News for hackers. Stuff that matters.
Re:Why You Still Can’t Use a Chip Card Everywhere by gambiting on Monday July 25, 2016 @04:37AM (#12157273)
Because in US, signature fraud is still on the bank, not on the merchant. So to give you an example - someone steals your card, goes to a shop, signs the receipt and walks away with the goods. Now if you report your card as stolen to the bank, the bank will refund you, but the merchant also keeps the money. So merchants have no financial incentive to upgrade their terminals, because card fraud does not impact them.

Now the same situation in the UK - you report your card as stolen, the bank refunds you, but also takes the money away from the merchant(saying that the responsibility to check the signature was on them and they failed, so they lose the money). As a result, almost no one in UK accepts signature-only cards, because you could literally buy something, sign the receipt, walk out and report the card as stolen - and the merchant loses all the money. So merchants had all the incentive to upgrade their terminals to chip-and-pin only, terminals which can take magnetic-strips are just super rare and usually not supported even if the machine has them.

edit: it looks like signature fraud in US is not always on the bank. My mistake, sorry.

Re:Why You Still Can’t Use a Chip Card Everywhere by lentil on Monday July 25, 2016 @04:52AM (#12157324)
> almost no one in UK accepts signature-only cards

> terminals which can take magnetic-strips are just super rare and usually not supported even if the machine has them.

I've not found this to be the case. I used a non-chip US card here in the UK extensively over the last year or so, and I've never once encountered a merchant that didn't want to take my card, nor a terminal that didn't read magnetic strips.

I do find people at checkouts to be a little surprised by someone having to swipe & sign, since that's quite rare now. And often they had trouble finding a pen for me to sign with :) But I was always able to complete the transaction nonetheless.

Re:Why You Still Can’t Use a Chip Card Everywhere by gambiting on Monday July 25, 2016 @05:07AM (#12157378)
Really? I had my Polish-issued signature-only card with me here in UK just a few years ago and the only place that would take it was the post office - every supermarket I tried just refused(I had one instance where I convinced the cashier to just try swiping the card and it did actually work, to her surprise, but in most places it was just a flat out no).
Re:Why You Still Can’t Use a Chip Card Everywhere by aninhumer on Monday July 25, 2016 @06:03AM (#12157583)
If you're Polish, this might just be xenophobia.

I can imagine a cashier just rolling their eyes at an American using a weird card, but being much more distrustful of a Polish person doing the same.

Re:Why You Still Can’t Use a Chip Card Everywhere by feintruled on Monday July 25, 2016 @05:27AM (#12157457)
It's all about the liabilites - the shops are allowed to accept swipe and sign, but the fees and liability are massively shifted to the merchant. A lot of places do have this as a fallback for PIN damaged cards though, you are right. They judge it to be worth the risk to not lose the business.
Re:Why You Still Can’t Use a Chip Card Everywhere by wiredfool on Monday July 25, 2016 @05:23AM (#12157435)
In the UK, Ireland, and France I've only found a couple of places that wouldn't take a signature card -- Automated service stations and the Autoroute toll plazas in France and a toy store in Ireland. Everyone else has been ok with a chip+signature card from the US.
Re:Why You Still Can’t Use a Chip Card Everywhere by lentil on Monday July 25, 2016 @02:33PM (#12160580)
Yep, I've had that experience trying to buy petrol in France too. That's the only place I can remember running into a problem with it, actually. Never anywhere in the UK.
Re:Why You Still Can’t Use a Chip Card Everywhere by pmontra on Monday July 25, 2016 @05:12AM (#12157395)
Maybe it's the same in Europe. I have Italian credit cards with PINs (one even contactless, no choice). I don't remember the PINs because it's chip and signature everywhere I've been, even outside Italy. It's very rare that somebody asks me for a PIN. I say that I'll sign and it's OK.

Contactless, no thanks, I don't want somebody to swipe my purse without me knowing and as far as I googled it's not clear that Faraday bags really work. Contactless passports too.

Re:Why You Still Can’t Use a Chip Card Everywhere by gambiting on Monday July 25, 2016 @05:28AM (#12157461)
I literally would close my account if the bank didn't offer contactless. It's so much better. To answer your concern - the only way for anyone to "swipe" your purse is to have an authorized, authenticated terminal which can communicate with your card using the proper key from the bank - which means that the terminal would get invalidated by the bank straight away after people started reporting fraud. Contactless cards literally won't surrender their information to regular NFC readers. But even assuming they could - the most you can be charged is relatively small amount, and only 5x a day until you have to type in your pin - and if that happened your bank would refund you instantly. So seriously, I can't imagine not having a contactless card.
Re:Why You Still Can’t Use a Chip Card Everywhere by oarsinsync on Monday July 25, 2016 @06:28AM (#12157688)
Unfortunately that's only true until the next vulnerability that allows theft via NFC on a mobile device. There has already been one, there will almost certainly be another.

http://www.securityweek.com/contactless-visa-cards-vulnerabl...

> "With just a mobile phone we created a PoS terminal that could read a card through a wallet," said Martin Emms, lead researcher on the project. "All the checks are carried out on the card rather than the terminal so at the point of transaction, there is nothing to raise suspicions. By pre-setting the amount you want to transfer, you can bump your mobile against someone’s pocket or swipe your phone over a wallet left on a table and approve a transaction. In our tests, it took less than a second for the transaction to be approved."

Re:Why You Still Can’t Use a Chip Card Everywhere by gambiting on Monday July 25, 2016 @06:32AM (#12157706)
Absolutely - but that still flags a terminal for review and will get it blocked. There does not exist any vulnerability that would allow you to clone NFC cards, which has the biggest potential for abuse. And again, even then - contactless cannot be used to take out any cash, so it's not an attractive target for thieves. What are they going to buy with a cloned NFC card(if they could get one)? Lunch?
Re:Why You Still Can’t Use a Chip Card Everywhere by feintruled on Monday July 25, 2016 @05:24AM (#12157440)
Your fears are mostly unwarranted. Even if they could get close enough to clone your card (and their are cryptographic safeguards that make this difficult) they would be able to do a limited number of transactions before it asked for the PIN (which can not be read directly from the card, so they should not know this).

Then, when you tried to use your legit card, the on-card transaction count would clash and the card and clones would be frozen. You, as the obvious owner of the card, would be free of all liabilty and due a refund (the bank would not kick up a fuss about this, it is in their interest to reduce friction in these low amount cases to drive technology adoption).

Re:Why You Still Can’t Use a Chip Card Everywhere by kyriakos on Monday July 25, 2016 @04:46AM (#12157303)
doesn't this give an incentive to US banks to upgrade the terminals in stores for free? they'll make back the money from the reduced fraud.
Re:Why You Still Can’t Use a Chip Card Everywhere by bkor on Monday July 25, 2016 @05:07AM (#12157376)
The credit card fee is way higher due to fraud; the "insurance" and so on needs to be paid somehow. The margins asked in e.g. Netherlands to pay with a bank card are much lower than any credit card. Partially these low fees are a result of price restrictions set by the government many years back. Then eventually banks figured out they could make much more money with a low fee and huge volume.

Before chip+pin (in Netherlands), swipe+pin was used. For fraud the client was already responsible. In practice the bank almost always reimbursed the client. To restrict the fraud/skimming, cards are often restricted to be used in Europe only. A setting you can easily change.

Due to above, usually non-European tourists are now affected by skimming.

I prefer the tap to pay btw. Banks restrict which machines can get money off these cards and in practice it is usually the typing in of your PIN which is the biggest problem. Depending on the bank you can change the max tap to pay amount.