Visa Claims Chip Cards Reduced Fraud By 70% (arstechnica.com) 186
An anonymous reader quotes Ars Technica:
Although only 59 percent of US storefronts have terminals that accept chip cards, fraud has dropped 70 percent from September 2015 to December 2017 for those retailers that have completed the chip upgrade, according to Visa.
There are a few ways to interpret those numbers. First, it seems like two years has resulted in staggeringly little progress in encouraging storefronts to shift from magnetic stripe to chip-embedded cards, given that in early 2016, 37 percent of US storefronts were able to process chip cards. On the other hand, fraud dropping 70 percent for retailers who install chip cards seems great. Chip-embedded cards aren't un-hackable, but they do make it harder to steal card numbers en masse as we saw in the Target's 2013 breach.
There are a few ways to interpret those numbers. First, it seems like two years has resulted in staggeringly little progress in encouraging storefronts to shift from magnetic stripe to chip-embedded cards, given that in early 2016, 37 percent of US storefronts were able to process chip cards. On the other hand, fraud dropping 70 percent for retailers who install chip cards seems great. Chip-embedded cards aren't un-hackable, but they do make it harder to steal card numbers en masse as we saw in the Target's 2013 breach.
only 59 percent of US storefronts have terminals (Score:1)
Re: (Score:1)
Seems I heard that Oct the Chip Readers were mandatory. Seems not yet - can anyone fill in these blanks?
They've been "mandatory" for a while now. But many of them don't work.
A group of retailers filed a lawsuit over it but I don't think it has gone anywhere.
Re: (Score:2, Interesting)
They aren't mandatory but they do charge higher fees to process the transaction if you don't use the chip. Online card purchases still act like swipe cards since all you have is the basic info so it's not like they can just force all transactions to work like using the chip.
Re: (Score:3)
They are not mandatory. BUT the retailer is now on the hook for fraud. Not the CC co. or the processor. The retailer also must buy the new equipment. If the CC co.s really wanted to stop fraud. They would provide the readers themselves. Payback would be less than a year.
Re: only 59 percent of US storefronts have termina (Score:5, Insightful)
Re: (Score:2)
Re: only 59 percent of US storefronts have termina (Score:4, Insightful)
Can I please have it this way instead? "Visa caused 70% of fraud by not implementing decades old system earlier than they did."
The glass can be half empty.
Re: (Score:2)
Can I please have it this way instead? "Visa caused 70% of fraud by not implementing decades old system earlier than they did."
The glass can be half empty.
Presumeably, with less fraud, the fees paid by merchant and by consumer should drop, or am I joking?
Re: (Score:2)
"Mandatory" is a very flexible term. Merchants can, in theory, still imprint cards with a knuckle buster and deposit those in the bank like checks.
The actual rule is that if you don't use a chip card reader, and there's a dispute, the merchant pretty much automatically loses. For merchants who don't have problems with fraud to begin with, it's an expense they can easily do without.
That's why the 59% that have adopted the new technology have produced such a disproportionate reduction in fraud: They're the on
Re: (Score:2)
Meaning in Canada, we've had cards with chips in them for more than 10 years already and pretty much every single stores have a chip reader and very few actually accept magnetic cards anymore.
I never had a problem with my magnetic US credit card in BC or Quebec.
Re: (Score:2)
I've never seen a chip reader that didn't also have a mag strip reader as well. When I was in Iceland a year and a half ago, the card I used for nearly everything didn't have a chip. The only place I had trouble with it was buying fuel, and that wasn't because it didn't have a chip, but because it didn't have a PIN (which it could have, if I'd known to set it up in advance).
Re: (Score:2)
Plus it seems if a reader can't read the chip after 3 attempts, it will let it go through as a mag strip tranaction.
Re: (Score:2)
If you ave a decent card issuer, using your card without the ccv should raise a fraud alert
Re: (Score:2)
Re: (Score:2)
once i paid my time warner bill using the wrong expire date.
My bank issued me a new credit card number as a "security precaution".
I logged into Paypal to update my number and it already had the new number. . .
Re: (Score:2)
Meaning in Canada, we've had cards with chips in them for more than 10 years already and pretty much every single stores have a chip reader and very few actually accept magnetic cards anymore.
I never had a problem with my magnetic US credit card in BC or Quebec.
You wouldn't. Liability in this case is at your own bank (the issuer)
The way I understand it, if the acquiring bank supports chip and the merchant doesn't, then the merchant is liable for fraud. If the acquirer (in this case Canadian bank) doesn't support chip, then the acquirer is liable.
If both the acquirer and the merchant support chip, the issuer (your bank) is liable. So they have no problem with you using a magstripe. In case of fraud, your bank is liable.
Re: only 59 percent of US storefronts have termina (Score:5, Informative)
Same thing in Europe - chip cards rules since at least 10 years now.
Just minor problems that are easy to resolve by cleaning the chip contacts against the shirt whenever there's a problem.
This seems to be pretty much a symptom where the US is - way behind on a lot of things these days compared to 50 years ago when the US was the leader in technology.
Re: (Score:2)
We don't. But out standard cards have been just fine accepting mobile phone NFC payments long before Apple claimed to invent the idea. Hell I rarely use my card.
As for plastic technology ... who developed NFC? The Japanese working with the Dutch. You're welcome.
Re: only 59 percent of US storefronts have termina (Score:5, Informative)
It's not the ancient plastic cards that are technology, it's the computer embedded into them, and the crypto, NFC, wireless power and other things used around them that make them technology. Is it just because the US is the last in the world to start supporting this that it's "backwards"?
Re: (Score:3)
My first smartphone was an i-mate SP2 in 2004.
i-mate is an Irish company. It was built by HTC, a Taiwanese company.
Nokia, Philips and Sony invented NFC, none of which are American companies. One Finnish, one Dutch and one Japanese.
ARM is a UK company, which powers pretty much every smartphone ever.
Where is 'Murica in all this innovation?
Re: (Score:2)
oh.. and first smartphone NFC trial was by Innovision (at the time, a UK company), using a Nokia 6131 in the UK in 2007
Apple's first NFC equipt product, the iPhone 6 came out in 2014
First Android phone with NFC was the Nexus S in 2010
Re: (Score:2)
All I can say is that this "stupid idea" has been working for years over here in Europe.
Gas stations (Score:2)
Now we have one great place left for skimmers to set up: gas pumps. I have yet to see one that is NFC capable or that included a chip reader.
And in the past three years, I've had my card skimmed twice -- it's become annoying enough that I ended up relegating a single card to gas station use, so that when it gets skimmed again I won't need to cancel any sort of auto-pay setup against it.
It's crazy to me that credit companies don't get stricter with gas station owners.
Re: (Score:3)
Every gas station in Canada uses chip & pin, most were rolled out a year and change before it became mandatory up here. The real problem up here since everything is chip & pin is actually banks and ATM's that are owned by banks but deployed in variety stores and so on. Hitting banks is the big one right now, the fakes are getting damned elaborate too replacing the entire front bezel to pull the card data and pin.
Re: (Score:1)
I am afraid that you are absolutely wrong. Chip cards without signature most definitely prevent skimming. The card number is not read from the cards mag stripe. Data including the card number is encrypted using the chips and sent to the issuer to verify fully encrypted. Chip cards without PIN's allow physical cards to be stolen and used fraudulently. The CC issuers have decided to continue paying to cover this type of fraud instead of forcing PIN's on Americans.
Re: (Score:2)
The card number is not read from the cards mag stripe.
How do you control the skimming device to ensure that?
Re: (Score:2)
You don't insert the card fully into the chip reader, so the mag stripe isn't read even if a skimmer was placed there.
Re: (Score:2)
Never seen a gas pump where that's actually possible. You put the chip card into the same slot as you put the mag strip card, and you shove it in exactly as far - all the way.
Re: Gas stations (Score:2)
No card here in Canada gets inserted all the way into the reader.
Re: Gas stations (Score:2)
Actually I take that back. It would be more correct to say that no card gets fully inserted in gas pumps in stations near here.
Re: (Score:2)
Re: (Score:3)
At least some cards with chips store the card number on the chip unencrypted.
In a previous job my keyboard had a card reader on it for reading certificates from ID cards. I played around with Java's smartcardio package and read my credit card. Saw the card number right there. Some also give out the number to NFC readers.
The bit that prevents fraud is not keeping the card number secret, it's signing tokens with asymmetric encryption. You can't read the private keys from the chip.
Re: (Score:2)
I find it interesting to note that it's the year 2018 and humans are still working on ways to be able to conduct financial transactions without fraud or theft. There must be something that, how something that seems like it would be such a simple thing actually is not...
Re: (Score:2)
Re: (Score:2)
I've seen gas pumps with NFC. More than once. Not universal yet, but it's getting more common.
(I suspect it's because California is so oppressive to gas stations anyway that the pumps get replaced a lot more often than most places anyway.)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The weird part is the proprietary gas payment apps in lieu of putting in chip readers.
Like if I want to pay for gas with my phone at a shell station, I would *have* to have a Chase credit card.. for some reason.
Exxon has a more open ended payment app, and to their credit it works... most of the time.
Re: (Score:2)
I have never seen a pump without a chip reader.
Probably because I live in a modern country like New Zealand, where chip cards have been widespread for well over a decade. Some of them don't even have a magstripe reader.
I did have a magstripe only card back in the 90 and early 2000's though.
I know how I interpret this. (Score:1)
fraud has dropped 70 percent from September 2015 to December 2017 for those retailers that have completed the chip upgrade, according to Visa.
For years credit card companies allowed people to be defrauded because it was cheaper for them. When they were forced to use better security they tell us "Surprise, it's more secure! Who knew? Nobody knew!" Assholes, all of them.
Re: (Score:2)
For years credit card companies allowed people to be defrauded because it was cheaper for them.
Actually, for years the major credit card companies have had zero-liability policies for fraud. Do you own/use a credit card?
Re: (Score:2)
Your negligence, real or asserted, removes all limits. You are free
Well, yea... (Score:3)
"Martha? Would you ring up Woodrow 2-4-2 and ask the president of the bank to wire $10,000 to Sparky up in Reno out of my account? It's 5-4-7-9. Thanks!
I call that (Score:1)
Just my 2 cents
Chip and Sig was designed to target one thing (Score:1)
Chip and signature in the USA was designed to combat card skimming and cloning of mag stripes - it can't stop other kinds of fraud. Yes, it can help prevent fraud of stored data as chip data is different then mag stripe data - but the root of the fraud is cloned mag stripe data - often from skimmers.
If no terminals accept mag stripe, then cloned cards won't work. Someone can still copy the data off the front and back of card visually, and they can still clone the mag stripe. But then the fraud is reduced t
Re: (Score:2)
Chip and signature in the USA was designed to combat card skimming and cloning of mag stripes
Adding a chip has absolutely no effect on card skimming. The only way to combat that is to remove the mag-stripe, but for backwards compatibility, I'm not aware of anywhere in the world that has done that yet.
Once your mag-stripe data is captured, someone somewhere else in the world (where the backwards compatibility will kick in automatically, because the card is foreign and can't be expected to keep up with local standards) will clone the data onto a magstripe only card, and use it to withdraw money a
Re: (Score:2)
With the wide-spread hacks into large retailers, the transactions are looked at with a microscope. Purchases under $10 have an 80% chance of locking out my card, and in places the card company knows I am (small transactions to "test" stolen
It's easy to speed up the rollout (Score:2)
Shift the risk. Make merchants with no chip capability liable for fraud.
Pay wave in the US? (Score:2)
I returned from a 10-year stint in Australia, where I stopped carrying cash, wrote only two checks, and for purchases under an amount set by the merchant -- $30 in some cases, $100 more typical -- simply tap the card, faster than cash. I looked into it here and the friction apparently was the cost of the chip. Apparently not. Anyone know what the heck is keeping tap-pay from becoming a thing if the chips are already on the cards?
As to card details being compromised for online purchases, hate PayPal all you
Re: (Score:2)
RFID is as secure as leaving your front door open and shouting 'Rob Me Now'.
Your card details can be read while the card is in your wallet and in your pocket.
That's where RFID secure wallets orRFID blocking cards come in.
Re: (Score:2)
Yes this is common knowledge. But if I don't know someone who knows someone who knows someone who got hijacked, I'm not going to lose sleep and still have the insta-pay convenience. Credit card numbers are far more troublesome than rfid, and my bank freezes my account almost instantly when the flags go up. The thing about rfid is (in this case) it only works in Australia and given you have to make a legit looking card with a chip in it, and the low transaction amounts, it's a huge amount of work for a small
Re: (Score:2)
Your card details can be read while the card is in your wallet and in your pocket.
When I've used my card online, the details available via unauthenticated RFID or by taking a snapshot or imprint of the front of the card (its the same details) are only sufficient to complete a purchase when I deal with US vendors. Everywhere else, I need 2FA or at least the 3 digits from the back of the card to finish the transaction.
Re: (Score:2)
Many cards have all the details on the back now - there's nothing on the front except the bank's logo.
So all you need is a picture of the back of the card.
Re: (Score:2)
All cards have all the details on the back, except prepaid credit cards where the card number is printed on, not stamped.
The stamped numbers can be read from a photo of either side.
Re: (Score:2)
I only have one card with RFID
You're an idiot. If you had two cards then the read would simply fail.
Don't believe me? Then google for this
Oh I believe you. Know what? The best thing about card details skimmed via RFID is how in most of the world they are completely useless to fraudsters as they can't replicate cards that require chip+PIN. Now if the USA would get off their arse and mandate PIN like in other sane countries there'd be no more RFID cloning in the USA either.
Re: (Score:2)
That's why my credit card stays in my wallet next to my wallet ninja, that effectly blocks the NFC signal.
I use my phone for NFC payments.
Simply reading a card with an RFID reader won't give you the expiry date or the CCV number. Reading it with a terminal will leave a trace back to the terminal owner.
and undid those gains... (Score:2)
Re: (Score:2)
I gives me pause to wonder (Score:2)
What the fraud rate would have been if we'd done what we should have done and gone to Chip&Pin?
Even though I have PINs on all my cards, only Target uses it. Even in Europe and India my cards comes up "signature", not PIN.
But if the fraud rate is low now, that probably only means that the crims haven't figured out how to defraud it – yet.
P.S. I'm still waiting for restaurants to get the portable readers that the wait staff bring to my table and my card never leaves my sight.
chip w/o pin is still crap (Score:2)
Chip and pin was broken in 2007 (Score:2)
See Ross Anderson's "Light Blue Touchpaper" for a timeline, https://www.lightbluetouchpape... [lightbluetouchpaper.org]
As other writers noted, Visa has 70% less fraud because they can now disclaim responsibility for all the fraudulent charges on the older, more popular equipment. There might be a small decrease in fraud overall, but the "70% less" is really "70% the merchant has to eat, as we're not accepting fraud reports from their equipment".
Re: (Score:2)
The entire point of the liability shift was to try and reduce the card present fraud in the system. The level of skimming and cloning in the US is outrageous when fixes for the very issue were in use worldwide for decades. Even chip and signature puts a dent in it because the chip effectively cannot be cloned. The acquiring banks that lease the equipment to the merchants and process their transactions had - literally - no incentive to update. They were rolling out updated equipment that still did not suppor
How many TRANSACTIONS are using chips? (Score:2)
"...although only 59 percent of US storefronts have terminals that accept chip cards, fraud has dropped 70 percent from September 2015 to December 2017 for those retailers that have completed the chip upgrade... it seems like two years has resulted in staggeringly little progress in encouraging storefronts to shift from magnetic stripe to chip-embedded cards, given that in early 2016, 37 percent of US storefronts were able to process chip cards."
There are still many storefronts that cannot process chip card
Re: (Score:3)
When they first deployed the chip cards, I had mine for all of two weeks before it was compromised by the wait staff at one of the restaurants I frequent :|
So the wait staff managed to duplicate the chip in your card? Where do you eat?
Re: (Score:2)
Why would a thief bother duplicating the chip, when they can do all the online purchases they'd like with just the name, number, expiry and CVV?
Re: (Score:2)
You don't even need to do online purchases. After 2 years, the chips on 2 of my cards are so flaky that they often don't work. It works every now an then, but usually it ends up telling me to reinsert the card, then after the 3rd failed chip read it tells me just to swipe it. Never once has a cashier given it a second though and asked to see the card or ID. They just act like it's routine (which wouldn't surprise me if it were). So really all they need to do is clone your card onto a card with an intentiona
Re: (Score:2)
An increasing number of stores are refusing to swipe when the chip isn't working. (My employer does.)
The reason is that thieves will deliberately damage the chip and reprogram the mag strip with a different number than is on the card (if there is one, these days), which is the old fashioned form of credit card fraud all over again.
You really need to call your bank and tell them to replace the card. Otherwise, eventually, you won't be able to use it at all.
Re: (Score:2)
For somebody who uses a non-Apple device in order to run applications that have no close substitute on iOS, is it worthwhile to buy and carry an iPad mini just for Apple Pay?
Re: (Score:2)
Or maybe a refurbished iphone SE? I think that would be cheaper, and a smaller form factor
Re: (Score:3)
So you handed them your pin, and it's their fault? You understand how this works right? You plug your card into the terminal, then enter your pin. If it was compromised, then it was a plain old skim because the business hadn't rolled over to chip & pin and were exempt from requiring *you* from entering it.
Re:So full of shit (Score:4, Interesting)
Re: (Score:2)
So the US is still 10-15 years behind Canada then is what you're saying. Up here if you don't enter a pin, you can't complete the transaction. I also mentioned the cloning bit in my comment, which makes the original posters point about "omg chip & pin is a failure, it was all their fault" again worthless. Chip & pin didn't fail in that case which is what they were trying to make as a point.
Re: (Score:2)
I'm amazed that so few storefronts are actually using the chip readers. Most large retailers have had them since the Target hack, but then there are some places like Mariano's who still don't have them. I'm kind of surprised they're willing to eat the losses from fraud.
Re: So full of shit (Score:1)
In the US, very few chip cards come with chip PIN's (these are distinct from credit card ATM PIN's for cash advances); most have you sign something or nothing at all.
Re: (Score:3)
In the US, very few chip cards come with chip PIN's (these are distinct from credit card ATM PIN's for cash advances); most have you sign something or nothing at all.
Here's how it works up here. Bank card + pin = direct withdrawal from your bank account(see Interac system). CC, again requires a pin. CC+Pin = billing directly to your CC. You don't sign for things up here unless there's a widespread terminal failure and the company still has an old fashioned carbon-copy style credit device available.
Re: (Score:2)
You don't sign for things up here unless there's a widespread terminal failure and the company still has an old fashioned carbon-copy style credit device available.
You only need a carbon-copy device if the power is out or all your terminals are broken and if the power is out there's no lights so most likely the store will close. It's far more common that the Internet connection is down, then it goes into offline mode where instead of the regular receipt it spits out a bill that I sign on, at least that's the way it works here in Norway. I'm not sure if they send it electronically later when it reconnects and the signatures are just for disputes or if the store needs t
Re: (Score:2)
It's far more common that the Internet connection is down, then it goes into offline mode where instead of the regular receipt it spits out a bill that I sign on, at least that's the way it works here in Norway
Here, in my part of Canada, if the retailer/restaurant’s internet connection goes down, the hand-held terminals just flip over to 3G or GPRS wireless, and conduct the transaction through the cellular network.
Bad assumption! (Score:1)
Most USA issued CC's are chip and signature. No PIN is required.
Re: (Score:2)
Signatures aren't required any more.
https://www.creditcards.com/cr... [creditcards.com]
Re: (Score:1)
No, its extremely useful. The fraud rate using stolen physical cards is fairly low. What the CC companies and issuers were really worried about were the data breaches at major retailers that were exposing 100's of thousands or millions of credit card numbers at a time. Once the numbers were stolen, generating fake cards and going shopping was very easy. Chip cards prevent that type of fraud. For consumers, the lack of a PIN means that the issuer covers you for losses if you loose your card. With Chip + PIN,
Re: (Score:2)
That’s why restaurants use portable card terminals. The card never leaves your sight.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
You don't need to clone the chip, all you need to do is damage it.
If a terminal fails to read the chip, it will accept a mag strip.
You'll probably have to swipe it - and be prompted to insert it, insert it - and be prompted to swipe due to read failure, then swipe it again
It may ask you to insert it multiple times before allowing a swipe.
Re: (Score:2)
Oh? And what kind of illicit business is that?
Re: (Score:2)
"Please- if you want to get rid of your crypto spend it at my business!"
>wants people to spend their crypto at their business
>doesn't reveal what that business might be
Sounds more like you're the fraud.
Re: (Score:2)
credit cards and crypto exclusively
you have a weird understanding of the word exclusively
Re: (Score:2)
to the exclusion of others; only; solely.
By defining a group of payment methods that they accept "exclusively," they are simultaneously defining the group of payment methods that they do NOT accept (i.e. everything else).
Re: (Score:2)
How do you find the convience of $20 tranaction fees and 10+ minutes transaction confirmation times?
Or you're not using bitcoin, but some other crypto "currency" that's about to fail? [slashdot.org]
Re: (Score:2)
Fraud with Card-not-present (e.g., buying things online) is going up.
They don't care about that because in any disputed CNP transaction they can just screw the merchant with a chargeback.
It costs Visa/MC nothing, and the merchant has no recourse.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you didn't realize, Visa is part of the group that rolled out chip cards (EMV - Europay, MasterCard, and Visa) in the first place. They are still trying to convince the merchants and processors that are dragging their heels, because that's what people here always seem to do. Everyone is still in denial that chip cards are an important transition, let alone adding a pin.
Re: (Score:2)
The reason for poor uptake is an argument between the merchants, acquiring banks, CC networks, and issuers. Basically, most of the merchants lease the equipment from the acquirers, and the the acquirers are the only ones who didn't actually suffer from fraud because the liability largely fell on the Network or Issuer. However, the Acquirers own all the equipment and don't want to pay for an update. There is a double cost for them there as they both have to update hardware (the terminals themselves) and the
Re: (Score:2)
For the bank info, the problem is that account numbers are treated as the sacred piece of info. You pull money with a routing and account number and protect those numbers like a credit card number. Everywhere else, banking works on a push basis where the account number is merely a destination. It's all about legacy systems and backward compatibility.
Re: (Score:2)
cards are starting to get old now
I use Android Pay. As far as the terminal is concerned, my phone is a Visa Paywave card.
While all the terminals in New Zealand support NFC, a lot of merchants don't have the option enabled as the transaction fees are lightly higher. Some don't accept credit cards at all, as debit cards have no transaction fees.
Re: (Score:2)
The real question is, why is the USA so backwards on these things ?
Your life sounds a lot like mine. The real question is why are so many people outside the US so ignorant about how things work in the US? And why do so many of you keep trying to tell us how backward we are when it's clear you don't even have a clue?
Yes, there are still plenty of dinosaurs writing checks. In a country of 340M where probably at least 80M are over 60 years old there's bound to be a few. I dare say you've got a few over there too, where ever over there is.
Although it's true we still print thes
Re: (Score:2)
You need to get out of Poland more often.
Americans like me haven't written checks (or cheques) in years. And several of my cards have contactless, and I use it.
I suspect that I am not alone in this respect.
Re: (Score:2)
Re: (Score:2)