First time using EMV chip ever..

[Mailak]

Hmm... thank you for the in-depth explanation.

[Anonymous]

---

@yfan wrote:

---

@Mailak wrote:

I'm perplexed at claims/praises of security.

I used to go to walmart, swipe my card, sign, transaction complete.

I went to walmart, put my chip card in, was not asked to sign (low dollar transaction I guess), transaction complete.

What security did it add? Am I missing something? I can understand if there was a pin involved but most of the U.S. cards don't have one. (One of mine does, but again, it's signature priority).

---

The security is in the chip itself. The chip generates a different one-time-use transaction code every time it is read, and only the issuing bank can read/verify that code. This makes it relatively more secure than the magnetic stripe, as the stripe generates static information that is the same every time. The chip makes it next to impossible to duplicate the card - and duplicating it with a given transaction code makes the card useless to the thief since that code can never be used again.

That is separate from the security of the verification method. A signature can be very secure if sales associates are trained to verify it properly or if machines are coded to verify it, and a PIN can be rather insecure because it's a black box transaction - only your bank knows if the correct PIN was entered, and if they claim that it was for a transaction you believe is fraudulant and thus deny your fraud claim, you have no way of proving that it wasn't. A signature, on the other hand, is much more secure in this instance - you can actually prove whether a signature was yours and your bank has to actually produce the signature.

As for small transactions, cards/readers can be coded to ignore verification method for those regardless of what the method is.

---

Right, and the TL/DR version is basically the bolded bit, mag stripe cards are easily cloned, chipped cards much less so.  

[nyancat]

---

@creditconcept wrote:
As for security, the chip is SUPPOSED to generate a new random "key" for every transaction.

Example: 2252hdske6kek3jdken63 = McDonald's purchase $2.13

Even if you know the card number, you don't have the correct, I don't know what to call it, security key thing associated with each purchase. So it does not work. If someone physically has your card, there is no added security.

---

For a normal online transaction, ARQC - Authorisation ReQuest Cryptogram

[Anonymous]

In other countries credit cards have a PIN as well as a chip so that even someone with physical possession of your card can't use it.

I would guess the US is in the first phase of catching up, first getting the chip readers into widespread use to be followed up a few years from now with PIN transactions.

[Kenro]

US is so far behind the rest of the world in regards to PIN and Chip.

In UK our credit cards always had Chip + Pin, when you paid for things in restaraunt, you`d get machine bought to you, you enter your pin and pay.

I flipped here first time I had to leave my credit card for a waiter to take somewhere and then write how much tips I wanna leave... Seemed so insecure and risky.

Its still a massive pain to use Ritz Carlton in Europe because many terminals do not accept a signature and require a Pin which it does not have.

Makes the 0% foreign transaction a bit useless.

Also, Credit Cards in UK have had the visa and Mastercard paypass for years, something that is extremely rare in US. Funny thing is that a lot of terminals have the paypass technology enabled but barely any cards issued in US have it, I even had this one lady at counter in walgreens saying that its first time she seen someone use it.

[Kostya1992]

LOL... I think Pizza1 had a similar story not too long ago

[Anonymous]

For me, I've been using my diners card at Walmart for chip and pin feature. But any other places don't have it enabled like target and sprouts to name few. I insert my card and cashier always say "no, you have to swipe it, we don't have the chip feature yet"

[Anonymous]

Here in VA, Walmart does enfocre it i.e. to insert a chip based card. If I swipe it I get error saying something like please insert card into chip reader etc.

[Anonymous]

---

@Anonymous wrote:
In other countries credit cards have a PIN as well as a chip so that even someone with physical possession of your card can't use it.

I would guess the US is in the first phase of catching up, first getting the chip readers into widespread use to be followed up a few years from now with PIN transactions.

---

Other countries went straight to PIN, what's so different about the US? Which is why IMO we'll be more likely to start using Android Pay and Apple Pay for (nearly) everything than for the banks to ever issue anything other than signature preferring cards. In fact, the whole thing has been such a mess that I almost think we should have just skipped chip altogether and just mandated that everyone be able to accept NFC. Except for the whole thing with us being so far behind that it's impossible to implement without implementing chip first, of course.

[Anonymous]

Wow. I seriously feel ike a GD fool right now. Not once in the last 10 years have I ever thought to myself, hmm, I am sending my card back with someone that could do whatever they wanted with it. Yes I know there is protection or whatever. But whos to say they wouldnt write down the info and try to use it months and months down the road...

My question is, if you have a chipped card, and you see the terminal has the reader, can you just bypass the swipe and stick it in?