News for hackers. Stuff that matters.
Re:Gas Pump Skimmers by Gaelan on Tuesday September 19, 2017 @01:12AM (#15281962)
Pretty much all US cardholders have chip+pin now. I’d say about 75% of retailers support it.

(Not sure if this is how it works outside of the US, but we currently have cards with both magstripes and chips. You use the chip where it’s supported, the stripe where it isn’t.)

Re:Gas Pump Skimmers by VirtualAirwaves on Tuesday September 19, 2017 @03:47PM (#15288148)
I've never seen Chip+Pin on a Credit Card in the United States outside of Target Stores that uses it on their own store card.

Everywhere else is Chip+Signature.

Are you thinking of Debit Cards? (I won't use these. I got my bank, BOFA to issue me an ATM card that's not a debit card.)

Re:Gas Pump Skimmers by Gaelan on Saturday September 23, 2017 @08:36PM (#15322585)
Yeah, my debit is Chip+PIN. Curious, what do you have against debit cards?
Re:Gas Pump Skimmers by VirtualAirwaves on Tuesday September 26, 2017 @11:53AM (#15339750)
Try getting your money back if it's stolen. (And try convincing the bank you didn't give someone your PIN!) With a credit card, it's the banks money.
Re:Gas Pump Skimmers by zerocrates on Tuesday September 19, 2017 @01:29AM (#15282022)
Very few credit cards are chip and pin, they're mostly chip and sign. And I don't think I've ever seen a gas station with a chip reader, so the chip's not really doing you any good if you're just swiping anyway. I believe the gas stations were given a longer timeframe to convert.
Re:Gas Pump Skimmers by cstrat on Tuesday September 19, 2017 @01:38AM (#15282052)
Here in Australia its pretty much 100% chip and PIN or contactless payments (paypass). Has been for a number of years now.

I don't think anyone swipes cards unless there is something wrong with the payment terminal. Even vending machines are tap and go.

Re:Gas Pump Skimmers by sjwright on Tuesday September 19, 2017 @02:59AM (#15282362)
If you swipe an Australian-issued card in an Australian-issued payment terminal, it will insist that you use the chip instead. Only if there is a problem reading the chip are you permitted to use the magnetic strip. Either way, the correct PIN number is required.

I believe that the magnetic strip can still be used for certain low-value transactions by stable merchants (e.g. street parking meters) but such exceptions are rare. Certainly never the case in a normal retail situation.

https://www.cnet.com/au/news/australian-credit-cards-boost-s...

Re:Gas Pump Skimmers by nikcub on Tuesday September 19, 2017 @04:44AM (#15282806)
Theres a loophole in Australian regs that I recently noticed. With a foreign card on credit, you can swipe and OK past the PIN prompt with no PIN. Most merchants don't know they are supposed to sign and verify after that.

Of the dozen times i've tried it i've been prompted once to sign - and in that case the card had no signature on it and the merchant waived it away.

I'm in the process of figuring out the scope of this issue and how to fix/report it - I think the solution will be for terminals to enforce prompting for ID/signature

Re:Gas Pump Skimmers by falsedan on Tuesday September 19, 2017 @08:06AM (#15283868)
> I'm in the process of figuring out the scope of this issue and how to fix/report it

Don't bother, the merchants and card issues are well-aware of this. You're supposed to reconcile your card statement with your expected transactions, and dispute irregularities. If you attempt to fraudulently claim that you didn't perform a transaction, the issuer goes to the merchant to get a copy of the signature & uses it as proof you authorized the transaction.

If a fraudster forged your signature, you simply assert that the signature is not yours. If you attempt fraud here (sign in an unrecognisable hand), the fraud investigations will try to put you at the scene with CC TV recordings/handwriting matching/etc. Hopefully you have not signed any affidavits that the signature is not yours, because then you'll be up for perjury as well as fraud.

Re:Gas Pump Skimmers by jimjimjim on Tuesday September 19, 2017 @05:16AM (#15282962)
pin-bypass is pain. until people are all moved to just be chip/pin or even just pin then the only way is to add a bunch of prompts to hopefully force the staff to check for signature or to add delays/confirmations to make the process too annoying and force the customer to change.
Re:Gas Pump Skimmers by Jaruzel on Tuesday September 19, 2017 @02:48AM (#15282317)
Same here in the UK - it's ALL Chip & PIN, I can't even recall the last time I had to swipe my card[1], and I use it a LOT (yay, Airmiles!).

If the payment is <= 30 GBP, it's an offline transaction as well. Anything over that amount triggers a round trip to the backend servers.

As an aside, it's now perfectly possible to live a cashless life in the UK if you wanted to.

--

[1] That said, I think ATMs read the mag-stripe... but I don't really use those either these days.

Re:Gas Pump Skimmers by falsedan on Tuesday September 19, 2017 @08:08AM (#15283881)
> If the payment is <= 30 GBP, it's an offline transaction as well

It's still online (card-present check), but skips authorisation (no PIN needed).

Re:Gas Pump Skimmers by reaperducer on Tuesday September 19, 2017 @01:47PM (#15286922)
> it's now perfectly possible to live a cashless life in the UK if you wanted to

Perhaps in London. Try spending a long weekend in Torquay.

Re:Gas Pump Skimmers by Jaruzel on Wednesday September 20, 2017 @08:55AM (#15293183)
I'm sure the Tesco, Sainsbury, Co-Op, and Waitrose in Torquay can handle card payments if you were really stuck.
Re:Gas Pump Skimmers by lightbyte on Tuesday September 19, 2017 @09:27AM (#15284365)
I haven't found a single place so far that supported the chip+pin transaction. Everyone has the terminals but they are either set to not do the pin transaction or they are tapped off with a "broken" sign.
Re:Gas Pump Skimmers by zamalek on Tuesday September 19, 2017 @01:47AM (#15282091)
Here in Washington the chip readers are sometimes taped over... nearly always in, you guessed it, gas stations. They have the hardware but it's disabled.
Re:Gas Pump Skimmers by Gaelan on Friday September 22, 2017 @10:33PM (#15317717)
Yep, also in Washington, same here.
Re:Gas Pump Skimmers by jmharvey on Tuesday September 19, 2017 @01:53AM (#15282110)
We do? I've seen chip + signature all over the place, but I don't think I have a single chip + pin credit card.
Re:Gas Pump Skimmers by Tempest1981 on Tuesday September 19, 2017 @03:52AM (#15282568)
Target cards are chip + pin, IIRC
Re:Gas Pump Skimmers by reaperducer on Tuesday September 19, 2017 @01:48PM (#15286930)
You can thank Russian hackers for that.
Re:Gas Pump Skimmers by jopsen on Tuesday September 19, 2017 @01:57AM (#15282121)
The chip was to avoid skimmers like this...

When implemented there was a liability shift. But as always the US is far behind the rest of the world.

In Denmark the chip was added in 2004, and fully adopted 4-6 years later.