MC may be mandating issuers approve PIN bypass transactions in the US

[Anonymous]

Today I tried to use my Diners Club MC at CVS (which normally requires PIN if using the chip) without entering one--that is, I pushed Enter when prompted to do so. However, instead of declining as it normally does, it actually approved the transaction. I also heard that First Tech FCU started allowing bypass recently for their cards too.

Anyway, is it something MC is mandating now? Or did both issuers independently get sick of dealing with customer/merchant complaints and decide to give up on PIN in the US? FWIW, Diners Club was declining transactions without PIN as recently as June.

(BTW I would have preferred that PIN was disabled at the terminal level, especially if the de-facto standard in the US is chip and signature/nothing. In any case, I'm guessing this is for the best considering how resistant e.g. restaurants seem to be towards pay at the table and all.)

[zerofire]

It is not a PIN Bypass but just a PIN-less Debit Transaction. Apparently merchants were blowing a gasket when customers used their pin cards and then failed with denials. Basically customer was Swiss cheesed that they forgot pin and the merchant was not cheddared the sale while holding up the line. Some merchants have turned on PIN-less Debit Transactions on their terminals to speed up processing. What this does is that it sends an empty pin along with the transaction which the issuer will accept however it will be considered a higher risk transaction. The merchant takes a small risk which usually has no consequences but be careful when it comes to charging for other things as the issuer will see the pattern starting with the PIN-less charge. Walmart is the largest offender I know of but CVS would probably be close behind.

[Anonymous]

---

@zerofire wrote:

It is not a PIN Bypass but just a PIN-less Debit Transaction. Apparently merchants were blowing a gasket when customers used their pin cards and then failed with denials. Basically customer was Swiss cheesed that they forgot pin and the merchant was not cheddared the sale while holding up the line. Some merchants have turned on PIN-less Debit Transactions on their terminals to speed up processing. What this does is that it sends an empty pin along with the transaction which the issuer will accept however it will be considered a higher risk transaction. The merchant takes a small risk which usually has no consequences but be careful when it comes to charging for other things as the issuer will see the pattern starting with the PIN-less charge. Walmart is the largest offender I know of but CVS would probably be close behind.

---

Diners Club (as well as the First Tech FCU datapoint I previously mentioned) involve Mastercard credit cards. Debit routing in any form isn't possible with those. What's happening is that PIN on the CVM list (the priority list of allowed cardholder verification methods encoded on the chip) is being skipped and a flag is being sent over to the issuer saying that the PIN was bypassed. In the past, such transactions were always declined, but apparently no longer.

BTW, while actual chip and PIN credit cards are rare in the US, they do exist (though there's probably even less of a motivation for issuers to adopt those now if authorizing bypass is indeed mandatory).

[digitek]

I have Chip+PIN priority on my SDFCU Visa and have transactions approved in store all the time that do not require my PIN to be used.  I was kind of surprised by that when I first got it.  If a cashier/payment terminal can bypass the PIN and move to another payment form like signature then it kind of defeats the purpose of Chip+PIN priority.

Correct me if I'm wrong, but what I determined is that to make real Chip+PIN work it takes both a Chip+PIN priority card AND the payment network setup so that you can't bypass it (like in Europe).

[Anonymous]

---

@digitek wrote:

I have Chip+PIN priority on my SDFCU Visa and have transactions approved in store all the time that do not require my PIN to be used.  I was kind of surprised by that when I first got it.  If a cashier/payment terminal can bypass the PIN and move to another payment form like signature then it kind of defeats the purpose of Chip+PIN priority.

Correct me if I'm wrong, but what I determined is that to make real Chip+PIN work it takes both a Chip+PIN priority card AND the payment network setup so that you can't bypass it (like in Europe).

---

It does defeat the purpose but at the same time, it's likely unavoidable for US transactions. I'm sure Diners Club and/or MC's been getting a whole bunch of complaints from both cardholders and merchants about not being able to use PIN at entire categories of merchants (thanks to it continuing to be pretty frowned upon for customers to touch the terminal).

That said, I wouldn't be surprised if bypass is still declined for foreign transactions. No need to approve those since people elsewhere are used to PIN prompts and all. For that reason I'd still consider cards like Diners Club and SDFCU chip and PIN.

[HeavenOhio]

Wouldn't chip plus PIN be kind of like chip plus signature in that some transactions may require the PIN or signature while others might not?

[Anonymous]

---

@HeavenOhio wrote:

Wouldn't chip plus PIN be kind of like chip plus signature in that some transactions may require the PIN or signature while others might not?

---

It really depends on the terminal. A lot of US terminals do have PIN disabled (either in software or because the hardware to prompt for one doesn't exist in the first place), and at those, you'd either sign or not have to provide anything regardless of the card. There are a fair number that have PIN enabled, though, and for those, cards like Diners Club and SDFCU will cause the terminal to prompt for one.

The change described here is that Diners Club will no longer decline if you're asked for PIN at a terminal in the US and you (or the cashier/server) pushes Enter without entering one, unlike what they've done in the past. When that's done, the terminal will behave like you used a chip and signature card and either require a signature or let the transaction go through without providing anything. Note that this assumes that the terminal actually allows bypass, which isn't 100% guaranteed (for instance, Kroger and its associated brands will not let you bypass).

[NRB525]

It should be terminal specific for any bypass.

For myself, I will sometimes use my Diners Club card just to see that it triggers the PIN requirement. It gives me a Marie Kondo form of joy

On the other hand, those of us with 10+ cards might be challenged to recall the specific PIN for each card, if Chip+PIN really took off in the US.

[Anonymous]

---

@NRB525 wrote:
It should be terminal specific for any bypass.

For myself, I will sometimes use my Diners Club card just to see that it triggers the PIN requirement. It gives me a Marie Kondo form of joy

On the other hand, those of us with 10+ cards might be challenged to recall the specific PIN for each card, if Chip+PIN really took off in the US.

---

I tried using it a fair bit early on until I realized how many merchants (especially smaller ones and restaurants) where I live have serious acceptance issues with cards that need PIN. I still used it occasionally at counter service establishments afterward to test them but I did continue to run into issues more often than I was comfortable with.

Unfortunately now that bypass is allowed I suspect that the merchants that didn't already change their practices probably never will, especially since PIN preference is so uncommon to begin with.

[Anonymous]

---

@NRB525 wrote:
On the other hand, those of us with 10+ cards might be challenged to recall the specific PIN for each card, if Chip+PIN really took off in the US.

---

That's my issue with the whole CHIP+PIN thing. Overseas where I would only carry 3-4 Cards is fine, but at home I have way too many to remmeber. I'd have to use the same PIN on several of them.