
Why You Still Can’t Use a Chip Card Everywhere - prostoalex
http://www.slate.com/articles/technology/future_tense/2016/07/why_you_still_can_t_use_a_chip_card_everywhere.html
======
furyg3
Here in NL there's been chip and pin for forever, and 'signing' for a
transaction is laughable from a Dutch perspective. Chip + PIN is everywhere,
to the point that many merchants don't even accept cash anymore, too much of a
liability and hassle. Nor do most places accept credit cards... Chip+PIN is
authenticated and secure (online, no offline mode is supported), the merchant
fees are low (€0.05/transaction or lower), and the transaction is immediate
and not reversible... no dealing with chargebacks.

If you can find a place that takes credit cards, the dutch cards will also use
Chip+PIN. Non-PIN credit cards (mostly americans) can swipe, but they'll
almost certainly have to enter their PIN... In the many times I've used my US
CC in NL I've never had to sign.

Now that RFID transactions are becoming more popular it will be interesting to
see how this all develops.

~~~
Symbiote
Are you sure no offline mode is supported for Chip+PIN cards?

I don't know about the Netherlands, but it's typically used where the risk is
low, or making on-line transactions is inconvenient. For example, paying for a
train ticket on-board a train (data signal is unreliable, the real loss to the
train company is negligible) or buying fast food.

~~~
sean-duffy
I'm pretty sure offline is supported, unfortunately in the UK despite this
some train services have online-only chip+PIN machines in their buffet car,
forcing you to wait until they get good signal to pay for your food!

~~~
gadders
I think normally cards get a limit of offline transactions before they have to
do an online one. I think it's about 7 or so before an online transaction is
"forced".

~~~
tomw2005
This seems about the correct number. It is similar to how the contactless
support works. You are forced to use the traditional Chip and Pin method
occasionally. It seemed to be about 5 transactions for contactless initially
but I feel they have increased the limit now.

------
lb1lf
It is amusing how different expectations are in Europe and in the US; I still
remember the first time I went to the US (2001, methinks).

The first time I used my credit card and they used one of those card imprint
thingies and asked me to sign, I naïvely thought they were trying to con me.

In fairness, though, my native Norway was a quite early chip adopter as the
banks had to bear the cost in case of fraud as long as the user had not
exhibited gross^2 negligence - my first debit card (1993) was chipless, but
the 1995 replacement had a chip - whose use was voluntary at first, then
enforced a few years later.

------
_Wintermute
Can anyone explain why the US is so far behind in this case? It seems bizarre
that you have apple/android pay used alongside magnetic strips and signatures.

~~~
gambiting
Because in US, signature fraud is still on the bank, not on the merchant. So
to give you an example - someone steals your card, goes to a shop, signs the
receipt and walks away with the goods. Now if you report your card as stolen
to the bank, the bank will refund you, but the merchant also keeps the money.
So merchants have no financial incentive to upgrade their terminals, because
card fraud does not impact them.

Now the same situation in the UK - you report your card as stolen, the bank
refunds you, but also takes the money away from the merchant(saying that the
responsibility to check the signature was on them and they failed, so they
lose the money). As a result, almost no one in UK accepts signature-only
cards, because you could literally buy something, sign the receipt, walk out
and report the card as stolen - and the merchant loses all the money. So
merchants had all the incentive to upgrade their terminals to chip-and-pin
only, terminals which can take magnetic-strips are just super rare and usually
not supported even if the machine has them.

edit: it looks like signature fraud in US is not always on the bank. My
mistake, sorry.

~~~
lentil
> almost no one in UK accepts signature-only cards

> terminals which can take magnetic-strips are just super rare and usually not
> supported even if the machine has them.

I've not found this to be the case. I used a non-chip US card here in the UK
extensively over the last year or so, and I've never once encountered a
merchant that didn't want to take my card, nor a terminal that didn't read
magnetic strips.

I do find people at checkouts to be a little surprised by someone having to
swipe & sign, since that's quite rare now. And often they had trouble finding
a pen for me to sign with :) But I was always able to complete the transaction
nonetheless.

~~~
gambiting
Really? I had my Polish-issued signature-only card with me here in UK just a
few years ago and the only place that would take it was the post office -
every supermarket I tried just refused(I had one instance where I convinced
the cashier to just try swiping the card and it did actually work, to her
surprise, but in most places it was just a flat out no).

~~~
aninhumer
If you're Polish, this might just be xenophobia.

I can imagine a cashier just rolling their eyes at an American using a weird
card, but being much more distrustful of a Polish person doing the same.

------
bogomipz
And yet your new American "chip card" still won't work in Europe when you need
to do something important like buy a train ticket at the airport when you
land. There was a moment when the US could have joined the rest of the world
but decided not to.

This article seems to have ignored the real reason why the US opted for "chip
and sign" instead of "chip and pin". The thinking was that if Americans had to
remember a PIN for all of their credit cards they would likely narrow their
credit card usage to a single card - the one they memorized the PIN for rather
than using one of the 3 or 4 other cards they posses.

And I just had to laugh at this:

“Consumers may think that it feels a little bit longer because the card is in
the terminal the whole time instead of just swiping it and sticking it right
back in your wallet,” said Stephanie Ericksen, Visa’s vice president of risk
products. “But the actual transaction itself is taking the same amount of
time. It’s just that you’re watching your card be there while the information
is going out and coming back.”

Total BS. The actual "transaction time is on the order of milliseconds , the
time spent waiting for those milliseconds is closer to 20 to 30 seconds.

~~~
Symbiote
If your transactions take 20-30 seconds, something is badly wrong with the
communications infrastructure in the shops you are using.

In Europe, from pressing "OK" after typing in a PIN, it takes about 2-5
seconds before the card can be withdrawn.

~~~
wichert
For larger stores which have a basic always-on internet connection it will be
much faster. In my experience 2-5 seconds is what you see for mobile devices
that use 2G or 3G, or places that still use some form of dial-up for every
transaction (ISDN still exists..).

------
magoon
The dirty little secret is that banks make money off online Card Not Present
fraud. They take back the money from the merchant and charge a $35 fee.

In-person fraud is much lower, so this transition to chip readers is just
increasing their bottom line by 1) sticking it to retail merchants who don't
upgrade their systems; and, 2) making money off required system upgrades.

~~~
dfcowell
Merchants can mitigate that risk by requiring use of a bank operated
verification system like Verified by Visa or Mastercard SecurePay or the Amex
one which escapes my memory right now. You set a password on the card via your
internet banking which is required for card-not-present transactions.

------
tzs
What fraction of the chip and pin cards use tokenization?

------
iamleppert
The chip & pin system, at least technically, is a disgrace. It easily takes
2-3x the amount of time a swipe would take, and most merchants still make me
enter my PIN as well as sign. The chip readers are prone to malfunction, and
I'm sure they will be cracked in due time.

What's worse is you can still do a transaction without a PIN, leaving open the
opportunity of someone just stealing your card. The only fraud this really
prevents right now is copied cards.

It's crazy to me the payments industry can get away with charging $500 for
these card readers too. Most chip readers I've seen still have to dial up to
charge a card.

~~~
seszett
> _It easily takes 2-3x the amount of time a swipe would take_

I don't know, unless the terminal has a bad connection it usually takes less
time than writing a signature, even in online mode.

> _The chip readers are prone to malfunction, and I 'm sure they will be
> cracked in due time._

The technology has been in wide use for _decades_ in Europe. I'm pretty sure
the existing chip readers aren't very prone to malfunction, unless for some
reason the US is completely redeveloping everything from scratch.

Also, they haven't been cracked yet as far as I know.

~~~
choko
For what it's worth, most transactions don't require a signature. They only
time I've had to sign when using my debit card is when the transaction is in
the 100s (not sure of the exact amount).

