Be careful about using works like "cannot" in terms of what is possible to trust regarding hardware that is in possession of a potentially adversarial party and

Be careful about using works like "cannot" in terms of what is possible to trust regarding hardware that is in possession of a potentially adversarial party and systems that assume said cards are secure. There are a variety of attacks that are possible (pre-play, attacks that can make a stolen card work without a PIN, etc.) and it is likely that in the future it will be easier to perform these attacks. It is a standard risk/convenience continuum and everyone has staked out a different portion of that zone. In the US the merchant pays a lower commission on debit card (e.g. with PIN) transactions as well for the same reasons, which is why they will tend to suggest that option or offer it up as the default when you use a card that can be either debit or credit. When I suggested that there were only two systems I was simplifying a bit too much and you definitely caught me on that one. In most places it seems that there are two (and sometimes three depending on how mobile phone payments are cleared) dominant e-payment formats, one which puts the fraud burden on the merchant and one that puts it on the customer. The size of the burden is usually set by regulation and the level that this is set at tends to inform the nature of the security at the endpoints vs. what happens at the middle when clearing and reconciling transactions.