6 ms·

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail co

by awjr 12y ago

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

nodata 12y ago
Lack of chip and pin, or use of magnetic stripes instead of ICs?
jvm 12y ago
Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml http://www.forbes.com/fdc/welcome_mjx.shtml
- dghughes 12y ago
  http://m.youtube.com/watch?v=B80SyRmtbdI http://m.youtube.com/watch?v=B80SyRmtbdI
- celticninja 12y ago
  cool, so only about 5 years after it was widespread/standard in Europe
- js2 12y ago
  My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-usa-emv-cards-available-today-chip-pin-chip-signature.html http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRvcE1ELVg5UmlGZk01SHZvTUMxdUE https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I was looking into the CC issues, and as a US traveler not being able to get an EMV card with pin priority is annoying. Edit 2: jvm, not sure what you meant to link to, but that link just goes to the Forbes splash advert.
  - hackmiester 12y ago
    Maybe they will be. As of now, I have never seen a card with a chip in person at all. In my entire life.
    - justincormack 12y ago
      Try leaving the US?
  - tedunangst 12y ago
    Only one of my cards is chip and sig, and I had to go out of my way to get it. It's not the default for all new cards, and certainly not for existing cards.
    - wlesieutre 12y ago
      When my credit card expired recently I received a chip and sig replacement without requesting it. They're definitely starting to be offered by default.
      - abcabc321321123 12y ago
        The same thing happened to me.
  - mangodroppings 12y ago
    All of my cards (Amex, visa, mc, discover) are sig-only.
  - dionidium 12y ago
    This is wrong. The vast majority of cards are signature only. I have one chip and signature card and it's regarded as kind of a novelty.
  - drzaiusapelord 12y ago
    I have three cards. Only my debit/credit card has a chip and there's no pin. I can press it against one of the few readers that support this (Walgreens, Subway) and it'll work. My other two cards don't even have this. Of course, if these guys are storing my card in a non-encrypted way, its still the same issue as using swipe. On the plus side Google Wallet works at Walgreens. I have yet to see any other brick and mortar support it. Paying for stuff with your smartphone is such a no-brainer. Shame Apple won't play ball with Google (or even put NFC in its phones) and Verizon is doing its own thing with ISIS and not allowing Google Wallet to be installed on any phones on its network. There's a lot of wrong here and its not just limited to credit card number theft. If we have a more diversified way to pay for things it could limit the damage when one method is cracked but the others aren't. Sure Targets credit cards got stolen, but imagine if we were allowed to use Google Wallet. We'd be immune to it.
- Istof 12y ago
  I believe it is chip and signature... I got mine from Bank of America... no pin necessary when the chip is used (and it still has the magnetic strip for stores that don't have chip readers).
  - josho 12y ago
    The roll out for chip and pin in Canada started the same, but within the last year, I've found mag only readers to be extremely rare.
    - nucleardog 12y ago
      Even travelling through a lot of small towns in rural areas I don't think I've run into a magstripe-only reader in the past couple years at least. There was a period where it was a guessing game every time you paid for something whether it was magstripe or chip (some locations even had a chip-capable machine, but didn't have the service enabled with their payment processor, so you still used the magstripe...). It's pretty consistent now.
DrTarantism 12y ago
Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards
- mattmanser 12y ago
  That's not close to being a chicken and egg. The card companies just have to release the cards, then up the fees for using it without chip & pin. What's the point of buying the POS systems when no-one can use it and there's no guarantee the cards will be rolled out? It happened very rapidly here in Britain once the cards were out.
  - DrTarantism 12y ago
    It's all politics. Its a big financial commitment for whichever side goes first. The US has a bigger population than Britain. And perhaps the industry politics were different there too. The card companies may have got their way.
    - hannibalhorn 12y ago
      There's liability to consider as well. In the US, the consumer is generally not liable for fraud; I've certainly heard that in other countries with chip and PIN, if somebody steals and uses your card (having somehow obtained your PIN) you don't necessarily get your money back.
- DangerousPie 12y ago
  How is that? I have a Chip+PIN enabled credit card and if the shop doesn't support that I can still swipe the magnetic stripe. I don't see why they don't just provide credit cards with both options for a while until enough of the PoS hardware has been upgraded that they can get rid of the magnetic stripe. I guess cost plays a role, but I would assume that the decrease in fraud might offset that somewhat.
happyscrappy 12y ago
I have had chip and pin for a year from a US bank.
obvious_throw 12y ago
Many of us in the US still use exclusively cash for POS. For us, blasé attitude is to be expected.
wglb 12y ago
Well, note the numbers shown here: http://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/ http://krebsonsecurity.com/2014/05/the-target-breach-by-the-... 0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions). So do we know if it would have stopped the Home Depot breach?
- nhstanley 12y ago
  An important point to note is that, if banks want/care, they can put other safeguards that solve this problem, too. In Europe it is common for banks to text you a 6 number pin to confirm an online transaction, for example. There is no good reason to not do these things. It's still not perfect, but certainly much better.
  - wglb 12y ago
    So I can't quite see this working in a physical retail location, which is where the Target and Home Depot happened. So this, like chip and pin, would not have helped these particular issues.
Crito 12y ago
> "I'm quite surprised by the blasé attitude the US has to card security." Currently, if my CC information is stolen, I am not liable for any fraudulent charges. So why would I care? CC security is for the CC companies and the merchants, not for the consumers. That is why Americans (with the exception of those with Europe Envy or those who are merchants) don't care. There is no reason for them to. (In past discussions on this, somebody has mentioned that C+P would be beneficial for American consumers because it would mean less confused American tourists in Europe. The typical American does not vacation in Europe very frequently.)
- bartwe 12y ago
  Except you do pay for it indirectly, with additional overhead, through banking fees paying for insurance.
  - Crito 12y ago
    My credit union has absolutely negligible fees and, since I don't carry a balance on my CC, I give them a negligible amount of money as well. The cost of merchant fees passed on to the consumer is not something that I notice and therefore not something that I care about. I really do not have a reason to want C+P.
    - judk 12y ago
      What is your cash back rate?you pay vendors to pay 3% to the card issuer
- awjr 12y ago
  Well, any retailer has to increase their prices by 3% to cover CC charges. Even the simple act of a place insisting on a minimum spend of X on a CC can put you in a situation to spend more than you need to. You might not think you are paying for card fraud, but it's all priced into the products you buy.

by awjr 12y ago

nodata 12y ago

Lack of chip and pin, or use of magnetic stripes instead of ICs?

jvm 12y ago

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml http://www.forbes.com/fdc/welcome_mjx.shtml

dghughes 12y ago
http://m.youtube.com/watch?v=B80SyRmtbdI http://m.youtube.com/watch?v=B80SyRmtbdI
celticninja 12y ago
cool, so only about 5 years after it was widespread/standard in Europe
js2 12y ago
My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-usa-emv-cards-available-today-chip-pin-chip-signature.html http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRvcE1ELVg5UmlGZk01SHZvTUMxdUE https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I was looking into the CC issues, and as a US traveler not being able to get an EMV card with pin priority is annoying. Edit 2: jvm, not sure what you meant to link to, but that link just goes to the Forbes splash advert.
- hackmiester 12y ago
  Maybe they will be. As of now, I have never seen a card with a chip in person at all. In my entire life.
  - justincormack 12y ago
    Try leaving the US?
- tedunangst 12y ago
  Only one of my cards is chip and sig, and I had to go out of my way to get it. It's not the default for all new cards, and certainly not for existing cards.
  - wlesieutre 12y ago
    When my credit card expired recently I received a chip and sig replacement without requesting it. They're definitely starting to be offered by default.
    - abcabc321321123 12y ago
      The same thing happened to me.
- mangodroppings 12y ago
  All of my cards (Amex, visa, mc, discover) are sig-only.
- dionidium 12y ago
  This is wrong. The vast majority of cards are signature only. I have one chip and signature card and it's regarded as kind of a novelty.
- drzaiusapelord 12y ago
  I have three cards. Only my debit/credit card has a chip and there's no pin. I can press it against one of the few readers that support this (Walgreens, Subway) and it'll work. My other two cards don't even have this. Of course, if these guys are storing my card in a non-encrypted way, its still the same issue as using swipe. On the plus side Google Wallet works at Walgreens. I have yet to see any other brick and mortar support it. Paying for stuff with your smartphone is such a no-brainer. Shame Apple won't play ball with Google (or even put NFC in its phones) and Verizon is doing its own thing with ISIS and not allowing Google Wallet to be installed on any phones on its network. There's a lot of wrong here and its not just limited to credit card number theft. If we have a more diversified way to pay for things it could limit the damage when one method is cracked but the others aren't. Sure Targets credit cards got stolen, but imagine if we were allowed to use Google Wallet. We'd be immune to it.
Istof 12y ago
I believe it is chip and signature... I got mine from Bank of America... no pin necessary when the chip is used (and it still has the magnetic strip for stores that don't have chip readers).
- josho 12y ago
  The roll out for chip and pin in Canada started the same, but within the last year, I've found mag only readers to be extremely rare.
  - nucleardog 12y ago
    Even travelling through a lot of small towns in rural areas I don't think I've run into a magstripe-only reader in the past couple years at least. There was a period where it was a guessing game every time you paid for something whether it was magstripe or chip (some locations even had a chip-capable machine, but didn't have the service enabled with their payment processor, so you still used the magstripe...). It's pretty consistent now.

DrTarantism 12y ago

Its not a blase attitude. Its a chicken and egg situation. The credit card companies want to implement it but they need the stores to upgrade their point of sale hardware to accept the new cards. Stores say they won't upgrade their hardware til card companies release the cards

mattmanser 12y ago
That's not close to being a chicken and egg. The card companies just have to release the cards, then up the fees for using it without chip & pin. What's the point of buying the POS systems when no-one can use it and there's no guarantee the cards will be rolled out? It happened very rapidly here in Britain once the cards were out.
- DrTarantism 12y ago
  It's all politics. Its a big financial commitment for whichever side goes first. The US has a bigger population than Britain. And perhaps the industry politics were different there too. The card companies may have got their way.
  - hannibalhorn 12y ago
    There's liability to consider as well. In the US, the consumer is generally not liable for fraud; I've certainly heard that in other countries with chip and PIN, if somebody steals and uses your card (having somehow obtained your PIN) you don't necessarily get your money back.
DangerousPie 12y ago
How is that? I have a Chip+PIN enabled credit card and if the shop doesn't support that I can still swipe the magnetic stripe. I don't see why they don't just provide credit cards with both options for a while until enough of the PoS hardware has been upgraded that they can get rid of the magnetic stripe. I guess cost plays a role, but I would assume that the decrease in fraud might offset that somewhat.

happyscrappy 12y ago

I have had chip and pin for a year from a US bank.

obvious_throw 12y ago

Many of us in the US still use exclusively cash for POS. For us, blasé attitude is to be expected.

wglb 12y ago

Well, note the numbers shown here: http://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/ http://krebsonsecurity.com/2014/05/the-target-breach-by-the-... 0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions). So do we know if it would have stopped the Home Depot breach?

nhstanley 12y ago
An important point to note is that, if banks want/care, they can put other safeguards that solve this problem, too. In Europe it is common for banks to text you a 6 number pin to confirm an online transaction, for example. There is no good reason to not do these things. It's still not perfect, but certainly much better.
- wglb 12y ago
  So I can't quite see this working in a physical retail location, which is where the Target and Home Depot happened. So this, like chip and pin, would not have helped these particular issues.

Crito 12y ago

> "I'm quite surprised by the blasé attitude the US has to card security." Currently, if my CC information is stolen, I am not liable for any fraudulent charges. So why would I care? CC security is for the CC companies and the merchants, not for the consumers. That is why Americans (with the exception of those with Europe Envy or those who are merchants) don't care. There is no reason for them to. (In past discussions on this, somebody has mentioned that C+P would be beneficial for American consumers because it would mean less confused American tourists in Europe. The typical American does not vacation in Europe very frequently.)

bartwe 12y ago
Except you do pay for it indirectly, with additional overhead, through banking fees paying for insurance.
- Crito 12y ago
  My credit union has absolutely negligible fees and, since I don't carry a balance on my CC, I give them a negligible amount of money as well. The cost of merchant fees passed on to the consumer is not something that I notice and therefore not something that I care about. I really do not have a reason to want C+P.
  - judk 12y ago
    What is your cash back rate?you pay vendors to pay 3% to the card issuer
awjr 12y ago
Well, any retailer has to increase their prices by 3% to cover CC charges. Even the simple act of a place insisting on a minimum spend of X on a CC can put you in a situation to spend more than you need to. You might not think you are paying for card fraud, but it's all priced into the products you buy.