Isn't that a feature to make sure you can use it when you travel? Not everywhere supports chip and pin, do they? Has it ever been rolled out in the US, for example - or is 2FA something everyone can get? (I know it wasn't generally a thing before I moved).
Chips are widespread in the US (as well as contactless). US banks don't bother with PINs, but most of the PoS systems deployed to deal with chips can support PINs if the card requires it.
thanks. I've not been back for over 7 years, and that could have changed. I worked retail, and a few banks supported contactless at the time, but not many people actually had it (or perhaps not many used it).
Can Japan not obtain another country code from Visa/Mastercard (part of the first 6 digits)?
I assume that it could work as a temporary solution but the article hints that this problem will likely become global soon. So, instead of moving numbers, it's easier to add some and increase the possible combinations.
15 digits can make for 1,000,000,000,000,000 different card numbers, leaving 16th digit for checksum. This is a completely made-up problem, caused by chopping the number into card type, bank id, etc.
SUrely, there's some inefficiency in how numbers are used... 10 quadrillion for 7.5 billion people isn't enough?
The first digits are a header identifying the type of the card, (visa, mastercard...) and probably other characteristics. The main problem is that in Japan everybody has like 5 credit cards, because every big company has its own financial branch and issues cards (maybe to profit from a "reservoir" effect of the accounts?). So you have a credit card linked to your clothes shop, one from your supermarket, one from Raku…
Five cards per person is less than a billion cards, vs a quadrillion possible combinations of 15 digits. A drop in the bucket
The prevalence of credit cards has baffled me for decades now. I admit I have one, but the only thing I need it for is to buy things from webshops that don't cater to the Dutch market. Every webshop that's vaguely aware of the Dutch market supports iDeal, which is specifically designed to handle internet payment and doesn't involve sharing any sensitive information with merchants or other unknown parties; my bank han…
The Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.
But if the seller doesn't fulfil their end of the bargain, the bank will do a refund AND the seller will be kicked out of the system or prosecuted if they're actually defrauding people.
Banks have developed and signed off on the ideal system; THEY are saying the system is safe, therefore THEY are responsible if something goes wrong with your payment.
How does that chip work online? As far as I know, CCs around the world still depend on numbers. For what it’s worth, in the US, chip is pretty much everywhere. Main difference is that it’s chip and signature vs chip and pin. I wish we’d switch to pins as well, but it’s not like it’s the dark ages or anything.
I have two options, both provided for by the bank. 1. I have a dongle that creates a number code when prompted. 2. My phone is set up for 2fa, again through the bank. The screen shows the same keyword as the website and I enter a pin into my phone to authorize the transaction. I can't remember if I need to use the fingerprint option on the phone or if that's just for the bank's app.
For my bank, I scan a QR code in the bank app. Then, on the phone it shows me who I'm paying, how much, and an appove or deny button. It also allows me to select the account that the money will actually come from.
Card numbers are there for a reason: transactions without presenting the card, which actually are not a big problem as there are strict rules to follow and if frauds do occur, card holders are backed by charge-back policies. I guess all your concerns should really go to magnetic strip cards as there is virtually no way to tell fake card from genuine cards and that's the reason of EMV/PBOC card migration which just as…
There's far better ways to do it if you can use online - I submit my card number to them, they pass the card number, their account number, and the amount to my provider, I authorise they payment with my provider. If you're doing it over the phone though things like public key won't really work - to be long enough would make the numbers impossible to read out reliably, let alone the calculation I would need to do with…
Nah, think again, in either the merchant's or bank's perspective: how can they tell you are really who you claimed to be? That's the core question and why all the hustle. And again, even some design can perfectly solve that problem, there are additional problems to resolve: how to implement that change with reasonable cost, within reasonable time frame and with good user experience? And most importantly, does not break existing facilities. That's exactly how we get into the current situation, there are simply too much historical burden and while someone is trying to make things better, there maybe more organizations are putting sh*ts into it. For example, I really don't know if there were any banks ever used 5 digits PIN, but there are POS machines only accept 5 digits.
It's pretty easy to make a secure payment method for one-off payments or fixed-price regular payments. A lot of the value of credit cards is that you can use them to pay for things that do usage-based billing, without having to do anything after the initial setup.
That's what direct debits (Avtalegiro in Norwegian) are for. Works fine here. I only use my credit cards for buying things in shops or one off things online. And my credit card gets paid by direct debit.
Direct debits have all of the dangers of credit cards and then some - you have to give out a numeric identifier, and unlike a credit card that number allows pulling directly from your bank account.
The Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.
But if the seller doesn't fulfil their end of the bargain, the bank will do a refund AND the seller will be kicked out of the system or prosecuted if they're actually defrauding people. Banks have developed and signed off on the ideal system; THEY are saying the system is safe, therefore THEY are responsible if something goes wrong with your payment.
The barrier is of course much higher for the consumer to take on such a case.
Hell yeah! Now we just need to get banks to stop using SMS 2FA and embrace an open 2FA standard like TOTP and our money (!!) will finally be almost as secure as our Facebook accounts have been for 5 years...
TOTP can be phished (there is even ready to use proof of concept software for building a TOTP phishing site), so it's a pretty poor choice. https://breakdev.org/evilginx-2-next-generation-of-phishing-... Instead banks should use WebAuthn. WebAuthn's credentials are directly bound to the DNS name. So anything that involves fooling the human like a phishing site can't work. The only site your authenticator can give the…
SMS 2FA can also be phished, so TOTP would still be better and WebAuthn is such a complete paradigm shift that it would take many years for banks to implement it. TOTP is so stupidly simple they could roll it out in a month, audits and all.
Not to mention that in order to have a decent WebAuthn experience, you need a Yubikey with NFC, which go for 30-60$ if I remember correctly. Cost of authenticators is why everyone switched away from RSA SecurID.
That’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.
I think most us cards have chips, but no pins. It’s bizarre.
My bank has programmable pins. So one pin goes to account X, and the other goes to account Y. It's super handy when travelling so we can have our "per diem" attached to one pin, and then have another pin for things that would fall outside of that purpose.