
Testing the Limits of Credit Card Signatures (Part 1) - chaosmachine
http://www.zug.com/pranks/credit/
======
scorxn
The trouble is that most of these "pranks" boil down to testing the attention
of service-level employees of corporations. They don't give a shit, and
shouldn't, given the realities of filling as many orders as possible during a
shift.

------
ccarpenterg
Signature is only required when a compliance process has begun. So, for
example, when you check your transactions and see one that you can't recognize
then you call your bank and object that trx. In that moment the bank ask for
the physical documents and may check your signature, but it depends on the
rules of your card operator (Visa, MasterCard, Amex).

~~~
philwelch
But that opens up an obvious scam:

1\. Buy something with your credit card

2\. Sign with a false name

3\. Contest the charge

4\. Get a refund--keep the merchandise.

~~~
MichaelApproved
There are lots of soft was to scam the system. The question is are you that
type of person? Is that the life you pick? Running small scams hoping you
won't get caught. Focus your energy on building something useful. You've
already completed step one of that process "read hacker news."

~~~
philwelch
Don't worry--having the mindset and creativity to think of ways to break the
system aren't always bundled with the inclination to actually do them. I have
better ways of applying my creativity. I suspect I just have what Schneier
calls a "security mindset":
[http://www.schneier.com/blog/archives/2008/03/the_security_m...](http://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html)

------
chaosmachine
Be sure not to miss part 2, where the author takes things to the next level...

<http://www.zug.com/pranks/credit_card/>

~~~
bmalicoat
That ended up being kinda mean to that Circuit City salesman. He probably
thought he was making the sale of his life.

------
Judson
Its more like testing the limits of the "next" button (since the article is
broken down into 5-6 pages).

------
rabble
It's because the signatures aren't used as a security system in the first
world. Here in South America i get checks and credit card receipts rejected on
a pretty regular basis because my signature is slightly off. By which i mean,
i didn't make the curve of the P the same way. Believe me, i prefer they
didn't check.

When i complain, they offer to let me put each variation of my signature on
file, so i could have several which pass the test.

~~~
isleyaardvark
I was all set to agree with you, but then I looked up VISA's Merchant
Agreement online [pdf]:
[http://usa.visa.com/download/merchants/rules_for_visa_mercha...](http://usa.visa.com/download/merchants/rules_for_visa_merchants.pdf)

I was surprised to see on page 28 that it is considered a security feature.

------
lionhearted
I've done stuff like this - just made a smiley face on the sign line. Never
had a problem with it. It's funny though, occasionally at a very official
place I've had a staff member say my real signature that matches all my ID is
too messy and ask me to write down my name beneath it in print. That happened
to me at at least one or two consulates over the last few years when applying
for visas.

Also, I remember one time a friend got a 250 euro ticket driving through
Austria, and I thought it was nonsense. He was speeding sure, but I think they
inflated it by more than it was, and they said he had to pay on the spot or
they wouldn't let him go. If I was in that spot, I think I'd write "Coerced
Void" in artful cursive on the receipt and protest it later with the credit
card company.

------
ghshephard
Anything under $25 no longer requires a signature anyways. I suspect that
number will just keep getting larger.

All my credit cards are disabled the instant I take them out of my normal
buying pattern, and even RedBox makes me enter my zipcode to rent a $1. movie
on the CC, so there are clearly more effective mechanisms to preventing fraud
than signature verification.

------
nzmsv
Most cashiers hand my card back to me with the receipt to sign, and can't
verify my signature. But many stores are now switching to using a PIN with
chip cards, at least here in Canada. And Europe's had chip cards forever now.
In fact, some places there no longer even have machines to read a magnetic
stripe.

~~~
RK
What's the advantage of chip + PIN over stripe + PIN?

~~~
scottallison
In the first full year after chip & pin became mandatory in the UK card fraud
in stores dropped by 47%. While retailers can still accept signatures, if they
do so they are not guaranteed the funds. Before the change, if the signature
matched then they got the funds regardless. Now the only way to be sure you
get paid is to accept PIN authorised transactions.

What this article doesn't say is that a lot of stores ask for ID when paying
by card... something that always surprises me; this NEVER happens at home.

------
nakkal
I have drawing a straight line for all my CC transactions for the past two
years and no one has bothered about it.

I think this will automatically phase out automatically with new technologies
like RFID...

------
tbgvi
In most cases the only time a signature gets looked at is if someone is
contesting a charge. The CC processor would ask the store for a record showing
that they actually made a purchase.

In the end, signatures are really there to protect the store not you. It's in
their best interest to have you sign with your actual signature. If you signed
as Donald Duck and then contested the charge they'd probably have a hard time
proving it was you and they'd lose money.

------
olliesaunders
While I was working in a supermarket on the till I once contested a signature.
This women's signature didn't match the one on the back of the card one bit.
So I said "Can you sign that again please", and she did, but it still didn't
match. Then I said "these signatures don't match at all" and she got all
shirty with me, at which point I decided I wasn't being paid enough to care
and just put it through anyway.

------
sliverstorm
Just the other day I went out and bought gas at a gas station for my friend's
bike, with his credit card and his cell phone in my pocket. (He got his
licence the next day)

The scanner didn't work so I had to go to the counter, and had to fake a
signature. Nobody even batted an eye. It was exhilarating, and unnerving at
the same time...

Maybe I should just chalk it up to my mind-busting ability to play it cool?

~~~
sliverstorm
(just kidding about that last bit!)

------
wanderr
The Lowes self checkout is annoying because you have to switch back and forth
from the touch screan to the credit card pad thing several times, so by the
time it wants me to sign, I just write something vulgar. It's never been a
problem.

------
nkohari
IANAL, but legally, any mark you make with the intent of signing is a
signature. I guess you could claim after the fact that it wasn't you who
signed the receipt, though...

------
thinkcomp
We're working on fixing this issue. Fortunately, I think our system works
better.

<http://www.facecash.com>

~~~
ericd
Your site looks gorgeous, but I think your tagline and copy could use some
serious work. After I read "The future of payments has arrived" I had no idea
what your product does, and you failed my 5 second filter. Since I wanted to
maybe suggest an alternative, though, I spent some more time to figure out
what you product does by reading the bottom. _I still couldn't figure out what
your product does._ Does this thing link my face with my credit card somehow?
Why on earth would I share banking details with you if I have no idea what the
benefit will be. Why no about page, at least?

~~~
thinkcomp
Thanks for the feedback. We were hoping that people would be intrigued by the
photo of the product (the same image where you read the tagline), and then
click on one of the links below
(<https://www.thinklink.com/index.html?more=1>), but you're right that it's
not clear enough. We'll work on it.

For the record, what it is: a pre-funded alternative payment system that uses
your phone, a barcode, and your face to eliminate the need for a plastic card
at the point of sale. Hence no crazy signature problems.

~~~
ericd
Ah OK, I didn't see those. I think a horizontal nav with About, Signup, etc.
would do wonders, at least for those that expect an about page. A more
explanatory tagline would help too, though. Thanks for the clarification.

How do you all plan to get around the very high hurdle of getting high
penetration of point of sale systems that are compatible and can show a
picture of someone's face? There're a lot of legacy systems out there... Don't
mean to bust your chops, just curious. Could do phone-based required
authorization instead, which would at least remove the picture requirement?

------
froo
I've often tested the limits of credit card signatures to the point that I now
regularly pose as several Disney cartoon characters.

------
metaprinter
forget credit cards, my name has been misspelled on my driver's license since
i can remember, spanning 2 states and 1 decade. I've never been asked about
it. Not when i bought my house or started a business or opened credit... no
one cares.

------
aneth
Signing a credit card receipt is not for signature verification. You are
signing a contract that you agree to pay under the terms of your card
agreement. Therefore, it doesn't matter how you sign as long as it was you. If
you sign a multimillion dollar recording contract with a smiley face, you are
still agreeing to the terms of the contract. Your signature doesn't have to
match anything.

If signatures were for verification, then they wouldn't have you sign the
back. That would be like writing your login on post-it note stuck to your
computer.

