EMV Liability Shift: Your Observations

[Anonymous]

---

@Open123 wrote:

---

@Anonymous wrote:
I'm not sure. We're allowed to dispute an online charge that otherwise isn't caught by the banks as fraudulent, so I don't understand why they would give us a harder time disputing EMV PIN transactions.

---

With your secret pin # used for the transaction, how will you prove it wasn't you?

---

The burden of proof is on the bank, not you.

That said, they would need to prove that a) a PIN was actually used and b) you didn't take good enough care in protecting the PIN. (b) is the big one and the thing that would be fairly difficult to prove; what if the PIN got captured by a hidden camera or similar through no fault of your own, for instance?

[Open123]

---

@Anonymous wrote:

---

@Open123 wrote:

---

@Anonymous wrote:
I'm not sure. We're allowed to dispute an online charge that otherwise isn't caught by the banks as fraudulent, so I don't understand why they would give us a harder time disputing EMV PIN transactions.

---

With your secret pin # used for the transaction, how will you prove it wasn't you?

---

The burden of proof is on the bank, not you.

That said, they would need to prove that a) a PIN was actually used and b) you didn't take good enough care in protecting the PIN. (b) is the big one and the thing that would be fairly difficult to prove; what if the PIN got captured by a hidden camera or similar through no fault of your own, for instance?

---

Assuming I'm willing to endure the expense to challenge and go to court to fight them, what's my motivation to change to chip & pin?  Currently, I don't need to concern myself with any of this.  So, how does chip & pin benefit me?

*Edited*  PS - You really think a Bank won't just insist I'm liable if my secret pin # were used?

PS 2 - What you forwarded is the general burden of proof that exists now, which is why if the Merchant/Bank procures a receipt with my signature verified by a couple of independent handwriting experts, I lose.  This tells me nothing about how my "secret" pin that should only be known to me will be viewed, as definitive proof of a legitimate purchase.  Why would I want to even bother with this?  Because the Merchants and Banks who want to limit fraud liability?  Because "they" use it in the rest of the world?  Because those who make these machines say it's better for me?  Because the Insurance carriers want to reduce claims?  I'm a Consumer, and none of these reasons often touted benefit me.

PS 3 - If it is mandated that the correct pin # "in of itself" (not unlike IP address) isn't definitive proof I made the purchase, then I'm all for it.  Otherwise, I'll stop using CCs if we adopt chip & pin, like they have in Europe.

[Anonymous]

---

@Open123 wrote:

---

@Anonymous wrote:

---

@Open123 wrote:

---

@Anonymous wrote:
I'm not sure. We're allowed to dispute an online charge that otherwise isn't caught by the banks as fraudulent, so I don't understand why they would give us a harder time disputing EMV PIN transactions.

---

With your secret pin # used for the transaction, how will you prove it wasn't you?

---

The burden of proof is on the bank, not you.

That said, they would need to prove that a) a PIN was actually used and b) you didn't take good enough care in protecting the PIN. (b) is the big one and the thing that would be fairly difficult to prove; what if the PIN got captured by a hidden camera or similar through no fault of your own, for instance?

---

Assuming I'm willing to endure the expense to challenge and go to court to fight them, what's my motivation to change to chip & pin?  Currently, I don't need to concern myself with any of this.  So, how does chip & pin benefit me?

*Edited*  PS - You really think a Bank won't just insist I'm liable if my secret pin # were used?

---

Isn't that what filing complaints with the CFPB is for? I would hope it wouldn't come down to having to go to court or even CFPB. Also something to note is that the UK used to not have a liability law similar to ours; that changed pretty quickly when banks tried to push liability to consumers (mainly due to huge backlash in the media). I would think a similar backlash would occur here if a bank tried something like that.

As for reasons to adopt it? I can give you a few (but not sure if any will resonate):

1. Frequent debit card users would benefit. It's your actual money that's (temporarily) gone if something happens. Why not make PIN required instead of optional for those and reduce the likelihood of that occuring? (Yes, it's still optional even with chip.) They even did studies showing that "PIN debit" had much less fraud than "signature debit".

2. Visiting other countries. Yes, I know they're supposed to accept chip and signature. They sure place a lot more scrutiny on the signature (and ID) than we do though. Meanwhile the chip and PIN users have already left the store.

3. Speaking of #2, some retailers in the US are being really passive aggressive about the whole signature thing. Retailers like Home Depot and Rite Aid apparently are now asking for signature with chip even for a $2 purchase. PIN would sure make things faster if you can't avoid those stores.

Honestly I'm more bothered by the fact that we seem to be relying on a form of "security" that's supposed to be checked after the issuer approved the transaction (and the money's gone). If Americans don't want PIN, then issuer approval should be more than enough. Don't ask for ID, don't make people scrawl something on a screen or piece of paper after the fact. Though at least the ID checking seems to be happening before the card's swiped/inserted, so that's something at least?

[Anonymous]

1. Under which merchant category does the merchant fall? 
2. In which state is the merchant located?
3. Were you surprised that this particular merchant had this functionality enabled? If so, why?

85% of places I shop take the chip. Nothing new really.

In other news.... was out at a market today, saw the dreaded "must spend $15 or more to use credit cards" sign. Then when paying I handed her my double cash card and she refused to take it. Because she DIDNT have a chip reader. I said, its fine, you  can flip it over and use the mag stripe.

Then, her husband stepped in and said, sorry, we have no signal here, and since your card does not have raised numbers we cannot make a carbon copy.....

Ummm ok reminds me of PF changs all over again!

[Open123]

---

@Anonymous wrote:

Isn't that what filing complaints with the CFPB is for? I would hope it wouldn't come down to having to go to court or even CFPB. Also something to note is that the UK used to not have a liability law similar to ours; that changed pretty quickly when banks tried to push liability to consumers (mainly due to huge backlash in the media). I would think a similar backlash would occur here if a bank tried something like that.

--  Per the old adage, pioneers get slaughtered, while those who follow flourish.  It's one thing to be a beta tester for a program or early adopter for technology, but quite another when doing so may cause me money and inconvenience.  I have no doubt the Banks will push the liability upon consumers, and I'm not going to risk being amongst the "unlucky" before they change from the backlash.  This could take years.  And, I have no faith in the CFPB, at all. 

As for reasons to adopt it? I can give you a few (but not sure if any will resonate):

1. Frequent debit card users would benefit. It's your actual money that's (temporarily) gone if something happens. Why not make PIN required instead of optional for those and reduce the likelihood of that occuring? (Yes, it's still optional even with chip.) They even did studies showing that "PIN debit" had much less fraud than "signature debit".

--  Has no bearing on me.  If this is important, they can adopt this for "debit" cards, and leave the credit ones alone, where funds temprorarily gone isn't an issue.

2. Visiting other countries. Yes, I know they're supposed to accept chip and signature. They sure place a lot more scrutiny on the signature (and ID) than we do though. Meanwhile the chip and PIN users have already left the store.

--  When abroad, I use chip & pin as a last resort, and only on a card with a very small CL.  I'm very comfortable with risk, but not this kind of risk, which is completely unecessary.  To risk this liability (even if 1 in 10,000) to leave the store a little faster?

3. Speaking of #2, some retailers in the US are being really passive aggressive about the whole signature thing. Retailers like Home Depot and Rite Aid apparently are now asking for signature with chip even for a $2 purchase. PIN would sure make things faster if you can't avoid those stores.

--  Ah, I have no issues with this.  If they want me to sign, I'll sign.  

Honestly I'm more bothered by the fact that we seem to be relying on a form of "security" that's supposed to be checked after the issuer approved the transaction (and the money's gone). If Americans don't want PIN, then issuer approval should be more than enough. Don't ask for ID, don't make people scrawl something on a screen or piece of paper after the fact. Though at least the ID checking seems to be happening before the card's swiped/inserted, so that's something at least?

--  I really don't care what "they" do, so long as I'm not liable for fraud.  The moment that I am, I'll stop using CCs.

---

In general, checking ID is a bad policy.  What if I've lost my ID and waiting for the 4 - 6 weeks for replacement?  So, with an ID policy, I can't use CCs?  If IDs are standard, what about foreigners without Gov't issued IDs?  What ID will suffice?  Passport?  Army pass?  Corporate ID?  AARP ID?  School ID?

We don't even require an ID to vote, but I'll need to show one to have dinner because I've lost my wallet and stranded in a city far away from home?  This make sense to anyone?

*Edited*  typos

[Anonymous]

For what it's worth I checked out the T&C for the few cards in the US that are actually chip and PIN.

Diners Club:

Lost or Stolen Cards or Account Numbers

If any card or account number is lost or stolen, or if you think someone used or may use them without your permission, notify us at once by calling the Customer Service telephone number shown on the billing statement or the number obtained by calling toll-free or local Directory Assistance. We may require you to provide certain information in writing to help us find out what happened, and to comply with such procedures as we may require in connection with our investigation. Don’t use the card or account number after we’ve been notified, even if they are found or returned. You may be liable for unauthorized use of the account, but not for more than $50. You won’t be liable for unauthorized purchases or cash advances made after we’ve been notified of the loss or the theft; however, you must identify for us the charges on the billing statement that were not made by you, or someone authorized by you, and from which you received no benefit.

(No mention of PIN anywhere in the linked document.)

UNFCU (choose "Visa Credit Card"):

Personal Identification Number

We will issue a Personal Identification Number (PIN) to you. This PIN will allow you to make cash withdrawals and purchases at payment terminals compatible with Chip and PIN credit cards. Your PIN is your secret code. You agree not to disclose your PIN to anyone and to notify us immediately if you believe your PIN has been stolen.

Liability for Unauthorized Use

If your card(s), convenience check(s) or PIN is lost or stolen, or if you believe someone may be using your account without your permission, you must notify us immediately. You may contact us by writing to: [snipped], or by calling us at [snipped], or toll-free within the US/Canada at [snipped]. We may terminate or limit access to your account if you have notified us or we have determined that your card, convenience checks and/or PIN may have been lost or stolen, or that there may be unauthorized access to your account. You may be liable if there is unauthorized use before your notice to us. In general, your liability for unauthorized use of your card before your notice to us will not exceed USD 50. The USD 50 limit does not apply for convenience checks and cash advances. You will not be liable for any unauthorized use of your card that occurs after you notify us. If you fail to notify us within 60 days from the date a statement was first transmitted to you that included an unauthorized charge, you may not be reimbursed for unauthorized transactions that occurred. Failure to promptly notify UNFCU of unauthorized use may also result in the closing of your account. We may terminate or limit access to your account if you have notified us or we have determined that your card, convenience checks and/or PIN may have been lost or stolen, or that there may be unauthorized access to your account.

 (The T&C implies that as long as you notify them promptly, the maximum you'll be out is $50. I don't see anything that gives the CU an opening to exempt their liability, even if you told your PIN to someone.)

First Tech FCU:

UNAUTHORIZED USE

I may be liable for the unauthorized use of the Card and/or the Account. I will not be liable for unauthorized use that occurs after I provide notification by calling [snipped], or when you receive notice in writing at [snipped], of the loss, theft or possible unauthorized use. In any case, my liability for unauthorized use will not exceed $50.00. My liability may be lower in cases of credit card fraud in accordance with current MasterCard Rules. “Unauthorized Use” means use of the Card on my Account, by a person other than me, who does not have actual, implied or apparent authority for such use, and from which I receive no benefit. Without limiting the foregoing, “unauthorized use” does not include any use by a third party as described below under “Authorized User”.

LOST OR STOLEN CARD, NOTIFICATION AND LIABILITY

I will notify you AT ONCE if I believe that the Card, Account number, PIN or any combination of the three has been lost or stolen by immediately calling you at [snipped]. Telephoning is the best way of minimizing my possible losses. I understand that my total liability to you shall not exceed $50.00 for any Account and/or Card transactions resulting from the loss, theft or other unauthorized use of the Account and/or Card that occurs prior to the time I give notice to you. In some cases my liability for unauthorized transactions will be zero under applicable MasterCard Rules.

(Similar terms to UNFCU.)

Those terms may change, true. But so far, that nightmare scenario mentioned above doesn't seem like it's possible under the current T&Cs.

[Anonymous]

Also for those worried about liability if you're asked for PIN at a kiosk/ticket machine using a card that's normally chip and signature:

Barclaycard:

Liability for Unauthorized Use of Your Account.
If your Card or any Check(s) are lost or stolen or if you have reason to think someone may use your Account without your permission, you must notify us at once. Please either visit the website on the back of your Card and send us an e-mail or telephone us at the number on the back of your Card concerning the loss or theft of your Card or Checks or the possible unauthorized use of your Account. Do not use the Card, Account number or any Checks after they have been reported lost or stolen, even if they are found or returned. You will not be liable for unauthorized use of the Account; however, you must identify for us the charges that were not made by you or someone authorized by you and through which you received no benefit. We may require you to provide us with certain information and to comply with our investigation procedures. We may terminate or limit access to your Account if you have notified us or we have determined that your Card or Checks may have been lost or stolen, or that there may be unauthorized access to your Account.

(No mention of PIN, similar to Diners Club.)

Bank of America:

UNAUTHORIZED USE OF YOUR ACCOUNT

Please notify us immediately of the loss, theft, or possible unauthorized use of your account at [snipped].

(No mention of PIN.)

Andrews FCU:

3. LIABILITY FOR UNAUTHORIZED USE. As provided from time to time in VISA’s Operation Regulations, when a transaction is processed through the VISA network, you will not be liable for unauthorized use of your Card or VISA checks unless you were grossly negligent in the handling of your Account or Card. You may be liable for unauthorized use of your Card or VISA Checks when the transaction is not processed through the VISA network, like at ATMs or other non-VISA branded transactions when a PIN is required and in all cases when you were grossly negligent in the handling of your Account or Card but in any event, your liability will not exceed $50.00. Also, you will not be liable for unauthorized use of your Card or VISA Checks that occurs after you notify us by telephone or in writing as indicated below. In all cases, immediately upon learning of the loss, theft or possible unauthorized use of your Card and/or VISA Checks, you agree to notify us by calling 1-800-449-7728 during regular business hours, weekends, holidays, or after Credit Union hours; or by writing to: Andrews Federal Credit Union, 5711 Allentown Road, Suitland, Maryland 20746 (Attention: Operations Department). You agree to give us your complete cooperation in our efforts to recover any stolen Card and/or VISA Check and amounts due from unauthorized users and to have unauthorized users prosecuted.

(Maximum liability is $50 even if you're "negligient" with your PIN.)

So yeah, I'm not too worried. For the time being, anyway. (If anything, the chip and PIN MasterCards seem more lax about the whole thing compared to the Visas.)

[longtimelurker]

---

@Anonymous wrote:

For what it's worth I checked out the T&C for the few cards in the US that are actually chip and PIN.

Diners Club:

Lost or Stolen Cards or Account Numbers

If any card or account number is lost or stolen, or if you think someone used or may use them without your permission, notify us at once by calling the Customer Service telephone number shown on the billing statement or the number obtained by calling toll-free or local Directory Assistance. We may require you to provide certain information in writing to help us find out what happened, and to comply with such procedures as we may require in connection with our investigation. Don’t use the card or account number after we’ve been notified, even if they are found or returned. You may be liable for unauthorized use of the account, but not for more than $50. You won’t be liable for unauthorized purchases or cash advances made after we’ve been notified of the loss or the theft; however, you must identify for us the charges on the billing statement that were not made by you, or someone authorized by you, and from which you received no benefit.

(No mention of PIN anywhere in the linked document.)

UNFCU (choose "Visa Credit Card"):

Personal Identification Number

We will issue a Personal Identification Number (PIN) to you. This PIN will allow you to make cash withdrawals and purchases at payment terminals compatible with Chip and PIN credit cards. Your PIN is your secret code. You agree not to disclose your PIN to anyone and to notify us immediately if you believe your PIN has been stolen.

Liability for Unauthorized Use

If your card(s), convenience check(s) or PIN is lost or stolen, or if you believe someone may be using your account without your permission, you must notify us immediately. You may contact us by writing to: [snipped], or by calling us at [snipped], or toll-free within the US/Canada at [snipped]. We may terminate or limit access to your account if you have notified us or we have determined that your card, convenience checks and/or PIN may have been lost or stolen, or that there may be unauthorized access to your account. You may be liable if there is unauthorized use before your notice to us. In general, your liability for unauthorized use of your card before your notice to us will not exceed USD 50. The USD 50 limit does not apply for convenience checks and cash advances. You will not be liable for any unauthorized use of your card that occurs after you notify us. If you fail to notify us within 60 days from the date a statement was first transmitted to you that included an unauthorized charge, you may not be reimbursed for unauthorized transactions that occurred. Failure to promptly notify UNFCU of unauthorized use may also result in the closing of your account. We may terminate or limit access to your account if you have notified us or we have determined that your card, convenience checks and/or PIN may have been lost or stolen, or that there may be unauthorized access to your account.

 (The T&C implies that as long as you notify them promptly, the maximum you'll be out is $50. I don't see anything that gives the CU an opening to exempt their liability, even if you told your PIN to someone.)

First Tech FCU:

UNAUTHORIZED USE

I may be liable for the unauthorized use of the Card and/or the Account. I will not be liable for unauthorized use that occurs after I provide notification by calling [snipped], or when you receive notice in writing at [snipped], of the loss, theft or possible unauthorized use. In any case, my liability for unauthorized use will not exceed $50.00. My liability may be lower in cases of credit card fraud in accordance with current MasterCard Rules. “Unauthorized Use” means use of the Card on my Account, by a person other than me, who does not have actual, implied or apparent authority for such use, and from which I receive no benefit. Without limiting the foregoing, “unauthorized use” does not include any use by a third party as described below under “Authorized User”.

LOST OR STOLEN CARD, NOTIFICATION AND LIABILITY

I will notify you AT ONCE if I believe that the Card, Account number, PIN or any combination of the three has been lost or stolen by immediately calling you at [snipped]. Telephoning is the best way of minimizing my possible losses. I understand that my total liability to you shall not exceed $50.00 for any Account and/or Card transactions resulting from the loss, theft or other unauthorized use of the Account and/or Card that occurs prior to the time I give notice to you. In some cases my liability for unauthorized transactions will be zero under applicable MasterCard Rules.

(Similar terms to UNFCU.)

Those terms may change, true. But so far, that nightmare scenario mentioned above doesn't seem like it's possible under the current T&Cs.

---

I think Open WAS assuming that the law would change if PIN became mandated, as the banks would argue, as at least initially in the UK, the system is secure, and if a PIN was used, we can assume either it was the card holder or that the card holder was sufficiently careless with safeguarding the PIN that he/she is also liable.

Now whether that would happen is another question.   I think in the last response, Open implies that he has no problem with the system/concept IF this liability change doesn't happen.

[slicemans]

The walmart next to my house, most supermarkets have activated their terminals already. Home Depot too.  This is in los angeles area. The people that are lagging are the gas stations, fast food

[Anonymous]

---

@longtimelurker wrote:

I think Open WAS assuming that the law would change if PIN became mandated, as the banks would argue, as at least initially in the UK, the system is secure, and if a PIN was used, we can assume either it was the card holder or that the card holder was sufficiently careless with safeguarding the PIN that he/she is also liable.

Now whether that would happen is another question.   I think in the last response, Open implies that he has no problem with the system/concept IF this liability change doesn't happen.

---

IMO if anything would trigger a law change, it would be Apple Pay. (I doubt PIN will ever become mandatory in the US.) Apple Pay is even stronger in some respects compared to chip and PIN due to the tokenization and the fingerprint authentication. But as we've seen, the criminals found a way to commit fraud using Apple Pay in record time. And one year later, the banks and CUs that support it have not changed their T&Cs to exempt themselves from liability nor has Congress loosened that law I linked to above.

Honestly, I don't think banks want to push for such changes regardless because they rely on the card system being "easy" and "hassle free". Spooking people by raising the possibility of cardholders being responsible for charges they made pokes a huge hole in that really quickly.