Also large retailers that "self-acquired" didn't want to invest in upgraded readers, or lose access to the card details.
Breaches like Target's where a bunch of actual CPANs and customer details were stolen started to force the US to upgrade. Enforcing PCI compliance of separation and encryption of CHI has also forced US companies and banks to upgrade.
Was it Visa and MasterCard? Or the issuing banks?
Sorry, to clarify:
PII: Personally Identifiable Information (relates to GDPR etc)
CHD: Card Holder Data (relates to EMV etc)
CHD is a form of PII, but PII has greater scope.
Apple Card was/is Apple's way to promote contactless EMV in the US, which in turn promotes use of Apple Pay on the phone/watch.
Apple Card is a US only thing though AFAIK.
Apple Card, with fewer than 7mm users, was launched half a decade after Apple Pay [1][2]. Apple sells over 200mm iPhones a year here. Apple Card was not a way to promote contactless payment, it's a margin play.
Its sole purpose is to be swiped. It's well made, but I don't think they want people using it.
Went to a new city, one place out of the four I visited required a signature, the rest were fine with tap to pay/chip+Pin. Some places are fine until some arbitrary limit, etc. The place that made me sign? The purchases were $5-$6.
Contactless has different floor limits than Contact (chip). For example, in AU, the limit for contactless without PIN is ~AUD100. In the UK, I believe its GBP30.
If you tap for a payment over that limit, the reader will ask for the PIN.
The primary difference is that if a customer uses contactless/contact and PIN, then the risk of the transaction is passed to the network/issuer, instead of the merchant.
Americans don't want to punch in a PIN. We have more cards per capita and are habituated to the convenience of a swipe. (Unlike much to the world, our fraud risk sits almost entirely on the merchant side.)
Contactless had no hope with a PIN. Merchants catered to that despite higher cost and risk.
I’m not sure if it’s true for all EU countries and banks, but in general you don’t put in your PIN every time with contactless. The card usually works for a number of transactions without a PIN, often up to a certain limit, after which it asks you to insert it again.
As an American, I never get prompted in Europe for a PIN. Even for large transactions. That matches a swipe's convenience.
That was the whole point of moving to EMV, it removes the fraud risk from the merchant.
That's different to the charge-back risk, which is where the customer disputes the transaction itself.
In parts of the world where the consumer's bank bears the risk, and there is in imbalance between commercial and consumer banking, there is a powerful group--consumer banks--to apply pressure.
Sometimes that results in fewer consumer protections. In most: indirect pressure on merchants. (I can think of no country with an imbalance in favor of commercial banking with a strong consumer sector.) This state describes most of the world: optimized for cost reduction.
> That was the whole point of moving to EMV, it removes the fraud risk from the merchant
Who bears fraud risk varies.
In America, it was always the merchants. They have limited leverage over Visa and Mastercard. With the banks neutral and a valid competitor in American Express, there was nobody who wanted to anger consumers by taking away their swipes. (If you're that merchant, you're cash only.) So they optimized for purchasing convenience.
Australia is a cost optimizer. America a convenience optimizer.
The fraud of magstripes was huge, because there was literally no security. Anyone could create a magstripe. Customers using credit cards in the US are protected by legislation against that fraud.
The whole point of EMV was to remove the capability of fraud by replicating the magstripe. It meant that the transaction could correctly tell between "card present" and "card not present" transactions. So the risk of card-present transactions is dramatically lowered, independent of who is responsible for the fraud.
It is to both the merchants and the banks benefit to reduce/remove fraud. The banks offloaded it to the merchants in the US (as they did in other countries), but the introduction of EMV was "sold" to the merchants in the rest of the world by the banks saying they would take on the risk of fraud for "card present" transactions.
The banks were never "neutral" in the US. Visa/MC were both bank consortiums.
America is not a "convenience optimizer" its a "changing consumer behavior is hard so lets not do it" optimizer.
Merchants had more power, but the ultimate deciders were consumers, who have not only a choice in merchants but a choice in cards.
> the risk of card-present transactions is dramatically lowered, independent of who is responsible for the fraud
Nobody cares if business goes down more than the fraud costs.
> Visa/MC were both bank consortiums
This is wrong. American Express is bank-like because it owns its own credit book. Visa and MasterCard are payment processors. They are publicly traded and not bank consortiums. This is crucial to understanding the power dynamic: the payment processors do not take diktats from the banks.
> America is not a "convenience optimizer" its a "changing consumer behavior is hard so lets not do it" optimizer
Sure. Friction avoided for not being worth the trouble is optimising for convenience.
I can personally tell you that had a card gone chip + PIN mandatory, I’d have dropped it, and if a merchant started requiring special payment requirements I’d expect compensation for the trouble. Many merchants, notably Starbucks, did this, but it could never go mainstream. And unlike countries where consumer banks were incentivised to lobby for reforms, that political will to override the public’s preferences couldn’t exist here.
"By 1970, BofA gave up direct control of the BankAmericard program, forming a cooperative with the other various BankAmericard issuer banks to take over its management. It was then renamed Visa in 1976."
Both Visa and Mastercard mandated upgrades to merchant terminals in the non-US world. For example, in Australia, as of 1 August 2014, Chip+PIN was required.
That upgrade has been delayed repeatedly in the US because of pushback from the merchants that don't want to upgrade their terminals. It has nothing to do with the consumers.
Visa in the US states: "When you upgrade to chip technology, you continue to be protected from counterfeit fraud losses. As of October 1, 2015, businesses that don’t accept Visa chip card transactions may be responsible for any resulting counterfeit fraud. Similarly, effective April 17, 2021, Visa transactions made at ATMs and Automated Fuel Dispensers (AFDs) will be included in the Liability Shift Policy."
In the US however, they continue to support signatures, which have been removed pretty much every where else:
"No. Visa continues to support a range of cardholder verification methods (CVMs) including signature, online PIN, and no-signature for low-value, low-risk transactions. Visa will maintain interoperability across those methods with technical standards, business rules, and compliance programs."
https://usa.visa.com/run-your-business/small-business-tools/...
When Chip + PIN was introduced in the UK in 2003, people were widely concerned about the potential for inconvenience (entering a PIN takes longer than a swipe, the transaction might take longer to be processed, you might forget the PIN altogether).
In reality, fear outweighed the reality, the world carried on as usual and people adapted very quickly. It's now just totally normal here to enter a PIN and the average British person would feel far more inconvenienced if asked to sign for a transaction instead (which has become such a rare event here that the average person would be completely taken by surprise if asked to do so).
I've not found this to be the case anymore, sometimes the terminal will display a limit or the merchant will believe the limit applies to phones, but no limit is technically enforced.
Specifically, I believe this was due to Strong Customer Authentication laws in the EU: https://www.visa.co.uk/partner-with-us/payment-technology/st...
Not true, although shop keepers will often say it won't work, right up until I tap and it works
On some POSes, you can get a hint of when the POS either doesn't understand CDCVM or isn't configured to verify it when you tap with Apple Pay/Google Wallet and you get back a "Cardholder Device Not Verified" on the receipt.
Obviously ultimately, even with CDCVM support, it's up to how things are configured, but in the UK at least, every single POS I've seen that returns "Cardholder Device Verified" will let transactions through the same way as if you did Chip+PIN.
Which, thinking about it, is exactly how it should be.
The closed circuit of chip reader and pin was always touted as super secure. Then suddenly, you could pay contactless with most cards regardless of the amount and enter the PIN. Too me this always seemed to subvert the "super secure" chip & PIN authentication.
It's a small "hardship", really. On small amounts contactless works just dandy and having to present the physical card to the chip reader for larger amounts makes me actually feel better.
Chip and Pin usually implies offline PIN. The terminal supplies the PIN, after a one-way transform of some sort IIRC* to the chip on the card, which then verifies it locally against a stored version of that same hash or whatever.
With contactless you're doing online PIN. The terminal applies a transform and some sort of asymmetric key encryption to the PIN, and this gets sent to your bank. There's nothing any less secure here.
(* I wrote an EMV 'kernel' a long, long time ago, in about 2002, and some more PIN block processing code about 8 years back. So it's been a while!)
So you could write it in Visual Basic if you wanted, but your PCI auditor might have a problem with that. :)
As far as I understand it EMV has L1 and L2 "kernels", then there is an "L3" that is acquirer specific.
When a device is "PCI-PADSS" certified, the L1/L2 kernels are what are tested.
When a merchant is PCI-DSS audited, it is a combination of the PCI-PADSS certification for the device, as well as the L3 layer and other business processing rules around handling the CHD (Card Holder Data). The L3 is supplied by the merchant's acquirer (often with the terminal itself) and the acquirer has had the device validated as part of their PCI audit.
EMV L1 Kernel: The "app" that understands the EMV protocol and data exchanges ("APDUs") between the reader and the card. The equivalent of the PHY chip and ethernet frame handler in ethernet.
EMV L2 Kernel: The "app" that understands the EMV business rules and processing of transaction. The equivalent would be the IP layer in networking land.
EMV L3 Kernel: The specific "acquirer" rules, eg, there is a BIN (Bank Identification Number) accept/deny list that an acquirer will accept. It also has other rules about limits etc that the acquirer imposes. The equivalent would be IPTables in Linux.
I was very proud when my security library, including implementations of all sorts of ANSI X.9 standards, derived-unique-keys-per-transaction, a keystore that was destroyed on tamper, secure program code update mechanisms etc etc passed certification, on a device with 128k of SRAM and 256k of program memory.
Shame it never made it to market. Stupid unicorn company taking on tens of millions in debt and then exploding... still, I got a few trips to China out of it.
The kernel I wrote in about 2002/3 was in C and allowed a PC using a dumb reader (with secure PIN pad) to run the transaction, on Windows, Linux or (shudder) Unixware at the time.
Years later in 2014 when I worked on a terminal product the company had bought in a third party kernel, also written in C to run on an embedded MIPs board. There was a platform SDK and a custom gcc variant to build bare-metal executables. You bootstrapped the kernel by passing it a malloc implementation and a couple of hooks to other things like accelerated crypto functions etc, and it provided an API to run the transaction.
I also worked briefly on a contactless terminal product in 2012, which IIRC was C and C++ (old-skool C-like C++) on a proprietary OS of some sort, and they were moving to embedded linux on ARM at the time.
(edit - See also rswall's parallel answer, it's very good. I wrote an EMV L2 kernel in that parlance, and interacted with another. We also did some of the L1 bits)
There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field.
There are some changes to the business rules around processing contactless payments. Although the same floor limits for asking for the PIN for contact and contactless are pretty much the same these days.
Worse than that, it's a marketing name :)
Or it was in the UK. Strictly speaking the cards contain a customer verification method list that gives the terminal the info about whether and in what priority order it should process PIN offline, online, signature or other methods. This method allows american cards to function elsewhere in the world, depending on the terminal risk profile, and euro cards which usually would require a PIN to function in PIN-less US terminals.
> There is very little difference in the process when using NFC, except that the power to the chip in the card is via the NFC field.
Sure, but in contactless EMV there is no user interaction part of the process, so 'offline PIN' is not a possibility. This is because the transaction process would have to halt while the user entered their PIN and continue afterwards. So I'm pretty sure that for contactless transactions there is no offline PIN CVM. The process is also going to be slightly different in that the card/phone doesn't stick around for any post-transaction issuer scripts, and IIRC from the short time I worked on a contactless product, there is only a single application-cryptogram generation phase compared to the two in a chip transaction, though I can't remember the significance of that now!
Or can I ... the second Gen AC phase is where the card signs off on the bank's authorisation of a transaction, if the transaction has gone online. Strictly your chip card can still decline a transaction even if the bank says it's OK. This is missing in contactless flow because, again, it would require the transaction to pause and take longer than a quick wave.
I didn't need to re-present the card to the reader. It processed the rest of the transaction after the PIN was entered.
Yeah that's an online PIN, it's sent to your bank for verification, not the card (which has already done its part of the transaction).
(If you want to be pedantic, yes, you're quite right! The EMV transaction process is still going on at that point, between the terminal and the bank, and it has indeed paused to allow the user to enter a PIN. The process between the terminal and the card has completed though, so offline PIN can't be done, because in the offline PIN process the card performs the verification.
It's this what makes HN still an outstanding resource and community.
Thanks!
What is secure is not about the communications, it's about what information is exchanged, how the dynamic CVV is generated and used, how the PIN is validated in a Chip+PIN environment.
The PIN pad, where you enter the PIN is just as secure using the contacts or contactless. The PIN doesn't leave the PIN pad in the clear.
This is country-dependent; while this is the case in Spain, it's not the case in France, where the terminal will insist the card be inserted and the PIN entered.
there's a write up on this that i cannot find. the reason was actually that some criminal organization with ties to lots of political pacs had their money cow being fraud (or money laundering) on gas stations. so they forced gas stations to never update the pins for this very specific reason.
Chip+PIN is the basis of contactless+PIN, same EMV standard, same stuff happens under the covers. Different business rules for merchant risk, chargeback etc
That doesn't happen with Apple Pay though, since it's an authenticated NFC payment. My (physical) Visa card has a 50€ contactless limit but with Apple Pay, I can just use it to the card's limits. I've paid for a 880€ MacBook with just tapping my Apple Watch against a reader.
As far as the reader is concerned, for contactless, there is no, as in none as in nada difference between a contactless payment with a physical Visa card, or a contactless payment using Apple Pay (or Google or Samsung Pay).
They are all "authenticated NFC payments".
It doesn't change the fact that the reader doesn't know if it's a phone or not, it's just a contactless payment standard
So there aren't "different limits" for Apple/Google/Samsung Pay compared to using your physical Visa/MC/Amex/Discover/etc card.
> So there aren't "different limits" for Apple/Google/Samsung Pay compared to using your physical Visa/MC/Amex/Discover/etc card.
Not from the _payment_ provider (mastercard/visa/etc), but from the _card_ provider (google pay/apple pay/banks) - e.g. my Bank card has a contactless limit of £100, but that same card via Google Pay has a limit of ??? (never reached it, thousands probably)
And for most transactions it's just 'tap your card' (no pin), no need to have it in the phone.
Plus you have to carry around your cards.
When I'm not travelling for work, I only have my phone. No need for wallet, has drivers license, Medicare (AU), and my credit/debit cards in the Apple wallet.
I haven't used physical cash in AU except very rarely for about a year now.
Though I'd never travel without my wallet, I like having a backup plan if something happens to my phone
I still need to carry it when I'm driving, because our drivers licenses haven't been able to download to the Wallet yet, but once that happens, I won't need my physical wallet.
Some people are trying to normalize "American" to mean anyone from North or South America, but the reality is, of course, that 99.9% of the time, American means people from the US.
Here we're talking about the difference between the card networks and merchant acquiring in the US vs elsewhere in the world.
Honestly United Statesian is more confusing because that ambiguously could refer to Mexicans.
It really sounds like you’re trying to troll and yeah people generally don’t like it if you intentionally get their nationality wrong.
No, the official name (in English) is the United Mexican States. (In Spanish, its structurally the same as the Spanish name of the USA (Estados Unidos Méxicanos vs. Estados Unidos Americanos, but the English names do not follow the same structure.)
> which everyone shortens to Mexico but for some reason you’re not okay shortening the United States of America to Americans?
People in American States [0] that are not the United States of America have very good reasons to prefer to distinguish the adjective for “belonging to the Americas” for the one for “belonging to the United States of America”.
> Honestly United Statesian is more confusing because that ambiguously could refer to Mexicans.
Yeah, that would be a problem if we also needed to distinguish the adjective referring to association with México-the-country from some supranational uses of México but were already using Estadounidense to make that distinction for different uses of “America”, but…that problem doesn’t exist for México, to start with.
[0] see, e.g., the terminology used by the OAS https://www.oas.org/en/about/principles.asp
i’ve lived in several countries and used apple wallet in all of them + the us since 2012.
and my german bank only got a card available in wallet in 2021…
chip and sign is dumb, but nfc and apple wallet work just as well in the states as they do anywhere else.
A politically heated examples: if you go to the farthest village of Russia, where only poor people live(for example 12h drive from Irkutsk), you will be able to pay with contactless payments in their local store(before the war, you would be able to pay with Visa/Mastercard/Apple/Google/etc).
And in China you will be able to pay with qr codes based payments even to a homeless entrepreneur on the street, that tries to sell you selfmade slippers, or something like that.
I believe the point is that this change feels much more of a small increment elsewhere, because we've had modern payment systems for a while. NFC appeared in our cards without any significant change, because we had chip cards for decades before that.
> and my german bank only got a card available in wallet in 2021…
They probably didn't hurry because they had contactless payment long before that.
And Americans will typically try to cut it any number of ways that aren’t “the US is uniquely behind the times, given their wealth”.
The reality: When I was working retail, in 2010 mind you, customers would very routinely be surprised and annoyed by the fact that our store didn’t have terminals that accept NFC payments.
When Apple Pay came out in…2014? 2015?, all the American tech pundits were talking about it like it was futuristic alien technology.
I’ve spent exactly one week in the US, ever. I was in Seattle. If I used my card to pay for food at a restaurant, it was entirely common and accepted for someone to take my card, scurry away, and come back at some point with something for me to sign. Back home, they’ll bring me the terminal so I can just tap my card (or phone, or whatever), or they’ll do it for me in the case of a card, and that’s that.
It’s such an odd thing to get defensive about.
The way payments in restaurants are typically handled in much of Europe is convenient but to the parent's point, the obsession with never letting go of your card sometimes seems a bit excessive.
Most of the non-major banks are a pain to even open disputes with — not to mention:
- having to receive a new card (a pain if one's frequently on the road, or if the bank doesn't ship overseas);
- change any recurring billing details, if needed;
- possibly set up direct debits (sometimes with paper forms, like in Singapore);
- some other stuff I haven't thought of.
Ah, yes, "if it's NIH, it's probably because we're so honest we don't need it".
That makes no sense. Ive been doing contactless payment in the US long before apple Pay.
Pretty sure my Amex did it back in 2010?
The iPhone 6S with Apple Pay came out in 2015.
> The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
I don’t think I’ve been to many merchants that don’t take Apple Pay. One of the annoying ones is AMC movie theaters.
Contactless payment doesnt require a phone, the first contactless payment cards have existed since 2007 [1]
[1] - https://www.finextra.com/newsarticle/17411/barclaycard-rolls...
It's only the US as a major environment that has delayed (and delayed) applying the same rules, or that adopted Chip+Signature in the first place.
> The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
Looking at you, HEB
Privacy.com serves the purposes of a per-merchant PAN (read: credit card number) online without having to use apple pay.
So from Apple Pay wallet -> reader -> acquirer -> network -> issuer, the DPAN is used. When it reaches the issuer, the issuer detokenizes DPAN -> CPAN to process the request. When it responds, it retokenizes etc for the response.
Specifically: there’s a transit org (I’ve tried to reach them about this issue, to no avail) that lets you enter your (real, CPAN) credit card number on their public web site and get back your “own” (if it happens to be your card…) transit history i.e. the times when you tapped your iPhone/Android on their NFC/tap enabled turnstiles.
So, they /do/ seem to have a way to either get the CPAN when the card is tapped, or maybe they can tokenize the CPAN in the same way as the phone and then compare the tokens…?
I thought that could not be possible but it 100% works. To me it’s a huge security problem. But again, I have not heard back from them at all.
Do you understand how they do it? Thanks
1. How does "Express Mode" work?
"Express Mode" is using the NFC "card" without any smarts from the phone, which is why it works when the phone itself doesn't have power. This is also why "transit cards" work in Express Mode because they are just NFC cards, but with a different "app" on the card that supports different processes than an EMV "credit/debit" card. EMV cards are probably the "dumbest" smart cards out there.
So effectively, it is exactly like using a physical NFC card. The NFC field powers the card. The "card" in the wallet only has the DPAN, the CPAN is not stored or used at all after the card is "enrolled".
2. Online enquiries with my "real" CPAN?
In terms of that online enquiry where you are typing the CPAN into the website, under PCI rules, they are not allowed to see the CPAN outside of PCI scope, which has strict rules on how that information is stored and used.
They usually use a "transit acquirer" to process their EMV transactions. What this acquirer does is that it processes the EMV taps under PCI rules, but also provides the transit provider with: a) a "one way hash" of the card. This is unique to the CPAN, but unable to be reversed back to be the CPAN. b) the transit information related to the tap (eg station of entry/exit etc) c) the transit provider can store trip information against the one way hash.
So when you type in the full CPAN on the transit provider's website, that is securely (ie iframes and the like) sent to the acquirer, which sends back the one way hash. The same hash is used to identify the trips that the transit provider keeps info about.
So they aren't "seeing" the CPAN (at least if their PCI auditor is doing their job properly). What they "see" is the one way hash that they can use in their system.
It makes sense that hashing allows the transit provider to link the CPAN to the taps.
Having checked, the CPAN is not inputted via an iframe on the transit provider’s site - it’s sent via https, but directly to the site’s web host. Is that necessarily non PCI compliant (or only non compliant if they store it - which they might not)? Are there PCI bounties..?
My bigger problem with all of this is that someone who comes in temporary contact with a credit card can get that person’s transit history. Is that not a security risk?
You shouldn't be able to see anything about the DPANs except the 6+4 information though and perhaps some detail of which device it is on.
Transit providers are not allowed to use the EMV card purely as "identification".
I answered elsewhere on the thread about how the transit provider is able to use the EMV as an identifier after it has been used for payment, with a one way hash sent to the transit provider.
When I went to the US nobody seemed to understand this. Loads of shops would have a sticker saying "Apple Pay Accepted" or something, and when I took out my Pixel phone they would say, oh that isn't an iPhone that won't work. Of course, it worked every time because the card reader has no idea what brand of phone it is or if it's even a phone at all..
Even compared to a few years ago, contactless payments seemed way more prevalent and frictionless. In Amsterdam, on the advice of a local, I did buy a chip card for transit as systems are still in the process of switching but my understanding is various transit systems there and elsewhere increasingly let you just tap a contactless credit card.
It was pretty weird seeing Apple users around me get excited about finally being able to pay with their phones when the first bank here started offering Apple Pay. I guess they never noticed that every other brand of smartphone had been doing that for give years at that point?
As for the public transit system, the stupid mess of checking in and out at varioustterminals still exists, but they are indeed working on using bank cards for public transit. They're of limited use though (no ability to store discounts and such) and not all transit companies accept them yet. I'm not sure what the situation is with credit cards, as the Netherlands is very much debit card oriented. The cards follow the same standards, but as any American trying to do groceries here will find out, that doesn't mean all cards will work on all terminals.
I was told that and then I basically used nothing but my contactless credit card over the course of a week. But I was admittedly mostly in central Amsterdam and doing tourist stuff and restaurants.
A Dutch friend, who knows the industry a little, said that the Dutch banks had gone their own way with payment systems in the past. This heritage had taken some time to unwind. (I guess he was talking about things like Chipknip?)
Silly me at the time didn't realize I could go next door to Jumbo and pay with whatever the hell I wanted... live and learn!
[0] https://www.reddit.com/r/geldzaken/comments/1085e6t/albert_h...
Hopefully this will put an end to the common perception in NL that Mastercard/Visa == credit card. Most of them aren't!
Funny note: Aldi accepts everything, even AMEX.
I'm not sure if there's even an API to add store rewards cards as NFC cards, since all of my rewards cards in the Wallet are barcodes.
> These programs are conveyed through NFC via Apple Wallet's VAS protocol. Programs that support One Tap are conveyed at the same time as a payment card stored in Apple Wallet.
https://www.op.fi/private-customers/daily-banking/cards/card...
Other banks in Finland also offer the same loyalty card integration with their payment cards.
No idea how it works technically. I assume that it broadcasts the loyalty card and the debit card at the same time when you use NFC, since you can get both with one (long) tap against the payment terminal. It also reads the loyalty card if you use chip + PIN to pay. The loyalty card is completely separate from the actual payment card - if I use Apple Pay to pay with the same underlying Visa card, it will not give me any loyalty rewards.
If only Android had a way to pay if the phone was out of battery I could dump the cards entirely.
Perhaps at some point batteries will get so good that running out of battery just won't be a concern any more.
One additional thought: I now live in Europe, and use my contactless card for payments. However, sometimes it fails and I am required to use my chip and PIN. (I'm guessing because the bank thought the transaction needed additional security for some reason.) In this case, if I only had my phone, I would be stuck?
Apple Pay does not force the above, as you have already identified yourself via mandatory biometrics or device PIN.
Basically it references the purchase to your history and if there's something funky it forces you to re-auth.
Mostly happens to me on vacations and road trips when I pay in multiple locations 100s of km away from each other.
But I've never had to do it at my local grocery store(s), even though I might visit them multiple times a week.
"In a ‘card present’ scenario, the convenience of contactless at point-of-sale would remain, however customers will be asked to complete a Chip and PIN transaction when they reach the maximum total contactless spend, or have exceeded the card issuer's limits for consecutive contactless transactions since they were last authenticated." [1]
"When you spend around £100 in shops (across multiple payments, not just in one go) without having used Chip & PIN , we’ll do an extra security check by declining the next contactless payment and asking you to use Chip & PIN instead. " [2]
[1] https://www.barclaycard.co.uk/business/business-matters/frau... [2] https://monzo.com/blog/2019/09/11/strong-customer-authentica...
It is pretty annoying because there are a lot of terminals that don't have the PIN keyboard, e.g. on vending machines. If you card decides it needs PIN, you are not buying, unless you can sidestep it using a phone.
It doesn't seem to be universal though. I paid for multiple hotels in Europe (so hundreds of pounds/Euros) with contactless payments and--although I actually made a point of making sure my card had a PIN after a problem on my previous trip--I never needed it.
What i know is that almost 50 (times flies, i originaly wrote 40...) years ago, my uncle worked a bit with secure terminals at a French company (forgot the name, but i know he lived in Spain for a while), then was yanked by a company that worked with American Express, took the Paris-NY Concord at least a hundred time to try to implement the same stuff he did in Europe in the US (chip + PIN), was distraught because the issue weren't technical and somehow transformed from engineer to executive, and ended up being an auditor for money laundering and fraud detection in major banks (received death threats and had bodyguards for a while).
Don't know if it is related, but the first time i went in the US i remembered some stories he told me about this American Express job and said to myself "Yeah, that checks out".
Yes, there is no reason to believe that the chip+pin is a technical issue, it's mostly business / political with lot of (financial) interests under.
Often policies like that are decided because of lobbying:
some people found large niches on how to make money, and they try to convince others to not change their habits even if the new system would benefit the masses (like the situation with the imperial system).
A cursory google search suggests that most HD stores do not accept it. There are some reddit threads about individual stores gaining support. Perhaps I lived in a test market?
Hopefully they rollout support soon!
No Apple Card is not called Apple Pay
Huh? I remember making contactless payments from my Samsung phone in the USA back in 2013 just fine. It had an unfortunate name at the beginning, but otherwise worked great.
> https://www.macrumors.com/2023/04/15/kroger-fred-meyer-apple...
Perhaps it's better to specify which parts of the world, I'm assuming you mean US and Canada versus Europe and China.
Meanwhile, most developing nations (which make up a majority of the countries in the world) still operate primarily on cash.
Just on the limits part; here in Ireland (and probably a good chunk of Europe) the limit on a physical card is around EUR50. But on Apple Pay (and probably other phone-based card payments that I have tried) that limit is removed... I have bought TVs (EUR500+) and put a deposit on a car (EUR1000) with Apple Pay and no issues. Some terminals do have issues (older ones that the store just couldn't be arsed updating have a max 50 limit, even on Apple Pay) but most do not have this issue.
Long story boring; there must be something somewhere that tells it the limit is increased. Also, the reason is the security Apple Pay and others give. You will have a very hard time explaining how someone got passed your face id for a payment...
I think you have a very narrow view of "the rest of the world"! Try "Europe and East Asia" for a little more accuracy ;)
Apple Pay is quite the nice experience especial with the Apple Watch. It even getting out your phone is heavenly. Only thing I wish now is having to double-tap the button on my watch to initiate the process. Would to just hold it up.
You're incorrect about the 2nd. The 2nd "thing" is called Apple Card - most people know the difference.
I haven't been refused Apple Pay (ie, EMV) almost anywhere in the US unless that place simply only accepts cash.
American is the term Americans prefer, let’s try to be respectful.
It's hilarious (in a way) seeing EUians comment on Americans.
As an explanation, there are two different things called "Apple Pay" in the US.
One is the use of the secure element/wallet in an iPhone/watch to store an EMV card that is tokenized. The other is the Apple branded credit card issued by Goldman Sachs.
Leaving aside the branded credit card, the Apple Pay process is a standard that Apple worked with Visa/MC (and Google and Samsung) to develop. Essentially, a customer of a bank enrolls their card into Apple/Google/Samsung Pay and there is a tokenization service that provisions the phone Secure Element with an EMV "application" and the tokenized card.
The card has a different number to the actual issued card, maintaining the first 6 (issuer ID) and last 4 digits of the issued card (CPAN - Customer Primary Account Number) to establish a "DPAN".
When the phone is tapped, as far as the reader is concerned, it is a standard EMV card. The reader will go through its standard business rules for floor limits, PINs etc and process the transaction.
The merchant only gets the "6+4" digits of the card, the DPAN is sent over the network to the tokenization service, which translates the DPAN to the CPAN and sends the transaction to the issuing bank for authentication and payment.
The lack of being able to get the "real" CPAN is why some US merchants still refuse Apple/Google/Samsung Pay, specifically because they lose the ability to track customers.
The problem in the US, is instead of going to "Chip + PIN" like the rest of the world, the US went to "Chip + Signature" which removes the benefits of Chip+PIN in terms of fraud reduction etc.