Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card.
Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virtual non-event. When the credit card companies moved the issuing banks had to issue PINs, but everyone already knew the mechanics of using it.
The most interesting part is that the US already has the infrastructure to support this. I went to a Walmart in the US and paying with my Canadian credit card worked EXACTLY like it does in Canada - insert card, confirm amount, enter PIN, done. The cashier was a little confused that I didn't need to sign for it, but ultimately they just went with it.
The introduction of NFC was a similar non-event.
You have to remember not one, not two, not three, but several digits. Not only that. You have to look at a keypad. Oh, and you have to push buttons. Not once, not twice, but several times! Pity the poor fool who accidentally pushes the wrong button. More looking at a keypad and button pushing!
Yeah, I don't get it either. My only guess is the customer support calls for forgotten pins are more expensive to deal with than dealing with the incidents of fraud the pin would prevent.
My debit card and its PIN are used for a few different things - in-store payments, using the ATM, and authenticating when in-person at a bank. The last one is interesting - each desk at the bank, both the tellers and the offices where you talk to someone, has a terminal and every interaction starts with putting in your debit card and entering your PIN.
Extending this to credit card is no big deal - my main bank syncs the PIN between the debit and credit cards. I only have a credit card with the other bank that I use and I haven't set foot in one of their branches in 20 years, so I have no idea whether they sync the PINs or use their cards for in-person authentication.
They've been presenting a credit card and making a squiggle with a pen for years and never remembered a PIN at all. Their credit card bill is paid electronically online somehow, either automatically because of a direct debit configuration setup years before or via an interactive banking website. These were authenticated with a web password and perhaps archaic knowledge of a routing number and checking account nunber. No PIN in sight there either...
For example, if the contactless limit is £100 and it only allows four contactless transactions in a row, the worst damage that can be done is £400, so banks and card issuers only need to manage the liability for fraudulent contactless transactions up to that amount (Visa and Mastercard call it "Zero Liability" protection).
So most people dont write PIN.
Of course, since it’s the 2020s and not the 1990s we don’t need either since NFC is widely supported and an Apple/Google device transaction secured by biometrics on the client is far better and already widely supported.
Maybe it's because the prevalence of Interac already trained us to deal with PINs.
Banks? A chargeback goes to the business.
And the public eat the inconvenience of having fraud transacted on their behalf.
Why merchants don't insist on C&P isn't clear, though I suspect that distributed liability, ignorance, disaggregated political voice (see Mancur Olson's "Logic of Collective Action" <https://www.thoughtco.com/the-logic-of-collective-action-114...>), as well as asymmetric cost/benefit incentives between specific retail points-of-presence (store managers and franchise owners) vs. corporate purchasing and policy (see the McDonalds ice cream machine fraud <https://www.wired.com/story/they-hacked-mcdonalds-ice-cream-...>. Multiple HN discussions: <https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...>.
I want to call out this country wide edict. I've seen this done in both the United States and Canada. I do not know your personal situation, but I'm fairly sure it wasn't across the entire country of Canada.
Based on my experience both the United States and Canada are usually moving financial tech through different regions and social groups in phases and at different paces.
I'm trying to think of specific examples occurring nation wide and credit card technology just doesn't register. Maybe the removal of the Canadian penny, or paper dollar?
Yes, every card in Canada is chip and PIN except possibly some prepaid gift cards. The same is the case across Europe and Australia and has been for the better part of two decades now.
Speak not from whence you know not.
While all cards in Canada may have chip and PIN, no such event occurred where across the nation everyone started using it for every purchase, like there was no transition, nor different options to use with the same card. Consider contactless-enabled card payments as an example (like the original post did).
The assertion that the United States is somehow behind Canada in payment technology because all credit card issuers do not issue cards with chip and PIN seems invalid to me. Additionally the surprise at not requiring signatures. Merchants have been accepting contact-less enabled card payments in the United States, requiring no signature, for quite awhile.
The $1 and the $2 notes stopped being issued in 1989 and 1996 respectively. They are not demonetized and you can still exchange such money at any bank in Canada, or the Bank of Canada, for its face value.
https://www.bankofcanada.ca/banknotes/about-legal-tender/
>While all cards in Canada may have chip and PIN, no such event occurred where across the nation everyone started using it for every purchase, like there was no transition
What the hell is this supposed to mean? EMV-enabled cards were rolled out as each bank got onboard, replacing cards at expiry with EMV-enabled ones. Eventually no further non-chip cards were issued.
After a while, the same thing happened for contactless as well.
>nor different options to use with the same card.
EMV supports multiple applets per card, so you can absolutely have a debit and a credit card in the same physical card, choosing which you want to use after you insert it into the reader. These are unusual, perhaps because most people seem to prefer separate cards.
>The assertion that the United States is somehow behind Canada in payment technology because all credit card issuers do not issue cards with chip and PIN seems invalid to me.
The United States isn't just behind Canada, it's behind Europe, Australia, and most of Asia, as well.
I can send money from one European country to another in a regulated maximum of 15 seconds 24/7/365 (look up "SCT INST"), but the Americans can't get it from one bank to another in the same country quicker than a day or two (or sometimes three, apparently). Never mind consumers trying to punch in someone's ABA routing and account numbers to pay them... lol nope, hence the mess of insecure third-party services like Zelle, CashApp, etc.
Skimmers aren't really a thing in Europe because everything is EMV, and I don't mean the abortion which is chip-and-signature (although that still proves possession of the original card).
>Additionally the surprise at not requiring signatures. Merchants have been accepting contact-less enabled card payments in the United States, requiring no signature, for quite awhile.
Again you speak from whence you know not. Google Pay and Apple Pay use a different CVM, referred to as CDCVM, for which there is no PIN as user authentication is handled by the device (hence the need for a fingerprint or face scan before they can be used). For small transactions plastic cards are permitted to perform contactless transactions without a PIN in most countries for convenience as the risk of fraud is low given the maximum cumulative cap of perhaps €50/$50, configurable by the issuer, before a PIN becomes required, which caps the bank's liability in case of theft (since the cardholder is not on the hook for it).
>The $1 and the $2 notes stopped being issued in 1989 and 1996 respectively. They are not demonetized and you can still exchange such money at any bank in Canada, or the Bank of Canada, for its face value.
>https://www.bankofcanada.ca/banknotes/about-legal-tender/
Keep reading and you'll find they they do not meet the definition of legal tender. Like I said. Here's a quote from their site (https://www.bankofcanada.ca/banknotes/bank-note-redemption-s...)
=== Bank notes that are no longer legal tender
Since January 1, 2021, the Canadian $1, $2, $25, $500 and $1,000 bank notes are no longer considered legal tender. Essentially, this means that you may not be able to use them in cash transactions. ===
>> While all cards in Canada may have chip and PIN, no such event occurred where across the nation everyone started using it for every purchase, like there was no transition
> What the hell is this supposed to mean? EMV-enabled cards were rolled out as each bank got onboard, replacing cards at expiry with EMV-enabled ones. Eventually no further non-chip cards were issued.
> After a while, the same thing happened for contactless as well.
Again, I am explicitly making the claim that it is misleading to suggest Canada was ahead of the United States by mandating all credit cards have chip and PIN, because by then you could do the same thing with contactless (signatureless transations, with a benefit of not using a pin) just like in the United States.
>> nor different options to use with the same card.
> EMV supports multiple applets per card, so you can absolutely have a debit and a credit card in the same physical card, choosing which you want to use after you insert it into the reader. These are unusual, perhaps because most people seem to prefer separate cards.
I'm aware. I've had one.
>> The assertion that the United States is somehow behind Canada in payment technology because all credit card issuers do not issue cards with chip and PIN seems invalid to me.
> The United States isn't just behind Canada, it's behind Europe, Australia, and most of Asia, as well.
I kindly reject your assertion, because you are basing it on Canada requiring all cards have chip and PIN, but not enforcing its usage at all terminals.
> I can send money from one European country to another in a regulated maximum of 15 seconds 24/7/365 (look up "SCT INST"), but the Americans can't get it from one bank to another in the same country quicker than a day or two (or sometimes three, apparently). Never mind consumers trying to punch in someone's ABA routing and account numbers to pay them... lol nope, hence the mess of insecure third-party services like Zelle, CashApp, etc.
> Skimmers aren't really a thing in Europe because everything is EMV, and I don't mean the abortion which is chip-and-signature (although that still proves possession of the original card).
>> Additionally the surprise at not requiring signatures. Merchants have been accepting contact-less enabled card payments in the United States, requiring no signature, for quite awhile.
> Again you speak from whence you know not. Google Pay and Apple Pay use a different CVM, referred to as CDCVM, for which there is no PIN as user authentication is handled by the device (hence the need for a fingerprint or face scan before they can be used). For small transactions plastic cards are permitted to perform contactless transactions without a PIN in most countries for convenience as the risk of fraud is low given the maximum cumulative cap of perhaps €50/$50, configurable by the issuer, before a PIN becomes required, which caps the bank's liability in case of theft (since the cardholder is not on the hook for it).
I think we're done talking now, given you keep telling me I don't know what I'm saying, and you are obviously just ignoring the fact that I've been completing contactless, signatureless transactions with my credit card for a significant amount of my purchases made in the United States and Canada since 2008.
https://www.globalpaymentsintegrated.com/en-us/blog/2020/09/...
I'm unable to measure how "common" it was across two giant land masses with very different populations sizes. My personal story was paying by credit card via tap and requiring no signature, with a card issued in the United States while in Canada, and having people be very surprised at its use.
Alternatively - do what Monzo does in the UK and issue cards with a magnetic stripe that is disabled in the backend by default.
If you try to use the magnetic stripe, it sends you an alert that says "Someone (possibly you) tried to pay using the magnetic stripe. Do you want to allow the magnetic stripe for the next hour?"
Then if you travel to a country that relies on magnetic stripe, similarly it sends you a message saying "You have travelled to X - sometimes you may need to enable the magnetic stripe in order to use an ATM. Do you want to temporarily enable the magnetic stripe?"
Over here they just moved the burden of fraudulent transactions to the merchant if they still swiped instead of using the chip.
Shops upgraded their equipment real f'n fast.
Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks
The whole situation smells like it involves a lot of vendor lock-in, too (which I always hate to see).
Anyone who didn't think of providing a forward-compatible reader at any point in the last 10 yrs was driving into obsolence
Airline ticket counters…
Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad.
Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.
> Airline ticket counters…
> Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad.
The rest of the world figured this out long ago; this is already a solved problem.
I moved on and found a different lot.
Sucks that everything else about smart watches sucks tho. Thanks to Apple making the "pretty" Apple watch, other brands have forgone things like eink/mip displays that get better battery life. :/
The deal with processors is this:
if you use chip + PIN or sig and there is fraud, it's on the processor (Visa/Mastercard, etc)
if you use swipe, it's on the retailer directly.
In Europe you can buy card terminals for €30 with no monthly fee, and you don't even have to be a registered business entity.
Now that I check, that same company exists in the US too:
From the POV of these small business owners that Sumup terminal doesn't do anything to help them and if anything makes their life harder. It won't integrate with their business management software (our product) and most likely will have higher transaction fees than their current payment processor. The company I was with offered EMV terminals that were fully integrated with the management software (I helped write the integration), but there wasn't a lot of interest in them outside of larger companies. The small guys in general don't have a lot of incentive to care about information security. One of the other projects I worked on was migrating the management software from using encrypted CC numbers stored in its database to using tokens. When we took away the ability for users to unmask and view the full CC number some of them started saving saving card numbers in the plain text customer info fields (address, etc.).
"You won't be able to accept cards for payment unless you use an EMV terminal or tokenized card for recurrent CNP transactions."
Problem solved.
Exactly the type of company that should be getting one of those portable card readers that can be easily replaced.
It can't be harder to enter an amount in the device and ask the customer to insert card and type pin than typing numbers or swiping many times, getting signatures, etc.
I use my app, not my card, for this reason.
There is a huge difference between this kind of attack and what an attacker can do with the old scheme of magnetic swipe data over RFID. With the former, the only thing an attacker can do is perform a real transaction in that moment; this transaction leaves behind an audit trail tied to a real merchant (the operator of the terminal) and their bank account. An attacker cannot, however, initiate additional payments without accessing the payment card again, and without access to the cryptographic secrets held by the payment service provider, they cannot extract the card number to use for online transactions.
With the latter, it's equivalent to skimming a the magnetic stripe: an attacker can clone the card and reuse it for transactions as often as they'd like for whatever amounts they can authorize. In addition, they will have access to the plaintext card number, which would allow them to use it for online transactions. And absolutely none of this leaves behind an audit trail of how the attacker got your card.
Here in Alberta, it's the law that you need to pay before you pump[0]. If you're at a modern pump you insert your card, it does a preauth for some amount (you can select common amounts, like $20 of fuel, or "fill up" which is like $125 or $250 depending on the station), then when you're done it does a purchase for the exact amount.
If you're not at a modern pump, or you're paying cash, you have to go into the store, prepay for something that you think will fill your tank, fill your car, then go back into the store and get your change.
[0] https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-v...
She didn't have any problem taking a chipped card but I imagine there are self-serve places that can't. It was only in 2018 that Oregon allowed self-serve in counties with less than 40,000 people. 17 of the 36 counties qualify.
The advice I've seen with credit cards seems to be "always tap if you can" since that's not subject to skimming or stealing a PIN.
Then they continue to be part of the problem (and liability for fraud is on them).
Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story.
Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular?
Everywhere I go in South America and Europe, businesses have portable readers. The card companies just sent them new readers and they were accepting chips overnight. Same when NFC was introduced.
The US payment and banking systems are truly maddening.