Chip and PIN

[NHH]

So, about 15 years ago, the banks brought in Chip and Pin. Patrick Stewart did loads of ads saying how it was much safer; no-one checked signatures on cards anymore, so if someone stole your card, they'd just have to present it, and do a passable imitation of your signature, and hey presto, the money was in the hands of the thief who dun the blag.
Fast forward a few years, and the same banks are now pushing contactless, in which neither signature nor PIN are needed. So, what happened to make them move from having something (a signature) to something stronger (a PIN) to having nothing (contactless)?
Did they stop giving a stuff about card fraud, or is there something whizzo that I'm not aware of that makes contactless even more secure than a PIN?

[Ginger Yellow]

Chip and PIN

I don't have an inside track on this, but I think it has less (ie nothing) to do with improving security, because it doesn't, and more to do with maintaining revenues from consumer payments in the face of competition from the likes of Apple/Android/Samsung Pay, mobile billing and so on.

[WOM]

Chip and PIN

Indeed. And grousing from retailers about how card use slows down checkout time. Walmart even has you insert the card while they're checking you through to save a few seconds.

[Incandenza]

Chip and PIN

But you can do that anywhere, can't you? Or are you mentioning that they make people do that? It's something I do anyway.

I've started using Apple Pay since I got my watch. No having to reach into my pocket at all, I didn't really see the point of Apple Pay on your phone since I'd have to reach into the same pocket to get my wallet out. Some places make you do PIN with Apple Pay, though, so it's really not a hell of a lot faster.

[Ginger Yellow]

Chip and PIN

Well, US (and Canadian?) chip and pin is the worst of both worlds, so I can definitely see why retailers (and consumers) would want to move to contactless.

[Stumpy Pepys]

Chip and PIN

[pebblethefish]

Chip and PIN

Incandenza wrote: I didn't really see the point of Apple Pay on your phone since I'd have to reach into the same pocket to get my wallet out.

You keep phone and wallet in the same pocket? How baggy are your trousers?

[ad hoc]

Chip and PIN

As I mentioned elsewhere, just today, mrs hoc went to the bank which had informed her that her new card was waiting. On looking at it she realised that it was not for her, but a replacement corporate card for a company she no longer works at...the bank had just automatically replaced her old one which had actually been cancelled. It was contactless, so had she been dishonest (or had she left that company on bad terms) she could have walked away with it and used it anywhere.

[WOM]

Chip and PIN

Incandenza wrote: But you can do that anywhere, can't you? Or are you mentioning that they make people do that? It's something I do anyway.

No, some of the POP systems here will default if you insert the card before the teller enters the purchase amount. You have to remove your card and do it again.

[ursus arctos]

Chip and PIN

Same here, for that matter

The absence of standardisation is annoying

[Incandenza]

Chip and PIN

pebblethefish wrote:

I didn't really see the point of Apple Pay on your phone since I'd have to reach into the same pocket to get my wallet out.

You keep phone and wallet in the same pocket? How baggy are your trousers?

Not baggy at all. Keys in left pocket, wallet and phone in right pocket. I try to keep my wallet skinny so it doesn't feel bulky with both in my pocket.

[Various Artist]

Chip and PIN

Stumpy Pepys wrote:

First thing I thought of too, Stumpy.

[sw2borshch]

Chip and PIN

No back pocket, Inca? What about your vape mod?

[Incandenza]

Chip and PIN

I hate carrying things in my back pocket.

[sw2borshch]

Chip and PIN

Even old bus tickets, pennies you found in the street and Fussbudget's bus pass?

[Fussbudget]

Chip and PIN

Ah, that's where it is!

[Snake Plissken]

Chip and PIN

Chip and PIN was never about increasing security - basically the introduction was a huge opportunity for the credit card companies to shift blame for a fraudulent transaction from the retailer / them to the end user. (The only way that the money could possibly have come out is if they knew your PIN, amirite?)

Barclaycard sent me a new contactless credit card with a sticky wallet thing, encouraging me to stick it to the back of my phone. Brilliant idea. So now if I lose my phone, I've lost a card people can use to buy stuff as well.

[anton pulisov]

Chip and PIN

Chip and PIN was never about increasing security - basically the introduction was a huge opportunity for the credit card companies to shift blame for a fraudulent transaction from the retailer / them to the end user. (The only way that the money could possibly have come out is if they knew your PIN, amirite?)

I don't think that's completely true.

Credit card fraud is much higher in the US than in Europe, because in the US they still use the completely insecure magnetic stripe + signature system. Whereas in Europe chip with PIN code is now the standard. So it is genuinely a more secure system.

And with the chip+PIN system the banks will still refund your money if you are defrauded. My sister had loads of her cash withdrawn from random ATMs in Paris. Apparently skimmers had somehow copied her card and intercepted her PIN. The banks refunded all of the money.

The main potential problem I can see with paying by card is that I make so many small payments using my card, that I wouldn't notice if somebody stole my details and used them to make a number of small payments every now and then. Rather like a kid nicking a quid out of a parent's wallet every week.

[caja-dglh]

Chip and PIN

NHH wrote: So, about 15 years ago, the banks brought in Chip and Pin. Patrick Stewart did loads of ads saying how it was much safer

And as life comes full circle, Patrick Stewart is going to play the poop emoji in the emoji movie.

[Snake Plissken]

Chip and PIN

antoine polus wrote: Credit card fraud is much higher in the US than in Europe, because in the US they still use the completely insecure magnetic stripe + signature system. Whereas in Europe chip with PIN code is now the standard. So it is genuinely a more secure system.

It is a matter of shifting liability. In a card+signature setup, the retailer is supposed to check the signatures match. If they fail to do so, then the retailer is liable for failing to authenticate the card.

In a chip+PIN set up, the machine is secure and the only thing that supposed to fail is if the customer gives their PIN away. Liability for authentication is shifted to the user as the only person who should be able to authenticate is the customer.

As you point out, cards can still get skimmed, and the banks are more than a little coy on how. My wife has had a particular card used several times both online and in-store, including replacements - the irony being she doesn't know her own PIN. (It is only for online transactions, has been set up with 3D Secure and the CVV number is not supposed to be stored in a database, so how the hell they are doing it only the bank knows, because they very cheerfully keep replacing them.)

[Amor de Cosmos]

Chip and PIN

It is a matter of shifting liability. In a card+signature setup, the retailer is supposed to check the signatures match. If they fail to do so, then the retailer is liable for failing to authenticate the card.

Liability for authentication is shifted to the user as the only person who should be able to authenticate is the customer.

Some of this is down to the differing national attitudes of banks/credit card companies towards customer service. I believe I've mentioned here before that several years ago La Signora had her wallet lifted from her handbag one evening. She didn't notice until we returned home a couple of hours later. Waiting for us was a message from RBC asking her to call immediately because several large items had been charged to her credit card, they also said, in the initial message, not to worry, if the card had been stolen she would not be liable for any funds charged. Over two thousand dollars had been withdrawn and was replaced by the following morning. In her wallet was also a Lloyds card, less than $200 had been drawn on that. She had to contact Lloyds, it took over a week of transatlantic calls before she got to speak to anyone who would discuss "the issue" with her. Basically the onus was on her to prove she hadn't spent the money herself. When she finally did to their satisfaction, it took over six months before the funds reappeared in her account.

[Sam]

Chip and PIN

About a decade ago the bank phoned up my grandma to confirm a suspicious payment that had been made on her debit card. Someone's spent a couple of hundred pounds late at night in a pub, have you been tricked into giving your card details to anyone?

She laughed and told them the previous day had been her 90th birthday so she'd taken her four daughters and all their families for dinner at a nearby pub with good food, and paid for it all. The next day she got a massive bouquet of flowers and a huge Happy Birthday card from the bank.

Here, not only do they not have chip and PIN, but you don't even sign the slip of paper until after the money has been taken from your card, just to confirm you've made the payment. The retailer is supposed to check the name on the card against your photo ID, but they frequently don't even do that. People in Argentina often seem baffled when I suggest there's something wrong with this practice.