Hello!
I've been reading these forums off and on for about 2 years now and I finally decided to join to offer my knowledge of Chip & PIN technology as a fairly longtime banker.
Nearly everyone here seems so excited about Chip & PIN coming to the US, but I personally prefer Chip & Signature myself. And here's why:
For the past 5 years I have worked for a major Canadian bank (until very recently) and have handled numerous fraud investigations at the branch level. What most people don't seem to realize is that Chip & PIN is not at all a secure system. Studies by major UK universities have shown repeatedly that Chip and PIN technology has been flawed and easily exploited from the very beginning, and I have seen it happen!
I realize that Chip and PIN does have some advantages, and it is certainly more secure (for the banks) than magnetic stripe technology. But what about for the customer?
Many people here have discussed the upcoming liability shift from banks to merchants. Unfortunately, nobody seems to realize that the real liability shift, kind of a secret one, is from the banks to their customers.
An example: I recently took a complaint from a customer about a nearly $2000 charge that appeared on her account statement. This person swore up and down that it wasn't hers and that she had no idea what it was. Having personally waited on this customer many times in the past, I had no reason to doubt her and every reason to believe her based on a well established banking relationship and knowledge of her character.
So I sent the dispute off for investigation, knowing what the result would be. When the answer came back a few days later, the bank said that the person's Chip card and correct PIN were used to pay for the charge and that the bank would not reverse the transaction--just as I thought. It was then my great privlege to pass this awful news along to the customer, who ultimately lost the entire $2000. This particular Chip and PIN transaction was on her debit card, so the money had already left her account at the time the transaction was made. The transaction also did not go over a VISA or MasterCard debit network, but rather the Canadian Interac debit network, so there was no opportunity to use VISA or MasterCard policies to limit her liability.
So, what happened? Well, somehow (I don't know how) the customer's card was compromised, and likely the criminal used any 4 digit PIN number at all to make the charge. There is a way these people have of tricking the chip terminal into thinking the entered PIN was correct. I don't know all of the ins and outs of how they do it, but I have seen the results many times. When the bank sends away for information from, for example, VISA International or MasterCard or whichever network was used, a report is generated by the card processing company of the bank whose terminal was used. For example, a company such as Moneris in Canada, or Chase Payment Tech. Anyway, the report indicates whether or not a correct PIN had been used by sending a code of Y for yes and N for no. If the report says Y, then even the bank that owns the credit card believes that the correct PIN was used, and they then refuse to take any liability for the charge--the customer has to pay.
This example is just one of many that turned out the same way during my time with the bank. Part of my reason for ultimately leaving banking was due to my disgust with this kind of situation. I saw many customers taken advantage of after Chip and PIN became the standard in Canada. I don't know in every case whether or not the customer was being honest, but in a number of cases I did know the customer quite well and do not believe it was in the person's character to lie to the bank. The bank's character, however, is another story...
Why am I telling you all this? Well, Chip and PIN is coming--that's inevitable! So there's no way around it. My advice is to never let your card out of your hand/wallet/sight when Chip and PIN comes, because then it is much more difficult to have your card compromised. If your card has a RFID chip in it, it can't hurt to get a RFID blocking sleeve or wallet either! I have both. My other way of dealing with this is to have a few different cards all with relatively low limits. This way, if the bank says "Your PIN was used, you have to pay!" then at least the damage won't be as significant.
In Canada, a law was passed a few years ago that no auto CLIs are allowed. If the bank wants to increase your limit, they have to ask you for permission to do it. If you consent, then up it goes to the offered amount. This makes it easy to keep limits where they are. In one case I became uncomfortable with a 5 digit limit I had and decided to call the issuer and lower it by a few K to $7,000. Personally I think anywhere in the $2,000 to $5,000 range is ideal, though having one card with above $5K isn't too bad. I prefer higher limits on LOC accounts that are not accessable by either a bank card or credit card. This is also good if you carry a balance as the interest on a LOC is usually much lower than on a CC (at least in Canada).
Please note that all banks in Canada operate in the way I have described--as I believe they do in other Chip and PIN countries and untilately will in the US. In Canada they all eventually made some slight changes to their terms and conditions, and from then on the customers were on the hook. I make no guarantees that the same WILL happen in the US, but I would be extremely surprised if it didn't happen after while. I have advised numerous people in Canada to write to their federal MP to have a law enacted to pass liability back over to the banks whether or not a correct PIN was used, but since it affects a relatively low percentage of the population overall, most people are neither aware of the issue nor inclined to write letters about it--right up until it happens to them!
If anyone has any questions about this issue, I am happy to answer them insofar as I can without giving out any confidential information related to my past customers. I also prefer not to say which bank I worked for.
I have some (limited) knowledge of underwriting from my time as a banker as well and will eventually share some of that. Whether or not people choose to believe this post is of no interest to me. I offer it simply for informational purposes. Do with it as you will.
G
If the US starts with chip & pin it will be mandatory that the card issuer lets the customers select their pin of choice. Like this you can remember and do not have to write it down.