EMV for all cards

[Anonymous]

I' am in the process of making sure all of my cards, debit and credit, have the EMV chip. I' am aware that not all merchants have made the switch for their hardware to accept the emv chip, so with that being said, how secure is emv? Theoritically someone can snatch my card, swipe it, sign for the purchase and getaway with some free goods. A few merchants that I shop with are allowing the swipe and sign method, with that method in place, anyone with my card can do the same.

[p-]

---

intellis wrote:... how secure is emv?

---

We are halfway there with Chip and Sign, as the most secure method available is Chip and Pin.  That means that someone in physical posession of your card can use it for purchases, but as far as I know, the tech does not exist yet to clone them as easily as the mag stripe cards.  If we were Chip/Pin, someone who steals your card would not be able to use it at a POS.

A thief can still use it for online purchases if they know the CCV code on the back, and anywhere that does not yet have a chip terminal as your card will still have the mag stripe.

[Anonymous]

"If we were Chip/Pin, someone who steals your card would not be able to use it at a POS."

"A thief can still use it for online purchases if they know the CCV code on the back, and anywhere that does not yet have a chip terminal as your card will still have the mag stripe."

---

So what was the ressoning for the 'chip/sig' push instead of the 'chip/pin', especially if 'chip/pin is more secure'?

OAN

I have been a victim of fraud twice since I have had my CSP with emv, and both times in an restarurant in an airport. A few online purchases were made too, but all were easily removed. Now I don't even hand my card to the waitress anymore, I ask is they can accept my purchase while I'm at the table.

[p-]

---

intellis wrote:...So what was the ressoning for the 'chip/sig' push instead of the 'chip/pin', especially if 'chip/pin is more secure'?

---

 A lot of people are asking that question.  I assume it's part of a gradual transition to a chip and pin system.  A few of my cards already have pins assigned.

The most common methods of fraud I've seen are skimmers on gas pumps, swipe recorders or keyloggers behind the counter at a restaurant, and someone just photographing the front and back of the card.  The first two are covered by chip and pin and chip and sig, once the mag stripes are gone.  And the last is easy to watch for with purchasing pattern algorithms.  I'm guessing we'll see some opt in security messaging for protection with online purchasing.  The only thing the pin covers that the sig does not is a lost or stolen card.  And those of us in the know ought to be able to react quick enough to that.

[Themanwhocan]

Thats why my Target credit card is Chip+Pin, and has no magnetic stripe.

Security!

Plus, you know... If someone did manage to charge something to my Target account, what are they gonna buy with such a low credit limit anyways...

Security!

[longtimelurker]

---

@p- wrote:

---

intellis wrote:...So what was the ressoning for the 'chip/sig' push instead of the 'chip/pin', especially if 'chip/pin is more secure'?

---

 A lot of people are asking that question.  I assume it's part of a gradual transition to a chip and pin system.  A few of my cards already have pins assigned.

The most common methods of fraud I've seen are skimmers on gas pumps, swipe recorders or keyloggers behind the counter at a restaurant, and someone just photographing the front and back of the card.  The first two are covered by chip and pin and chip and sig, once the mag stripes are gone.  And the last is easy to watch for with purchasing pattern algorithms.  I'm guessing we'll see some opt in security messaging for protection with online purchasing.  The only thing the pin covers that the sig does not is a lost or stolen card.  And those of us in the know ought to be able to react quick enough to that.

---

Right, there are various types of fraud, and which is most common varies from place to place and also over time.   I believe US CC companies were most concerned with card cloning and, at least as far as we know, the addition of the chip makes that much harder.   Chip&Pin provides additional protection from stolen cards (and not everyone reacts as quickly as most myfico members).   Card not present fraud (online) is still a big issue.  I believe that when the UK went 100% chip & pin (with some exceptions for various disabilities) eventually card not present fraud increased, as did the use of stolen UK cards in the US, due to the absence of pin

[Anonymous]

---

@p- wrote:

I assume it's part of a gradual transition to a chip and pin system.  A few of my cards already have pins assigned.

---

The US will probably be on chip and signature (semi-)permanently, with PIN really being used only for compatibility reasons overseas. For one thing, PIN is seen by banks as basically obsolete so they don't really want to bother. Not to mention that a lot of people will set all their cards to have the same PIN and/or to something that's easily guessed, neutralizing most of the benefits.

I bet we go to biometrics on the cards themselves or we wholesale switch to stuff like Apple Pay before PIN is mandated.

[takeshi74]

---

@Anonymous wrote:

how secure is emv?

---

More secure than mag stripe but there's still possible fraud with EMV whether chip & signature or chip & PIN.  There are many articles and such (including prior threads) that you can reference out there if you're really interested.  You need to keep in mind that there isn't just one type of or vector for fraud and therefore it's difficult to provide a simple answer to such a question.  As stated above, C&S does help prevent cloning.  Neither C&S nor C&P will totally prevent a man in the middle sort of fraud.

No security is ever 100%.  Security is all about layering and deterring.  Criminals are clever and it's a cat and mouse game that keeps escalating on both sides.  EMV can help but you'll want to layer active monitoring on top of that.

---

@Anonymous wrote:

A few merchants that I shop with are allowing the swipe and sign method

---

The card and creditor play a role in determining whether the card is chip & signature or chip & PIN.  Most cards in the US are currently chip & signature.  Merchants may still not require a signature for purchases under a certain amount.

---

@Anonymous wrote:

EMV for all cards

---

Also be aware that EMV can be contact or contactless.

[sr383]

---

@Themanwhocan wrote:

Thats why my Target credit card is Chip+Pin, and has no magnetic stripe.

Security!

Plus, you know... If someone did manage to charge something to my Target account, what are they gonna buy with such a low credit limit anyways...

Security!

---

The debit card's the same way--I hadn't noticed.

[Themanwhocan]

---

@longtimelurker wrote:

---

@p- wrote:

---

intellis wrote:...So what was the ressoning for the 'chip/sig' push instead of the 'chip/pin', especially if 'chip/pin is more secure'?

---

 A lot of people are asking that question.  I assume it's part of a gradual transition to a chip and pin system.  A few of my cards already have pins assigned.

The most common methods of fraud I've seen are skimmers on gas pumps, swipe recorders or keyloggers behind the counter at a restaurant, and someone just photographing the front and back of the card.  The first two are covered by chip and pin and chip and sig, once the mag stripes are gone.  And the last is easy to watch for with purchasing pattern algorithms.  I'm guessing we'll see some opt in security messaging for protection with online purchasing.  The only thing the pin covers that the sig does not is a lost or stolen card.  And those of us in the know ought to be able to react quick enough to that.

---

Right, there are various types of fraud, and which is most common varies from place to place and also over time.   I believe US CC companies were most concerned with card cloning and, at least as far as we know, the addition of the chip makes that much harder.   Chip&Pin provides additional protection from stolen cards (and not everyone reacts as quickly as most myfico members).   Card not present fraud (online) is still a big issue.  I believe that when the UK went 100% chip & pin (with some exceptions for various disabilities) eventually card not present fraud increased, as did the use of stolen UK cards in the US, due to the absence of pin

---

I think CC companies were most concerned with shifting the fraud liability to the merchants. Once that occurs, they really dont care how secure the cards are...

I'm sure its a coincience that they choose a less secure card, probably because it was cheaper to implement, and left magnetic stripes on most cards. They also wanted to keep as many people using credit cards as possible, and not lose customers that struggle to remember a bunch of pin numbers. And the cost for implementing this dubious attempt at improving security is borne mainly by the merchants as well.