News for hackers. Stuff that matters.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by NavinF on Thursday September 15, 2022 @03:44AM (#32848541)
The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by neilalexander on Thursday September 15, 2022 @04:38AM (#32848972)
What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by meragrin_ on Thursday September 15, 2022 @08:54AM (#32851111)
> What about it is inconvenient?

You have to remember not one, not two, not three, but several digits. Not only that. You have to look at a keypad. Oh, and you have to push buttons. Not once, not twice, but several times! Pity the poor fool who accidentally pushes the wrong button. More looking at a keypad and button pushing!

Yeah, I don't get it either. My only guess is the customer support calls for forgotten pins are more expensive to deal with than dealing with the incidents of fraud the pin would prevent.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Mister_Snuggles on Thursday September 15, 2022 @10:34AM (#32852682)
Don't they have to deal with those forgotten PIN calls anyway? Don't you need a PIN to get cash out of an ATM?

My debit card and its PIN are used for a few different things - in-store payments, using the ATM, and authenticating when in-person at a bank. The last one is interesting - each desk at the bank, both the tellers and the offices where you talk to someone, has a terminal and every interaction starts with putting in your debit card and entering your PIN.

Extending this to credit card is no big deal - my main bank syncs the PIN between the debit and credit cards. I only have a credit card with the other bank that I use and I haven't set foot in one of their branches in 20 years, so I have no idea whether they sync the PINs or use their cards for in-person authentication.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by saltcured on Thursday September 15, 2022 @07:39PM (#32859952)
Imagine that in this other alien culture, most people were using credit cards for most transactions and rarely ever use their ATM/debit card. They don't have a day to day use for cash so do not frequent ATMs nor do they have much reason to frequent bank branches.

They've been presenting a credit card and making a squiggle with a pen for years and never remembered a PIN at all. Their credit card bill is paid electronically online somehow, either automatically because of a direct debit configuration setup years before or via an interactive banking website. These were authenticated with a web password and perhaps archaic knowledge of a routing number and checking account nunber. No PIN in sight there either...

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by NavinF on Thursday September 15, 2022 @05:01AM (#32849104)
It takes a few more seconds. Never gonna happen.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by sbarre on Thursday September 15, 2022 @07:46AM (#32850299)
Do you say this because you believe that Americans are exceptional compared to the rest of the world? Because the rest of the modern world has made the change without trouble.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by micromacrofoot on Thursday September 15, 2022 @08:00AM (#32850428)
it’s because american corporations put profit above all else, and someone probably crunched the numbers and determined that faster transactions make them more money despite higher occurrences of fraud
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by hugobitola on Thursday September 15, 2022 @08:49AM (#32851026)
How could entering a 4 digit PIN be slower than "printing a piece of receipt, handing over a pen and waiting for the customer to sign"?
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by saltcured on Thursday September 15, 2022 @07:44PM (#32860010)
When still requested, the signature is often just scrawling something into a signature box on a touch screen of the same device with the chip reader or contactless receiver. There might be some stylus dangling on a tether and often a spastic finger tip is sufficient to satisfy the UI.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by dwringer on Thursday September 15, 2022 @09:14AM (#32851400)
Generally (at least in my part of the US) people stopped being asked to sign for small purchases several years ago; usually now convenience stores and big box stores under a certain dollar amount just ask you to tap a button instead of sign.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by japanuspus on Thursday September 15, 2022 @10:00AM (#32852092)
This is the same with PIN in Europe (at least for contactless): Below a certain amount you do not have to enter the PIN.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by micromacrofoot on Thursday September 15, 2022 @11:42AM (#32853740)
Signing is very rare these days, non-existent for small purchases... and still seemingly rare for larger ones. I've spent hundreds of dollars in single transactions without signature or pin.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Closi on Thursday September 15, 2022 @07:46AM (#32850298)
How often do you have to do it though? It's only for high-value transactions (>£45) and the rest is contactless.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ghaff on Thursday September 15, 2022 @08:08AM (#32850505)
In Ireland I’ve had to enter a PIN for as little as 15 Euros. It’s very variable. Never run into this in Europe before and it’s been something of a pain because I don’t have a PIN on any of my personal cards. Fortunately I found I do have one on my corporate card.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by neilalexander on Thursday September 15, 2022 @08:27AM (#32850730)
The threshold varies between banks but there is often a limit as to how much you can spend or many times you can use "unverified" contactless payments (i.e. not Apple Pay which forces biometric verification) in a row before it will stop and demand a Chip+PIN transaction instead, to prevent someone who finds/steals a card from spending large amounts without ever needing to know the PIN.

For example, if the contactless limit is £100 and it only allows four contactless transactions in a row, the worst damage that can be done is £400, so banks and card issuers only need to manage the liability for fraudulent contactless transactions up to that amount (Visa and Mastercard call it "Zero Liability" protection).

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by omnimus on Thursday September 15, 2022 @06:39AM (#32849797)
I am nit sure how it works elsewhere but with NFC i can set limit when PIN is required . And with NFC on phone this gets preapproved by using biometrics.

So most people dont write PIN.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by acdha on Thursday September 15, 2022 @07:24AM (#32850115)
The time is moot in almost all situations as long as it doesn’t take you longer to enter the PIN than it does for a cashier to finish tallying items. The concern I’ve heard businesses raise is that people won’t remember it but that’s also a chicken and egg problem since people will remember what they use regularly.

Of course, since it’s the 2020s and not the 1990s we don’t need either since NFC is widely supported and an Apple/Google device transaction secured by biometrics on the client is far better and already widely supported.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by dezgeg on Thursday September 15, 2022 @10:24AM (#32852525)
Hm, where is it possible to enter the PIN that early? Everywhere I have seen the reader will only ask PIN once the full amount to be charged is known.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by ThePowerOfFuet on Thursday September 15, 2022 @12:04PM (#32854084)
It takes less time, as the PIN is entered before the receipt is even printed.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by Mister_Snuggles on Thursday September 15, 2022 @10:21AM (#32852467)
I've heard this argument but I honestly don't understand it. This is the reality for making credit card purchases in Canada, having to remember PINs for credit cards is something I've never heard anybody complain about.

Maybe it's because the prevalence of Interac already trained us to deal with PINs.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by canadianwatcher on Sunday September 18, 2022 @03:51PM (#32890864)
Except that not everywhere in Canada requires chip and PIN.
Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by xtiansimon on Thursday September 15, 2022 @07:44AM (#32850276)
“Banks are willing to eat the tiny reversed transactions…”

Banks? A chargeback goes to the business.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by dredmorbius on Thursday September 15, 2022 @11:41PM (#32861792)
This.

And the public eat the inconvenience of having fraud transacted on their behalf.

Why merchants don't insist on C&P isn't clear, though I suspect that distributed liability, ignorance, disaggregated political voice (see Mancur Olson's "Logic of Collective Action" <https://www.thoughtco.com/the-logic-of-collective-action-114...>), as well as asymmetric cost/benefit incentives between specific retail points-of-presence (store managers and franchise owners) vs. corporate purchasing and policy (see the McDonalds ice cream machine fraud <https://www.wired.com/story/they-hacked-mcdonalds-ice-cream-...>. Multiple HN discussions: <https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...>.

Re:Crazy Thin ‘Deep Insert’ ATM Skimmers by DanAtC on Thursday September 15, 2022 @04:21AM (#32848842)
Banks don't eat reversed charges, the retailer does.