7 ms·

Interestingly, this last year, many businesses I frequent updated to new Verifone terminals. My credit card doesn't read on only that brand of terminal (works

Interestingly, this last year, many businesses I frequent updated to new Verifone terminals. My credit card doesn't read on only that brand of terminal (works everywhere else i use it), unless I wrap it in a piece of receipt tape or plastic bag before sliding it thru, then it works after a try or two. Not sure why, but I haven't replaced the card yet simply because it is an interesting experiment.

creshal 12y ago
> before sliding it thru The US are still using magnet stripes?
- Nursie 12y ago
  Yup, it's rather quaint at this point!
- mikeash 12y ago
  Yes. We're just now transitioning to chips. My cards are gradually being replaced with chip cards, starting last year. In October of this year, new rules will come into effect that basically require all cards and terminals to use chips, by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip. (In other words, merchants will foot the bill for fraud if they don't upgrade their terminals.) We're taking our time, but we're finally moving there. Edit: despite having chip cards, I've yet to be able to use the chip in the US. Many places now have chip-enabled terminals, but often not set up to use the chip part, and after a few failed attempts I just gave up on it.
  - mrchucklepants 12y ago
    This happened to me at Costco the other day. Chip capable terminal but it didn't do anything. The guy at the register had never seen anyone try to use it before. He didn't even know the new slot was there.
  - ams6110 12y ago
    In October of this year, new rules will come into effect that basically require all cards and terminals to use chips How does this affect Square and similar peripheral readers for mobile devices? Will users of those now be liable for fraud?
    - mikeash 12y ago
      Good question. Looks like the answer is, yes, you will be liable just like anybody else, and just like other providers, Square will start providing chip readers. They have a page about it here: https://squareup.com/emv https://squareup.com/emv Interestingly, it looks like this may be the end of the model where the reader is so cheap they can give it away for free, as they list it for $29.
      - Nursie 12y ago
        I do quite like their tiny reader, and I'm wondering if it uses some sort of modem for comms over the audio port...? Kinda cool.
        mikeash 12y ago
        I believe they've been using a modem sort of setup for a while, and this is probably the same sort of thing. Their original reader was pretty much a magnetic reader head hooked straight to the microphone port, decoded by Square's software on the phone. You could record your card's stripe using a voice recorder program (I tried it for fun) and you'd get this fun squeaking noise from it. Square's competitors eventually tried to discredit them by pointing out that this data was unencrypted, and that meant that Nefarious People could Steal your Precious Card Data using a Square reader. Square eventually responded by changing over to a reader that encrypted the magstripe data before communicating it to the phone, meaning there must be some sort of digital communication happening over the audio port.
        Nursie 12y ago
        OK, that's interesting, I had assumed that the older readers had simply transmitted the analogue signal generated by moving the mag strip through the reader, and was wondering if maybe the new one just attached to the mini-jack port and did its actual comms over bluetooth. But if they've already got a digital data transmission system in place then that's a whole different game. Thanks for the insight!
  - hobarrera 12y ago
    > by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip. What about tourists and alike?
    - mikeash 12y ago
      No idea. There might be different rules for foreign cards. Otherwise, the card issuer which could have issued a chip card but didn't would be liable, as I understand it.
- zyxley 12y ago
  The first hard date for when liability for magstripe fraud starts switching from credit card companies to merchants is this October.
  - c22 12y ago
    My understanding is that merchants are already liable in most cases. What happens in october is the possibility for the bank to be liable in case the merchant supports chip and pin but the bank does not.
  - misaelm 12y ago
    I'll just add that starting in October, the merchants will be liable for magstripe transactions completed with counterfeit cards but not for those coming from other type of frauds (e.g lost/stolen cards) as long as the merchants have proper card acceptance procedures.
- eli 12y ago
  Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some liability for fraud on the consumer?
  - Nursie 12y ago
    Nope. Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability. The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.
    - petejansson 12y ago
      The US is moving to Chip & Signature, rather than Chip & PIN, but the liability will still shift to the merchant, not the buyer. http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...
      - Nursie 12y ago
        Well, it's a good start, and Chip & PIN is just a terminal capability flag and a CVM list alteration away...
    - lotsofmangos 12y ago
      Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.
      - Nursie 12y ago
        I'm interested in liabilty for what though. I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though. I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild. --edit-- and it still involves a stolen card at that point doesn't it?

creshal 12y ago

> before sliding it thru The US are still using magnet stripes?

Nursie 12y ago
Yup, it's rather quaint at this point!
mikeash 12y ago
Yes. We're just now transitioning to chips. My cards are gradually being replaced with chip cards, starting last year. In October of this year, new rules will come into effect that basically require all cards and terminals to use chips, by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip. (In other words, merchants will foot the bill for fraud if they don't upgrade their terminals.) We're taking our time, but we're finally moving there. Edit: despite having chip cards, I've yet to be able to use the chip in the US. Many places now have chip-enabled terminals, but often not set up to use the chip part, and after a few failed attempts I just gave up on it.
- mrchucklepants 12y ago
  This happened to me at Costco the other day. Chip capable terminal but it didn't do anything. The guy at the register had never seen anyone try to use it before. He didn't even know the new slot was there.
- ams6110 12y ago
  In October of this year, new rules will come into effect that basically require all cards and terminals to use chips How does this affect Square and similar peripheral readers for mobile devices? Will users of those now be liable for fraud?
  - mikeash 12y ago
    Good question. Looks like the answer is, yes, you will be liable just like anybody else, and just like other providers, Square will start providing chip readers. They have a page about it here: https://squareup.com/emv https://squareup.com/emv Interestingly, it looks like this may be the end of the model where the reader is so cheap they can give it away for free, as they list it for $29.
    - Nursie 12y ago
      I do quite like their tiny reader, and I'm wondering if it uses some sort of modem for comms over the audio port...? Kinda cool.
      - mikeash 12y ago
        I believe they've been using a modem sort of setup for a while, and this is probably the same sort of thing. Their original reader was pretty much a magnetic reader head hooked straight to the microphone port, decoded by Square's software on the phone. You could record your card's stripe using a voice recorder program (I tried it for fun) and you'd get this fun squeaking noise from it. Square's competitors eventually tried to discredit them by pointing out that this data was unencrypted, and that meant that Nefarious People could Steal your Precious Card Data using a Square reader. Square eventually responded by changing over to a reader that encrypted the magstripe data before communicating it to the phone, meaning there must be some sort of digital communication happening over the audio port.
        Nursie 12y ago
        OK, that's interesting, I had assumed that the older readers had simply transmitted the analogue signal generated by moving the mag strip through the reader, and was wondering if maybe the new one just attached to the mini-jack port and did its actual comms over bluetooth. But if they've already got a digital data transmission system in place then that's a whole different game. Thanks for the insight!
- hobarrera 12y ago
  > by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip. What about tourists and alike?
  - mikeash 12y ago
    No idea. There might be different rules for foreign cards. Otherwise, the card issuer which could have issued a chip card but didn't would be liable, as I understand it.
zyxley 12y ago
The first hard date for when liability for magstripe fraud starts switching from credit card companies to merchants is this October.
- c22 12y ago
  My understanding is that merchants are already liable in most cases. What happens in october is the possibility for the bank to be liable in case the merchant supports chip and pin but the bank does not.
- misaelm 12y ago
  I'll just add that starting in October, the merchants will be liable for magstripe transactions completed with counterfeit cards but not for those coming from other type of frauds (e.g lost/stolen cards) as long as the merchants have proper card acceptance procedures.
eli 12y ago
Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some liability for fraud on the consumer?
- Nursie 12y ago
  Nope. Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability. The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.
  - petejansson 12y ago
    The US is moving to Chip & Signature, rather than Chip & PIN, but the liability will still shift to the merchant, not the buyer. http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/ http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...
    - Nursie 12y ago
      Well, it's a good start, and Chip & PIN is just a terminal capability flag and a CVM list alteration away...
  - lotsofmangos 12y ago
    Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.
    - Nursie 12y ago
      I'm interested in liabilty for what though. I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though. I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild. --edit-- and it still involves a stolen card at that point doesn't it?