First Tech Chip-and-PIN Questions

[TJN]

I recently was approved for the Choice World Mastercard and have completed the spend for the SUB over the past month.  I acquired the card purely for the Chip-and-PIN priority feature as I travel to Europe often and it would just be easier to have a proper PIN-enabled card.

What I can't really figure out in my testing in the US...is this card really PIN priority?  I've used the card at literally dozens of different retailers from gas to groceries to home improvement stores and have yet to be once asked for a PIN. I realize that those terminals may fall back to signature verification as allowed by the card but I'm still shocked that I not once was asked for it.

As a follow-up question, First Tech says you can change your PIN over the phone with them.  How is this possible on a card that supports offline PIN verification?  In offline situations, doesn't the chip do the PIN verification, and therefore the PIN must be changed in branch or at a compatible ATM?

Thanks!  Hopefully when I hit Europe next I will be prompted for my PIN.  Crossing fingers.

[toothgrind3r]

I have this card and have used it in Europe (but it's been about 5 years), and every time it asked me for the PIN. And like you, not once in the US.

I'm guessing it depends on the POS terminal?

As far as changing the PIN, at the time (again, 5 years ago), I was told that I needed to do it in branch or at a First Tech ATM...neither of which I had near me at the time, so I never changed it. I never had the option to change it online.

[coldfusion]

There is no single standard used with Chip & PIN implementations.

In some cases where a card supported both online and offline PIN verification - which I think the First Tech cards do - you could supposedly change your PIN by logging onto your online account and making the change; the next time you used the card at a terminal capable of performing the update you would enter the old PIN and the card would be updated with the new PIN for offline/ICC use. 

I have a UNFCU Elite and have never tried to change the PIN, but when I use it in the US I do get prompted to enter it.

[TJN]

---

@toothgrind3r wrote:

I have this card and have used it in Europe (but it's been about 5 years), and every time it asked me for the PIN. And like you, not once in the US.

I'm guessing it depends on the POS terminal?

As far as changing the PIN, at the time (again, 5 years ago), I was told that I needed to do it in branch or at a First Tech ATM...neither of which I had near me at the time, so I never changed it. I never had the option to change it online.

---

Ok, that gives me some hope then that this will work as expected in Europe.  Interesting that you used to have to go in to change the PIN.  I'm curious if that was just a limitation of their systems at the time or if something has changed with how these cards work.

[TJN]

---

@coldfusion wrote:

There is no single standard used with Chip & PIN implementations.

In some cases where a card supported both online and offline PIN verification - which I think the First Tech cards do - you could supposedly change your PIN by logging onto your online account and making the change; the next time you used the card at a terminal capable of performing the update you would enter the old PIN and the card would be updated with the new PIN for offline/ICC use. 

I have a UNFCU Elite and have never tried to change the PIN, but when I use it in the US I do get prompted to enter it.

---

So would a terminal capable of updating the PIN be an ATM then?  

That's interesting that you get prompted for a PIN with your UNFCU card.  I'm curious why that is for your card but not for the FTCU card. If the FTCU card is truly PIN priority you'd think I would also be prompted to enter a pin just as you experience.

[coldfusion]

---

@TJN wrote:

---

@coldfusion wrote:

There is no single standard used with Chip & PIN implementations.

In some cases where a card supported both online and offline PIN verification - which I think the First Tech cards do - you could supposedly change your PIN by logging onto your online account and making the change; the next time you used the card at a terminal capable of performing the update you would enter the old PIN and the card would be updated with the new PIN for offline/ICC use. 

I have a UNFCU Elite and have never tried to change the PIN, but when I use it in the US I do get prompted to enter it.

---

So would a terminal capable of updating the PIN be an ATM then?  

That's interesting that you get prompted for a PIN with your UNFCU card.  I'm curious why that is for your card but not for the FTCU card. If the FTCU card is truly PIN priority you'd think I would also be prompted to enter a pin just as you experience.

---

Different implementations.   Not all Chip + PIN cards issued in the US support(ed) both online and ICC PIN and they don't all necessarily follow the same ordering of prioritzation between online PIN, offline PIN, and signature authorization.

As far as the ATM machine, it would depend on the machine and how it was programmed.

I don't even know whether First Tech still supports Chip + PIN either nor do I know how current the ENV CVM database is.  I know it took them quite a while to remove the Andrews FCU Titanium from that list after they discontinued issuing them with PIN support.

[bllfr0g]

So a couple of things to unpack here.

• I would not stress too much about this. Europe isn't like it was 10 years ago when you ran a decent chance of hitting a kiosk or merchant who couldn't handle a US credit card. While it's not 100% guaranteed, garden-variety US chip-and-signature cards are extremely likely to cause you no issues nowadays.
• To a large degree, Europe has moved beyond chip-and-pin to contactless. Yes, you can still use chip-and-pin... but you'll probably be the only one because everyone else will be using contactless! On my recent trips to Europe I have not used my physical cards a single time (except for getting cash at an ATM). Apple Pay everywhere.
• When I had that first tech credit card, it was PIN priority and supported both online and offline PIN. I would imagine it's still the same.
• If you *really* want to check your card before you go, get yourself a smartcard reader (they're like $20). Using a free program called CardPeek you can scan the chip on your card and pull out the Cardholder Verification Methods list, which will show you exactly what methods, and in what order, the card uses.
• For online PIN, the PIN is stored on the bank's comptuers, so it's obvious how you can change that online.
• For offline PIN, the PIN is stored on your card itself. So you're right to ask how you can change it. The answer is... it's complicated. I've had a few cards in the US that supported offline PIN, either as primary or secondary CVM, though all of those issuers except for First Tech has stopped offering offline pin. (And I don't have the First Tech card any more.) When I DID have offline-pin cards, different issuers had different policies for PIN change:
  • Some just wouldn't do it. The PIN you're assigned is the one you get, full stop. If your PIN is compromised, they send you a whole new card with a new PIN.
  • First Tech, 5+ years ago when I had their card, would allow you to change the CC PIN at a First Tech ATM, only. Since they own that ATM, they can do whatever magic they want with it to make the PIN change happen.
  • SDFCU, when they still offered PIN-priority cards, allowed you to change your offline PIN via an automated phone number. So how did THAT work? Well, the standard for EMV chip cards includes something called the "issuer script", where the card issuer can send commands to your card that run when you process an ordinary transaction with the card. So with SDFCU, one could request a PIN change, which would then get sent to your card the NEXT TIME you did an in-person transaction. Of course, that meant you had to do one last transaction using the OLD PIN, and during that transaction, the new PIN would get written to the card. Barclays cards in the US (like the old Uber Visa) used to work that way too. As you can imagine, this is probably super confusing for most people, which is why I suspect many issuers just disallowed PIN change altogether on these cards.
  • Further complicating the PIN change business is that shortly after EMV cards rolled out in the USA, Visa and Mastercard came up with something called Quick Chip (Visa) and M Chip/Fast (Mastercard.) Those are extensions to the EMV standard that make it faster to run a chip card transaction at the point of sale. Without getting into too many details... one of the things that these extensions do is skip the issuer script. So once Quick Chip became a thing, THEN the process was:
    • Change PIN over the phone.
    • Take card to a terminal that DOES NOT use Quick Chip.
    • Do one last transaction with the old PIN to get the new PIN programmed.
  • Of course, there wasn't necessarily any easy way to determine if a particular POS uses Quick Chip or not. If you really understand EMV you MIGHT be able to tell by watching how the transaction goes... but you wouldn't be able to tell before starting the transaction (it's not like the cashier is going to know!) So you end up going all over town buying stuff, hoping to trigger an issuer script? Nowadays, pretty much all merchants have adopted Quick Chip. Back when I had an offline PIN card, ATMs were pretty reliable about NOT doing Quick Chip and actually running the issuer script, but even that's not guaranteed. And of course these are credit cards... so do you really want to do a transaction at an ATM with your credit card? Oddly enough, my Barclay Visa would run the issuer script just by sticking it in an ATM and requesting an "available balance check" (and that cost me nothing.) My SDFCU Visa would NOT run the script for a "balance check" and I actually needed to do a cash advance (which does cost me a small amount, even if I pay it off immediately) to get the issuer script to run. Anyway, this is obviously not really tenable for the average consumer.

Anyway, TL;DR:

• Yes, your card is most likely PIN preferring and supports online and offline PIN.
• It really doesn't matter though; it's pretty hard to find a terminal in Europe that does NOT take contactless at this point.
• If you REALLY want to check your card before you go, get a reader and use CardPeek.

[longtimelurker]

---

@bllfr0g wrote:

• To a large degree, Europe has moved beyond chip-and-pin to contactless. Yes, you can still use chip-and-pin... but you'll probably be the only one because everyone else will be using contactless! On my recent trips to Europe I have not used my physical cards a single time (except for getting cash at an ATM). Apple Pay everywhere.

---

Just to comment on this.  Certainly my experience in cities in the UK.   Over "tons" (technical term) of transactions over the last 4 years, only once did mobile pay (Samsung rather than Apple) fail, and I used a US card that spat out a signature form.   And that was just a temporary problem, I was able to use Samsung Pay both before and after this at the same store.

Certainly different from say 10 years ago, where using a signature requiring US card was a pain because everyone had moved to chip&pin.   But now, as @bllfr0g says, contactless (or mobile) has completely taken over, at least in the UK.