Should USA card issuers adopt EMV (Chip & PIN)? [Opinion discussion]
#166
Ambassador, Hong Kong and Macau
Join Date: May 2009
Location: HKG
Programs: Non-top tier Asia Miles member
Posts: 19,671
Yup...the wireless terminals are increasingly popular in Canada. While a lot of restaurants have adopted them as part of their chip migration, many restaurants here used them before Chip because our debit cards have always required PINs.
Do you have any sources to back that up? (I'm not doubting you, I just want to read for myself)
In Canada we have 3 different types of wireless terminals in use - Bluetooth, WiFi, and GSM/GPRS, so the security considerations for each is different.
Do you have any sources to back that up? (I'm not doubting you, I just want to read for myself)
In Canada we have 3 different types of wireless terminals in use - Bluetooth, WiFi, and GSM/GPRS, so the security considerations for each is different.
I wonder is any leakage of data traffic between the wireless terminal and its base dangerous if the card involved is an EMV card combined with Dynamic Data Authentication? After all, ARQC and ARPC can't be reused and new ones have to be generated with the card present.
#167
Original Poster
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
Ideally true, but in corporate America run by number crunching MBAs and bean counters, it's all about nickel-and-diming the customer in order to recuperate lost revenue/recover assesed risks.
Inevitably, rising skimming fraud would just put more pressure to the banks and merchants, which in turn just gets passed down to the consumer.
I work in the food industry. Cost of food for consumers because of rising fuel prices. Do you think the grocery stores are eating up the price of rising fuel that is inclusive to bring groceries from the farmland to your neighborhood grocer? No, grocers just pass along the cost of rising fuel to their customers.
And in the end, market forces does drive the rest of the competitors to follow suit to reduce their losses too. Just look at all those baggage fees for the airlines.
Just put yourself in the merchants' shoes than thinking from the consumer standpoint. Imagine you have a restaurant. You became a victim of a fraudulent customer who used a skimmed cloned credit card at your restaurant, so you have to foot the $100 bill. Imagine that happened to your restaurant five times this month already and you're $500 in the red now. What are you going to do? Charge the customers more.
Or, put into another perspective, why do you think a can of Coca-Cola from a convenience store in Thailand costs less than 50 cents when it costs over a buck at a 7-11 stateside? Do you think 7-11 in the US is eating up the cost of higher labor cost, material prices, transportation fuel cost, and other costs associated with bringing that can of Coke from the factory in the US to your neighborhood 7-11 as opposed to the Coke factory in Thailand to the Family Mart in Bangkok? The majority of the extra 50 cents or more we pay for a can of Coke is pretty much passed down to the American consumer.
Inevitably, rising skimming fraud would just put more pressure to the banks and merchants, which in turn just gets passed down to the consumer.
I work in the food industry. Cost of food for consumers because of rising fuel prices. Do you think the grocery stores are eating up the price of rising fuel that is inclusive to bring groceries from the farmland to your neighborhood grocer? No, grocers just pass along the cost of rising fuel to their customers.
And in the end, market forces does drive the rest of the competitors to follow suit to reduce their losses too. Just look at all those baggage fees for the airlines.
Just put yourself in the merchants' shoes than thinking from the consumer standpoint. Imagine you have a restaurant. You became a victim of a fraudulent customer who used a skimmed cloned credit card at your restaurant, so you have to foot the $100 bill. Imagine that happened to your restaurant five times this month already and you're $500 in the red now. What are you going to do? Charge the customers more.
Or, put into another perspective, why do you think a can of Coca-Cola from a convenience store in Thailand costs less than 50 cents when it costs over a buck at a 7-11 stateside? Do you think 7-11 in the US is eating up the cost of higher labor cost, material prices, transportation fuel cost, and other costs associated with bringing that can of Coke from the factory in the US to your neighborhood 7-11 as opposed to the Coke factory in Thailand to the Family Mart in Bangkok? The majority of the extra 50 cents or more we pay for a can of Coke is pretty much passed down to the American consumer.
Last edited by kebosabi; Nov 23, 2011 at 7:50 am
#168
Join Date: Aug 2010
Posts: 286
The corporate bean counters cannot create profit by increasing the price above the optimum price, unless they're a running charity and can convince goodwill customers to pay more to help out a good cause. Having fraud losses do not qualify as a "good cause", and having systemic security costs to prevent fraud loss does not count as a "good cause" either. If the cost is due to a publicized donation to the american heart association (for example), only then does it work to charge more than market value.
US customers don't care about the price of rice in China -- they care about the price of rice in the US.
I work in the food industry. Cost of food for consumers because of rising fuel prices. Do you think the grocery stores are eating up the price of rising fuel that is inclusive to bring groceries from the farmland to your neighborhood grocer? No, grocers just pass along the cost of rising fuel to their customers.
Just put yourself in the merchants' shoes than thinking from the consumer standpoint. Imagine you have a restaurant. You became a victim of a fraudulent customer who used a skimmed cloned credit card at your restaurant, so you have to foot the $100 bill. Imagine that happened to your restaurant five times this month already and you're $500 in the red now. What are you going to do? Charge the customers more.
Or, put into another perspective, why do you think a can of Coca-Cola from a convenience store in Thailand costs less than 50 cents when it costs over a buck at a 7-11 stateside? Do you think 7-11 in the US is eating up the cost of higher labor cost, material prices, transportation fuel cost, and other costs associated with bringing that can of Coke from the factory in the US to your neighborhood 7-11 as opposed to the Coke factory in Thailand to the Family Mart in Bangkok? The majority of the extra 50 cents or more we pay for a can of Coke is pretty much passed down to the American consumer.
#169
Ambassador, Hong Kong and Macau
Join Date: May 2009
Location: HKG
Programs: Non-top tier Asia Miles member
Posts: 19,671
I think garyschmitt is making a wrong assumption here. Going back to Economics 101 (okay maybe 102) he's assuming the demand for restaurants food is perfectly elastic http://en.wikipedia.org/wiki/Price_elasticity_of_demand - any supplier raising prices will immediately price themselves out of the market, or out of the credit card-accepting restaurant market at least.
I prefer the view that restaurant consumers are close to unitary elastic. If restaruants raise prices, some of us will cook at home. But some of us will continue to eat out anyway.
A case in point is Hong Kong restaurants in the past year - our currency (HK$) is pegged to the US$ but all the countries who provide our food are not and have appreciated, so we get imported inflation. Restaurants here have either closed, raised their prices or provided smaller portions for same price (so we have to order more side dishes where we did not have to before).
Increase in credit card fraud is the same as imported inflation - an upward shift in the supply curve. Prices will increase.
I prefer the view that restaurant consumers are close to unitary elastic. If restaruants raise prices, some of us will cook at home. But some of us will continue to eat out anyway.
A case in point is Hong Kong restaurants in the past year - our currency (HK$) is pegged to the US$ but all the countries who provide our food are not and have appreciated, so we get imported inflation. Restaurants here have either closed, raised their prices or provided smaller portions for same price (so we have to order more side dishes where we did not have to before).
Increase in credit card fraud is the same as imported inflation - an upward shift in the supply curve. Prices will increase.
#170
Join Date: Aug 2008
Programs: HHonors Gold, Marriott Lifetime Gold, IHG Gold, OZ*G, AA Gold, AS MVP
Posts: 1,874
If store A has $50 in fuel costs per pallet of rice, and store B has $500 in fuel costs per pallet of rice because they are ten times further from the distribution point and a fuel increase amplified the difference, fuel costs are in fact eaten by the store. If they passed the $500 in fuel costs on to the customer, they would sell fewer units, and lose profit. Store B cannot charge higher than market price simply because they have more costs.
They're not at all driven to increase costs. There's no incentive. The drive is the opposite, choosing the path of lesser cost (to maximize profit).
Nonsense. The restaurant can't move the price higher than market, or they'll lose even more than the $500 they already lost. Competitors control the price, not incurred expenses. If a mom and pop store were to increase the price on the basis of their cost, they need a better bean counter because it's a naive business judgment.
They're not at all driven to increase costs. There's no incentive. The drive is the opposite, choosing the path of lesser cost (to maximize profit).
Nonsense. The restaurant can't move the price higher than market, or they'll lose even more than the $500 they already lost. Competitors control the price, not incurred expenses. If a mom and pop store were to increase the price on the basis of their cost, they need a better bean counter because it's a naive business judgment.
Also, percysmith seems to have made the point better than I have.
And on the last point- that mom-and-pop store better kick up their prices on the basis of cost. The other option in the case of restaurants is to lower the quality of ingredients. Three words- drainage ditch oil. No thank you.
#171
Original Poster
Join Date: Jul 2006
Location: LAX
Programs: AA EXP 1.5MM, Asiana Club Silver, KE Morning Calm, Hyatt Platinum, Amtrak Select
Posts: 7,161
Now let's say that starts to happen more frequently to the level of five transactions EVERY MONTH and it starts affecting not only you, but practically every competitor out there within the city. If a problem exists that affects more frequently and that hits across an entire market, then there's no need to undercut the other guy to keep your market share, you need to start recuperating your losses and taking assumed risk because your competitors are probably making the same conclusion.
The threat of skim-cloned credit cards is indeed something that is happening more in America today which affects every merchant and their competitor out there. Same thing with rising fuel prices that hit all the airlines; it's a problem that affects the entire industry, inevitably they'll just pass the cost down to the consumer.
Last edited by kebosabi; Nov 24, 2011 at 8:34 am
#172
Join Date: Aug 2010
Posts: 286
I think garyschmitt is making a wrong assumption here. Going back to Economics 101 (okay maybe 102) he's assuming the demand for restaurants food is perfectly elastic http://en.wikipedia.org/wiki/Price_elasticity_of_demand - any supplier raising prices will immediately price themselves out of the market, or out of the credit card-accepting restaurant market at least.
My claims are supported either way. If fraud is completely unavoidable, then everyones hands are tied and nothing can be done anyway. If the fraud is cheaply avoidable (that is the cost of security is less than the cost of the fraud that it offsets), then restaurant owners have the competitive pressure to implement the security feature. If the security feature costs more than it saves, then it makes no sense to implement it, because doing so would increase net cost.
The silly proposal at issue here is to bring in a portable terminal that is less secure, and also introduces a cost of its own. You're losing in every respect. To pay more for a system that is less secure means more equipment costs, higher fraud costs, and no savings. Makes no sense from a business standpoint or a security standpoint.
#173
Join Date: Aug 2010
Posts: 286
I see some airlines offering two free bags, some one, some none. I see different ticket prices too. Whether an airline bundles various services to one price, or they break it out into ala carte pricing is 6 to 1, half a dozen to the other.
Also, percysmith seems to have made the point better than I have.
And on the last point- that mom-and-pop store better kick up their prices on the basis of cost. The other option in the case of restaurants is to lower the quality of ingredients. Three words- drainage ditch oil. No thank you.
And on the last point- that mom-and-pop store better kick up their prices on the basis of cost. The other option in the case of restaurants is to lower the quality of ingredients. Three words- drainage ditch oil. No thank you.
#174
Join Date: Aug 2010
Posts: 286
Precisely my point. A restaurant or a merchant would probably not raise their prices if credit card fraud hits them may be like one transaction every six months or so and maybe one store in a single city at that. At such a rate, it is a cost of doing business and the merchant would likely eat up the cost for the sake of letting consumers pay for their products with a credit card.
Let's say you're paying half the price of fuel as your competitors. If the optimum price happens to be lower than the competition's price (because the difference is more than made up for in volume), then you would be a fool to charge more. Following the herd is not the smart thing to do if you can increase profits by lowering your price.
Now let's say that starts to happen more frequently to the level of five transactions EVERY MONTH and it starts affecting not only you, but practically every competitor out there within the city. If a problem exists that affects more frequently and that hits across an entire market, then there's no need to undercut the other guy to keep your market share,
You don't counter skimming by replacing equipment with new equipment that also has the same vulnerability, and also introduces more vulnerabilities. Creating more fraud opportunities without even controlling the past ones is just a recipe for disaster.
#175
Ambassador, Hong Kong and Macau
Join Date: May 2009
Location: HKG
Programs: Non-top tier Asia Miles member
Posts: 19,671
You don't counter skimming by replacing equipment with new equipment that also has the same vulnerability, and also introduces more vulnerabilities. Creating more fraud opportunities without even controlling the past ones is just a recipe for disaster.
#176
Join Date: Jul 2007
Posts: 1,762
We always come up with the same questions but no answers......let us assume for a second that chip and pin is not inherently less susceptible to fraud (I don't agree but okay). Let us assume something better will become available in 10 years. Where Gary has no answer remains what I said a couple of days ago.
What does Gary want to tell those of us who travel today, not 5 years from now, who are increasingly finding it difficult to carry out routine transactions with the non chip American credit cards? His solution seems to be, use cash. I find that overwhelmingly inconvenient and not a good way to travel in the 21st century. Using a credit card sometimes gives me an advantage say in a dispute over shoddy merchandise or unreceived services. The issuance of chip and pin cards does not mean the entire payment system has to be changed.
As I've said, at least for the time being, chip and pin is the norm throughout most of the civilized and even uncivilized world, well at least chip. The problem is only growing worse by the day. A minor inconvenience today. A year from now a major inconvenience and perhaps while Rome burns, the banks fiddle and before we know it, Americans won't be able to use their credit cards anywhere in Europe, Japan, Canada. Is that you want? Is that what visa/mc want?
The issuance of chip and pin cards will not delay the development of more secure payment systems. Why do we continue to argue this?
What does Gary want to tell those of us who travel today, not 5 years from now, who are increasingly finding it difficult to carry out routine transactions with the non chip American credit cards? His solution seems to be, use cash. I find that overwhelmingly inconvenient and not a good way to travel in the 21st century. Using a credit card sometimes gives me an advantage say in a dispute over shoddy merchandise or unreceived services. The issuance of chip and pin cards does not mean the entire payment system has to be changed.
As I've said, at least for the time being, chip and pin is the norm throughout most of the civilized and even uncivilized world, well at least chip. The problem is only growing worse by the day. A minor inconvenience today. A year from now a major inconvenience and perhaps while Rome burns, the banks fiddle and before we know it, Americans won't be able to use their credit cards anywhere in Europe, Japan, Canada. Is that you want? Is that what visa/mc want?
The issuance of chip and pin cards will not delay the development of more secure payment systems. Why do we continue to argue this?
#177
Join Date: Aug 2008
Programs: HHonors Gold, Marriott Lifetime Gold, IHG Gold, OZ*G, AA Gold, AS MVP
Posts: 1,874
The thing is, he's arguing that "the market" has decided that such technologies are uneconomical, and thus not worth adopting. Most people here are onboard with getting merchants and issuers alike to take on EMV (if not +PIN, then at least +Sign). He's stuck in the magstripe age, insisting that issuance should be performed on the banks' schedule. Which means waiting for who knows how long or applying for a Canadian card (assuming I want one with no annual fee).
#178
Join Date: Aug 2010
Posts: 286
Instead of inventing obscure situations, who's to say that the suppliers prices are above $2 anyway? The retail market and wholesale market are different markets. The retailer selling fuel for $2/gal could have a cheaper supplier than the competition, or they could be manufacturing their own product. My premise did not impose any particular cause for the price difference -- nor need it. My premise doesn't require all retailers to have the same source, and also have the same price at that source. Even if they have the same source, price can still differ if volume differs.
Although what you propose still leaves room for debate because it replaces old vulnerabilities with new ones, and we're speculating that the new ones are lesser. Moreover, the skimming vulnerability is only countered if the insertion only penetrates the device enough to read the chip (if it were to take the full length of the card, the magstripe could still be skimmed while the chip is accessed). And such an attempt at an old exploit would generally work because consumers don't think that critically enough to notice.
Even more secure yet would be to use a wired terminal to process a pure EMV card (that is, with no magstripe on the card). And it would impose no critical thinking or street wisdom on the consumer.
Last edited by garyschmitt; Nov 25, 2011 at 10:40 am
#179
Ambassador, Hong Kong and Macau
Join Date: May 2009
Location: HKG
Programs: Non-top tier Asia Miles member
Posts: 19,671
I have no idea what the cost of introducing EMV in the US is compared to the annual losses to fraud, but given the US is one of the last adopters of EMV, the probable result is a profit.
Also this change has to happen nationally - but I don't see this being so difficult if Visa and Mastercard organise banks to do this.
Indeed. If you want to advocate something that is less vulnerable to fraud, cash-only would do that because risk of counterfeit bills is much less. Cost is lower, but market share is negatively influenced by the lack of payment acceptance. It's common in Europe for small retailers to take the cash-only route to reduce cost.
I don't see acceptance of cash as an issue being inferior to cards except for unmanned kiosks. But I understand the US has no such kiosks anyway - they're in Europe.
[QUOTE=garyschmitt;17513533]Indeed, but now you're talking something different than jeffjaguar, who proposed following a waitress to the terminal to witness the swiping action. What you describe is not merely portability, but rather a combination of changes that would likely enhance security (if implemented correctly).
Although what you propose still leaves room for debate because it replaces old vulnerabilities with new ones, and we're speculating that the new ones are lesser. Moreover, the skimming vulnerability is only countered if the insertion only penetrates the device enough to read the chip (if it were to take the full length of the card, the magstripe could still be skimmed while the chip is accessed). And such an attempt at an old exploit would generally work because consumers don't think that critically enough to notice.
We've taxis over here who take Visa (very few). The first batch of terminals weren't reliable. Some cabbies try to make my EMV chip + magstripe Visa card (Visas only, or cash) work by magstripe when the EMV chip processing failed. The terminal tells them every time to use the chip instead, because mine is an EMV card.
EMV even over unsecured wireless is better cos each time the terminal generates a fresh request and the chip is needed to send the right response to the request back to the issuer for authorising payment.
#180
Join Date: Aug 2010
Posts: 286
I don't own that solution. The cash payment solution is a reality of consuming Europe. You may think carrying cash and counting coins is inconvenient, but it's not as inconvenient as discovering that you've just dined in a cash-only restaurant, and all you have is plastic, in which case you have to make a dash for the ATM, and perhaps leave collateral while you do so. Or even discovering it's a no-plastic resto in advance, and deciding to walk out.
The magstripe has orders of magnitude higher acceptance than chip and pin.