FlyerTalk Forums

FlyerTalk Forums (https://www.flyertalk.com/forum/index.php)
-   Credit Card Programs (https://www.flyertalk.com/forum/credit-card-programs-599/)
-   -   Post your receipt of your 1st EMV based transaction in the US (https://www.flyertalk.com/forum/credit-card-programs/1542111-post-your-receipt-your-1st-emv-based-transaction-us.html)

Majuki Feb 24, 2015 1:26 am


Originally Posted by Silver Fox (Post 24404980)
Just to add to that, all of the UK supports chip and pin and it is mostly online. Offline is rare and will depend on, for example, a floor limit, or because the chip has told it to go online. Since 14/2/2016 (2/14/2016 in your currency) it was a requirement to use chip and pin with very few exceptions and the stick for that was that if it was signed for then the retailer was likely to have to pick up the cost of any fraudulent transaction. In fact, I cannot recall having to sign for anything for many a year now. I think it is quaint that I am asked to sign in the US. It's like a blast from the past.

Was that meant to be 2006? For the record, the US is far from the only chip-and-signature location. I'm of the opinion of some others on here who don't care too much about whether things are PIN or signature as long as the card works. However, I do personally prefer PIN-based verification only because it's faster and allows me to retain possession of the card. I just would hope as a UK cardholder that I never fell victim to card fraud with PIN use as it seems next to impossible that the bank will try to reverse the charges.

AllieKat Feb 24, 2015 1:27 am


Originally Posted by Silver Fox (Post 24404980)
Just to add to that, all of the UK supports chip and pin and it is mostly online. Offline is rare and will depend on, for example, a floor limit, or because the chip has told it to go online. Since 14/2/2016 (2/14/2016 in your currency) it was a requirement to use chip and pin with very few exceptions and the stick for that was that if it was signed for then the retailer was likely to have to pick up the cost of any fraudulent transaction. In fact, I cannot recall having to sign for anything for many a year now. I think it is quaint that I am asked to sign in the US. It's like a blast from the past.

You're confusing online authorisation with online PIN. In the UK, transactions are authorised online but the PIN is almost always verified offline.

Silver Fox Feb 24, 2015 6:56 am


Originally Posted by AllieKat (Post 24405043)
You're confusing online authorisation with online PIN. In the UK, transactions are authorised online but the PIN is almost always verified offline.

I am not confused about anything. I was talking about online authorisation when the chip and pin is placed into a terminal handed to me by a merchant where a PIN is used and not a signature.

AllieKat Feb 24, 2015 7:50 am


Originally Posted by Silver Fox (Post 24405881)
I am not confused about anything. I was talking about online authorisation when the chip and pin is placed into a terminal handed to me by a merchant where a PIN is used and not a signature.

Proving that you're very confused. Because you just said authorisation. Which is correct. The UK uses online authorisation. But nobody in this thread was talking about authorisation. We were talking about authentication. The UK uses offline authentication.

P.S. to clarify in case we need to take a step back - authentication proves WHO you are, authorisation determines WHAT is allowed. The authorisation step happens online in the UK, but the authentication step happens offline with a PIN stored on the card. Many terminals in the UK are not programmed for online authentication, so when they receive a card that asks to verify the PIN online, they fall back to signature.

The same seems to be happening in the US, at least by one popular acquirer.

Lyolik Feb 24, 2015 8:08 am


Originally Posted by AllieKat (Post 24406178)
The UK uses offline authentication.

Why to use the offline authentication with the online authorization (except CDA as the anti MITM-attack method)?
And you're confusing the card authentication with the cardholder verification. :)

AllieKat Feb 24, 2015 8:12 am


Originally Posted by Lyolik (Post 24406284)
Why to use the offline authentication with the online authorization (except CDA as the anti MITM-attack method)?

Not authentication of the card, but authentication of the cardholder (PIN). And because offline PIN is faster than online.

Lyolik Feb 24, 2015 8:26 am


Originally Posted by AllieKat (Post 24406303)
And because offline PIN is faster than online.

No. Offline PIN is slower than online (especially enciphered) but safer.

AllieKat Feb 24, 2015 8:33 am


Originally Posted by Lyolik (Post 24406395)
No. Offline PIN is slower than online (especially enciphered) but safer.

Really? Why does it seem so much faster in the UK then?

reclusive46 Feb 24, 2015 8:55 am


Originally Posted by Lyolik (Post 24406395)
No. Offline PIN is slower than online (especially enciphered) but safer.

It's a lot slower if the pin is keyed in incorrectly as the transaction almost had to completely start again with online PIN.

tmiw Feb 24, 2015 8:55 am


Originally Posted by Lyolik (Post 24406395)
No. Offline PIN is slower than online (especially enciphered) but safer.

Didn't we just have a discussion a while back where people pretty much said that offline PIN is deprecated precisely because of security issues?

AllieKat Feb 24, 2015 9:41 am


Originally Posted by tmiw (Post 24406558)
Didn't we just have a discussion a while back where people pretty much said that offline PIN is deprecated precisely because of security issues?

Well, there are CVM downgrade concerns. And I've never heard ANYONE claim online PIN is faster before.

Points Scrounger Feb 24, 2015 10:04 am


Originally Posted by AllieKat (Post 24406178)
Proving that you're very confused. Because you just said authorisation. Which is correct. The UK uses online authorisation. But nobody in this thread was talking about authorisation. We were talking about authentication. The UK uses offline authentication.

P.S. to clarify in case we need to take a step back - authentication proves WHO you are, authorisation determines WHAT is allowed. The authorisation step happens online in the UK, but the authentication step happens offline with a PIN stored on the card. Many terminals in the UK are not programmed for online authentication, so when they receive a card that asks to verify the PIN online, they fall back to signature.

The same seems to be happening in the US, at least by one popular acquirer.

Are you implying kiosks, or do you mean that there are offline "staffed" POS as well? I ask as I have a card that is online sig, with an offline PIN (for kiosks, presumably).

reclusive46 Feb 24, 2015 11:23 am


Originally Posted by Points Scrounger (Post 24406965)
Are you implying kiosks, or do you mean that there are offline "staffed" POS as well? I ask as I have a card that is online sig, with an offline PIN (for kiosks, presumably).

Most staff kiosks use offline PIN (I.e pin checked on the card) but still authorise the transaction online with the bank.

Kiosks are the same, offline authorisation transactions only really occur on trains and via contactless in the UK. A card that supports offline pin isn't necessary in the UK though as I've never encountered an automated machine that wouldn't take a C&S card, it'll just go through with no verification. (This will because of our strict disability laws).

Silver Fox Feb 24, 2015 11:35 am


Originally Posted by AllieKat (Post 24406178)
Proving that you're very confused. Because you just said authorisation. Which is correct. The UK uses online authorisation. But nobody in this thread was talking about authorisation. We were talking about authentication. The UK uses offline authentication.

P.S. to clarify in case we need to take a step back - authentication proves WHO you are, authorisation determines WHAT is allowed. The authorisation step happens online in the UK, but the authentication step happens offline with a PIN stored on the card. Many terminals in the UK are not programmed for online authentication, so when they receive a card that asks to verify the PIN online, they fall back to signature.

The same seems to be happening in the US, at least by one popular acquirer.

No, really, not confused. Perhaps lacking a little clarity I agree. The point of Majuki was "Does this mean that Australian cardholders would still be prompted for a signature in the UK most of the time?". What I should have added was that my chip and PIN on a UK bank card worked in Oz, so he/she might have a similar experience in the UK that their Oz card works here. But forgot to add that. Happy to clear that up. Carry on, it's a riveting read. :)

reclusive46 Feb 24, 2015 11:44 am


Originally Posted by Silver Fox (Post 24407463)
No, really, not confused. Perhaps lacking a little clarity I agree. The point of Majuki was "Does this mean that Australian cardholders would still be prompted for a signature in the UK most of the time?". What I should have added was that my chip and PIN on a UK bank card worked in Oz, so he/she might have a similar experience in the UK that their Oz card works here. But forgot to add that. Happy to clear that up. Carry on, it's a riveting read. :)

Its possible an Australian would sign in the UK. Only one of the Aussie banks supports offline PIN. Most UK cards now support offline and online PIN, so they wouldn't be signing in Australia but one or two UK banks don't support online PIN (I'm pretty sure RBS/Natwest don't but I'm not sure who the other is).


All times are GMT -6. The time now is 9:05 am.


This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.