garyschmitt

Why do you think it makes more sense to align with Europe over Asia? And moreover, why do you think chip-sig would be problematic? There have already been reports posted of what happens when chip-sig is used in a chip-pin region -- it works. The machine asks for confirmation w/out pin, and a receipt to sign is printed.

In principle, it's a poor approach to disregard the technology and law aspects, and simply follow what the next guy is doing. Chip-pin has less protection to US cardholders. Chip-sig works in both Europe and Asia, and has the legal protection of a signature (legally forcing the bank to prove a signature match in fraud cases, where a PIN match is trivial to prove)

percysmith

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3)

I've been trying to work out whether my Australian Chip and PIN works in UK if I had to use it on unmanned terminals. The response I've got was "contact UK merchant". F U! The whole point of asking about Chip and PIN was that there's *no* human merchant! if there's a human merchant manning the terminal then Chip and Sign will be possible.

Anyway I'm not supporting turning over my USD50,000 credit limit on certain cards over to PIN control so some European merchant can sack some metro ticket seller or gas station part-time student. If they think it's so unimportant then perhaps they should make it PIN-free (as in Paywave or STT) and absorb the risk of chargeback.

A signature is only a small bit of merchant due diligence when accepting credit cards. it represents more than 130 years of bills of exchanges common law about investigating the bona fides of a purported customer before accepting the manuscript signature - whether you know the customer, have you checked his ID, is he buying something readily resellable, do you have the customer on CCTV etc and yes, whether the signature matches the back of the card. A PIN absolves 130 years of common law with one stroke - or one keypad if you like.

Even ATM doesn't scare me the much - all my banks limit me to less than US$3,000 withdrawals a day (bigger withdrawals need counter service), and ATM terminals on the whole are more secure from tampering and shoulder surfing than retail chip and pin terminals.

jamar

Asia includes Japan, which is Chip+PIN. While manned merchants are equipped for Chip+Sign, unmanned terminals... aren't. For example, the train ticket terminals take magstripe+PIN or most chip+PIN (Canadian Chip+PIN debit failed), but there must be a PIN somewhere. It also must be four digits, which frustrated me when I had a Chinese JCB card with a six-digit PIN.

Referring back to Japan, the two times I had to stand in line and wait for a manned ticket counter at Shin-Osaka and Osaka station... six people working, still had to wait half an hour in line to get a ticket. Sometimes it isn't about sacking people, it's just a matter of too many customers.

It was only after that I discovered the Aeon ATM (yes, yes, I know, finance company, kinda sketchy, but their ATMs in Japan support UnionPay and I decided I needed cash after that) hiding in a corner.

percysmith

If you have too many customers then the ticket agent should be kept in position!

And their ticketing system might need a rewrite too by the sound of things. Or more online ticketing options.


Speaking of train ticket queues, have you ever try Unionpay Quickpass (闪付) in Mainland China http://corporate.unionpay.com/infone..._87029830.html ? No PIN or sign there, but I suppose there're transaction limits (PIN and sign everything else). Its really copycat Visa Paypass isn't it?

Has anyone rolled it out?
I saw it in Shanghai Metro last Oct, but I think it was a snack vending machine rather than ticket vending. Has ticket vending been moved to Quickpay yet?
And China Railways? Would make buying a ticket much more civilised.

jamar

Ah yes, QuickPass. BankComm gave me an ATM card with it last year. No PIN, but as with all transactions in mainland China, signature is still required. Also, different from PayPass in that it's separate from the bank account, and there's a total deposit limit of 1000RMB in the QuickPass account. And there's no automatic top-up mechanism; must head to the ATM to reload when the QuickPass account runs dry (and this requires the PIN). All in the name of protection, I suppose, but costs it a bit in convenience.

As for which merchants accept it, pretty much every UnionPay merchant here in Shanghai is able to take it using the EMV chip (convincing them to run it with the chip, however, is another issue entirely). China Railways only accepts it at the ticket desk (too many people, but worse than Japan by a factor of 10- over 20 ticket agents and it STILL takes over half an hour to get a ticket- when will someone see sense and allow foreigners to use the automatic machines again?), however. Automatic ticket machines are cash only (and, of course, you need Chinese ID).

Contactless is more hit-and-miss (some vending machines are poorly maintained because paying by QuickPass requires the vending machine to give you a 40% discount on what you're buying, and the people maintaining it don't like that- though that begs the question of why they agreed to it in the first place).

percysmith

Quickpass - you sure they agreed - or were they forced to install it against their will (dictate of the local SAIC or Big4 bank)?

We had a trial run of Visa taxis in HK last year.
Historically, cabbies have insisted on cash and resisted moves to go on Octopus or Visa lest the taxman comes knocking.
The merchant bank (Dah Sing) gave a 20% discount to cardholders for using Visa taxis out of pocket for 2011.
But as soon as that ceased all the terminals were all torn out and the cabbies went back to their black market ways.

Quickpass with signature's spastic - what's "quick" about it then? Merchant still has to print and file the signed card slip.

The idea was no signature, no merchant copy - or is this Paywave with Chinese characteristics again?

We in HK haven't had a chance to get them yet - but BoCHK's promised they're coming http://www.hongkongcard.com/forum/fo...hp?id=7285&p=1

jamar

1- no clue, but the BankComm logo on some of the vending machines indicates that either they forced it or they're paying out of pocket. More likely the former if the vending machine operators aren't motivated to fix broken contactless readers.

2- Spastic? Yeah. The only thing "quick" about it is that authorization occurs offline, saving a few seconds at best (and the time saved is replaced with the merchant having to select "QuickPass A/C" or "Bank A/C" on the terminal). "PayWave with Chinese characteristics" would be the best way to describe it.

(also, the ads on the linked page really make me wish I could apply for CCs in Hong Kong.)

garyschmitt

It's not an issue. E.g. use a magstripe at the London Underground. No pin or sig required.

Moreover, in the obscure case of an unmanned merchant having large enough transactions to need authentication, a PIN can always be associated with the magstripe and verified over the network. In fact this is how magstripe cards work in ATMs.

In that case you just enter all zeros.

jamar

I'm talking about ticket machines in Japan. JR West not being the Tube, they actually check for a PIN, even on magstripe cards.

Tried my Schwab Visa and ATM PIN, it failed all the same. So seems it also must be credit. Or something else is wrong.


And this returned an error of "Check your PIN and try again". Tt returned that error instantly so I assume it checks offline for an all-zero input and blocks it.

kebosabi

Except in this case, it means that if this person had a Chip-and-PIN card, he could have used the automated machine and wouldn't have wasted half an hour of his life standing in line and missing several trains because of this.

percysmith

Provided he has a PIN card and others don't.

If all of them have PIN cards then the manned/unmanned queues will balance. It'll be like HKIA, where the manned HK residents' arrival counter (there are only one or two per immigration sub-hall nowadays) has a longer queue than the HK residents' e-channel (there'll be 8-10 per sub-hall).

The queue for the manned counter will be longer, but the queuing and processing time is frequently shorter. For the same amount of floor space, the manned counters beat the e-channels hands down.

jamar

Well, certain types of Chip+PIN card. The Chip+PIN CIBC Visa Debit card failed as well as my magstripe+PIN Schwab Visa Debit. And a look at my CC slips shows that Visa Debit and Visa Credit are different EMV applications, so a logical conclusion might be that those machines seem to reject debit cards entirely. Which creates a new problem.

garyschmitt

I replied to your general claim that unmanned terminals can't do Chip+Sign. They can.

You will always find broken machines for all possible payment methods for various reasons. This is an implementation issue, not engineering design issue. The London Underground is proof of that.
Again, you're pointing to a broken implementation, and concluding from that that the technology doesn't work. ATMs can in fact accept a PIN to authenticate a magstripe. There is no technological infeasibility to speak of.
Yet another broken machine. A proper machine will allow for 6 digits. But even if it's poorly designed with a 4 digit limit, it will revert to signature if properly configured.

percysmith

How can unmanned terminal do Chip + Sign? Digitally compare the signature to the signature at your issuer bank? Can Visanet exchange signature data?


Credit cards having PINs for ATM does not make them Chip + PIN.

HK's chip and sign cards all have PINs for cash advances. However no bank has put in a Verification Method List with PIN authentication allowed.

Not that the banks don't know how to do it - do you think HSBC doesn't know how to issue Chip and PIN cards in HK after being a Big 4 UK bank?

But probably cos it can't - the Monetary Authority here hasn't authorised it. Banks are restricted to Small Ticket Transaction if eligible, Paywave for below HK$500 (US$64), Magstripe and Sign or Chip and Sign.

jamar

1- In this specific case (JR West ticket machines), these machines do accept some magstripe+PIN (AmEx Japan says that its magstripe-only cards will work in all JR ticket machines as long as a PIN has been set) but not cards with only a normal cash-advance/ATM PIN (my Schwab debit, for one), meaning that there's something that has to be done at the issuer's end, not the merchant's end.

2- "Proper" machines by that definition are not very easy to find. At least my experience with my magstripe+PIN+Sign UnionPay credit card has taught me such- but that's another issue entirely. Though I'm curious as to how you think a ticket machine with no reference to look up (neither Chase, Barclays US, nor Citi US have required me to leave a signature sample with them) and no way to input a signature for record-keeping could "revert" to signature. Say I buy a train ticket and don't feel like paying for it. If I were to ask for a chargeback, the issuing bank would discover that JR West has no corroborating evidence to show that I used that card at that time. The liability hole is so massive that I can't imagine it being the "proper" configuration.

I'm kind of surprised that the PRC hasn't "harmonized" HK into using the same rules it does (magstripe/chip+PIN+Sign).