Go Back  FlyerTalk Forums > Miles&Points > Credit, Debit and Prepaid Card Programs > Credit Card Programs
Reload this Page >

USA EMV cards: Availability, Q&A (Chip & PIN -or- Chip & Signature) [2012-2015]

Community
Wiki Posts
Search
Old Sep 20, 2013, 11:40 am
FlyerTalk Forums Expert How-Tos and Guides
Last edit by: philemer
Posts from 1/1/16 onward can be found here: http://www.flyertalk.com/forum/credit-card-programs/1739359-2016-onward-usa-emv-cards-availability-q-chip-pin-signature.html

EMV wikipost volunteers: kebosabi

What is EMV?
EMV is a defacto global standard of technology where there is a visible microchip on the front of the card. It looks like this:

Who issues them?
See Google Docs spreadsheet in Post #1

SFOAMS also has created a list of excellent webpage that shows US EMV cards in a more interactive interface

Another site, which lets you narrow the search for an EMV card by various parameters, is http://www.spotterswiki.com/emv/index.php.

Several credit unions issue some form of Chip-and-PIN credit cards or prepaid cards. Prepaid EMV cards however are not recommended due to junk fees. USAA (currently restricted to members of military) used to offer Chip-and-PIN cards, but as late has backtracked to Chip-and-Signature priority.

Hey that's a cool Google Docs list! I know others that aren't on that list. How can I help by adding them to the list?
My bad for not putting this into the wiki sooner. Right now, the Google Docs is locked out of editing and only in "read-only" view because there were instances in the past where people would just delete the rows not thinking that it affects others viewing the list.

If you promise not to delete any rows and input all the pertinent info (annual fee, rewards, FTF, etc.), I can provide you with edit access. Just shoot me a PM to kebosabi with your gmail address and I'll provide you edit access.

Thanks for helping out!


As of October 2014, no USA-based card issuer offers Chip-and-PIN priority cards except for BMO Harris (Diners Club) and UN Federal Credit Union. Other major USA-based banks such as BofA, Chase, Citi, as well as others issue Chip-and-Signature cards which may work at many automated kiosks. However, bear in mind the word may is used above is a context where there is no absolute certainty of success for certain environments such as automated kiosks due to different natures of offline and online transactions. It is highly recommended to read Post #3 which lists real life FTer examples on how Chip-and-Signature worked and did not work at various transaction environments.

Can I upgrade it right now?
If it's listed on that Google Docs spreadsheet or SFOAMS' Silk page, wouldn't hurt to call/twitter them for a free upgrade. If you get the response you don't like, hang up, try again.

What is the difference between Chip-and-Signature and Chip-and-PIN?
You insert the chipped card into the slot. The physical contact terminal will read the EMV chip and the terminal will automatically read the preferred cardholder verification methods (called CVM) for that card.

Chip-and-Signature means that the terminal will printout a receipt for you to sign. This is the most prevalent authentication for most US issued EMV cards. Chip-and-Signature helps in a way that it will get through to face-to-face merchant transactions where you and the merchant do not speak the same language.

Chip-and-PIN means that the terminal will prompt you to input a PIN for authentication. Some credit union issued credit cards will have this CVM as secondary if Chip-and-Signature cannot be done. Chip-and-PIN is the more prevalent method of authentication used outside the US, especially in transaction environments where no human interaction is needed (i.e. automated gas pumps, toll roads, train kiosks, etc.).

The Google Docs spreadsheet will list which CVM are used in the EMV cards listed. Some cards can only do Chip-and-Signature. Other cards can do both Chip-and-Signature and Chip-and-PIN. And others might have a third option called No CVM (no authentication needed) which is reserved for low value transactions.

One chip can hold a lot more data, therefore it is capable of doing multiple verification methods. That's one of the great things about EMV over the mag-stripe which can hold very little data.

I want to know for sure what my EMV chip does. Is there anyway I can test out my own EMV card to see what the CVM list is?
alexmt has written up a nice step-by-step procedure on Post #3615.

If most of the EMV cards in the US is the Chip-and-Signature type, doesn't that mean it's still useless abroad?
Depends if you see it as glass half empty or glass half full. See Post #3 for further details on how Chip-and-Signature has worked both successfully and unsuccessfully depending on the merchant transaction environment and use your best judgment whether which one is right for you.

Are there any places in the US that are accepting transactions via the EMV chip?
tmiw has created a dedicated Google maps webpage to show where EMV has been proven to work here: http://emvacceptedhere.com/ Per his Post #4240, feel free to add any places with active EMV terminals if you come across one.

As of 2014/05, the EMV terminals in most Walmarts and Sam's Clubs are being turned on. Hence, the best place to try them out would be your local Walmart or Sam's Club. For other merchants, it's slowly being phased in.

I hope people will post them in the Post your receipt of your 1st EMV based transaction in the US thread. cvarming has shown us an EMV transaction receipt from Brooklyn, NY in Post #2380. I myself had my first EMV based (Chip-and-Signature) transaction in two stores in the Los Angeles area, as shown in detail in Post #2705 (courtesy of WhatWhatTech for pointing these two stores out)

I don't want a chip in my card. I heard horror stories all over the media saying hackers can steal my credit card info from a mile away.
There are two types of chips. One is contactless and the other is contact. Cards can be either one or the other, or both.

In the Google Docs spreadsheet, the cards that are capable of contactless payments are listed seperately under the "RFID or NFC contactless chip" column. If it says yes, then that means it has the ability to do contactless payments. If it says no, it doesn't have that feature.

The one that the media has overhyped about hackers "stealing your information wirelessly" was the contactless type like this:

You are worried about this happening, right?

You don't have to worry. EMV is a chip standard that can have both contact and contactless interfaces. With the traditional contact interface, this means you actually have to physically insert the chip into a POS terminal for it to be authorized, like this:

With the contact interface, nothing is wireless. No data is sent out in a stand-alone contact type EMV chip. With the EMV contactless interface, data is sent wirelessly.

Furthermore, contactless chip cards are required to show a symbol (looks like Wi-Fi symbol) somewhere on the card that to denote it's capability as a contactless card. For example, here's an example of a Discover Card with contactless capability (in which Discover calls "Discover ZIP") showing the contactless symbol on the back of the card:

Don't believe everything that the media says. Besides, millions of people all over the world from London to Singapore, uses contactless payments daily in extremely crowded subways and mass transit with nary any problems. There are multiple layers of encrypted securities and keys that are needed to break the code.

Frankly, giving your physical card to a waiter/waitress who takes the card out of your view is much more susceptible to fraud than contactless payments.

Why should I care?
If you are an international traveler, you will want this because majority of the world has or in the process of converting to this payment format.


In fact, in 2012, even North Korea moved to the EMV format, leaving the US as one of the countries in the world that hasn't done so.

In addition, VISA, MC, AMEX, and Discover have all agreed to incentivize the USA shifting to EMV payments by 2015 by shifting liability for fraudulent transactions to merchants if they do not have EMV equipment and the cardholder has an EMV card. So if you travel internationally or would like to get one before the others, you might be interested in getting one.


BS! I had no problems using my card in [insert whereever country], [insert whatever point in time]
If you stick to the tourist path where they have lots of visitors from the US, you should have no problems using your mag-stripe only card in hotels and restaurants, at least for now. But as things can change as things go forward.

However, consider that once you start taking the off-beaten path, go to non-touristy places where they are not familiar with mag-stripes, rent a car and use toll roads, fill up gas, or try to buy train tickets you might end up into a trouble of the machine not recognizing your card because it lacks the chip. Furthermore, a lot of toll roads, gas pumps, and automated ticket machines lack any human assistance to help you when you need it the most.

But [insert credit card company] told me all merchants that display their logo must accept them! All I have to do is report them for violating their agreements, right?
There are several factors against this.

1. You can only speak English. The merchant representative, most likely a part-time clerk earning minimum wage, speaks in a different language, let's say French. If you have no French language skills, how are you going to get your point across? Are you going to whip out your cell phone at exorbitant int'l roaming charges and hope the customer service is going to translate it for you on the spot? Or maybe you might actually know French. But how about Swahili, Farsi, Balinese, or the multiple languages in mainland China?

2. Just like US, the rest of the world's businesses uses part-time minimum wage workers as cashiers to cut down on labor costs. Most of their SOP training manuals are written by MBA types to not to do anything they are not familiar with. Do not expect them to understand the intricate details of credit card mumbo jumbo. You don't expect Taco Bell employees to understand the minute details of Discover-JCB-Union Pay agreements, right? Same thing the other way around: be respectful as a guest in their country, prepare in advance in their ways, avoid being an "ugly American" stereotype.

3. You are a guest in their country. You are a minority. If 99.9% of their country's people and other tourists from around the world uses EMV, do you really think they are going to accomodate the 0.1% of American tourists who only have mag-stripes credit cards?

4. Again, you are a guest in their country. How would you, as an American standing in line, react if a Chinese tourist was clogging up the lines at a local Taco Bell because the clerk doesn't understand the Discover-Union Pay agreement and has trouble communicating between Mandarin spoken by the tourist and English spoken by the Taco Bell clerk? Same way the other way around. You do not want to clog up the lines for everyone. The less hassle, the better.

5. VISA and MC make tons of money from merchants in that country. Say SNCF French Rail. It's a billion dollar company in France. Do you think VISA is going to pull the plug of their relationship with SNCF because SNCF refuses to do mag-stripe processing at their unmanned train station kiosk? Of course not. Be realistic.

6. And lastly, if you're up against an unstaffed toll kiosk, gas pump or train ticket machine, are you going to yell curses at the machine?

But I want my credit card to be able to be used in the US too!
No worries. They have not gotten rid of the mag-stripe on the back of the card for backward compatibility reasons, just like we still have embossed numbers on our cards for backwards compatibility to using those old carbon copy imprinters.

[insert own Hyatt card image front and back together with red arrows pointing to all the backward compatibility features]

You use the chip on the front of the card abroad (for now), and the mag-stripe just like any other card for the US. Basically, you're increasing your credit card's acceptance rate by getting a card that both via the chip and the mag-stripe. You're getting a better deal for free.

And when 2015 comes along and US switches to EMV, you'll be way ahead of everyone else too!


So why did the rest of the world and the US moved/moving toward EMV?
Primarily, due to fraud concerns. You see, the mag-stripe has been with us since the 1950s. It may have been the most high tech thing back in the day, but with the technology that is available today, any shmo can pick up a $100 USB magnetic card skimming device off of eBay and get your credit card info.

And unlike skimming off contactless cards which actually need the person to have l33t programming skills, skimming off a magnetic stripe has become so ubiquitous that nary a day goes about skimming fraud going on somewhere in America, from gas pumps, Michael's stores (2011), Target breaches (2013), restaurant waiters/waitresses, to even McDonald's drive thrus.

https://www.google.com/search?q=skimming+fraud

These type of fraud used to be prevalent in Europe. But once they started switching over to EMV starting over 2 decades ago, this type of fraud went elsewhere. It went over to Asia, Canada and Mexico, Latin America, etc. etc. until they too began implementing EMV to combat skimming fraud. The US is practically the only country left that hasn't done so, therefore all the fraud that used to take place elsewhere is now happening here.


But EMV is old and it's not fool proof. Shouldn't we just skip over it and do something new instead?
Yes, EMV is old. It was developed in the 1990s and its smart card payment predecessor was first introduced in France. But as of today, it has become the defacto global standard of payments.

But then, what else is there? There is no other de facto global standard of payments alternative. For example, if we decide to skip over it and do something new, hypothetically like DNA matching technology, it still means US int'l travelers will continue to have problems abroad with useless plastic acceptance because no other country is using this DNA matching technology except the US.

Besides, nothing is fool proof. You can say that the bank vault isn't fool proof because you can crack it open if enough C4 is used. But your average low-life scumbag isn't likely to get military grade C4 easily either. But the bank vault does make it harder to get the bank's money over say a petty cash box. That's the point here. EMV is akin to a security tight bank vault, the old mag-stripe is akin to a petty cash box lying around inside the drawer.


I'm a business owner and I don't think EMV is going to take off. I'm not going to spend extra hundreds of dollars to upgrade my credit card machine. Convince me other wise why I should.
I can understand the added extra cost to your business once this switchover takes place. But before even saying that, look at your existing POS terminal. Does it have a slot somewhere to insert a card?

Most likely, if you had replaced your POS terminal within the past five years, you already have an EMV capable terminal. EMV is basically just not turned on yet from the processor and acquirer side.

If you have an EMV capable terminal, then a best bet would be to contact your acquirer to have the EMV feature turned on. You did your end of the deal already by having an EMV capable terminal, it is now the acquirers' responsibility to turn it on in accordance to the EMV switchover mandate.

And if you don't, you are going to replace your POS terminal anyway from common wear and tear. It isn't a hard switch-over. You can continue to use your POS terminal until it dies out because EMV cardholders will still have the mag-stripe on the back. And by the time your non-EMV capable POS terminal is up for replacement the market will be full with these newer POS terminals that can accept the mag-stripe, EMV, as well as contactless payments.

In addition, you may also want to check with your acquirer or processor about EMV capable terminals. Some of them are willing to replace your terminal for free in preparation for the US EMV switchover. Call and ask for details.


But what's in it for me? I'm the one that has to pay for the upgrade.
All the major card networks have given incentives for merchants for the upcoming EMV switchover.

If 75% or more of your credit card transactions are done on an EMV contact and contactless terminal, they are going to waive your annual PCI-DSS fees, which usually costs you around $5.00-$19.95/month per terminal. The overall long term cost savings of those compliance fees will be larger than the cost of an one time upgrade for the terminal.

The downside is that once EMV switchover happens and if you do not have a POS terminal that is able to accept EMV, the fraud liability shifts over to the merchant.

I own several fast food franchises. If I upgrade my POS terminals at all of my restaurants, it's going to cost me thousands, if not millions. I don't think anyone is going to use a fake credit card to buy $5 burgers. And if they do, wouldn't it be cheaper for me to eat the fraud cost?
Remember also that fraud isn't just committed by dishonest customers using fraudulent cards. Fraud can also happen with dishonest employees skimming off credit card data from the mag-stripe as in the case of a teenage McDonald's drive thru employee skimming off $13,000 of customers' credit cards in Olympia, WA. Consider the public relations fall out that your business may have if this happens (i.e. the big Target breach of 2013, where someone used a mag stripe card to load malware INTO Target's system). Is it worth risking to take such a huge PR disaster?
Print Wikipost

USA EMV cards: Availability, Q&A (Chip & PIN -or- Chip & Signature) [2012-2015]

Thread Tools
 
Search this Thread
 
Old Sep 26, 2015, 9:16 pm
  #13621  
FlyerTalk Evangelist
 
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,508
Originally Posted by storewanderer
These merchant processors who cannot process EMV should still be on the hook for any fraud at the merchant locations where the cards are processed until they have Chip equipment available for the merchants. Some of these Visa/MasterCard rules are at the processor level and I while I don't fully know the ins and outs of the liability shift legal language I think some of the responsibility lies on the processor too.

It is the processors who pay the cost of fraud anyway (not Visa/MasterCard). So if I am a processor and know that effective October 1, I am no longer on the hook for fraud if my processing customers don't have Chip terminals, but I do not provide my processing customers with the ability to obtain Chip terminals as of October 1, it appears I am not acting in good faith as a processor and I am attempting to malevolently shift fraud liability to my customers rather than covering it myself which is supposed to be part of the deal with card processing... I see some lawsuits coming out of this.
My understanding is that the merchant's acquirer gets liability after 10/1, and depending on their policies may pass it onto the merchant. That's why Square is assuming liability for those who've preordered the EMV reader, for instance. If a magstripe only card was swiped or a chip card inserted, the card's issuer assumes liability.

Originally Posted by scibot
That doesn't seem to say more than what we've already know, right?
tmiw is offline  
Old Sep 26, 2015, 11:15 pm
  #13622  
Moderator: Manufactured Spending
 
Join Date: Jul 2011
Posts: 6,580
Originally Posted by MrTemporal
I don't buy this argument. Somehow virtually all the Europeans and Canadians I know seem to be able to remember their pin. Americans are not stupider than others, nor do we have poorer memories.
I think the issue is that it would be a competitive disadvantage. In Canada and Europe, all credit cards require a PIN, so people have no choice but to remember their PINs. However, in the US, if some banks required a PIN and others didn't, people would prefer to use the card from the signature-preferring banks. No bank wants to go first and lose customers.

Originally Posted by sdsearch
You apparently missed my post of a few months ago about my experience on an LAX FlyAway Bus (where the $10 fee is only payable by card on the bus) which had just switched to a portable terminal that was EMV enabled, and the driver complains at one point "if you have a card with a PIN, please know what your PIN is!". So this happened in fact, no just theory.
Are you sure he wasn't referring to PINs for debit cards run in "debit" mode? The Flyaway website still says they do not accept "chip and PIN", but that probably needs to be updated.


Originally Posted by joshwex90
BTW, just an interesting anecdote I witnessed at EWR...

French guy checking out takes his credit card and inserts it. Nothing happens and he patiently waits. Salesperson tells him he has to swipe. He seems very confused and asks about the chip reader. She says "it doesn't work; you need to swipe your card," telling him as if he's an idiot for trying to insert the card.

He looks at the card and keeps flipping it around, etc. He gives up and has her swipe it for her, and she has to walk around to swipe for him.

He then waits to enter a PIN, but the receipt prints. He asks, "what about my PIN?" She asks, "did you use a debit card or a credit card?" He says, "what?"

At this point, I step in to try and explain the confusion on both sides. He walks out, muttering about incompetent American stores and she's complaining to me about idiotic tourists.

And I rolled my eyes at both
I would think that someone who worked at a major international airport would be familiar with this kind of thing. Equally, I would think that someone traveling internationally would be familiar with this kind of thing.

France was one of the first countries to implement EMV in the 1990s, so I guess the first batch of people in the world who had no experience with mag stripes are now coming of age just as the last remaining countries are switching over.
cbn42 is offline  
Old Sep 26, 2015, 11:59 pm
  #13623  
FlyerTalk Evangelist
 
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,508
Originally Posted by cbn42
I think the issue is that it would be a competitive disadvantage. In Canada and Europe, all credit cards require a PIN, so people have no choice but to remember their PINs. However, in the US, if some banks required a PIN and others didn't, people would prefer to use the card from the signature-preferring banks. No bank wants to go first and lose customers.
While true, Visa and MC could have mandated PIN preference on all US cards if they wanted. Instead, issuers got almost no guidance and they all chose the least difficult option.

I actually think no one really wanted to do EMV. Not the retailers, not the banks and not Visa/MC US. They all were kinda forced to do it when the latter really wanted the US to skip straight to NFC and tokenization instead. The retailers figured that if they were being forced to move to EMV, we might as well adopt everything; hence the complaining from the NRF about signature preference. The banks and Visa/MC needed to fix the most immediate problems while still wanting to go away from inserting and swiping cards completely, so they implemented (mostly) online only, signature only cards as the most cost effective option to buy time, with some exceptions geared towards foreign travelers who immediately needed a solution that worked in kiosks.

And since they were all forced into doing it, everything's rushed. So now there's a chance that NFC acceptance still won't be common for years* if ever, and we might not be able to adopt PIN preference in the future without making merchants replace stuff again. In short, everyone's unhappy as a result.

* For the reasons hashed out before, mainly the extensive use of integrated systems, poor training meaning that small businesses won't/can't run NFC transactions even if it's switched on in their terminals, etc.
tmiw is offline  
Old Sep 27, 2015, 12:11 am
  #13624  
 
Join Date: Mar 2011
Location: Window Seat
Programs: National Executive, HHonors Gold, IHG Platinum, Hyatt Visitor
Posts: 2,495
So Kohls is definitely on its way to NFC/EMV. I was in tonight. As the transaction is going, the screen just says swipe card like always.

However once the cashier totals and presses pinpad tender, then the system showing tap/swipe and I tried to tap NFC AmEx and it read the tap. Then the system went to another screen and it said insert/swipe card. I tapped again and it read again and then asked me to select credit or debit. I pressed credit. The system tried to process the tap but it would not process, it said cannot process.

So I re-tried that a couple times and it still did not work.

Then I tried to insert the card and that time nothing happened at all, despite the screen saying swipe/insert.

The employees said the system was updating and would be updated by October 1 to accept both tap or insert.
storewanderer is offline  
Old Sep 27, 2015, 12:48 am
  #13625  
Suspended
 
Join Date: Oct 2004
Location: Bay Area
Programs: DL SM, UA MP.
Posts: 12,729
Used my Schwab debit at a Sicilian local bank ATM in Taormina. Thing looked old and I believe the slot was motorized. I didn't have to push in in all the way.

Thought that it was motorized to swipe through.

But on the receipt it said chip processed transaction.

Couple nights later I made another withdrawal at a Bank National de Paris ATM but this one didn't indicate it was chipped on the receipt.

The ATM looked the same as the one at the Sicilian bank, with a big alphabetic keyboard in the middle with the numeric keypad to the right. Only used the numeric keypad in both cases.

It was good to see that they've had chipped ATMs in Europe for awhile.
wco81 is offline  
Old Sep 27, 2015, 1:09 am
  #13626  
 
Join Date: Jul 2007
Posts: 1,762
tmiw...you are quite right. The banks and processors in this country given their choice in the matter would never have gone to emv. They were perfectly content to bop along with magnetic strips until something better that would handle the online fraud problem came along; something biometric probably.

After all, the banks are/were making humongous profits on their plastic card operations and eating the fraud was simply a small drop in the bucket as compared to what they were raking in. The fact that some of their customers were being inconvenienced was of small consequence to them; remember Capital One's solution to the problem. (Tell the merchant they are required to accept all valid mc/visa cards even if it means manually entering the numbers).

Somewhere along the line, they began to feel the pressure from foreign banks who could not eat the fraud losses emenating more and more from the United States as chip and pin had become the standard outside the USA but as long as the USA kept magnetic strips, they had to. And when data breaches occurred, their cards were just as susceptible to being cloned. Again the inconvenience being suffered by travelers was of small consequence to them. So where were they to turn? At some point it was becoming clear that fraud was increasing on card is present transactions, there was more and more screaming from their best customers of being unable to conveniently use their cards in more and more places and quite frankly emv was the only game in town despite all its imperfections.

They also, as all bankers do, feared the government getting involved and mandating something. So they were forced to go with emv but I still think they wanted to do it as cheaply as possible and still are looking for something better to come along. Going with signatures rather than pins, as I think you understand, is far cheaper in terms of infrastructure and may not like. They also came up with the idea of no cvm's for small purchases to speed things along. They also decided to be somewhat more aggressive in getting kiosks to honor the no cvm mandates. Again, we don't know here just how significant it is now at kiosks and the like. We do know that many places that once would not touch a non pin card with a 10 foot oop 3 meter pole now do so however reluctantly that might be. Whether it's 100%s a or 99.5% effective I don't know and can't answer.

Now if only, at least in my opinion, they can get merchants outside the USA to not waste time with signatures on small purchases their decision to go with signature preference becomes somewhat more tenable whether we like it here or not.

I also throw in one other thought which we have lost in our discussions here. USAA is a very progressive bank and we all know here they were one of the first on board with a "true" chip and pin card. After issuing pin preferred cards for over a year, something made them change to signature preferred with pin capabilities. Nobody here, despite some efforts, has ever been able to come up with a reason as to just why they did it. Also why would Citibank which issues millions of pin preferred cards outside the USA be so adamant that there was no need to issue cards with any pin capabilities inside the USA? Obviously the technology is there. Same holds for so many of our large banks which have the capabilities to issue pins via their foreign branches throughout the world. It is mind boggling that not a single large bank has gone in a pin preferred direction although, for example Citibank does issue pin preferred cards to US government employees because of their contract with the US government and even, I believe, Bank of America issues some pin preferred cards for corporate cards (correct me on this if I'm wrong).

The only conclusion I can reach is that the banks do have valid reasons, at least in their own mind, of defraying some of the costs of this conversion by sticking with signatures with full knowledge that signatures have no security value whatsoever while they seach for something that will also alleviate the problem with card not present transactions. I just don't see any further sense to investing further in the just as outdated emv technology while they search for something better.

Last edited by JEFFJAGUAR; Sep 27, 2015 at 1:24 am
JEFFJAGUAR is offline  
Old Sep 27, 2015, 1:12 am
  #13627  
Moderator: Manufactured Spending
 
Join Date: Jul 2011
Posts: 6,580
Originally Posted by tmiw
While true, Visa and MC could have mandated PIN preference on all US cards if they wanted. Instead, issuers got almost no guidance and they all chose the least difficult option.
I think there is a good chance that the US will move from signature to PIN several years from now, just as Australia did. The life cycle of hardware is not that long, so it shouldn't be too much of an issue.

Changing both the way of reading the card and the CVM together would have been too much for many people to handle. It sounds silly to people who travel internationally, but many Americans will just pay with cash if their credit card puts up too many barriers to use. Visa and MC have no doubt crunched the numbers on this.

Originally Posted by tmiw
I actually think no one really wanted to do EMV. Not the retailers, not the banks and not Visa/MC US. They all were kinda forced to do it when the latter really wanted the US to skip straight to NFC and tokenization instead. The retailers figured that if they were being forced to move to EMV, we might as well adopt everything; hence the complaining from the NRF about signature preference. The banks and Visa/MC needed to fix the most immediate problems while still wanting to go away from inserting and swiping cards completely, so they implemented (mostly) online only, signature only cards as the most cost effective option to buy time, with some exceptions geared towards foreign travelers who immediately needed a solution that worked in kiosks.
If no one wanted to do it, then why is it happening? There was no government mandate. There was a bit of a public outcry after Target and Home Depot, but that would have likely died down.

I think the problem is that NFC and tokenization are not picking up in the US. Visa PayWave and MC's Paypass never gained traction, Apple Pay is widely viewed as a gimmick, and Visa/MC realized that they can't keep hobbling along with mag stripes until something else catches on, which could be decades from now. That, combined with pressure from international travelers, forced them to act.

Originally Posted by tmiw
And since they were all forced into doing it, everything's rushed. So now there's a chance that NFC acceptance still won't be common for years* if ever, and we might not be able to adopt PIN preference in the future without making merchants replace stuff again. In short, everyone's unhappy as a result.
I don't know how it went in other countries, but I wouldn't call it rushed. Most major banks are issuing EMV cards, and many major retailers are accepting them. Those retailers that are not are either 1) not likely targets of fraud, because the ticket size is too low (fast food outlets and such) or 2) are taking other steps like checking IDs until their acquirers get caught up. I think everything is on track and the vast majority of US transactions will be EMV very soon.
cbn42 is offline  
Old Sep 27, 2015, 1:32 am
  #13628  
FlyerTalk Evangelist
 
Join Date: Dec 2009
Location: HaMerkaz/Exit 145
Programs: UA, LY, BA, AA
Posts: 13,167
Originally Posted by Majuki
I'd imagine most cashiers, even at an international airport like Newark, aren't familiar with the nuances among swipe-and-sign, chip-and-PIN, and chip-and-signature transactions. To most people in the US, the only time you'd enter a PIN is when you use a debit card over the debit network. It's just like when my sister-in-law was visiting and requested to pay in US dollars at a store that was offering DCC. (The offer was on the customer facing terminal, and I could see the cashier facing screen didn't show anything.) The young female cashier had a look that implied she wanted to say, "How else would you pay?"
I find airport workers in Europe to be much more aware of travel issues than airport workers in the USA. I understood exactly what he meant when he asked about PIN and I understood her confusion as well. Just kinda ridiculous that we're this close to the liability shift and she doesn't get EMV to the slightest

Originally Posted by cbn42
I would think that someone who worked at a major international airport would be familiar with this kind of thing. Equally, I would think that someone traveling internationally would be familiar with this kind of thing.

France was one of the first countries to implement EMV in the 1990s, so I guess the first batch of people in the world who had no experience with mag stripes are now coming of age just as the last remaining countries are switching over.
I actually wouldn't expect her to know. She was maybe 25 years old, in a small duty free shop (it was Terminal B by DL, which is a small operation).

As for traveling abroad, he may not be such a world traveler. Could have been a tourist who rarely used his card. Think about the flip side - about how confused American tourists can be when they travel to Europe and don't get insert chip versus swipe magnetic stripe.

He wasn't that young, but if he's been doing chip for 20 years, it would be disorienting to suddenly need to swipe.
joshwex90 is offline  
Old Sep 27, 2015, 1:53 am
  #13629  
 
Join Date: Jul 2009
Location: SJC
Programs: AA, AS, Marriott
Posts: 6,061
Originally Posted by joshwex90
I find airport workers in Europe to be much more aware of travel issues than airport workers in the USA. I understood exactly what he meant when he asked about PIN and I understood her confusion as well. Just kinda ridiculous that we're this close to the liability shift and she doesn't get EMV to the slightest.
Sure, but I imagine on the whole they're seeing more international cards in a variety of formats: contactless, swipe-and-sign, chip-and-signature, and chip-and-PIN. I imagine there are even people on FlyerTalk who are barely aware of EMV. The non-FlyerTalk crowd is likely to be even more unaware. I've been witnessing people at Target, and it's not been encouraging. I was one of those ignorant of EMV until a few years ago. As recently as 2008 I thought that the reason my card didn't work on a French autoroute was because my card issuer had declined the transaction.

I still remember the embarrassing situation where my friend and I had a line of impatient drivers behind us. Fortunately, my friend had a euro denominated Visa Electron that worked. I was furious with the call center of my card's issuer for declining a transaction at a critical juncture, which had happened a few times on the trip already. The American rep assured me that there were no attempted or declined transactions on my account, which made me even more furious. (I thought the issuer was trying to play dumb to save face since I had called twice before on this trip.) What we both didn't know was that the kiosk on the toll road needed a card with offline chip-and-PIN support. I didn't figure this out until I found this thread about 3 years ago. Who's to say even in 2015 that call center reps would be any better informed of these nuances?
Majuki is offline  
Old Sep 27, 2015, 1:54 am
  #13630  
FlyerTalk Evangelist
 
Join Date: Jan 2014
Location: San Diego, CA
Programs: GE, Marriott Platinum
Posts: 15,508
Originally Posted by cbn42
I think there is a good chance that the US will move from signature to PIN several years from now, just as Australia did. The life cycle of hardware is not that long, so it shouldn't be too much of an issue.
I heard somewhere that retailers generally keep terminals for 5+ years. Not sure how true that is though. However, there is a now a hard limit in the form of EMV certification expiration, so we may be seeing them get updated more often.

Also, Australia had PIN before chip. They just had this weird period just before PIN was mandated on chip where you could choose the CVM, kinda similar to how debit cards work in the US. The US is more like the UK and Canada except for the US not adopting PIN along with chip.

Originally Posted by cbn42
If no one wanted to do it, then why is it happening? There was no government mandate. There was a bit of a public outcry after Target and Home Depot, but that would have likely died down.
Visa and MC did institute the October 1 liability shift date back in 2011, which wasn't taken seriously by anyone until it became clear that it wasn't going to get moved back or cancelled. And considering that it wasn't just Target and Home Depot getting hacked but numerous other retailers as well, Visa/MC doing so could very well have forced federal intervention on the matter.

Originally Posted by cbn42
I think the problem is that NFC and tokenization are not picking up in the US. Visa PayWave and MC's Paypass never gained traction, Apple Pay is widely viewed as a gimmick, and Visa/MC realized that they can't keep hobbling along with mag stripes until something else catches on, which could be decades from now. That, combined with pressure from international travelers, forced them to act.
Considering that all four major card brands and 400+ banks and credit unions support Apple Pay and/or Android Pay, I don't think that side of the equation considers it a gimmick. If nothing else, it's a decent solution for the card not present fraud problem. The downside is that it's app only and does nothing for you if you make your purchases from a Web browser.

The problem with the NFC side of Apple Pay really is that it possibly came out a year or two too early. An initial wave tried it, found that a) barely anywhere they normally shop supported it, b) they still had to sign/enter a PIN and/or c) had to open up Passbook to give the cashier the last four of the "virtual" card. With those problems, it's no surprise a large number simply stopped attempting to use it. On the other hand, Samsung Pay might be given a lot more slack because it'll work nearly everywhere on Day One.

The question is whether Apple can lure back those who stopped bothering with it. And they might be able to, based on this article (that I think was posted here earlier).

Originally Posted by cbn42
I don't know how it went in other countries, but I wouldn't call it rushed. Most major banks are issuing EMV cards, and many major retailers are accepting them. Those retailers that are not are either 1) not likely targets of fraud, because the ticket size is too low (fast food outlets and such) or 2) are taking other steps like checking IDs until their acquirers get caught up. I think everything is on track and the vast majority of US transactions will be EMV very soon.
On the surface, perhaps. But if you look at stuff such as the poor merchant training and very little common AID support for debit, it sure seems rushed.

Originally Posted by JEFFJAGUAR
They were perfectly content to bop along with magnetic strips until something better hat would handle the online fraud problem came along; something biometric probably.
3D Secure was already in the US to some extent, but it wasn't ideal by any means. Apple/Android Pay is probably the closest as I stated above but only solves card use inside iOS and Android apps. And only became a thing late last year/this year, long past the point where the decision to move to EMV was made.

Also, I'm not sure what the motivation is on Visa/MC's part to mandate a solution for CNP when fraud liability is already on the merchant. Increased confidence in using one's card online, thus more spending?

Originally Posted by JEFFJAGUAR
The only conclusion I can reach is that the banks do have valid reasons, at least in their own mind, of defraying some of the costs of this conversion by sticking with signatures with full knowledge that signatures have no security value whatsoever while they seach for something that will also alleviate the problem with card not present transactions. I just don't see any further sense to investing further in the just as outdated emv technology while they search for something better.
I wouldn't mind a much higher no CVM limit for domestic transactions. I'm thinking something in the $150 to $200 range. Or maybe even some sort of dynamic algorithm on the issuer end that evaluates risk and forces the terminal to spit out a signature line/screen in certain cases. Something that makes 99% of transactions signature-free unless the issuer really doesn't like something, meaning that signatures become rare enough that they may actually be checked. I'm not sure the NRF would be too happy with being told that Americans are now going to be issued "no CVM" preferring cards and they have to support that CVM or I'd suggest that.

On the other hand, that might cut into NFC use as well (but possibly not due to EMV being pretty slow in comparison).
tmiw is offline  
Old Sep 27, 2015, 3:23 am
  #13631  
Moderator: Manufactured Spending
 
Join Date: Jul 2011
Posts: 6,580
Originally Posted by tmiw
I heard somewhere that retailers generally keep terminals for 5+ years. Not sure how true that is though. However, there is a now a hard limit in the form of EMV certification expiration, so we may be seeing them get updated more often.
5 years might be too soon. I'm thinking more along the lines of 10 years or so. Many countries are still chip-and-signature, so if they switch to PIN and the US is the last holdout (again), it may apply some pressure.

Originally Posted by tmiw
Also, Australia had PIN before chip. They just had this weird period just before PIN was mandated on chip where you could choose the CVM, kinda similar to how debit cards work in the US. The US is more like the UK and Canada except for the US not adopting PIN along with chip.
Interesting, I didn't realize that.

Originally Posted by tmiw
Visa and MC did institute the October 1 liability shift date back in 2011, which wasn't taken seriously by anyone until it became clear that it wasn't going to get moved back or cancelled. And considering that it wasn't just Target and Home Depot getting hacked but numerous other retailers as well, Visa/MC doing so could very well have forced federal intervention on the matter.
I've heard the theory that the threat of federal intervention forced the industry to act, but my recollection is that there were few major breaches prior to 2011, so I'm not sure that makes sense. When the breaches started a couple of years ago, Visa/MC and the banks said "we already have a plan we are working on".

Originally Posted by tmiw
Considering that all four major card brands and 400+ banks and credit unions support Apple Pay and/or Android Pay, I don't think that side of the equation considers it a gimmick. If nothing else, it's a decent solution for the card not present fraud problem. The downside is that it's app only and does nothing for you if you make your purchases from a Web browser.
Lots of banks used to support Paywave as well. My bank sent me an NFC debit card, with a brochure and other fancy marketing materials about the supposed future of payments. When my card came up for renewal, it came with a little note in the fine print saying Paywave had been discontinued.

Originally Posted by tmiw
On the surface, perhaps. But if you look at stuff such as the poor merchant training and very little common AID support for debit, it sure seems rushed.
I think the reason it seems rushed is because we think of it as a "deadline". That word has even been used many times in this thread. However, it's not a deadline, and you can't expect that everything will be 100% compliant by then. The liability shift is meant to provide a bit of an extra incentive to upgrade, but businesses will upgrade only when it makes sense for them to do so given their individual circumstances.



Originally Posted by tmiw
I wouldn't mind a much higher no CVM limit for domestic transactions. I'm thinking something in the $150 to $200 range. Or maybe even some sort of dynamic algorithm on the issuer end that evaluates risk and forces the terminal to spit out a signature line/screen in certain cases. Something that makes 99% of transactions signature-free unless the issuer really doesn't like something, meaning that signatures become rare enough that they may actually be checked. I'm not sure the NRF would be too happy with being told that Americans are now going to be issued "no CVM" preferring cards and they have to support that CVM or I'd suggest that.
I think that would be a great idea. The NRF might support "no CVM" priority cards if Visa/MC changed the rules to allow them to check IDs for large transactions.
cbn42 is offline  
Old Sep 27, 2015, 5:55 am
  #13632  
 
Join Date: Jul 2007
Posts: 1,762
The last thing in the world I would ever want to checking of ID's. As we said several times, credit card fraud to a consumer is relatively benign. It is not identity theft, it leaves no lasting financial scars and while it can be a tad inconvenient to be cardless for a day or two when travelling (easily solved of course by having more than one card) I do agree it can be a pain to notify my automatic payees of the new number, expiration date and security code. But again it leaves no lasting scars. Identity theft, OTOH, can take years to resolve and sometimes can lead to tragic consequences. While I would be the first to agree that a quick glance at a driver's license is most unlikely to cause a problem, when you start restricting it to large purchases the clerk/scammer might take more notice of the details. I for one would rather live with the small possibility of credit card fraud than although even smaller the possibility of identity theft no matter how far fetched one might think it is.

Besides, checking ID's to some degree loses its effectiveness for large purchases because after all if one is contemplating a fraudulent large purchase, one might be very likely to have obtain fraudulent ID also.

Last edited by JEFFJAGUAR; Sep 27, 2015 at 6:19 am
JEFFJAGUAR is offline  
Old Sep 27, 2015, 7:06 am
  #13633  
 
Join Date: Jun 2013
Location: SJC/SFO
Posts: 373
Originally Posted by joshwex90
As for traveling abroad, he may not be such a world traveler. Could have been a tourist who rarely used his card. Think about the flip side - about how confused American tourists can be when they travel to Europe and don't get insert chip versus swipe magnetic stripe.

He wasn't that young, but if he's been doing chip for 20 years, it would be disorienting to suddenly need to swipe.
I had a friend from Europe visit a couple of months ago. She is early 30s and it was her first time in the US. She complained how her European ATM/debit card doesn't work in the US. I went "huh?" and asked her to show me. We walk up to one of those old small business-owned ATMs and she inserts the card and leaves it in the slot going "See? It doesn't work". I pull the card out of the ATM and both the ATM and her eyes suddenly light up.

So yes, I can see how a European who has never set foot on American soil before could have never experienced swiping a card.
blaz is offline  
Old Sep 27, 2015, 8:06 am
  #13634  
 
Join Date: Jun 2015
Posts: 710
Originally Posted by JEFFJAGUAR
Citibank does issue pin preferred cards to US government employees because of their contract with the US government and even, I believe, Bank of America issues some pin preferred cards for corporate cards (correct me on this if I'm wrong).
Citi issues pin preferred cards to their corporate customers in the US as well.
glbltvlr is offline  
Old Sep 27, 2015, 10:06 am
  #13635  
 
Join Date: Jul 2009
Location: SJC
Programs: AA, AS, Marriott
Posts: 6,061
Originally Posted by JEFFJAGUAR
Besides, checking ID's to some degree loses its effectiveness for large purchases because after all if one is contemplating a fraudulent large purchase, one might be very likely to have obtain fraudulent ID also.
The ironic thing is that for most large purchases where I'm doing a card present transaction, such as buying suits or furniture, is that there has never been any request for ID. Granted these are likely low targets for fraud, and in the case the furniture store they know my delivery address anyway. However, I've never been asked at a department store for hundreds of dollars yet a fast casual franchise with counter service has a store policy of checking IDs?

I also heard a discouraging thing from the restaurant that took down the "must show ID" signs. A colleague was requested to show ID, and when he asked why the cashier said, "Because your card has a chip in it." I did ask him to check to see if his card was endorsed on the back - it wasn't - but I hope this doesn't become more widespread for those merchants who have not upgraded their terminals after the liability shift. I imagine they would even be on shakier ground than they are now with respect to chargebacks, right? After October 1st if you're not running EMV it's more or less case closed.
Majuki is offline  


Contact Us - Manage Preferences - Archive - Advertising - Cookie Policy - Privacy Statement - Terms of Service -

This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2024 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.