: check. I think I've seen a 3dsecure prompt once, maybe twice. I tried to enable it so I could buy fron Aliexpress without calling my card issuer and asking them to turn off all fraud protection on my account for an hour, but that still doesn't work, when I want weird junk direct, gotta call in.
- justsomehnguy 4y ago
  > 3DSecure ticks all the boxes for what you're not supposed to do If your bank implemented it that way. My 3DSecure prompts just asks for a confirmation code, which is sent via SMS or an app on the phone. No creds.
  - robin_reala 4y ago
    Other verification methods I’ve seen: specific characters from a 3DS-specific password (old nationwide.co.uk), in-app approval notification (wise.com), Swedish BankID app verification (ICA banken, Handelsbanken).
  - grishka 4y ago
    Yeah wtf. This is the only implementation I've seen, so I assumed they're all like that.

iudqnolq 4y ago

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". I think it's configurable depending on merchant risk tolerance. I've seen cases where the terminal lets you swipe after three failed chip reads, for example.

pinko 4y ago
Almost every terminal will fall back to mag-swipe if the chip fails to read 3 times. I had an Amex with a faulty chip and had to do this every time. Terminal (every single one) would refuse to allow me to pay with a swipe initially, insisting on chip -- but once the chip failed 3 times, they'd all happily take the swipe.
- kalleboo 4y ago
  The terminal may try, but in Europe since about a decade ago most card issuers will reject stripe transactions on a terminal with a chip reader when the card also has a chip, to prevent downgrade attacks.
  - pinko 4y ago
    Ah yes, my comment was totally US-centric, which is dumb of me.

hamburglar 4y ago

> Last time I tried swiping my card — and that was ages ago — the terminal displayed something to the effect of "this card has a chip, please insert the chip". The problem is that the way the terminal knows "this card has a chip" is that information is encoded on the magstripe. So rewriting the magstripe can just disable that functionality. I assume the merchant could configure their terminals to insist on using the chip no matter what, but it's extremely rare in the US. One thing I don't get is how other countries require chip+pin for all transactions, but a high percentage of the US terminals I read are comically unreliable for using the chip. If we switched to "always require chip", half my typical transactions would fail because of broken chip readers. Why is there such a discrepancy in the quality of the terminals here vs elsewhere?

grishka 4y ago
Huh? I don't know what's the situation now because I hardly use the chip any more, I mostly tap (the card itself, we no longer have Google Pay), but I don't remember a single time when the chip wouldn't work. The terminals around here look like any mass-produced electronic device, nothing special about them. Though they are old — I do sometimes see newer fancier all-touchscreen ones when I travel to other countries. There's also one weird model with a secondary keypad on a curly cable that they usually put on the counter, with the main unit somewhere out of sight. It has a small screen and can accept taps. But if you want to use the chip, you have to hand your card over to the cashier to have them insert it into the main unit. > So rewriting the magstripe can just disable that functionality. That feels strange to me. If I were designing this protocol, it'd have to first ask the issuing bank whether using the magstripe is ok.
- deleted 4y ago
  [deleted]
- hamburglar 4y ago
  > Huh? I don't know what's the situation now because I hardly use the chip any more, I mostly tap (the card itself, we no longer have Google Pay), but I don't remember a single time when the chip wouldn't work. Wow. My main card doesn't have tap capability, so I'm forced to use the chip all the time. Read failures are extremely common. I even have my own protocol for when it fails: take it out and shove it back in while holding it firmly to the left edge of the slot. If that doesn't work, try again holding it against the right edge of the slot. Sometimes, it's just sloppy alignment in the slot and doing one of those will fix it. If normal, left-aligned and right-aligned all fail, that makes three attempts so the machine will give up and have you swipe it anyway.

toast0 4y ago

> 3DSecure is a thing and its job is to prevent this exact situation. 3DSecure ticks all the boxes for what you're not supposed to do. Popup window: check, put in your banking username and password while using a merchant site, not your bank's site: check. I think I've seen a 3dsecure prompt once, maybe twice. I tried to enable it so I could buy fron Aliexpress without calling my card issuer and asking them to turn off all fraud protection on my account for an hour, but that still doesn't work, when I want weird junk direct, gotta call in.

justsomehnguy 4y ago
> 3DSecure ticks all the boxes for what you're not supposed to do If your bank implemented it that way. My 3DSecure prompts just asks for a confirmation code, which is sent via SMS or an app on the phone. No creds.
- robin_reala 4y ago
  Other verification methods I’ve seen: specific characters from a 3DS-specific password (old nationwide.co.uk), in-app approval notification (wise.com), Swedish BankID app verification (ICA banken, Handelsbanken).
- grishka 4y ago
  Yeah wtf. This is the only implementation I've seen, so I assumed they're all like that.