4 ms·

The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time rememb

The lack of security surrounding Chip and PIN doesn't surprise me. A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. As such, she's one of the few people on chip and sign, and has no PIN attached to her card. Even with that, she /still/ has to deal with fraud departments every few years saying that someone used her card and "PIN" in some obscure location, and this is obviously all her fault. It takes quite a bit of frustration for her before the fraud department finally comprehends that there is no pin to clone there. Of course, me being stateside, I still have to deal with antiquated magstrips and /their/ various faults. I've got cards with chips in them, but no one is taking them yet, and the bank I'm with (Wells Fargo) isn't even planning on rolling out chips on their debit card line until the end of the year, and even then, by request only. The whole financial security system is just ridiculous.

JosephRedfern 12y ago
Out of interest, how does Chip and Sign work at an ATM?
- selectodude 12y ago
  For now, banks are only doing chip+sig on credit cards. I imagine chip+pin on debit cards for ATMs is a 2016 issue.
- sliverstorm 12y ago
  I don't know for sure, but debit cards already follow the chip&pin model, except it's magstripe&pin. So I would imagine it would read the chip, and you would enter your ATM pin.
pyre 12y ago
On the other hand, with Chip & PIN, if someone uses the Chip and PIN they will claim that they don't have to protect you from fraud. I recall reading a few years ago about auto insurance companies denying claims on stolen cars because it was "impossible" for the car to be stolen due to the new key tech at the time. They were ignoring that the dealerships help the master keys, and car thieves would just attack that as the weak point (i.e. get an insider to cut the keys, and give you the address for the owner). The real reason that the insurers were denying claims is that they want to just push all of the risk onto the consumer, while still taking their money to 'insure' them.
- mattmanser 12y ago
  That's not been true since 2009. http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability
gergles 12y ago
WF is issuing EMV-enabled debit cards as of yesterday. Just call and ask for one.
- Sanddancer 12y ago
  I was just in a wells fargo branch yesterday and asked about it and was told they were planning on rolling them out later this year. Probably one of those left hand not knowing what the right hand is doing situations.
  - deleted 12y ago
    [deleted]
- callahad 12y ago
  AFAIK, no US bank is actually offering true "chip-and-pin" cards. USAA used to, but they re-ordered the CVMs on cards issued since last June. Now their cards prefer signatures over PINs, just like most other American EMV cards.
  - vel0city 12y ago
    It seems like many places in the US that accept chipped cards don't even ask for a signature. I put in the card, it asks to verify the amount, and then processes it. I've had some large (>$100) transactions get approved with just a card, no PIN or signature. I can't recall a single time I've had to enter a PIN or sign for an EMV transaction.
  - mcmancini 12y ago
    Isn't Barclaycard issuing Chip-and-PIN cards, albeit signature priority, that work in PIN-only situations?
    - otterley 12y ago
      Yes, they are.
tzs 12y ago
> A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. Are the PINs assigned by the card issuer and unchangeable, or can the user change the PIN? If the user can change them, couldn't she change the PIN to something that isn't arbitrary to her?
- chrisfosterelli 12y ago
  The PINs are typically changeable.
- Sanddancer 12y ago
  For her, it's remembering and being able to put in any number sequence, so in this case, she really can't.

JosephRedfern 12y ago

Out of interest, how does Chip and Sign work at an ATM?

selectodude 12y ago
For now, banks are only doing chip+sig on credit cards. I imagine chip+pin on debit cards for ATMs is a 2016 issue.
sliverstorm 12y ago
I don't know for sure, but debit cards already follow the chip&pin model, except it's magstripe&pin. So I would imagine it would read the chip, and you would enter your ATM pin.

pyre 12y ago

On the other hand, with Chip & PIN, if someone uses the Chip and PIN they will claim that they don't have to protect you from fraud. I recall reading a few years ago about auto insurance companies denying claims on stolen cars because it was "impossible" for the car to be stolen due to the new key tech at the time. They were ignoring that the dealerships help the master keys, and car thieves would just attack that as the weak point (i.e. get an insider to cut the keys, and give you the address for the owner). The real reason that the insurers were denying claims is that they want to just push all of the risk onto the consumer, while still taking their money to 'insure' them.

mattmanser 12y ago
That's not been true since 2009. http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability http://en.wikipedia.org/wiki/Chip_and_PIN#Banks.27_liability

gergles 12y ago

WF is issuing EMV-enabled debit cards as of yesterday. Just call and ask for one.

Sanddancer 12y ago
I was just in a wells fargo branch yesterday and asked about it and was told they were planning on rolling them out later this year. Probably one of those left hand not knowing what the right hand is doing situations.
- deleted 12y ago
  [deleted]
callahad 12y ago
AFAIK, no US bank is actually offering true "chip-and-pin" cards. USAA used to, but they re-ordered the CVMs on cards issued since last June. Now their cards prefer signatures over PINs, just like most other American EMV cards.
- vel0city 12y ago
  It seems like many places in the US that accept chipped cards don't even ask for a signature. I put in the card, it asks to verify the amount, and then processes it. I've had some large (>$100) transactions get approved with just a card, no PIN or signature. I can't recall a single time I've had to enter a PIN or sign for an EMV transaction.
- mcmancini 12y ago
  Isn't Barclaycard issuing Chip-and-PIN cards, albeit signature priority, that work in PIN-only situations?
  - otterley 12y ago
    Yes, they are.

tzs 12y ago

> A friend of mine is dyslexic, and one of the symptoms is that she has a real hard time remembering arbitrary sequences of numbers, like PINs tend to be. Are the PINs assigned by the card issuer and unchangeable, or can the user change the PIN? If the user can change them, couldn't she change the PIN to something that isn't arbitrary to her?

chrisfosterelli 12y ago
The PINs are typically changeable.
Sanddancer 12y ago
For her, it's remembering and being able to put in any number sequence, so in this case, she really can't.