Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EMV Switch This Week Could Threaten Many Businesses in U.S

eweek.com

Post reply on HN
Print view View original

31–40 of 59 posts

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#31

Post by weaksauce »

xenadu02 wrote: post #12
brianjolney wrote: post #5

I'm pretty sure the article has it completely backwards. If a retailer has a chip reading terminal, they aren't responsible for fraud. It incentivizes retailers to update their hardware, or face shouldering the fraud risk for chip enabled cards that they end up swiping.

You're correct. If the merchant has the EMV reader but the bank card only has a mag stripe the bank eats any fraud, period. The merchant is completely off the hook.

What happens if the reader is an EMV one but the fake bank card looks like it has a chip and it was swiped instead of using the chip? I have a debit card with the chip but I can still swipe it at the hybrid terminals. Who owns liability in that case?

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#32

Post by slashink »

quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him.

2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provider hotline, cancel that card and get a new one in the mail the day after.

3. I have never seen this but i agree this is an issue. That is a unnecessary UX roadblock.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#33

Post by davb »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

> The first transaction on each reader and random transactions every 20-50$ (and all transactions above a $20 limit) will require chip+PIN verification

Not necessarily. In the UK (at least, at the banks where my fiancée and I hold accounts), you need to enter your PIN:

1) On the first transaction after activating a new card

2) On transactions above £30 (~$45) starting 1st Sep 2015 (however apparently some terminals have the former £20 limit hard coded and require a firmware update to increase the limit)

3) On random transactions

In the case of the random PIN verification for contactless payments, the frequency with which these are required isn't entirely clear. I have spent ~£100 over numerous successive contactless transactions (local store then rounds of drinks at the bar) without requiring PIN verification. In fact, I've never needed to enter my PIN - every contactless transaction has been automatically approved.

Over a typical week, I do contact a good mix of contactless and Chip-and-PIN transactions, so my risk profile might be different from someone who has, for example, a 80/20 contactless-to-chip ratio.

I'm unsure whether the PIN verification requirement is triggered by the application running on the card or by the transaction processor. This might actually be covered in the EMV spec [1].

[1] https://www.emvco.com/specifications.aspx?id=21

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#34

Post by slashink »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

Fully agree, the few times i visited the U.S. it always surprised me that a country with such technological speed still relies on the "unsafe" magnetic swipe. Not saying the chip is foolproof in any way but it's a good step from the magnetic system in place.

The same problems was raised when countries in the EU switched to chip but it was mostly vendors who was on old cash registers with no interfaces for the new card systems. That was solved through a manual total price entry into the EMV system, acting as it own system basically.

And as the parent comment mentioned, contactless payment is just really nice for smaller transactions. The ability to buy a coffee without opening your wallet (goods under $20) makes lines in stores so much faster since no signing/code entry is needed.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#35

Post by Sanddancer »

irl_zebra wrote: post #17
QUFB wrote: post #8

Earlier quoted context omitted.

The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.

I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal." My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

Chip and pin isn't any more secure than chip and sign, and is a greater hassle. For a while, merchant banks would deny fraud claims from skimmers claiming that the victim must have let the fraudster know the pin. However, as the card has to be on the magstrip as a backup, it's trivial to clone a pin. A friend had to fight for a fraud claim on her card a few years back, with the bank giving her that line. thankfully, she is dyslexic, and has chip and sign as an accommodation, so she was finally able to get enough words in for the rep to check her account flags and realize there was no way in hell she gave a pin to anyone, because her account doesn't have a pin attached to it. Chip and sign cards have pins on them for various silly reasons, even if there is no way it would ever be used.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#36

Post by davb »

slashink wrote: post #32
quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him. 2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provide…

1) I agree - I think this is a regional thing. In the UK, ATMs almost always lock the card in place (typical non-corner-store ones take the entire card into the machine).

2) In the UK, most machines make you take the card out before dispensing the banknotes. Bank-owned (non-corner-shop) ATMs "spit out" the card and beep until you take the card. Only then do they dispense the cash.

3) I don't think many UK card issuers use multiple applications for the same context. That is to say, if you put your card into an ATM, only one application is likely to be compatible with that profile. There may be other applications for travel (ITSO, for example, is a travel card standard built on Global Platform). I think every EMV terminal has support for application selection menus (usually in the form of little buttons along the side of the screen) but they're virtually never used in the UK.

In my experience while travelling, US payment terminals are the most unusual.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#37

Post by cbhl »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

In Canada, EMV and NFC rolled out at around the same time -- EMV gets used for big transactions where you want PIN auth, and NFC gets used for low-risk transactions like buying a coffee.

There was definitely a learning curve for figuring out the new terminals at first (some PoSes required both swiping and using the chip), but that only lasted about a year or two.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#38

Post by cbhl »

weaksauce wrote: post #31
xenadu02 wrote: post #12

Earlier quoted context omitted.

You're correct. If the merchant has the EMV reader but the bank card only has a mag stripe the bank eats any fraud, period. The merchant is completely off the hook.

What happens if the reader is an EMV one but the fake bank card looks like it has a chip and it was swiped instead of using the chip? I have a debit card with the chip but I can still swipe it at the hybrid terminals. Who owns liability in that case?

Once I used my chip cards in a reader in the US, and was told, "this is a chip card, please insert it into the bottom" so there's definitely a bit that can be set in the magstripe to tell the PoS that a chip should be available in case you clone just the magstripe.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#39

Post by rbobby »

davb wrote: post #36
slashink wrote: post #32

Earlier quoted context omitted.

1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him. 2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provide…

1) I agree - I think this is a regional thing. In the UK, ATMs almost always lock the card in place (typical non-corner-store ones take the entire card into the machine). 2) In the UK, most machines make you take the card out before dispensing the banknotes. Bank-owned (non-corner-shop) ATMs "spit out" the card and beep until you take the card. Only then do they dispense the cash. 3) I don't think many UK card issuer…

Same in Canada... gotta take the card and then the money comes out. Nice thing is that you never forget your card in a machine :)

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#40

Post by davb »

Aardwolf wrote: post #28

Yep had chips for decades already in Europe (it's not called "EMV" here though, just a chip afaik). I don't know who is liable in Europe for fraud (shop or bank), but, about the article, I find it odd, the chips should be more secure, so why are banks giving the responsibility of fraud to merchants while not for the insecure magstripes? The banks should be able to trust their own chips right?

It is indeed called EMV here, it's just not marketed as such. EMV stands for Europay, Mastercard and Visa - the original consortium who agreed the smartcard payment standard. In the UK it's marketed as "Chip and PIN", but it's all EMV.

The specifications are all available online too [1] and make for an interesting, if involved, read.

EMV are responsibly for a number of specifications, including "Chip and PIN" style payment, contactless (NFC) and CAP (Chip Authentication Program - a two factor system where users are given self-contained challenge/response card readers with which virtually every EMV card is compatible).

https://www.emvco.com/specifications.aspx

Post reply on HN