Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EMV Switch This Week Could Threaten Many Businesses in U.S

eweek.com

Post reply on HN
Print view View original

41–50 of 59 posts

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#41

Post by stordoff »

quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

Every ATM I've use in the UK will wait for you to remove the card before finishing the transaction (e.g. dispensing the receipt or cash you asked for). If you lose the card in the machine, a new one can be mailed to you (within two days IIRC), though this has never happened to anyone I know.

I've never seen a "Application" choice, so I can't really comment on that. Is that US specific?

Overall, I've found the UX on new cards to be a big improvement on magstripes.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#42

Post by davb »

rbobby wrote: post #39
davb wrote: post #36

Earlier quoted context omitted.

1) I agree - I think this is a regional thing. In the UK, ATMs almost always lock the card in place (typical non-corner-store ones take the entire card into the machine). 2) In the UK, most machines make you take the card out before dispensing the banknotes. Bank-owned (non-corner-shop) ATMs "spit out" the card and beep until you take the card. Only then do they dispense the cash. 3) I don't think many UK card issuer…

Same in Canada... gotta take the card and then the money comes out. Nice thing is that you never forget your card in a machine :)

Yeah. And if you do happen to enter you PIN, request cash then just walk away, the machine will furiously beep for a short time then pull the card back in ("swallow the card").

You've then got to request a replacement card from your issuer but it does limit the chance of a stranger coming along and retrieving the forgotten card and attempting to use it (for a signature fall-back transaction after damaging the chip, or for a cardholder not present - CNP - transaction).

Bank-operated ATMs will also often retain the card if it's been reported lost or stolen, but this does rob the lucky/brave checkout operator of their £50 bonus if they happen to retain a stolen card that's been used in store.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#43

Post by tyoma »

slashink wrote: post #34
creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

Fully agree, the few times i visited the U.S. it always surprised me that a country with such technological speed still relies on the "unsafe" magnetic swipe. Not saying the chip is foolproof in any way but it's a good step from the magnetic system in place. The same problems was raised when countries in the EU switched to chip but it was mostly vendors who was on old cash registers with no interfaces for the new car…

I'm curious, what happens if you have more than one credit card -- do you get to pick which gets charged?

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#44

Post by davb »

creshal wrote: post #19
pjc50 wrote: post #16

Earlier quoted context omitted.

Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.

As far as I can tell, skimmers in Germany still copy the (fallback) magnet stripe and PIN, to use those in countries that don't require EMV. It's far easier than trying to break EMV chips.

This is the case in the UK too.

When it became more difficult to use cloned magstripe-only cards in the UK, banks relied more heavily on behavioural profiling and risk analysis ("has this card been used in this country in the past?", "does this cardholder travel frequently?", "is this vendor known to have weak cardholder verification processes?").

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#45

Post by run4yourlives2 »

quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

You remove your card first, then it dispenses cash.

> Also, what happens if the power goes out or the machine crashes?

Seriously? Where do you live where the grid is this unstable?

Living in Canada, I can tell you that using my cards in the US where there are no EMV/chip readers feels tremendously insecure to me now. It's just a matter of getting used to things.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#46

Post by run4yourlives2 »

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

We've had them so long here in Canada that I can barely remember when I last used a swipe outside of visiting the US, or maybe using square.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#47

Post by davb »

tyoma wrote: post #43
slashink wrote: post #34

Earlier quoted context omitted.

Fully agree, the few times i visited the U.S. it always surprised me that a country with such technological speed still relies on the "unsafe" magnetic swipe. Not saying the chip is foolproof in any way but it's a good step from the magnetic system in place. The same problems was raised when countries in the EU switched to chip but it was mostly vendors who was on old cash registers with no interfaces for the new car…

I'm curious, what happens if you have more than one credit card -- do you get to pick which gets charged?

In this UK (at least), this is known as "card clash". You can't select which card is used. I'm not sure what the EMV contactless specification actually says, but anecdotally terminals will either fail to process the transaction (general card read error or a more specific collision message) or unpredictably select a card to charge.

Most card issuers (and companies like TfL - Transport for London, the transport authority who use contactless travel cards) recommend taking your card our of your wallet if you have more than one contactless card.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#48

Post by MrRadar »

irl_zebra wrote: post #17
QUFB wrote: post #8

Earlier quoted context omitted.

The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.

I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal." My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

> My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

Americans love credit cards and those who use them tend to have a lot of them. I personally have six credit cards and three debit cards (and, yes, I have a reason for having each card). My father has a wallet more than 1 in (2.5 cm) thick from all the cards he carries. According to the Boston Fed the average cardholding consumer had 4.0 credit cards and 1.6 debit cards in 2012[1]. Forcing people to memorize a PIN for each card they have would discourage people from signing up for more than one or two cards which would be a nightmare scenario for the credit card industry.

[1] http://www.bostonfed.org/economic/rdr/2014/rdr1401.pdf (page 92, table 11)

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#49

Post by run4yourlives2 »

tyoma wrote: post #43
slashink wrote: post #34

Earlier quoted context omitted.

Fully agree, the few times i visited the U.S. it always surprised me that a country with such technological speed still relies on the "unsafe" magnetic swipe. Not saying the chip is foolproof in any way but it's a good step from the magnetic system in place. The same problems was raised when countries in the EU switched to chip but it was mostly vendors who was on old cash registers with no interfaces for the new car…

I'm curious, what happens if you have more than one credit card -- do you get to pick which gets charged?

You are tapping the card you wish to charge in "contact-less" payment.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#50

Post by run4yourlives2 »

amalag wrote: post #3

So there is zero incentive to replace a non-emv reader. Once you have to NOT use the stripe. It is a big problem for stores. Credit cards have both so stores have to force only those transactions to the EMV. The machines need to be smart enough to figure out if the card has both and not allow the stripe transaction.

The bank has incentive. Here in Canada if I try to swipe my cards (all chip) it will deny the transaction by default.
Post reply on HN