Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Swiping left on magnetic stripes

mastercard.com

Post reply on HN
Print view View original

261–270 of 325 posts

Re: Swiping left on magnetic stripes

#261

Post by yarcob »

ohazi wrote: post #119
drclau wrote: post #12

Why does it take so long? Where’s the bottleneck? Where I lived over the last years (two countries in Europe), I don’t even have to use the physical card. I just use contactless payments with the phone. Prior to that, it was contactless with card. Even ATMs work with contactless (not all, yet). Prior to that, it was chip. I honestly don’t even recall the time when the magnetic stripe was needed. (edit) Think of this:…

From the card companies' perspective, the alternative to magstripe isn't contactless, it's contact (the smart card IC embedded in the physical card). In the US, the card companies convinced merchants to adopt the EMV contact standard by implementing a liability shift that would make the merchants liable for card-present magstripe fraud after a certain date. For merchants using POS terminals, the liability shift happe…

Contactless is not less secure than magstripe. I don't know where you got that from.

You can't make a fake contactless card, because each card has a private key that you can't extract. But it's trivial to make a fake magnetic stripe card.

One type of fraud with EU credit cards works like this: Criminal collects credit card numbers and pins by adding a hidden magnetic stripe reader to an ATM and a video camera, then create a fake magnetic card, and then withdraw money with fake card + PIN somewhere abroad where magnetic stripes are still allowed.

For this reason, my bank disables withdrawals from abroad by default, and you need to manually enable world wide payments in the online banking app.

Re: Swiping left on magnetic stripes

#262

Post by iarenaza »

rutthenut wrote: post #247
VilleO wrote: post #233

Earlier quoted context omitted.

Quick googling gave me average US car consumption 25 mpg vs 57 mpg in EU. Edit: Bad googling, sorry. 57 mpg was proposed for new cars.

Wow! Average 57 mpg in Europe - really? Even for diesels, that sounds extremely optimistic; is that from manufacturer-supplied figures? US gallons happen to be smaller too, fwiw

Well, my 7 years old Mercedes A 180 CDI 2012 model (Diesel engine) averages 53 mpg (4.4 l/100Km) still today (see my old comment with all the details for the these numbers at https://news.ycombinator.com/item?id=14552816). The manufacturer-supplied official numbers are even better (3.3 to 3.6 l/100Km, or about 65 to 71 mpg).

NB: the above mpg numbers are computed using US gallons (3.785 litres)

Re: Swiping left on magnetic stripes

#263

Post by Denatonium »

wcarss wrote: post #113
ryandrake wrote: post #65

Earlier quoted context omitted.

Yea, the Achilles Heel of contactless (or phone/NFC) in the USA is the uncertainty that it's supported and the terrible UX for failure cases. How many times have you had this happen? Your groceries are all rung up and the POS terminal is waiting. You dig out your phone or contactless card and try to invoke the contactless payment system. Nothing's happening. You wave it around a little. Still nothing. Grocery cashier…

Coming from Canada: my last experience with the stripe, >3-4 years ago, was more like: pull out the card. Swipe it (it doesn't work), Swipe it (it doesn't work), Swipe it slowly (it doesn't work), wrap a garbage bag around it and Swipe it slowly (it doesn't work), Swipe it one last time -- hey, it works! Then, physically sign my name on some piece of paper with a gross pen they had lying around. vs my last 100 contac…

Some US chip-enabled ATMs still insist on reading the magstripe first, and then tell you to reinsert if the card tells it that it's a chip card. If the ATM doesn't swallow your card, you can often swipe ANY chip-enabled card and then insert your preferred card when it tells you to reinsert.

Re: Swiping left on magnetic stripes

#264

Post by bjowen »

Animats wrote: post #206
drclau wrote: post #12

Why does it take so long? Where’s the bottleneck? Where I lived over the last years (two countries in Europe), I don’t even have to use the physical card. I just use contactless payments with the phone. Prior to that, it was contactless with card. Even ATMs work with contactless (not all, yet). Prior to that, it was chip. I honestly don’t even recall the time when the magnetic stripe was needed. (edit) Think of this:…

Where’s the bottleneck? Gas stations. The gas station industry has been avoiding upgrading pumps. It's expensive. Retail checkouts usually just need a replacement of the desktop unit, but gas pumps require actual modification. They got a 3-year delay, until October 2020. Then April 17, 2021. Then they got hit by the coronavirus epidemic. The upgrade has to be done by a qualified installer; you don't want someone who…

That’s a great answer. My observation (watching from a card issuer across the pond) has been that it’s also integrated checkout/POS infrastructure at a number of large retailers - supermarkets, department stores, pharmacies as well as automated fuel dispensers and ATM†. The USA lagged for probably 15 years before there was any significant penetration of chip + PIN and contactless payments. Once the first large retailer replaced its fleet in ~2017 it’s been accelerating.

Since the USA makes up fully half of global card payments, MC and Visa were never going to ditch mag stripe until there was 80% penetration.

†Many AFDs seem to be configured to reject international cards which may explain why they’re not well represented in my sample set.

Re: Swiping left on magnetic stripes

#265

Post by nulbyte »

lotsofpulp wrote: post #237
gregmac wrote: post #156

Earlier quoted context omitted.

> Contactless is very hit-or-miss for me in the US; about 1/3 the time it just doesn't work at all That's a shockingly high number. I'm in Canada, and I'd take a rough guess that maybe 1-2% of taps fail on first try. Most of the time it works on a second try -- and I actually think that usually happens when the POS system is slow and you tap too early. And in cases where it really is just not working, the fallback is…

I am in the US and I have been using tap to pay for a few years now with consistent success. And as you wrote, if it does not, you just insert the chip. But that seems rare.

I've come across a few places that accept contactless, but specifically reject Google and Apple Pay, and until recently, none of my cards had contactless built in, so Google Pay was the only way to do contactless. But, I have a Samsung phone with MST, so I can fake a swipe. Amusingly, the terminals that won't do contactless Google Pay happily accept the same with the magnetic reader.

Re: Swiping left on magnetic stripes

#266

Post by Spare_account »

koolba wrote: post #257
wcarss wrote: post #113

Earlier quoted context omitted.

Coming from Canada: my last experience with the stripe, >3-4 years ago, was more like: pull out the card. Swipe it (it doesn't work), Swipe it (it doesn't work), Swipe it slowly (it doesn't work), wrap a garbage bag around it and Swipe it slowly (it doesn't work), Swipe it one last time -- hey, it works! Then, physically sign my name on some piece of paper with a gross pen they had lying around. vs my last 100 contac…

> ... wrap a garbage bag around it and Swipe it slowly (it doesn't work), ... Garbage bag? You mean one of those paper thin plastic bags that many big cities in the USA have all but banned? Does that actually help with the mag strip being read or was that a joke regarding the cards being complete garbage?

It's a real-world solution that is widely-known but not widely understood.

https://old.reddit.com/r/explainlikeimfive/comments/1ycw61/e...

No idea if this explanation is legit, but I can anecdotally confirm that the trick has permitted a purchase in one case in my own direct experience.

Re: Swiping left on magnetic stripes

#267

Post by nulbyte »

poopypoopington wrote: post #45
drclau wrote: post #12

Why does it take so long? Where’s the bottleneck? Where I lived over the last years (two countries in Europe), I don’t even have to use the physical card. I just use contactless payments with the phone. Prior to that, it was contactless with card. Even ATMs work with contactless (not all, yet). Prior to that, it was chip. I honestly don’t even recall the time when the magnetic stripe was needed. (edit) Think of this:…

To play devil's advocate – who cares? We've had magnetic strips for decades and they work fine. Yes, they're insecure but anti-fraud measures taken by the bank can mitigate that. If this helps more stores accept payments without having a painful transition isn't that worth it? I use Apple Pay most places but I don't mind having to use a strip once in a while or if others do.

> but anti-fraud measures taken by the bank can mitigate that.

Not really. Anti-fraud measures by the banks usually amount to taking the hit themselves, unless they actually catch the culprit. And that's only in the case of actual fraud. In other instances, the banks' algorithm screws up and blocks your card for a legitimate transaction. Then there's the hassle of replacing your card.

In the U.S., the bank where I have my checking account can print cards in the branch, but many more make you wait for the ever-worsening postal service to deliver you a new one.

Re: Swiping left on magnetic stripes

#268

Post by [deleted] »

mintplant wrote: post #258
ehnto wrote: post #217

Earlier quoted context omitted.

Gas stations also have a disincentive to have you pay at the pump. They want you to walk in and buy from the mini-market, at least here in Australia the petrol was a loss-leader for a long time. They made all their money from the in store mini-market. All petrol stations here are essentially convenience stores with a gas station attached to get you in the door. We have had pay at the pump before, but they got rid of…

This may be the case in Australia, but it's very much not in the US. Pay-at-pump is ubiquitous. Barring outliers like Oregon, people are not used to having to interact with another person or walk away from their cars in the process of filling up their tanks. Gas stations do tend to have colocated convenience stores, but going in one is an optional part of the experience.

[deleted]

Re: Swiping left on magnetic stripes

#269

Post by bjowen »

poopypoopington wrote: post #45
drclau wrote: post #12

Why does it take so long? Where’s the bottleneck? Where I lived over the last years (two countries in Europe), I don’t even have to use the physical card. I just use contactless payments with the phone. Prior to that, it was contactless with card. Even ATMs work with contactless (not all, yet). Prior to that, it was chip. I honestly don’t even recall the time when the magnetic stripe was needed. (edit) Think of this:…

To play devil's advocate – who cares? We've had magnetic strips for decades and they work fine. Yes, they're insecure but anti-fraud measures taken by the bank can mitigate that. If this helps more stores accept payments without having a painful transition isn't that worth it? I use Apple Pay most places but I don't mind having to use a strip once in a while or if others do.

Anti-fraud measures for inherently insecure mag stripe are really tilted in favour of the big operators who can afford a well-skilled fraud shop or a provider who’ll happily charge millions per year in licence fees. The difference in fraud-to-total-dollars-transacted between a big player vs something like a credit union can be 20x, especially if there’s a major counterfeiting campaign. And it’s generally considered a social good not to make things easy for organised crime.

Re: Swiping left on magnetic stripes

#270

Post by kalleboo »

the_mitsuhiko wrote: post #14
tpmx wrote: post #6

So most of my current cards (in Europe) have 3 interaction methods: In order of decreasing readability/communication reliability: 1. Magnetic stripe 2. NFC 3. EMV The EMV ("chip") method is the least insecure, but lately all of my cards have been started oxidating. And it seems like the pogo pins in almost all readers also started wearing out too. Chip reader failures have become very common lately. It's very common…

To echo my other comment: my chip broke on my debit card and the card refused to work with magstripe only (and it was broken in a way were the NFC thing also no longer functioned). So not sure if the magstripe has any functionality in the SEPA region based on that experience.

Banks can reject magstripe use when it knows both the card and the card reader should have chip support.

I believe this is to help discourage downgrade attacks.

Post reply on HN