

EMV and Chip cards - excid3
https://squareup.com/emv

======
pzb
This is a great move to help reduce fraud for their US merchants, but even
more important is it expands their potential market. Adding a chip reader
opens up the rest of the world.

However, I'm still not sure how they will handle the PIN part of Chip and PIN,
as the usual requirement is that the PIN is entered on a dedicated Pin Entry
Device which then only presents the unlocked smart card to the merchant
register.

~~~
martinald
I think this only handles chip and signature cards, which is pretty useless.

Does anyone know if people can use chip and pin cards but only sign for them?

~~~
esej
If the card supports it. Simplified: the card/chip has a list of "cardholder
verification methods" ordered by preference If the terminal/reader supports
one of these methods, the card/chip will use it.

Some cards are pin only - notably most of Maestro, Visa Electron and V-PAY
cards.

A lot, a majority?, of chipcards issued in the U.S. prefers signatures - I'm
uncertain what the percentage is for which doesn't support pin at all.

~~~
techsupporter
What's really frustrating is the preference for signature. It makes almost all
US chip cards useless outside of the US and Canada because, for whatever
reason, standalone terminals and even some online POS pads will trip over the
"signature preferred" bit. It also means that cards like you list are not
usable at a signature-only terminal, even one like SquareUp that can do
online, live verification.

Why can't the US financial system just _follow_ the rest of the world for
once?

~~~
otterley
I haven't run into the "signature preferred" problem yet with automated PoS
terminals. Where did you run into this issue? I had no problem buying train
tickets with my US-bank-issued EMV card at AMS airport using my PIN.

~~~
techsupporter
If I may ask, which bank issued yours? My (former) JPMC card didn't work at
any unattended terminals like Luas stops in Dublin. When I went to some stores
and used the PIN pad, the terminal spit out a paper for me to sign. I'm
looking for a card that is confirmed to work as a PIN-primary card. So far,
only the State Department FCU seems to have one.

~~~
otterley
Mine is a Barclaycard Arrival+
([http://www.barclaycardarrival.com/](http://www.barclaycardarrival.com/)). It
is not a PIN-primary card, but it absolutely works in PIN mode at automated
PoS systems.

PenFed
([https://www.penfed.org/visasignaturepoints/](https://www.penfed.org/visasignaturepoints/))
also offers a true chip-and-PIN EMV card in the US (again, signature priority,
but I've verified the PIN works at PoS).

I don't think your JPMC card has a PIN assigned to the chip. Its PIN can only
be used at an ATM to get a cash advance.

~~~
martinald
Barclays is a British bank fwiw. They're likely to have all the infrastructure
in place.

------
wwarren
As a british immigrant to North America, I couldn't believe how far behind in
this regard the States and Canada were. Canada has since caught up, but the US
is only now getting there.

Anecdotal story: the only time my credit card has been defrauded is after a 3
day stay in the USA

~~~
Drilz
I have read that after the EMV system was introduced in the UK the fraud rate
actually went up.
[http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext](http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext)

~~~
kaoD
> Log in to Read the Full Article

Care to explain how and why the fraud rate went up?

Chip and PIN cards are widely deployed here in Spain, and all cases of fraud
around me involved drunk people not covering the keypad when entering their
PIN. In ATMs there's a nice animation of a hand covering the number pad, but
not on POS (LCD displays just say "Enter your PIN"), and many people are
careless or forget to do so.

I used to hear more cases of CC fraud back when magnetic strips were used, but
I might just be biased.

~~~
runeks
It's worth noting that because you add this chip, it doesn't necessarily mean
you remove the magnetic stripe.

My VISA (issued by a Danish bank), has both a chip and the magnetic stripe.

~~~
robin_reala
That’s pretty much just so the card is usable in the US if you travel there
though.

~~~
runeks
And also when the card reader in the store here in Denmark says "Use the
magnetic stripe!" for some reason.

------
brotchie
I wonder what their plans are for NFC / PayPass / PayWave? Are there
technological barriers to it? Could a NFC enabled Smartphone act as a payment
terminal?

It's only on rare occasions now that I have to even put in a pin (in
Australia), NFC style payment terminals are pretty much ubiquitous.

NFC payments in 80-90% of stores, many parking machines, >50% of vending
machines.

~~~
mpclark
I'm not an expert on this area but I believe NFC smartphones can't currently
act as payment terminals because PCI rules mandate that such things should be
self-contained single-purpose devices with their own PIN pad.

However, the game could change completely with the move to tokenization.

That's really cool that contactless is so ubiquitous in Oz. As a nation you
guys are very much ahead of the game on the whole contactless/NFC thing.

~~~
mootothemax
_I believe NFC smartphones can 't currently act as payment terminals because
PCI rules mandate that such things should be self-contained single-purpose
devices with their own PIN pad._

The NFC cards, SIMs, keyfobs etc. don't necessarily require a PIN here in
Poland; you're good for ~$15 USD (50 PLN).

If you need to pay more than that, you then have to enter your PIN as you
suggest.

Limits the use cases to corner-shop-equivalent purchases, still quite a large
market!

~~~
bryanlarsen
In Canada, some merchants are now accepting NFC payments without PIN for up to
CAD200 (USD180). When they first arrived, limits were typically more like $25.

------
sisk
A couple of data points:

American Express sent me a new card—unprovoked—about two months ago that is
chipped. As mentioned elsewhere, it is a chip and signature card (as opposed
to a chip and pin). I'm nothing particularly special as a credit card user so,
if I received a card, seems the roll out has already well underway.

Another point is, as mentioned elsewhere, PayPal already offers a chip and pin
compatible bluetooth device in a few countries marketed as part of their
PayPal Here brand[0].

[0] - [https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-
here](https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-here)

~~~
Nursie
IIRC the bank->merchant liability shift for the US is scheduled for sometime
next year. The banks can't very well shift the liability if they haven't given
their customers the new cards!

------
unwiredben
It looks like they're not able to power strictly off the audio jack anymore
with this tech. The product brief indicates that it uses a MicroUSB charging
connector. I wonder how many transactions a single charge can handle.

~~~
Nursie
I'll be impressed if they've somehow managed all the data flows over the audio
jack, personally... some sort of built-in modem?

------
prattbhatt
Seems they want to sell the EMV card readers instead of providing them for
free.

~~~
runeks
Honest question: does Square save money if credit card fraud decreases? It
would make most sense that the parties who lose money when fraud occurs would
offer these devices for free, or subsidize them, and I'm unsure of whether
Square is one of these parties.

------
stuaxo
Can't imagine not using these ... the only problem is the cards are weaker and
the chip starts to come out.

(Only if you don't use a wallet)...

------
foobarqux
And still no NFC.

~~~
oddevan
If NFC ever takes off as a must-have in the payments world, I'm sure Square
would try to use the NFC in phones through their app.

But given that they've already tried a "Just use the app, forget your wallet"
approach that didn't take off like they wanted, I'm guessing they're not ready
to try anything outside of mainstream payment cards.

~~~
bryanlarsen
NFC (specifically PayPass, PayWave & Interac Flash) is becoming fairly
ubiquitous in Canada.

~~~
reaperhulk
How is your experience with the reliability? I was recently up in Edmonton and
anecdotally it seemed like people had serious issues with the NFC payment
methods. Several times I saw people attempt to pay via NFC, try 5 times, then
eventually pay via insertion+PIN. Looked profoundly frustrating.

~~~
madeofpalk
In Australia, I would say about at least 75% of all in-person payments I make
are with PayPass/PayWave. That other 25% is cash and the odd place that hasnt
updated their terminals yet. Some banks will even give you like a 5% cash back
if you use contactless.

It's very reliable and is the defacto method of payment in places like pubs.
Often I'll hand my card over and they'll ask 'Can I just PayWave that?'

------
powertower
After reading the wikipedia article on this, these cards seems to be full of
fallback mechanisms that make them virtually useless for more advanced
protection but in only a few constrained situations, and it's biggest benefit
is that it allows MasterCard and the others to shift liability of fraud from
the Bank to the merchant and the customer.

~~~
Nursie
Nope.

It allows the shift in liability to the _merchant_ if they don't perform a
chip transaction.

Fallback is at merchant discretion, if they want to take transactions under
those circumstances then that's their risk.

Other than that, no EMV is not perfect, but it's a DAMN site better than the
everything-in-the-clear magstripe. Did you read the linked article about fraud
levels?

