Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EMV Switch This Week Could Threaten Many Businesses in U.S

eweek.com

Post reply on HN
Print view View original

11–20 of 59 posts

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#11

Post by larzang »

coleca wrote: post #2

I guess I'm not surprised by the lack of EMV capable card readers I still see in the US. Having worked in this space in the past, I am always checking out the payment terminals at the stored I visit. I've even seen some larger merchants that I frequent upgrade their PIN pads recently but to non-EMV capable models. If the big-box stores aren't getting it done there is little hope for the mom & pop type stores who will…

The business I work for uses Square, who are rolling out EMV+NFC readers soon and are covering liability in the meantime, which is nice.

Weirdly a couple months ago my local 7-11 upgraded to readers which have the physical EMV slot but those slots are non-functional.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#12

Post by xenadu02 »

brianjolney wrote: post #5

I'm pretty sure the article has it completely backwards. If a retailer has a chip reading terminal, they aren't responsible for fraud. It incentivizes retailers to update their hardware, or face shouldering the fraud risk for chip enabled cards that they end up swiping.

You're correct. If the merchant has the EMV reader but the bank card only has a mag stripe the bank eats any fraud, period. The merchant is completely off the hook.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#13

Post by wnissen »

QUFB wrote: post #8
amalag wrote: post #3

So there is zero incentive to replace a non-emv reader. Once you have to NOT use the stripe. It is a big problem for stores. Credit cards have both so stores have to force only those transactions to the EMV. The machines need to be smart enough to figure out if the card has both and not allow the stripe transaction.

The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.

The first few times it was really slow, but recently it's only added a couple seconds to the transaction. I really think this will be a non-issue in a couple months.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#14

Post by heywire »

larzang wrote: post #11
coleca wrote: post #2

I guess I'm not surprised by the lack of EMV capable card readers I still see in the US. Having worked in this space in the past, I am always checking out the payment terminals at the stored I visit. I've even seen some larger merchants that I frequent upgrade their PIN pads recently but to non-EMV capable models. If the big-box stores aren't getting it done there is little hope for the mom & pop type stores who will…

The business I work for uses Square, who are rolling out EMV+NFC readers soon and are covering liability in the meantime, which is nice. Weirdly a couple months ago my local 7-11 upgraded to readers which have the physical EMV slot but those slots are non-functional.

Most retailers started with the hardware upgrade, which generally has to be followed up by a software upgrade to enable the processing of an EMV transaction. Depending on the level of integration with the payment network, the software changes required at the Point of Sale can actually be pretty complex.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#15

Post by heywire »

brianjolney wrote: post #5

I'm pretty sure the article has it completely backwards. If a retailer has a chip reading terminal, they aren't responsible for fraud. It incentivizes retailers to update their hardware, or face shouldering the fraud risk for chip enabled cards that they end up swiping.

Agreed. The simplest way I've heard it described is that whoever has the lowest level of EMV support is liable. So if the bank hasn't issued you a chip card, but the retailer supports it, the bank is liable. Likewise, if you have a chip card, but the retailer doesn't have the EMV readers, the retailer is now liable -- and that is where the change is.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#16

Post by pjc50 »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#17

Post by irl_zebra »

QUFB wrote: post #8
amalag wrote: post #3

So there is zero incentive to replace a non-emv reader. Once you have to NOT use the stripe. It is a big problem for stores. Credit cards have both so stores have to force only those transactions to the EMV. The machines need to be smart enough to figure out if the card has both and not allow the stripe transaction.

The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.

I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal."

My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#18

Post by cpwright »

coleca wrote: post #2

I guess I'm not surprised by the lack of EMV capable card readers I still see in the US. Having worked in this space in the past, I am always checking out the payment terminals at the stored I visit. I've even seen some larger merchants that I frequent upgrade their PIN pads recently but to non-EMV capable models. If the big-box stores aren't getting it done there is little hope for the mom & pop type stores who will…

Yesterday, for the first time Home Depot's reader required inserting my card as opposed to just a swipe.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#19

Post by creshal »

pjc50 wrote: post #16
creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.

As far as I can tell, skimmers in Germany still copy the (fallback) magnet stripe and PIN, to use those in countries that don't require EMV. It's far easier than trying to break EMV chips.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#20

Post by darkr »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

More like 10 years. UK + Europe rollout of chip+pin/EMV + incentivised liability shift was around 2005/2006, and has reduced card fraud by around 70% in most countries. Contactless/NFC payment facilities have been pretty widespread (at least in the UK) since 2010 or so, and since the last couple of years or so are pretty much ubiquitous.

I suspect that America being so backwards in this respect has a lot to do with the power and influence wielded by corporate lobbyists in congress.

Post reply on HN