4 ms·

EMV and Chip cards

41 points by excid3 12y ago

wwarren 12y ago
As a british immigrant to North America, I couldn't believe how far behind in this regard the States and Canada were. Canada has since caught up, but the US is only now getting there. Anecdotal story: the only time my credit card has been defrauded is after a 3 day stay in the USA
- Drilz 12y ago
  I have read that after the EMV system was introduced in the UK the fraud rate actually went up. http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext
  - kaoD 12y ago
    > Log in to Read the Full Article Care to explain how and why the fraud rate went up? Chip and PIN cards are widely deployed here in Spain, and all cases of fraud around me involved drunk people not covering the keypad when entering their PIN. In ATMs there's a nice animation of a hand covering the number pad, but not on POS (LCD displays just say "Enter your PIN"), and many people are careless or forget to do so. I used to hear more cases of CC fraud back when magnetic strips were used, but I might just be biased.
    - runeks 12y ago
      It's worth noting that because you add this chip, it doesn't necessarily mean you remove the magnetic stripe. My VISA (issued by a Danish bank), has both a chip and the magnetic stripe.
      - Nursie 12y ago
        Hopefully the data on that stripe becomes a lot less useful though, as part of the data is saying "I have a chip!" and the merchant is under financial pressure not to accept stripe transactions after switchover due to the liability shift.
      - robin_reala 12y ago
        That’s pretty much just so the card is usable in the US if you travel there though.
        runeks 12y ago
        And also when the card reader in the store here in Denmark says "Use the magnetic stripe!" for some reason.
    - jonknee 12y ago
      If I know your PIN I still need to have your card with the chip on it to commit fraud. How does that part work?
      - kaoD 12y ago
        It's out of my area of expertise, but you should probably find information searching for "chip skimming" and the like. Also, as your sibling points out, most chip and PIN cards still feature a magstripe to downgrade if necessary.
  - ptaffs 12y ago
    I think fraud rate didn't go up at all, but EMV (Chip and PIN) had a fraud reducing effect. Of course other factors changed. You'll find references at http://www.theukcardsassociation.org.uk/plastic_fraud_figures/index.asp http://www.theukcardsassociation.org.uk/plastic_fraud_figure... and old news at http://news.bbc.co.uk/2/hi/business/4779314.stm http://news.bbc.co.uk/2/hi/business/4779314.stm neither of which require Log in to Read the Full Article.
foobarqux 12y ago
And still no NFC.
- oddevan 12y ago
  If NFC ever takes off as a must-have in the payments world, I'm sure Square would try to use the NFC in phones through their app. But given that they've already tried a "Just use the app, forget your wallet" approach that didn't take off like they wanted, I'm guessing they're not ready to try anything outside of mainstream payment cards.
  - bryanlarsen 12y ago
    NFC (specifically PayPass, PayWave & Interac Flash) is becoming fairly ubiquitous in Canada.
    - reaperhulk 12y ago
      How is your experience with the reliability? I was recently up in Edmonton and anecdotally it seemed like people had serious issues with the NFC payment methods. Several times I saw people attempt to pay via NFC, try 5 times, then eventually pay via insertion+PIN. Looked profoundly frustrating.
      - bryanlarsen 12y ago
        That does happen occasionally, but I find it's fairly rare, at least for me.
      - Nursie 12y ago
        I regularly use it to pay for take-out lunches here in London, has always been pretty reliable.
      - madeofpalk 12y ago
        In Australia, I would say about at least 75% of all in-person payments I make are with PayPass/PayWave. That other 25% is cash and the odd place that hasnt updated their terminals yet. Some banks will even give you like a 5% cash back if you use contactless. It's very reliable and is the defacto method of payment in places like pubs. Often I'll hand my card over and they'll ask 'Can I just PayWave that?'
pzb 12y ago
This is a great move to help reduce fraud for their US merchants, but even more important is it expands their potential market. Adding a chip reader opens up the rest of the world. However, I'm still not sure how they will handle the PIN part of Chip and PIN, as the usual requirement is that the PIN is entered on a dedicated Pin Entry Device which then only presents the unlocked smart card to the merchant register.
- martinald 12y ago
  I think this only handles chip and signature cards, which is pretty useless. Does anyone know if people can use chip and pin cards but only sign for them?
  - madeofpalk 12y ago
    Actually as of tomorrow in Australia, you won't be able to sign if you have a card that uses a chip. http://www.smh.com.au/digital-life/digital-life-news/pins-to-replace-credit-card-signatures-from-friday-20140727-zxd0r.html http://www.smh.com.au/digital-life/digital-life-news/pins-to...
  - Nursie 12y ago
    Depends on the card, which therefore depends on the risk profile that the issuing bank is willing to undertake. There's a list of acceptable verification methods in the card, and a list of methods the device is can perform is contained in the terminal software. The intersection of these is what's usually performed. (background - I wrote my first EMV processing kernel in 2001 and am currently working on a bluetooth-enabled card-reader and PIN entry device that looks like it will directly compete with the square device)
  - lucaspiller 12y ago
    When EMV was first introduced in the UK (10 years ago...) you could opt to sign instead of entering a PIN number. If you try and do that now in most cases the transaction is declined by the bank. This can cause issues when travelling abroad to countries that aren't use to or don't have the hardware for EMV.
brotchie 12y ago
I wonder what their plans are for NFC / PayPass / PayWave? Are there technological barriers to it? Could a NFC enabled Smartphone act as a payment terminal? It's only on rare occasions now that I have to even put in a pin (in Australia), NFC style payment terminals are pretty much ubiquitous. NFC payments in 80-90% of stores, many parking machines, >50% of vending machines.
- mpclark 12y ago
  I'm not an expert on this area but I believe NFC smartphones can't currently act as payment terminals because PCI rules mandate that such things should be self-contained single-purpose devices with their own PIN pad. However, the game could change completely with the move to tokenization. That's really cool that contactless is so ubiquitous in Oz. As a nation you guys are very much ahead of the game on the whole contactless/NFC thing.
  - mootothemax 12y ago
    I believe NFC smartphones can't currently act as payment terminals because PCI rules mandate that such things should be self-contained single-purpose devices with their own PIN pad. The NFC cards, SIMs, keyfobs etc. don't necessarily require a PIN here in Poland; you're good for ~$15 USD (50 PLN). If you need to pay more than that, you then have to enter your PIN as you suggest. Limits the use cases to corner-shop-equivalent purchases, still quite a large market!
    - bryanlarsen 12y ago
      In Canada, some merchants are now accepting NFC payments without PIN for up to CAD200 (USD180). When they first arrived, limits were typically more like $25.
- joelhaasnoot 12y ago
  Indeed, essentially this is a step behind the curve. While adoption isn't fast - the Netherlands is deploying both new cards to customers and new POS terminals with NFC built in.
stuaxo 12y ago
Can't imagine not using these ... the only problem is the cards are weaker and the chip starts to come out. (Only if you don't use a wallet)...
prattbhatt 12y ago
Seems they want to sell the EMV card readers instead of providing them for free.
- runeks 12y ago
  Honest question: does Square save money if credit card fraud decreases? It would make most sense that the parties who lose money when fraud occurs would offer these devices for free, or subsidize them, and I'm unsure of whether Square is one of these parties.
- burnte 12y ago
  Even today the language is to "order" a card reader, but there's no charge. So don't read into the phrase "pre-order" here. They used the same language when they started.
- jonknee 12y ago
  That's what they currently do with the magstripe readers. You then get a credit for the amount of the reader (limit 1 per account I believe). That makes it easier to avoid losing a ton of money when someone figures out another use for them.
powertower 12y ago
After reading the wikipedia article on this, these cards seems to be full of fallback mechanisms that make them virtually useless for more advanced protection but in only a few constrained situations, and it's biggest benefit is that it allows MasterCard and the others to shift liability of fraud from the Bank to the merchant and the customer.
- Nursie 12y ago
  Nope. It allows the shift in liability to the merchant if they don't perform a chip transaction. Fallback is at merchant discretion, if they want to take transactions under those circumstances then that's their risk. Other than that, no EMV is not perfect, but it's a DAMN site better than the everything-in-the-clear magstripe. Did you read the linked article about fraud levels?
unwiredben 12y ago
It looks like they're not able to power strictly off the audio jack anymore with this tech. The product brief indicates that it uses a MicroUSB charging connector. I wonder how many transactions a single charge can handle.
- Nursie 12y ago
  I'll be impressed if they've somehow managed all the data flows over the audio jack, personally... some sort of built-in modem?
sisk 12y ago
A couple of data points: American Express sent me a new card—unprovoked—about two months ago that is chipped. As mentioned elsewhere, it is a chip and signature card (as opposed to a chip and pin). I'm nothing particularly special as a credit card user so, if I received a card, seems the roll out has already well underway. Another point is, as mentioned elsewhere, PayPal already offers a chip and pin compatible bluetooth device in a few countries marketed as part of their PayPal Here brand[0]. [0] - https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-here https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-here
- Nursie 12y ago
  IIRC the bank->merchant liability shift for the US is scheduled for sometime next year. The banks can't very well shift the liability if they haven't given their customers the new cards!

41 points by excid3 12y ago

As a british immigrant to North America, I couldn't believe how far behind in this regard the States and Canada were. Canada has since caught up, but the US is only now getting there. Anecdotal story: the only time my credit card has been defrauded is after a 3 day stay in the USA

Drilz 12y ago
I have read that after the EMV system was introduced in the UK the fraud rate actually went up. http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext http://cacm.acm.org/magazines/2014/6/175170-emv/fulltext
- kaoD 12y ago
  > Log in to Read the Full Article Care to explain how and why the fraud rate went up? Chip and PIN cards are widely deployed here in Spain, and all cases of fraud around me involved drunk people not covering the keypad when entering their PIN. In ATMs there's a nice animation of a hand covering the number pad, but not on POS (LCD displays just say "Enter your PIN"), and many people are careless or forget to do so. I used to hear more cases of CC fraud back when magnetic strips were used, but I might just be biased.
  - runeks 12y ago
    It's worth noting that because you add this chip, it doesn't necessarily mean you remove the magnetic stripe. My VISA (issued by a Danish bank), has both a chip and the magnetic stripe.
    - Nursie 12y ago
      Hopefully the data on that stripe becomes a lot less useful though, as part of the data is saying "I have a chip!" and the merchant is under financial pressure not to accept stripe transactions after switchover due to the liability shift.
    - robin_reala 12y ago
      That’s pretty much just so the card is usable in the US if you travel there though.
      - runeks 12y ago
        And also when the card reader in the store here in Denmark says "Use the magnetic stripe!" for some reason.
  - jonknee 12y ago
    If I know your PIN I still need to have your card with the chip on it to commit fraud. How does that part work?
    - kaoD 12y ago
      It's out of my area of expertise, but you should probably find information searching for "chip skimming" and the like. Also, as your sibling points out, most chip and PIN cards still feature a magstripe to downgrade if necessary.
- ptaffs 12y ago
  I think fraud rate didn't go up at all, but EMV (Chip and PIN) had a fraud reducing effect. Of course other factors changed. You'll find references at http://www.theukcardsassociation.org.uk/plastic_fraud_figures/index.asp http://www.theukcardsassociation.org.uk/plastic_fraud_figure... and old news at http://news.bbc.co.uk/2/hi/business/4779314.stm http://news.bbc.co.uk/2/hi/business/4779314.stm neither of which require Log in to Read the Full Article.

foobarqux 12y ago

And still no NFC.

oddevan 12y ago
If NFC ever takes off as a must-have in the payments world, I'm sure Square would try to use the NFC in phones through their app. But given that they've already tried a "Just use the app, forget your wallet" approach that didn't take off like they wanted, I'm guessing they're not ready to try anything outside of mainstream payment cards.
- bryanlarsen 12y ago
  NFC (specifically PayPass, PayWave & Interac Flash) is becoming fairly ubiquitous in Canada.
  - reaperhulk 12y ago
    How is your experience with the reliability? I was recently up in Edmonton and anecdotally it seemed like people had serious issues with the NFC payment methods. Several times I saw people attempt to pay via NFC, try 5 times, then eventually pay via insertion+PIN. Looked profoundly frustrating.
    - bryanlarsen 12y ago
      That does happen occasionally, but I find it's fairly rare, at least for me.
    - Nursie 12y ago
      I regularly use it to pay for take-out lunches here in London, has always been pretty reliable.
    - madeofpalk 12y ago
      In Australia, I would say about at least 75% of all in-person payments I make are with PayPass/PayWave. That other 25% is cash and the odd place that hasnt updated their terminals yet. Some banks will even give you like a 5% cash back if you use contactless. It's very reliable and is the defacto method of payment in places like pubs. Often I'll hand my card over and they'll ask 'Can I just PayWave that?'

pzb 12y ago

This is a great move to help reduce fraud for their US merchants, but even more important is it expands their potential market. Adding a chip reader opens up the rest of the world. However, I'm still not sure how they will handle the PIN part of Chip and PIN, as the usual requirement is that the PIN is entered on a dedicated Pin Entry Device which then only presents the unlocked smart card to the merchant register.

martinald 12y ago
I think this only handles chip and signature cards, which is pretty useless. Does anyone know if people can use chip and pin cards but only sign for them?
- madeofpalk 12y ago
  Actually as of tomorrow in Australia, you won't be able to sign if you have a card that uses a chip. http://www.smh.com.au/digital-life/digital-life-news/pins-to-replace-credit-card-signatures-from-friday-20140727-zxd0r.html http://www.smh.com.au/digital-life/digital-life-news/pins-to...
- Nursie 12y ago
  Depends on the card, which therefore depends on the risk profile that the issuing bank is willing to undertake. There's a list of acceptable verification methods in the card, and a list of methods the device is can perform is contained in the terminal software. The intersection of these is what's usually performed. (background - I wrote my first EMV processing kernel in 2001 and am currently working on a bluetooth-enabled card-reader and PIN entry device that looks like it will directly compete with the square device)
- lucaspiller 12y ago
  When EMV was first introduced in the UK (10 years ago...) you could opt to sign instead of entering a PIN number. If you try and do that now in most cases the transaction is declined by the bank. This can cause issues when travelling abroad to countries that aren't use to or don't have the hardware for EMV.

brotchie 12y ago

I wonder what their plans are for NFC / PayPass / PayWave? Are there technological barriers to it? Could a NFC enabled Smartphone act as a payment terminal? It's only on rare occasions now that I have to even put in a pin (in Australia), NFC style payment terminals are pretty much ubiquitous. NFC payments in 80-90% of stores, many parking machines, >50% of vending machines.

mpclark 12y ago
I'm not an expert on this area but I believe NFC smartphones can't currently act as payment terminals because PCI rules mandate that such things should be self-contained single-purpose devices with their own PIN pad. However, the game could change completely with the move to tokenization. That's really cool that contactless is so ubiquitous in Oz. As a nation you guys are very much ahead of the game on the whole contactless/NFC thing.
- mootothemax 12y ago
  I believe NFC smartphones can't currently act as payment terminals because PCI rules mandate that such things should be self-contained single-purpose devices with their own PIN pad. The NFC cards, SIMs, keyfobs etc. don't necessarily require a PIN here in Poland; you're good for ~$15 USD (50 PLN). If you need to pay more than that, you then have to enter your PIN as you suggest. Limits the use cases to corner-shop-equivalent purchases, still quite a large market!
  - bryanlarsen 12y ago
    In Canada, some merchants are now accepting NFC payments without PIN for up to CAD200 (USD180). When they first arrived, limits were typically more like $25.
joelhaasnoot 12y ago
Indeed, essentially this is a step behind the curve. While adoption isn't fast - the Netherlands is deploying both new cards to customers and new POS terminals with NFC built in.

stuaxo 12y ago

Can't imagine not using these ... the only problem is the cards are weaker and the chip starts to come out. (Only if you don't use a wallet)...

prattbhatt 12y ago

Seems they want to sell the EMV card readers instead of providing them for free.

runeks 12y ago
Honest question: does Square save money if credit card fraud decreases? It would make most sense that the parties who lose money when fraud occurs would offer these devices for free, or subsidize them, and I'm unsure of whether Square is one of these parties.
burnte 12y ago
Even today the language is to "order" a card reader, but there's no charge. So don't read into the phrase "pre-order" here. They used the same language when they started.
jonknee 12y ago
That's what they currently do with the magstripe readers. You then get a credit for the amount of the reader (limit 1 per account I believe). That makes it easier to avoid losing a ton of money when someone figures out another use for them.

powertower 12y ago

After reading the wikipedia article on this, these cards seems to be full of fallback mechanisms that make them virtually useless for more advanced protection but in only a few constrained situations, and it's biggest benefit is that it allows MasterCard and the others to shift liability of fraud from the Bank to the merchant and the customer.

Nursie 12y ago
Nope. It allows the shift in liability to the merchant if they don't perform a chip transaction. Fallback is at merchant discretion, if they want to take transactions under those circumstances then that's their risk. Other than that, no EMV is not perfect, but it's a DAMN site better than the everything-in-the-clear magstripe. Did you read the linked article about fraud levels?

unwiredben 12y ago

It looks like they're not able to power strictly off the audio jack anymore with this tech. The product brief indicates that it uses a MicroUSB charging connector. I wonder how many transactions a single charge can handle.

Nursie 12y ago
I'll be impressed if they've somehow managed all the data flows over the audio jack, personally... some sort of built-in modem?

sisk 12y ago

A couple of data points: American Express sent me a new card—unprovoked—about two months ago that is chipped. As mentioned elsewhere, it is a chip and signature card (as opposed to a chip and pin). I'm nothing particularly special as a credit card user so, if I received a card, seems the roll out has already well underway. Another point is, as mentioned elsewhere, PayPal already offers a chip and pin compatible bluetooth device in a few countries marketed as part of their PayPal Here brand[0]. [0] - https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-here https://www.paypal.com/uk/webapps/mpp/how-to-use-paypal-here

Nursie 12y ago
IIRC the bank->merchant liability shift for the US is scheduled for sometime next year. The banks can't very well shift the liability if they haven't given their customers the new cards!