I'm in Boston, and have yet to encounter a single reader that takes chips. They have started having the slot lately, but it's always taped over or there's a sign telling you not to use it. Or if you try to use it, the cashier gives you a weird look and has no idea what you're doing and tells you to swipe.

Madison WI. Gas stations (at the pump) and grocery stores are the only places I go to that don't have or use the chips (taped over). I understand both have extra time to rollout.

I assumed it had rolled out across most of the US at this point since most of the smaller places had even implemented it.

I'm in Madison, too, and there are still a lot of places that don't use the chips. I was at Farm & Fleet yesterday, had to swipe, for example.

I've been told that card processors will get charged more going forward if they don't implement the chips, or for non-chip transactions because of the added risk involved. That should help speed up the transition or at least activate it on those readers that have it.

> I've been told that card processors will get charged more going forward if they don't implement the chips, or for non-chip transactions because of the added risk involved.

This is true. It's also weird, since really they should be charging less for chip-and-pin, not more for magstripes. By moving to chip-and-pin they immediately release themselves from the hook for card theft, moving the liability to the card holder. The high transaction costs in card networks have historically been defended as largely stemming from fraud costs. Yet, we're expected to pay the same fees.

It's a good time to be in the card processing business.

Where I live (NC) almost nobody has chips enabled, even big chains, the one exception being Target.

Nice, underhanded humor. The joke being on them was even better given they were the retail company famous for having best security. :)

I've actually noticed many of the pay at the pump not working with my chip card at all lately and having to go inside or use my other card that doesn't have a chip yet.

The worst part about that is it's going to start forming consumer habits. Everyone will trust the taped over sign as being from the merchant, when it could just as easily have been installed by a skimmer. Furthermore, if people get into the habit of swiping first, then using the chip when the terminal asks them to, that still leaves an opportunity to skim.

EDIT: Grammar

A fraudster taping over the chip slot would be detected after a single skim though, since the terminal won't accept a swipe from a chip enabled card if it's set to process chip payments.

I'm in Indianapolis area. The chip reader requirement is spreading everywhere I go. Target, Lowes, Kroger etc. it's getting to the point now that I use the chip more than swipe per week

Here in NY, chips are becoming more common. But rather strangely, my local diner has gone back to swiping because "they got a new card machine"

Every CVS in the Boston area makes me use the chip now.

FWIW, it may be a bank requirement, not a vendor one.

Recently, October 2015, the liability shift has happened from banks to merchants if they do not upgrade payment systems to chip-enabled devices. Some areas, notably gas stations, are exempted from this until few years later, that might explain why other commentators complained about them. Citing [1]:

"Beginning in October 2015, that liability will shift to the merchants in certain cases unless they have replaced or upgraded their card acceptance and processing systems to use chip-enabled devices and applications to process payment transactions."

1. http://www.emv-connection.com/understanding-the-2015-u-s-fra...

Informative! Thanks for sharing.

Odd. I'm also in Boston and have to use it almost everywhere I go.

It's worse than that: contactless payment has two modes, and one of them just lets you read the magswipe track 2 data (including card number) through the contactless interface.

https://www.level2kernel.com/emv-glossary.html#MSDmode

Is it used anywhere?

I'm in Seattle. You go to one store and try to swipe..."No, you have to use the chip". Next place you try to use the chip..."No, that doesn't work yet. You need to swipe it".

Seems like no one is on the same page

We had this in Europe for a few months, it was painful there too, but eventually everywhere will be chip only and the swipe will be literally removed.

I understand the US is doing a slightly slower rollout so you guys might have to put up with either/or for almost a year, but once it is done you'll get used to using the chip pretty quickly.

The two "big" dates for EMV in the US is Oct 2015 (liability shift: merchants) and October 2017 (liability shift: fuel dispensers and ATMs)[0]. After Oct 2017 there will be no reason for banks to issue cards with a magnetic strip at all (although they CAN for travel).

In Europe some banks no longer issue cards with magnetic strips (chip only).

[0] https://www.aciworldwide.com/-/media/files/other/published%2...

One thing I don't like about the chip is it seems to take a much longer time to authenticate. Is this the same in Europe as well? Would be nice if it was as fast as a swipe. But I rather have better security.

My main gripe, which is pretty trivial I guess, is that I'm so used to just swiping the card and throwing it back in my wallet. Using the chip requires leaving the card in the reader until the transaction is complete, so I've almost walked off without my card a couple times. I agree though. I'd rather have better security. I just need to adjust my habits :)

They are working on making it faster[1], though I wouldn't hold my breath for it to be rolled out anytime soon.

[1]: http://investor.visa.com/news/news-details/2016/Visa-Speeds-...

It has mo to do with connection to host/processor than the chip itself. Reading chip takes milliseconds usually.

In Canada, there was a period where most merchants just taped a piece of paper that said "NO CHIP" across the slot.

Now that the chip cards and functioning readers are the norm, you see a lot of terminals with a piece of paper taped onto them that says "NO TAP".

I've tapped my card at some merchants who were unaware that their terminal had been tap-enabled. "We don't have tap yet" "It's approved" "Oh!"

I just returned from Belgium. I made sure that all the cards I took had chips. Results were mixed: The train station kiosks recognized the cards as chip + signature even though I had a PIN for them, so I had to use the clerk to buy tickets. The payment terminals in restaurants asked for my PIN, but then rejected it. I suspect my bank (despite assurances) didn't enable it. I have no way to test my cards now that I'm back in the US, as the readers (for the stores that have them enabled) default to signature "verification". The whole situation is a mess.

It's been a while, but the last time I researched credit cards for chip+pin the US didn't have any readily available - they're all chip+signature. Even though you have a PIN I can guarantee that it's only good for cash-withdrawal transactions (e.g. as a debit card or a high APR cash advance).

This was USAA, which has a lot of members living overseas, so the assumption was that they're familiar with the requirements.

Authentication methods is an agreement between card and POS terminal with card having the final word. So yes, blame your bank for not configuring card parameters correctly.

You can also disable the magstripe simply by using a strong magnet next to it.

Putting the card in the same pocket with my Android phone with a wallet case that has a magnetic "lock" seems to be enough...

Great tip! I'll try that. ;-)

BTW it also works very nicely for those hotel key cards that have a magnetic stripe. You'll be safely kept away from the minibar of your room if you put your key card in the same pocket with the phone.

My card (German) looks like it doesn't have a magstripe any more. It's got a black stripe on the back all right, but that's only half the usual height and has writing on it. I'm about to visit the US in a couple of weeks so we'll see if it works...

In the US, they are slowly rolling out chip+signature--which is no better.

My magstripe is demagnetized (because my phone jacket contains a magnet). I have no problem using my card (in France).

In Denmark, everyone uses chip, it is only if the chip is damaged by a broken card, that people use the mag-stripe

How secure are the chips?

There isn't any publicized actual fraud based on cloning the chips or extracting data from them - out the whole huge amount of CC fraud.

They are vulnerable to a set of physical attacks e.g. etching off the surface of the chip, scanning it with sensitive microscope and attempting to deduce stored data from that (IIRC there were some proof of concept videos posted on HN a few months ago) but it's not a major risk as it (a) requires physical possession of the card, (b) takes time and is destructive, and the result is useless once the owner reports the lost/stolen card, and (c) has significant costs (rare expensive equipment, specialized skills, lots of time) that far exceed the limits on normal credit cards.

Does this count? http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ri...

This one is interesting, I had not seen it.

If I'm reading this right, it still doesn't compromise the data on chip (i.e., the card cannot be copied, the limits enforced by chip are kept, etc) but allowed to modify the chip so that a physically stolen card can be used without knowing the PIN because the POS erroneously accepts a PIN verification response from another chip. This described hack seems to be impossible in recent chip implementations as well, but I'm not eager to dig through specs to check.

Still, it is still similar to the chip analysis vulnerability in risk as it (a) requires physically stealing the card and modifying it - thus it doesn't enable the far more common scenarios of skimming the card by an ATM device or a person e.g. waiter; and (b) doesn't allow to clone the card, so purchases must be made quickly by people physically close to the thieves and operators doing the chip-modification, so it means a much greater chance of arresting the whole team than in the currently common fate of stolen US card data where you can just sell the data to people anonymously over internet, and they themselves can easily make cloned cards to make the risky part of actually obtaining the money/goods.

A skimmed card will just work on the first try. A card modified like this is still likely to trigger "stolen, call the police" message on the POS terminal.

Well, they literally can't be read without an authentication code from the bank, so pretty secure. Anyone can copy a whole magstripe, but the chip can't be read directly.