Chip/pin or chip/sig?

[ambivalent]

What does this mean?  I've seen it in a few threads and have no clue!  Thank you :-)

[longtimelurker]

So most current US cards as "swipe", you swipe them and sign the slip or screen.  The problem is that these are very easy to clone, someone can copy the strip as you swipe and then use it on another card.

Chip cards make this harder by having a chip built in.   When an EMV reader detects the chip, it will not allow you to swipe, and uses information stored in the chip to validate the transaction, and copying a chip is much harder than cloning.

The difference between chip&sig and chip&pin:  with a chip&pin card, you put the credit card in the reader, and, when prompted, enter your PIN.   This is like an ATM or debit card transaction, you need both the card and the correct PIN.    This is in use in most of Europe as well as other places.  The advantage is that the PIN is stored (encrypted) in the chip, so a reader can validate the card/pin even when not online (not communicating with network servers).

Chip&Sig was/is favored by the US companies. you put the card in the reader, and after a while you sign, again either a signature slip or a screen.   The claim is that with the infrastructure in the US, online/offline isn't important, the machines are always talking to the server and will validate that the card isn't stolen etc that way.

The pain comes when using a US Chip&Sig abroad, especially Europe.  Noone does signatures any more, so clerks are very confused when the machine spits out a slip, and no-one has a pen.

The big battle is over liability shift.  In other countries, with chip&pin the onus is on the card holder to prove that a transaction wasn't valid, as use of the PIN is taken to mean it was authorized (so don't write the pin on the card)

[ambivalent]

Okay, I get it.  Thank you!!

[nyancat]

---

@longtimelurker wrote:

So most current US cards as "swipe", you swipe them and sign the slip or screen.  The problem is that these are very easy to clone, someone can copy the strip as you swipe and then use it on another card.

Chip cards make this harder by having a chip built in.   When an EMV reader detects the chip, it will not allow you to swipe, and uses information stored in the chip to validate the transaction, and copying a chip is much harder than cloning.

The difference between chip&sig and chip&pin:  with a chip&pin card, you put the credit card in the reader, and, when prompted, enter your PIN.   This is like an ATM or debit card transaction, you need both the card and the correct PIN.    This is in use in most of Europe as well as other places.  The advantage is that the PIN is stored (encrypted) in the chip, so a reader can validate the card/pin even when not online (not communicating with network servers).

Chip&Sig was/is favored by the US companies. you put the card in the reader, and after a while you sign, again either a signature slip or a screen.   The claim is that with the infrastructure in the US, online/offline isn't important, the machines are always talking to the server and will validate that the card isn't stolen etc that way.

The pain comes when using a US Chip&Sig abroad, especially Europe.  Noone does signatures any more, so clerks are very confused when the machine spits out a slip, and no-one has a pen.

The big battle is over liability shift.  In other countries, with chip&pin the onus is on the card holder to prove that a transaction wasn't valid, as use of the PIN is taken to mean it was authorized (so don't write the pin on the card)

---

You were doing so well in your explanation until your last sentence. Liability shift is about moving liability to merchants, not to consumers. In fact, under recent regulations, consumers bear less of the burden of proof than ever before in Europe. which is still more than in America, but that isn't due to EMV.

[trumpet-205]

---

@longtimelurker wrote:
The advantage is that the PIN is stored (encrypted) in the chip, so a reader can validate the card/pin even when not online (not communicating with network servers).

---

Not all chip & PIN cards have PIN stored on the chip. Some can only do online PIN CVM, in that case when it is offline either it defaults to no CVM (if permitted) or failed transaction.

The reason US prefers chip & signature is that it is much cheaper to implement than chip & PIN. With online PIN, you need extra infrastructure to validate the PIN online. With offline, you need infrastructure to update the PIN. Chip & signature on the other hand is just reusing existing infrastructure since we are already signing credit card when we swipe.

[DaveSignal]

Today is a UK holiday, so the regular employees were not working at the store across the street from where I live and there was some new woman from a different store.  She refused to take any of my chip+sig cards and kept cancelling the authorized transaction.  She did this to my wife too.  I told her that I was a regular customer and had been shopping there with the same cards over the last 2 years.  At one point she told me that I the only way they would accept my card would be if I had some kind of vision problem preventing me from using a pinpad.  I then told her that I did have a vision problem.  And she asked for my medical documentation.  Ridiculous.  I was quite upset.  I was so upset, in fact, that I wrote a letter to the company to complain.

But I ended up walking a few blocks to Tesco to get what I needed.

Point of that story is that some merchants don't understand chip+sig and it can make you an outcast at some places.  It is also less secure.  There is no reason the US should not be issuing chip+pin cards.  I hope Target helps get things moving.

[nyancat]

---

@DaveSignal wrote:

Today is a UK holiday, so the regular employees were not working at the store across the street from where I live and there was some new woman from a different store.  She refused to take any of my chip+sig cards and kept cancelling the authorized transaction.  She did this to my wife too.  I told her that I was a regular customer and had been shopping there with the same cards over the last 2 years.  At one point she told me that I the only way they would accept my card would be if I had some kind of vision problem preventing me from using a pinpad.  I then told her that I did have a vision problem.  And she asked for my medical documentation.  Ridiculous.  I was quite upset.  I was so upset, in fact, that I wrote a letter to the company to complain.

But I ended up walking a few blocks to Tesco to get what I needed.

Point of that story is that some merchants don't understand chip+sig and it can make you an outcast at some places.  It is also less secure.  There is no reason the US should not be issuing chip+pin cards.  I hope Target helps get things moving.

---

Utterly ridiculous... I'd suggest (assuming this was a US issued Visa card) that you also report them on Visa's website and by calling 1-800-VISA-911. Your complaint reason is that a merchant displaying the Visa logo refused to accept your valid Visa card.

[DaveSignal]

I left a message with Visa as well.   The point is still the same.  And, although it is not common, this is not the first time I have had an issue with a merchant and a chip+sig card.  I am not a tourist.  I currently live in England.  I wish that the one chip+pin card that I have (SDFCU) would default to pin CVM just for those type of situations... and that the US would start offering more options for chip+pin.

[longtimelurker]

---

@nyancat wrote:

---

@DaveSignal wrote:

Today is a UK holiday, so the regular employees were not working at the store across the street from where I live and there was some new woman from a different store.  She refused to take any of my chip+sig cards and kept cancelling the authorized transaction.  She did this to my wife too.  I told her that I was a regular customer and had been shopping there with the same cards over the last 2 years.  At one point she told me that I the only way they would accept my card would be if I had some kind of vision problem preventing me from using a pinpad.  I then told her that I did have a vision problem.  And she asked for my medical documentation.  Ridiculous.  I was quite upset.  I was so upset, in fact, that I wrote a letter to the company to complain.

But I ended up walking a few blocks to Tesco to get what I needed.

Point of that story is that some merchants don't understand chip+sig and it can make you an outcast at some places.  It is also less secure.  There is no reason the US should not be issuing chip+pin cards.  I hope Target helps get things moving.

---

Utterly ridiculous... I'd suggest (assuming this was a US issued Visa card) that you also report them on Visa's website and by calling 1-800-VISA-911. Your complaint reason is that a merchant displaying the Visa logo refused to accept your valid Visa card.

---

I thought this was part of the UK compromise when Chip&Pin was brought in and advocates for the visually handicapped complained, see for example

http://www.paymentscouncil.org.uk/current_projects/chip_and_signature/

ANd nyancat, do you really think complaining will achieve anything? Maybe if it is a very small shop, but I don't think the issuers have a great track record of getting merchants to accept foreign/strange credit cards.

[longtimelurker]

---

@nyancat wrote:

---

You were doing so well in your explanation until your last sentence. Liability shift is about moving liability to merchants, not to consumers. In fact, under recent regulations, consumers bear less of the burden of proof than ever before in Europe. which is still more than in America, but that isn't due to EMV.

---

OK, thanks, guess I was confused!