8 ms·

Chip + Signature depends on the venue which makes it really annoying. Went to a new city, one place out of the four I visited required a signature, the rest we

Chip + Signature depends on the venue which makes it really annoying. Went to a new city, one place out of the four I visited required a signature, the rest were fine with tap to pay/chip+Pin. Some places are fine until some arbitrary limit, etc. The place that made me sign? The purchases were $5-$6.

rswail 3y ago
Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad. Contactless has different floor limits than Contact (chip). For example, in AU, the limit for contactless without PIN is ~AUD100. In the UK, I believe its GBP30. If you tap for a payment over that limit, the reader will ask for the PIN. The primary difference is that if a customer uses contactless/contact and PIN, then the risk of the transaction is passed to the network/issuer, instead of the merchant.
- JumpCrisscross 3y ago
  > Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. (Unlike much to the world, our fraud risk sits almost entirely on the merchant side.) Contactless had no hope with a PIN. Merchants catered to that despite higher cost and risk.
  - messe 3y ago
    > Contactless had no hope with a PIN I’m not sure if it’s true for all EU countries and banks, but in general you don’t put in your PIN every time with contactless. The card usually works for a number of transactions without a PIN, often up to a certain limit, after which it asks you to insert it again.
    - JumpCrisscross 3y ago
      > in general you don’t put in your PIN every time with contactless As an American, I never get prompted in Europe for a PIN. Even for large transactions. That matches a swipe's convenience.
      - djxfade 3y ago
        I believe this is controlled by your issuer. So your card issuer probably don't require PIN after n amount of swipes.
        matthewdgreen 3y ago
        It is arbitrary and random. Some machines will ask for it and others won’t. Some automated machines will refuse US cards altogether. Wait til you’re at a tollbooth entering the Autoroute trying to use all your US cards, and none of them are accepted.
        messe 3y ago
        Even Visa/MasterCard?
  - rswail 3y ago
    Unlike most of the world, where when a Chip+PIN or contactless payment is made, where the risk is transferred from the merchant to the acquirer/issuer. That was the whole point of moving to EMV, it removes the fraud risk from the merchant. That's different to the charge-back risk, which is where the customer disputes the transaction itself.
    - JumpCrisscross 3y ago
      > where when a Chip+PIN or contactless payment is made, where the risk is transferred from the merchant to the acquirer/issuer In parts of the world where the consumer's bank bears the risk, and there is in imbalance between commercial and consumer banking, there is a powerful group--consumer banks--to apply pressure. Sometimes that results in fewer consumer protections. In most: indirect pressure on merchants. (I can think of no country with an imbalance in favor of commercial banking with a strong consumer sector.) This state describes most of the world: optimized for cost reduction. > That was the whole point of moving to EMV, it removes the fraud risk from the merchant Who bears fraud risk varies. In America, it was always the merchants. They have limited leverage over Visa and Mastercard. With the banks neutral and a valid competitor in American Express, there was nobody who wanted to anger consumers by taking away their swipes. (If you're that merchant, you're cash only.) So they optimized for purchasing convenience. Australia is a cost optimizer. America a convenience optimizer.
      - rswail 3y ago
        I'd argue the opposite. In the US, the merchants had too much power to delay the introduction of Chip+PIN readers. The fraud of magstripes was huge, because there was literally no security. Anyone could create a magstripe. Customers using credit cards in the US are protected by legislation against that fraud. The whole point of EMV was to remove the capability of fraud by replicating the magstripe. It meant that the transaction could correctly tell between "card present" and "card not present" transactions. So the risk of card-present transactions is dramatically lowered, independent of who is responsible for the fraud. It is to both the merchants and the banks benefit to reduce/remove fraud. The banks offloaded it to the merchants in the US (as they did in other countries), but the introduction of EMV was "sold" to the merchants in the rest of the world by the banks saying they would take on the risk of fraud for "card present" transactions. The banks were never "neutral" in the US. Visa/MC were both bank consortiums. America is not a "convenience optimizer" its a "changing consumer behavior is hard so lets not do it" optimizer.
  - neilalexander 3y ago
    > Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. When Chip + PIN was introduced in the UK in 2003, people were widely concerned about the potential for inconvenience (entering a PIN takes longer than a swipe, the transaction might take longer to be processed, you might forget the PIN altogether). In reality, fear outweighed the reality, the world carried on as usual and people adapted very quickly. It's now just totally normal here to enter a PIN and the average British person would feel far more inconvenienced if asked to sign for a transaction instead (which has become such a rare event here that the average person would be completely taken by surprise if asked to do so).
- oakesm9 3y ago
  The UK has a limit of £100 for contactless cards, with a requirement to insert and enter your PIN after a few successive taps. Apple Pay and Google pay technically don’t have the PIN requirement as they’re authenticated and technically don’t have a limit, but in practice most shops still have a £100 limit.
  - PlutoIsAPlanet 3y ago
    > but in practice most shops still have a £100 limit. I've not found this to be the case anymore, sometimes the terminal will display a limit or the merchant will believe the limit applies to phones, but no limit is technically enforced.
  - deleted 3y ago
    [deleted]
  - ldrndll 3y ago
    In my experience few merchants limit Apple Pay to the contactless limit (Tesco being a notable exception) but many of the times I’ve used Apple Pay for larger purchases the person helping me has been surprised that it worked.
    - sksksk 3y ago
      I once paid for a car with Apple Pay (it was far over the £100 limit)
  - shawabawa3 3y ago
    > but in practice most shops still have a £100 limit Not true, although shop keepers will often say it won't work, right up until I tap and it works
  - rmccue 3y ago
    > with a requirement to insert and enter your PIN after a few successive taps Specifically, I believe this was due to Strong Customer Authentication laws in the EU: https://www.visa.co.uk/partner-with-us/payment-technology/strong-customer-authentication.html https://www.visa.co.uk/partner-with-us/payment-technology/st...
- CaptainZapp 3y ago
  Funnily enough my card doesn't work contactless with PIN. I need to shove it into the chip reader to make it work. Which, thinking about it, is exactly how it should be. The closed circuit of chip reader and pin was always touted as super secure. Then suddenly, you could pay contactless with most cards regardless of the amount and enter the PIN. Too me this always seemed to subvert the "super secure" chip & PIN authentication. It's a small "hardship", really. On small amounts contactless works just dandy and having to present the physical card to the chip reader for larger amounts makes me actually feel better.
  - Nursie 3y ago
    > Too me this always seemed to subvert the "super secure" chip & PIN authentication. Chip and Pin usually implies offline PIN. The terminal supplies the PIN, after a one-way transform of some sort IIRC* to the chip on the card, which then verifies it locally against a stored version of that same hash or whatever. With contactless you're doing online PIN. The terminal applies a transform and some sort of asymmetric key encryption to the PIN, and this gets sent to your bank. There's nothing any less secure here. (* I wrote an EMV 'kernel' a long, long time ago, in about 2002, and some more PIN block processing code about 8 years back. So it's been a while!)
    - rswail 3y ago
      Chip + PIN is basically the EMV standard for cards with chips on them (and the small set of connectors for when the card is inserted in a reader). There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field. There are some changes to the business rules around processing contactless payments. Although the same floor limits for asking for the PIN for contact and contactless are pretty much the same these days.
      - Nursie 3y ago
        > Chip + PIN is basically the EMV standard for cards with chips on them Worse than that, it's a marketing name :) Or it was in the UK. Strictly speaking the cards contain a customer verification method list that gives the terminal the info about whether and in what priority order it should process PIN offline, online, signature or other methods. This method allows american cards to function elsewhere in the world, depending on the terminal risk profile, and euro cards which usually would require a PIN to function in PIN-less US terminals. > There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field. Sure, but in contactless EMV there is no user interaction part of the process, so 'offline PIN' is not a possibility. This is because the transaction process would have to halt while the user entered their PIN and continue afterwards. So I'm pretty sure that for contactless transactions there is no offline PIN CVM. The process is also going to be slightly different in that the card/phone doesn't stick around for any post-transaction issuer scripts, and IIRC from the short time I worked on a contactless product, there is only a single application-cryptogram generation phase compared to the two in a chip transaction, though I can't remember the significance of that now! Or can I ... the second Gen AC phase is where the card signs off on the bank's authorisation of a transaction, if the transaction has gone online. Strictly your chip card can still decline a transaction even if the bank says it's OK. This is missing in contactless flow because, again, it would require the transaction to pause and take longer than a quick wave.
- ThePowerOfFuet 3y ago
  >If you tap for a payment over that limit, the reader will ask for the PIN. This is country-dependent; while this is the case in Spain, it's not the case in France, where the terminal will insist the card be inserted and the PIN entered.
- feygeubdjvf 3y ago
  > Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad. there's a write up on this that i cannot find. the reason was actually that some criminal organization with ties to lots of political pacs had their money cow being fraud (or money laundering) on gas stations. so they forced gas stations to never update the pins for this very specific reason.

rswail 3y ago

Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad. Contactless has different floor limits than Contact (chip). For example, in AU, the limit for contactless without PIN is ~AUD100. In the UK, I believe its GBP30. If you tap for a payment over that limit, the reader will ask for the PIN. The primary difference is that if a customer uses contactless/contact and PIN, then the risk of the transaction is passed to the network/issuer, instead of the merchant.

JumpCrisscross 3y ago
> Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. (Unlike much to the world, our fraud risk sits almost entirely on the merchant side.) Contactless had no hope with a PIN. Merchants catered to that despite higher cost and risk.
- messe 3y ago
  > Contactless had no hope with a PIN I’m not sure if it’s true for all EU countries and banks, but in general you don’t put in your PIN every time with contactless. The card usually works for a number of transactions without a PIN, often up to a certain limit, after which it asks you to insert it again.
  - JumpCrisscross 3y ago
    > in general you don’t put in your PIN every time with contactless As an American, I never get prompted in Europe for a PIN. Even for large transactions. That matches a swipe's convenience.
    - djxfade 3y ago
      I believe this is controlled by your issuer. So your card issuer probably don't require PIN after n amount of swipes.
      - matthewdgreen 3y ago
        It is arbitrary and random. Some machines will ask for it and others won’t. Some automated machines will refuse US cards altogether. Wait til you’re at a tollbooth entering the Autoroute trying to use all your US cards, and none of them are accepted.
        messe 3y ago
        Even Visa/MasterCard?
- rswail 3y ago
  Unlike most of the world, where when a Chip+PIN or contactless payment is made, where the risk is transferred from the merchant to the acquirer/issuer. That was the whole point of moving to EMV, it removes the fraud risk from the merchant. That's different to the charge-back risk, which is where the customer disputes the transaction itself.
  - JumpCrisscross 3y ago
    > where when a Chip+PIN or contactless payment is made, where the risk is transferred from the merchant to the acquirer/issuer In parts of the world where the consumer's bank bears the risk, and there is in imbalance between commercial and consumer banking, there is a powerful group--consumer banks--to apply pressure. Sometimes that results in fewer consumer protections. In most: indirect pressure on merchants. (I can think of no country with an imbalance in favor of commercial banking with a strong consumer sector.) This state describes most of the world: optimized for cost reduction. > That was the whole point of moving to EMV, it removes the fraud risk from the merchant Who bears fraud risk varies. In America, it was always the merchants. They have limited leverage over Visa and Mastercard. With the banks neutral and a valid competitor in American Express, there was nobody who wanted to anger consumers by taking away their swipes. (If you're that merchant, you're cash only.) So they optimized for purchasing convenience. Australia is a cost optimizer. America a convenience optimizer.
    - rswail 3y ago
      I'd argue the opposite. In the US, the merchants had too much power to delay the introduction of Chip+PIN readers. The fraud of magstripes was huge, because there was literally no security. Anyone could create a magstripe. Customers using credit cards in the US are protected by legislation against that fraud. The whole point of EMV was to remove the capability of fraud by replicating the magstripe. It meant that the transaction could correctly tell between "card present" and "card not present" transactions. So the risk of card-present transactions is dramatically lowered, independent of who is responsible for the fraud. It is to both the merchants and the banks benefit to reduce/remove fraud. The banks offloaded it to the merchants in the US (as they did in other countries), but the introduction of EMV was "sold" to the merchants in the rest of the world by the banks saying they would take on the risk of fraud for "card present" transactions. The banks were never "neutral" in the US. Visa/MC were both bank consortiums. America is not a "convenience optimizer" its a "changing consumer behavior is hard so lets not do it" optimizer.
- neilalexander 3y ago
  > Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. When Chip + PIN was introduced in the UK in 2003, people were widely concerned about the potential for inconvenience (entering a PIN takes longer than a swipe, the transaction might take longer to be processed, you might forget the PIN altogether). In reality, fear outweighed the reality, the world carried on as usual and people adapted very quickly. It's now just totally normal here to enter a PIN and the average British person would feel far more inconvenienced if asked to sign for a transaction instead (which has become such a rare event here that the average person would be completely taken by surprise if asked to do so).
oakesm9 3y ago
The UK has a limit of £100 for contactless cards, with a requirement to insert and enter your PIN after a few successive taps. Apple Pay and Google pay technically don’t have the PIN requirement as they’re authenticated and technically don’t have a limit, but in practice most shops still have a £100 limit.
- PlutoIsAPlanet 3y ago
  > but in practice most shops still have a £100 limit. I've not found this to be the case anymore, sometimes the terminal will display a limit or the merchant will believe the limit applies to phones, but no limit is technically enforced.
- deleted 3y ago
  [deleted]
- ldrndll 3y ago
  In my experience few merchants limit Apple Pay to the contactless limit (Tesco being a notable exception) but many of the times I’ve used Apple Pay for larger purchases the person helping me has been surprised that it worked.
  - sksksk 3y ago
    I once paid for a car with Apple Pay (it was far over the £100 limit)
- shawabawa3 3y ago
  > but in practice most shops still have a £100 limit Not true, although shop keepers will often say it won't work, right up until I tap and it works
- rmccue 3y ago
  > with a requirement to insert and enter your PIN after a few successive taps Specifically, I believe this was due to Strong Customer Authentication laws in the EU: https://www.visa.co.uk/partner-with-us/payment-technology/strong-customer-authentication.html https://www.visa.co.uk/partner-with-us/payment-technology/st...
CaptainZapp 3y ago
Funnily enough my card doesn't work contactless with PIN. I need to shove it into the chip reader to make it work. Which, thinking about it, is exactly how it should be. The closed circuit of chip reader and pin was always touted as super secure. Then suddenly, you could pay contactless with most cards regardless of the amount and enter the PIN. Too me this always seemed to subvert the "super secure" chip & PIN authentication. It's a small "hardship", really. On small amounts contactless works just dandy and having to present the physical card to the chip reader for larger amounts makes me actually feel better.
- Nursie 3y ago
  > Too me this always seemed to subvert the "super secure" chip & PIN authentication. Chip and Pin usually implies offline PIN. The terminal supplies the PIN, after a one-way transform of some sort IIRC* to the chip on the card, which then verifies it locally against a stored version of that same hash or whatever. With contactless you're doing online PIN. The terminal applies a transform and some sort of asymmetric key encryption to the PIN, and this gets sent to your bank. There's nothing any less secure here. (* I wrote an EMV 'kernel' a long, long time ago, in about 2002, and some more PIN block processing code about 8 years back. So it's been a while!)
  - rswail 3y ago
    Chip + PIN is basically the EMV standard for cards with chips on them (and the small set of connectors for when the card is inserted in a reader). There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field. There are some changes to the business rules around processing contactless payments. Although the same floor limits for asking for the PIN for contact and contactless are pretty much the same these days.
    - Nursie 3y ago
      > Chip + PIN is basically the EMV standard for cards with chips on them Worse than that, it's a marketing name :) Or it was in the UK. Strictly speaking the cards contain a customer verification method list that gives the terminal the info about whether and in what priority order it should process PIN offline, online, signature or other methods. This method allows american cards to function elsewhere in the world, depending on the terminal risk profile, and euro cards which usually would require a PIN to function in PIN-less US terminals. > There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field. Sure, but in contactless EMV there is no user interaction part of the process, so 'offline PIN' is not a possibility. This is because the transaction process would have to halt while the user entered their PIN and continue afterwards. So I'm pretty sure that for contactless transactions there is no offline PIN CVM. The process is also going to be slightly different in that the card/phone doesn't stick around for any post-transaction issuer scripts, and IIRC from the short time I worked on a contactless product, there is only a single application-cryptogram generation phase compared to the two in a chip transaction, though I can't remember the significance of that now! Or can I ... the second Gen AC phase is where the card signs off on the bank's authorisation of a transaction, if the transaction has gone online. Strictly your chip card can still decline a transaction even if the bank says it's OK. This is missing in contactless flow because, again, it would require the transaction to pause and take longer than a quick wave.
ThePowerOfFuet 3y ago
>If you tap for a payment over that limit, the reader will ask for the PIN. This is country-dependent; while this is the case in Spain, it's not the case in France, where the terminal will insist the card be inserted and the PIN entered.
feygeubdjvf 3y ago
> Chip + Signature is a dumb USian thing because merchants didn't want to change their readers to have a secure PIN pad. there's a write up on this that i cannot find. the reason was actually that some criminal organization with ties to lots of political pacs had their money cow being fraud (or money laundering) on gas stations. so they forced gas stations to never update the pins for this very specific reason.