Originally Posted by
bullfrog
So I took the card to two different ATMs (one BofA, one a random credit union) and took cash advances. Unsurprisingly the CVM list on the card has not changed.
This is actually the second replacement card. After the fraud, and I called and asked for the replacement to be expedited. When I got that card and saw it wasn't PIN-priority, I called back and explained that I'd gotten a signature-preferring card. The CSR assured me that my card is PIN-preferring. I tried to explain that it isn't, but of course the CSR doesn't know about CVM lists. I asked her if she sent me a new replacement, could she assure me that it would be PIN-priority? She said she could, and she sent out a replacement card. That second replacement was exactly the same as the first, with the CVM list I posted previously.
I'm not sure if they're just having production issues there or if they have deliberately decided to eliminate support for PIN-priority cards. The CSR swore to me that they do still support PIN-priority. What's odd is that there is definitely a PIN stored on the ICC, and it's the right one. There's just no CVM in the list that would ever use it.
I'm going to try writing them a secure email and see if I can get in touch with someone who might be a bit more technically knowledgeable than a standard CSR.
Is it possible that those ATMs are using Quick Chip? (It is technically allowable but I would think it'd be less "necessary" at ATMs vs. for normal transactions.) I did notice during PIN change transaction testing with Revolut and my local CU's ATMs that the card seemed to show several transactions in the transaction log with "2" at the beginning of the CVR (the usual indication of QC) but I'm not sure what happens at those ATMs with normal withdrawals/balance inquiries.
Also, there's a possibility
Originally Posted by
bullfrog
I understand that contactless is practically universal at this point too; does anyone have a sense if that applies to unattended kiosks as well?
In the UK at least it wasn't universal at unattended terminals back in 2017 but it was common enough that it was easy to avoid those. I imagine it's better now.