
Home Depot Files Antitrust Lawsuit Against Visa, MasterCard - ikeboy
http://www.wsj.com/articles/home-depot-u-s-credit-card-firms-slow-to-upgrade-security-1466000734
======
kylecordes
It seems to me that these alternatives (Chip & sign, chip and pin, carrying a
credit card at all) all compete poorly with the "tap my phone to pay"
offerings. I use the latter whenever and wherever it is offered. As I
understand it offers greater security than any of the above, and more
importantly (life is short) it is much faster. (Though there is one wrinkle.
Most point-of-sale systems process phone payments with just the tap. A few of
them seem to instead treat it as equivalent to a swipe, and then launch you
into a legacy multistep handshake thereafter.)

For reasons I don't understand, the credit card makers have spent many years
bringing the new chip cards to market, they include much higher technology
than ever offered before, yet the payment process takes much longer. Of course
these few seconds don't matter that much per transaction, but think it might
be enough to actually make a meaningful difference in staffing levels and line
lengths at big stores in December.

I do understand the fees though. The credit card brands and banks have worked
themselves, through years of diligent effort, into a business where they can
impose a kind of "tax" of 3% on most of the retail economy across the entire
US. This is obviously of immense economic value to them, and they will work
very hard at every level to maintain it for as long as possible. On the other
hand, paying these companies a 3% tax on every retail transaction is... rather
surprising in the grand scheme of things, and seems unlikely to persist for
that much longer.

~~~
buro9
This must be a US only thing.

In the UK nearly all cards can be used for contactless payments below a fixed
amount (£ 30 at the moment).

Additional security (inconvenience) only kicks in on higher price purchases.

Additionally, there is no time delay for contactless, and chip and pin is
extremely fast too.

Contactless is far faster than even unlocking your phone (even if you use a
fingerprint unlock), and can usually be done concurrent to the cashier putting
your item in a bag or reaching to pass it to you... it is essentially
frictionless.

This all works so well I find myself doing something I never though I would...
I've abandoned cash. Contactless payments are that good, and fast, and work at
the end of the day when my phone is out of battery, and works for every one of
my daily casual purchases (travel, food, a book, some toiletries, some
groceries, etc).

~~~
dnlbyl
Contactless cards did exist here in the US a number of years ago. I had one
from Chase. Then around 2014 when it expired, the replacement card did not
have contactless payment anymore. According to this article it was simply a
lack of demand: [http://www.digitaltransactions.net/news/story/Chase-To-
Disco...](http://www.digitaltransactions.net/news/story/Chase-To-Discontinue-
Its-Blink-Contactless-Card_-But-It_s-Unlikely-To-Slow-EMV-Migration)

~~~
knz
Lack of demand or lack of interest from the banks to invest in the
technology/security? I'd love to know why the US adopted "Chip and Signature"
rather than "Chip and Pin". Requiring a signature is essentially worthless. My
understanding was that it was a combination of US customers not being familiar
with using a PIN and concern over where the liability lies if fraud occurs
(the assumption being that if someone uses a PIN then the card owner gave them
the PIN).

~~~
Amezarak
I don't think chip and signature is a requirement - most places seem to ask
for a PIN rather than a signature.

Just swiping the card, however, also works just fine and I now use it
everywhere again because I can't be bothered to remember and type in yet
another passcode. Just more friction in the process.

~~~
phil21
> most places seem to ask for a PIN rather than a signature

That is for debit, which is an entirely different thing than credit.

There are no US banks that implement Chip & PIN. Heck, it's nearly impossible
to get a Chip & PIN capable card for travel if you have a US issuing bank.

Swipe support will in theory eventually be disabled (e.g. authorizations
declined by your issuing bank) at some point in the future when Chip &
Signature is being rolled out.

If you're typing your PIN code into a terminal in the US, you are using debit
though.

~~~
saluki
Here US, some stores when using a chip credit card (not debit/checking account
btw) requires a pin instead of a signature, not sure if they call it a pin but
it's 4 digits to verify purchases . . . instead of signature.

~~~
dec0dedab0de
I have never heard of a US credit card using a PIN. May I ask what kind of
card you have?

~~~
Amezarak
I have a MasterCard that takes a pin. I've been asked to enter the pin at
several places, including WalMart. It is a credit card, not a debit card.

Frankly, I'm baffles by these claims that US cards don't work with chip and
pin because so far, if I use the chip, I have been required to use the pin.

I also have a corporate amex with a pin set up, but I've never used it.

------
FollowSteph3
I'm surprised the discussion isn't focused on the 3% fee, it's almost not
discussed. Think about that, that's 3% of all retail transactions for
electronic processing. And their not even liable for charge backs, that's paid
by the vendor.

Another thing to realize, most credit cards have some kind of reward program
that amounts to about a 1% payout. That's coming out of the transaction fees,
which if you do the math is actually being paid for by the merchant. If the
fees were 2% there would no longer be rewards programs. I find that
interesting. The retail world is being taxed to pay the credit xard reward
programs of their customers. Makes you think a bit doesn't it ;)

------
Adutude
It would be nice if hacker news did not accept links to pay-walled sites

~~~
roasm
You can also click on the "web" link at the top of this page just under the
title of the article. That does a Google search for the article and that lets
you in.

~~~
dmix
Wow how have I not known of this. Is it new? I've been here forever and never
noticed that.

~~~
Sniffnoy
I think it's relatively recent. A few months old I think? No more than a year,
I'm pretty sure.

------
elthran
Are there any Americans here who are able to explain why the US is so
backwards when compared to European countries?

Visa and Mastercard and the banks all offer Chip and Pin services here in the
UK, and have done for years.

I can understand the delay in adopting chip cards, with the ridiculously large
number of terminals and cards that would have to be replaced - but I really
don't see why when you're performing the migration to cards with a chip, you
wouldn't implement PIN at the same time

~~~
tdicola
The US is much larger than individual European countries and has an order of
magnitude more credit card readers, etc. in circulation. Every single one of
those had to be updated to use the new system.

~~~
hackuser
The US therefore loses the economy of scale. Also, the US didn't even start
before the tech had already been deployed across Europe.

~~~
kbenson
Partly that's because the US banks didn't think the EU standard was secure
enough. They were proven somewhat right when a fraud ring found a way to
bypass some of the authentication[1]. Long story made short: The EU system did
something like authorizing the pin to the card using the chip, but not
requiring the bank to authenticate, which allowed the terminals to function
without a network connection. Criminals inserted the chip from one card over
the chip from another, intercepting the pin authentication request to the card
and allowing it, and then allowing the transaction to proceed against the
regular card. This would not work in the US where all the requests are
verified by the bank over the network (which is why it takes longer).

That the US card industry is trying to move away from requiring a pin is
somewhat strange, but I think can be explained by different people weighing in
at different stages. Engineers nixed the EU type system as not secure enough,
and then different company decision makers start pushing for no pin, to make
sure they don't see a dip in usage. What you end up with is this.

1:
[https://news.ycombinator.com/item?id=10414375](https://news.ycombinator.com/item?id=10414375)

------
teilo
The good news is that upgrading all these terminals to chip will make chip-
and-pin a simple matter of a software update.

I don't know if it was a matter of profit so much as fear of customer
alienation. First they get customers used to using the chips. Then they can
make them use pins later.

The biggest hurdle will be past once all the chip terminals actually work.
It's crazy how many vendors were forced to install these things before the
processors were even able to process chip transactions. Most small vendors in
this area of the country still are not able to accept chip cards despite
having the newer hardware. Thus they are now liable for fraudulent
transactions on swiped cards because their processors cannot get their sh*t
together.

But once that debacle is resolved, chip and pin should follow as a matter of
course.

Frankly, I too wish they had just ripped the bandaid off. After having spent a
couple weeks in europe, it is idiotic how many restaurants in non-tourist
towns have to scramble to find the one terminal that can print a signature
slip for their American guests.

------
uptown
I tried to pay with ApplePay at The Home Depot but their readers wouldn't
allow it. If your company is seriously concerned about fraud, maybe allow
customers to use available systems that help prevent it.

~~~
kijeda
Worse, they used to support it. They disabled it with the line that "upgrades"
to their terminals were the cause. [https://consumerist.com/2015/05/05/apple-
pay-unavailable-at-...](https://consumerist.com/2015/05/05/apple-pay-
unavailable-at-home-depot-as-retailer-upgrades-payment-terminals/)

------
ccvannorman
I wish that the shopping experience was

1) I go to a store and pick up what I need 2) I walk out of the store with
everything and take it home 3) Store knows what I took (RFID tags) 4) Store
knows who I am (Cameras, gait analysis, face, whatever, fingerprint at the
door, phone swipe, credit card swipe, be creative) 5) I receive an e-bill when
the vendor identifies me 6) I set up an auto-pay on my e-bill

Honestly, tap-to-pay doesn't seem like any difference at all vs cash or credit
to me. Show me something where I don't even need to interact on exiting the
store!

~~~
hinkley
The original pitch for the RFIDs was that they'd just be able to scan your
whole cart. I'm not sure what happened in the interim.

~~~
seanp2k2
RFID didn't work reliably from more than a few inches away and with that many
items? Tagging every item including bulk things like produce was a non-starter
for merchants due to all the extra labor involved? RFID tags cost much more
than the barcode already on product packaging? Check out hardware for this was
massively expensive, didn't integrate with existing lane systems smoothly,
confused consumers, was largely unavailable due to lack of demand, and was
super buggy / unreliable?

Those are all guesses but they all seem likely to me.

~~~
TillE
> from more than a few inches away

Nah, you can always crank up the power in line with the inverse square law.
Your other reasons are plausible. RFID tags are fairly cheap, but they can't
compete with printing a barcode on a label.

------
dean
In Canada, Walmart is suing Visa for 'unacceptably high' fees.
[http://www.cbc.ca/news/business/walmart-canada-
visa-1.363095...](http://www.cbc.ca/news/business/walmart-canada-
visa-1.3630956)

~~~
ikeboy
They stopped accepting it in Canada, and are suing in the US if I'm reading
that right.

------
vermontdevil
A typical process using a chip card:

1) Swipe card (out of habit)

2) Machine says use chip card reader.

3) Insert card in reader.

4) Machine freezes.

5) Get support - reset machine quickly.

6) Plan to swipe but luckily remembered. Inserts in slot.

7) Wait for what feels like hours to get it going.

8) Enter code

9) Approved! Takes card out.

Blah. I am sure in few years things will get better though. Or maybe just go
with Apple Pay (or that type).

~~~
djsumdog
In New Zealand, almost all terminals have had chip readers for years and I've
never had any of those issues. In almost every case I just insert a card, type
my pin and I'm good.

The German systems are a bit slower than others (and also everyone there,
young and old, uses cash more than cards, which is odd), but they essentially
work the same way.

America's credit and banking systems are over two decades behind the rest of
the planet (including parts of India).

In NZ, Australia, Germany and Indian, people can make person-to-person
transfers to anyone, on any bank, within 24-hours, for free, using just their
account number and full name (and in Germany a one time use TAN number, which
other countries are trying to implement). This is all taken care of at the
government banking level. No Square. No PayPal. No Facebook. Just state
mandated person-to-person transfers.

~~~
kentosi
As an Australian who's recently moved to US I'm absolutely dumbfounded by
this.

I need a third-party app to transfer money to my friend (Venmo). Why don't the
banks allow easy inter-bank transfer here?

And with signing with my credit-card, I feel like I'm back in 2010 in
Australia when some retails still hadn't adopted chip technology.

Dear US, you're a great country, but please catch up.

~~~
vermontdevil
Can't blame you. It's the stupid system that refuses to improve and improvise.

Us consumers are stuck.

------
ikeboy
[https://archive.is/wmqqR](https://archive.is/wmqqR) has it without paywall

------
iamleppert
At this point, what is stopping some other company from coming in and giving
all the merchants a square-like payment terminal that doesn't use the credit
card networks?

I honestly think this is something that needs to be done as a public works
project, or a non-profit.

~~~
unabst
If you have an idea, the chances someone is already doing it are actually
quite high: [https://www.withkash.com/](https://www.withkash.com/)

~~~
aroch
While a service that doesn't allow chargebacks is _very, very_ merchant
friendly, it is super not consumer friendly.

Chargebacks are frequently last resorts for dealing with unscrupulous
businesses or places that just don't give a shit once they've sold you what
they want to sell you.

That said, chargebacks can also be used vindictively and/or fraudulently. And
Visa/MC/etc could do a better job in dispute handling.

~~~
unabst
The police and the law should protect consumers from fraud.

One major root of the problem is the liability shift from police to the cards
and banks. If you're a buyer, you're suppose to file a chargeback, not call
the police. If you're the merchant, you're suppose to contest the chargeback,
not call the police. In a real sense, it's legalized theft enabled by a card
ecosystem sustained by companies with a monopoly that make too much. To think
the law favors these companies more than the people is outright disgusting.

~~~
ikeboy
For smaller purchases it's not worth it to go to the police or initiate a
lawsuit, so people won't. But if they have no recourse they wouldn't buy at
all, so payment processors need to offer some easier method of recovery.

If you as a merchant get an invalid chargeback, you can report the buyer to
the police.

~~~
unabst
Right they wouldn't buy at all _using these stupid cards_. Which is the whole
reason the entire industry has had to lobby and tilt the law in their favor.
Same with not passing these fees to the buyer. People will always find ways to
buy, and we're stuck with fees, risk, inconveniences, and all these band aids
that do nothing to resolve the root of the problem. Just more work for
everybody.

And for most people it's not worth trying to lift a pack of donuts off a store
shelf, but if they do they get arrested and can end up with life in prison
where there are three strikes laws. That's what keep the police busy and the
prisons full. Credit card fraud is far more common, and usually the
perpetrators are not desperate, are mentally well, intelligent and intentional
-- far more deserving of punishment if that's what we're after.

------
tosseraccount
American Express sued Visa and Mastercard in 2004:
[http://www.nbcnews.com/id/6494456/ns/business-
us_business/t/...](http://www.nbcnews.com/id/6494456/ns/business-
us_business/t/american-express-sues-visa-mastercard/)

They settled in 2007 :
[http://www.nytimes.com/2008/06/26/business/26credit.html](http://www.nytimes.com/2008/06/26/business/26credit.html)

Mastercard paid $1.8 billion, Visa paid $2.1 billion

MA and V have way outperformed AXP since.

------
cmurf
What happened to RFID/contactless? All of my cards had RFID, and then when
they were replaced got chipped. No RFID. I called all of the issuers and they
said chip only, no RFID option available. It's almost like they want us to use
our phones instead of the card itself?

And why are chip transactions so much slower than either swipe or contactless
transactions? It really is something of a regression.

~~~
kuzmin
Your RFID card is very easy to attack. Recently I heard of an attack where a
guy was sneakily putting a RFID card reader against people's pockets on the
subway. With this he was able to charge each card $20 without them even having
to authorize the transaction. (above $20 usually requires some auth)

Phones authorize the transaction differently and are this still safe to use
for tap & pay.

~~~
gruez
This attack doesn't work because as soon as you're discovered by a few
victims, the payment processor is going to roll back all your transactions.
Not to mention the massive paper trail you leave behind when you are applying
for a merchant account.

~~~
0xfeba
They could still sell the unused card info.

~~~
gergles
Not over the contactless interface, part of the data is different every time
the card is tapped. It becomes worthless to 'clone' contactless cards because
of that.

------
coryfklein
Digital currencies enable me to send $10 across the globe for less than a
penny and Visa charges $0.30 - I have a hard time imagining a future where the
system allows for such a large inefficient gap to remain for long.

Not saying that current digital currencies (bitcoin, etc) will replace Visa.
Just that they show that this problem doesn't cost 3% of the transaction to
solve.

~~~
rhino369
Convert back and forth to money you can actually use is much more expensive
though right?

~~~
coryfklein
If banks were to adopt some currency system that utilizes a blockchain-like
technology, then I expect the currency would be accepted as cash more
ubiquitously, but at that point it's all speculation.

------
optforfon
It's interesting how in China they kinda leapfrogged credit cards all together
(they still exist, but they're not ubiquitous). Here it's either cash or
payments through phones and QR codes using Alipay/Wechat/etc. It's pretty
fantastic and there is very little lock in like b/c these aren't hardware-
centric technologies. Just download an app, connect it to a bank account and
you're good to go (both merchant and customer). So competitors are free to
disrupt all they want.

Meanwhile parasites like Visa skim an insane 3% off of the whole US retail
economy. How this isn't banned by the government is beyond me... I'm sure it
rivals the sales tax in some jurisdictions.

------
jdeibele
I received a debit card from my relatively small credit union a few days ago.
I was very surprised to see that it didn't have a chip in it.

It seems likely that the fees they earn from "signature transactions" must be
significant enough that they don't want anyone using it as a chip card.

An alternative answer is that the cost of the cards themselves is so much that
they don't want to do it. When I lost my wallet, a different credit union
charged me $10 for a replacement card. And neither had a chip. The other banks
did it for free.

~~~
robbiet480
When this article mentions "signature transactions" it is speaking of "chip
and sig(nature)", meaning that you must insert or "dip" the chip-enabled card
into a terminal and then sign on the terminal. The signature is submitted to
your bank along with the transaction for verification. "chip and PIN" is much
the same, except that you must enter a PIN instead of signing, and the PIN is
sent to your bank for verification. I would also add that signature
verification doesn't really do much, since banks will accept just about
anything as your authorized signature. A signature is also not required for
transactions under $25 (usually, depends on the merchant and specific minimums
that your issuing bank sets).

It is quite weird that you don't have a chip card, since it is mandated to
only provide chip enabled cards as of October 2016. I would ask your credit
union for the reasoning behind not issuing you one.

------
crb002
Every chip reader in Des Moines uses the same reader hardware, and every
software install on them is radically different. Somebody is making bank
writing the glitchy touch screen apps.

------
frandroid
This seems like part of the global retailer war against credit card companies,
such as seen here in Canada:
[https://www.thestar.com/news/canada/2016/06/11/walmart-
canad...](https://www.thestar.com/news/canada/2016/06/11/walmart-canada-will-
no-longer-accept-visa-due-to-high-fees.html)

------
rietta
Site without a paywall - [http://www.ajc.com/news/business/home-depot-visa-
and-masterc...](http://www.ajc.com/news/business/home-depot-visa-and-
mastercard-are-colluding-on-ca/nrgMZ/)

------
willhamina
I've gone to cash whereever possible. I needn't monitor my CC accounts so
closely, reconcile them at end-of-month nor worry about stolen cards. Sellers
love cash.

Best of all I spend far less - I am more parsimonious if I pay with cash.

------
ArkyBeagle
This seems similar to WalMart's recent decision to stop taking some credit
cards in Canada.

[https://news.ycombinator.com/item?id=11887469](https://news.ycombinator.com/item?id=11887469)

------
callmeed
Where I am in California only about 1/3 of merchants are accepting chip cards
(even though I believe the deadline was October of last year).

------
chinathrow
The whole field is so ripe for disruption yer nothing ever materialises....

~~~
Afforess
Network effects. Same reason Facebook/LinkedIn/Twitter can suck, and yet not
be displaced by technologically superior products.

~~~
nix0n
Is there a technologically superior version of Facebook?

~~~
jjawssd
People made a lot of noise about
[https://joindiaspora.com/](https://joindiaspora.com/) but in reality almost
nobody cares about decentralized social media yet

~~~
nix0n
I did try Diaspora, but the UI seemed awkward and buggy, and it was slow
despite me being the only person on it (maybe Heroku would have been better
than a generic VPS).

------
pbreit
Oh, dear, Home Depot, please, no. Chip & PIN is the worst user experience of
all of them.

------
unabst
tl;tr Fuck these cards. Go team Depot. Walmart is suing too. [0]

As someone with one foot in retail, I can honestly say these cards are not
doing anyone any favors. Fraud is rampant and there are shoppers that travel
the world [0.5] with stolen cards just to spend stolen cards and gift cards
[1].

During the transition to chip, Square had liability shift for non-chip cards
[2], but we failed to meet the requirements for a few transactions because we
insisted on entering the ZIP for security, which requires key entry even at an
additional fee. There was no feature to enable ZIP code entry for swipes. In
these cases, trying to heighten security with additional measures was the
wrong move for us. We should have just let them swipe and Square eat the cost.

Apple has been burying a scandal of its own with Apple Pay fraud. Once after a
shopper left, we immediately received negative feedback through Square from
someone claiming they didn't just buy anything from our store. Well, when
someone has a phone, there is nothing to check. Though Apple Stores seem to
have been hit hard, which seems appropriate [3].

The main problems are, 1) as retailers we cannot treat every customer as a
crook nor can we profile them [4], 2) if they jump through all the hurdles, we
can't then not sell them something even if something seems odd, and 3) in the
case of Apple Pay, gift cards, and some swipe transactions, retailers are
actually covered so even if buyers appear suspect, there is zero incentive to
call them out, 4) the police don't treat it as shoplifting, and 5) some of the
worst offenders are not suspicious at all, and can even be contesting their
own purchases on purpose.

This is just a fact, but most of the scammers that came through our store were
from NY and were black (again, just a fact, not saying anything about race or
NY, though something does seem to be going on there [4][5]).

\--

[0] [http://www.wsj.com/articles/wal-mart-sues-visa-over-chip-
ena...](http://www.wsj.com/articles/wal-mart-sues-visa-over-chip-enabled-
debit-card-transactions-1462906677)

[0.5] [http://arstechnica.com/tech-policy/2014/11/authorities-
arres...](http://arstechnica.com/tech-policy/2014/11/authorities-
arrest-118-people-in-airline-ticket-fraud-sting/)

[1] [http://www.tripwire.com/state-of-security/risk-based-
securit...](http://www.tripwire.com/state-of-security/risk-based-security-for-
executives/risk-management/gift-card-fraud-how-its-committed-and-why-its-so-
lucrative/)

[2] [https://squareup.com/news/why-square-sellers-can-rest-
easy-a...](https://squareup.com/news/why-square-sellers-can-rest-easy-about-
the-liability-shift)

[3] [http://www.nytimes.com/2015/03/17/business/banks-find-
fraud-...](http://www.nytimes.com/2015/03/17/business/banks-find-fraud-
abounds-in-apple-pay.html)

[4] [http://www.ag.ny.gov/press-release/ag-schneiderman-
announces...](http://www.ag.ny.gov/press-release/ag-schneiderman-announces-
agreement-barneys-new-york-address-discrimination-against)

[5] [http://nypost.com/2016/04/26/rappers-used-stolen-credit-
card...](http://nypost.com/2016/04/26/rappers-used-stolen-credit-cards-to-
cheat-department-stores/)

------
pigpaws
article NOT behind a paywall: [http://boston.cbslocal.com/2016/06/15/home-
depot-visa-master...](http://boston.cbslocal.com/2016/06/15/home-depot-visa-
mastercard-chip-cards-lawsuit/)

TL;DR: chipped cards are not as secure as swiped cards. Also, CC processing is
expensive.

~~~
adrr
Not swiped cards. Chip and signature isn't as secure a chip and PIN.

------
post_break
After Home Depot showed it didn't understand security and my credit card was
spoofed I've tried to stop shopping there. It's difficult sometimes.

~~~
tssva
It's difficult to shop at the Home Depot by me. Either none or 1 register with
an actual cashier and 4 self-checkouts of which usually only 2 are functional
at any given moment. On a weekend I have abandoned my items and left more than
once because of the length of the checkout lines. Fortunately a Lowes is
opening close by soon. They actually have cashiers at the registers.

------
logicallee
if they had a trust, credit card processing fees would be 7%, not 3%. they
obviously don't.

-

correction: "If you're looking for quick numbers, here you go: the average
credit card processing cost for a retail business where cards are swiped is
roughly 1.95% - 2%" source: [https://www.cardfellow.com/average-fees-for-
credit-card-proc...](https://www.cardfellow.com/average-fees-for-credit-card-
processing/)

why would a trust have rates that low? It seems competitive to me...

~~~
function_seven
What makes you think 3% is low? Why isn't it high? Seems like a huge chunk of
a transaction's cost to me.

To clarify, supposed we lived in bizarroland where the transation fee was 7%.
bizarrologicallee could post this very same comment, but as "if they had a
trust, credit card processing fees would be 15%, not 7%"

~~~
developer2
Percentage fees make absolutely no sense, and that is the end of the
discussion. A flat fee regardless of the transaction amount is the only method
that even registers as logical.

~~~
germanier
Some part of the fee is used to insure against fraud. That is obviously
related to transaction volume.

~~~
rahimnathwani
I think you mean transaction value ($) rather than transaction volume (#). You
are correct, and the value is also the right thing to tax if you are funding
30-60 days of interest-free credit.

~~~
germanier
Thanks, English is not my first language. After looking at the first few
Google hits for "transaction volume" it seems to be confusingly used with both
meanings but it's best to be unambiguous.

