5 ms·

> There are two systems at work here, the credit system and the ATM system. The latter uses a PIN (no chip, so basically online verification) but the primary di

by pisarzp 13y ago

> There are two systems at work here, the credit system and the ATM system. The latter uses a PIN (no chip, so basically online verification) but the primary difference is related to chargebacks and fraud. Like in the UK, in a PIN system if I know your PIN and get your card I can loot your account and you are SOL. In the US a credit card transaction with a signature but no PIN means that the merchant is on the hook for fraud. If I get your card number and go on a spending spree you are not going to take a hit for any of the charges, the merchants are. That is absolutely true. However thanks to chip, cards cannot be copied or forged. Therefore merchants are paying lower commissions on debit/credit card payments as there are fewer fraudulent transactions. Some merchants are even declining to accept non chip-and-pin cards (not sure if is legal though).

evgen 13y ago
Be careful about using works like "cannot" in terms of what is possible to trust regarding hardware that is in possession of a potentially adversarial party and systems that assume said cards are secure. There are a variety of attacks that are possible (pre-play, attacks that can make a stolen card work without a PIN, etc.) and it is likely that in the future it will be easier to perform these attacks. It is a standard risk/convenience continuum and everyone has staked out a different portion of that zone. In the US the merchant pays a lower commission on debit card (e.g. with PIN) transactions as well for the same reasons, which is why they will tend to suggest that option or offer it up as the default when you use a card that can be either debit or credit. When I suggested that there were only two systems I was simplifying a bit too much and you definitely caught me on that one. In most places it seems that there are two (and sometimes three depending on how mobile phone payments are cleared) dominant e-payment formats, one which puts the fraud burden on the merchant and one that puts it on the customer. The size of the burden is usually set by regulation and the level that this is set at tends to inform the nature of the security at the endpoints vs. what happens at the middle when clearing and reconciling transactions.
SyneRyder 13y ago
"Some merchants are even declining to accept non chip-and-pin cards (not sure if is legal though)." If you travel to Sweden, you can't even use credit cards that are non chip-and-pin. I even went to one store that refused to accept cash: you had to use a chip-enabled credit card. In Australia, NFC wireless transactions (Visa PayWave / Mastercard Paypass) are gaining traction for purchases under $100. It's very convenient & usually fast.

by pisarzp 13y ago

evgen 13y ago

Be careful about using works like "cannot" in terms of what is possible to trust regarding hardware that is in possession of a potentially adversarial party and systems that assume said cards are secure. There are a variety of attacks that are possible (pre-play, attacks that can make a stolen card work without a PIN, etc.) and it is likely that in the future it will be easier to perform these attacks. It is a standard risk/convenience continuum and everyone has staked out a different portion of that zone. In the US the merchant pays a lower commission on debit card (e.g. with PIN) transactions as well for the same reasons, which is why they will tend to suggest that option or offer it up as the default when you use a card that can be either debit or credit. When I suggested that there were only two systems I was simplifying a bit too much and you definitely caught me on that one. In most places it seems that there are two (and sometimes three depending on how mobile phone payments are cleared) dominant e-payment formats, one which puts the fraud burden on the merchant and one that puts it on the customer. The size of the burden is usually set by regulation and the level that this is set at tends to inform the nature of the security at the endpoints vs. what happens at the middle when clearing and reconciling transactions.

SyneRyder 13y ago

"Some merchants are even declining to accept non chip-and-pin cards (not sure if is legal though)." If you travel to Sweden, you can't even use credit cards that are non chip-and-pin. I even went to one store that refused to accept cash: you had to use a chip-enabled credit card. In Australia, NFC wireless transactions (Visa PayWave / Mastercard Paypass) are gaining traction for purchases under $100. It's very convenient & usually fast.