Vid

Discussion of the attack is off-topic for this thread, but I believe the fix was to deprecate offline PIN CVM. We should talk about it in the EMV thread if you want to dig into the details.

Vid

FWIW, both Citibank and Chase issued me contactless cards automatically back in 2007. I tried to use the Citibank card at a CVS in NYC back then, and I remember the POS couldn't read the card through my wallet. Since I had to take the card out, I just swiped it instead of holding up the line while I tried to get contactless to work.

When I requested a contact EMV card I lost contactless on my Citibank card as they didn't offer dual-interface cards. Chase reissued me a new card without contactless support about two years ago as well, perhaps because they were beginning to phase out 'blink'.

tmiw

IIRC one can do offline PIN CVM but still approve the transaction online, so why can't it be the other way too? (approve offline but choose signature)

Vid

Ross' goal was to demonstrate that PIN CVM wasn't infallible, as the UK banking industry had established legal precedents that it was. In the US we were never subject to this kind of liability shift to the consumer, and hopefully we never will be.

RedLight2015

I am liking the progress of Contactless thanks to Apple Pay. My local grocery store had the Verifone MX860 readers, but instead of replacing the whole terminal with an MX915, they bought the NFC modules that attach to the top of the MX860, and I just used it today, it works! I guess it really doesn't make sense to replace a whole terminal to add contactless support, but that seems to be the step most stores are taking, but since the Mx860 already has a color LCD, and looks modern enough this was a more cost conscious move to add NFC. These guys added the module instead, and I applaud this move, it means they are forward thinking, because it's obvious they did this to support Apple Pay.

The MX860s also were already chip enabled, so another reason why it would have been stupid to just replace it. I'm glad they bought the modules.

scibot

https://dl.dropboxusercontent.com/u/...actlesspad.JPG Those modules look like that inside, it did have the 4 lights right, as those are newer and do work great! I guess it does make sense as long as you have the emv slot already and only people without the emv slots should go to the MX915 or MX925.

RedLight2015

Yes that is the one that they added, and honestly works a lot better with contactless cards than the MX915 built in one.

tmiw

I happened to be at the Asian store again this morning and this time I pushed Sale on the FD35. It sat for a while and then turned on one of the four lights on top. Tried tapping the Amex twice. Each time it read the card (all four dots lit up) but then failed. Had to insert.

I wonder what is up with the Amex contactless that causes problems.

scibot

I used to go to a small Thai Market with the FD35 pinpad and FD 100ti card machine and I tried to use Softcard (Amex) twice there and it failed to work both times as well with invalid card error and they said they took Amex on the door too, next time try out Google Wallet or a Paypass or Paywave card. Google Wallet (Mastercard) obviously works great on the FD35, so I think Amex Contactless does not work on the FD35 pinpad.

tmiw

So the Greek place apparently fixed their terminal because when I went there for lunch one light out of four was lit. I pushed Credit anyway and was able to pay with Google Wallet. ^

AllieKat

I doubt "they" fixed it if it was a First Data merchant, and more likely First Data has pushed out some update to fix issues.

scibot

Thats great to hear its working now and did you have to sign for your purchase? Also you should try to run Google Wallet as debit because I'm curious to see if it would work on First Data equipment and it has to be interesting what the receipt would even say for a Contactless debit card. I would try that but not any FD35 pinpads close to me and I've only seen one merchant facing VX520 with Contactless support locally. The Thai Market that was close but not in town moved and I'm not sure they even have the FD35 pinpad anymore. I know of two other places with the FD35 pinpad, but I won't go by any of them any time soon.

tmiw

Yep, I had to sign. I think it would say "Contactless" on the receipt either way since that's the method of capture.

tmiw

So according to mia's post over in the Diners Club forum, DC's US cards don't work on London transit (at least on the Underground; probably the same for the rest of it too). By extension this probably means Google Wallet and any other MSD contactless-only cards won't work even if the former allowed international transactions.

At least Amex's contactless cards seem like they'd work according to their page.

AllieKat

Interesting thing I found today, contactless works at Michael's, probably completely by accident on their part. I used my Amex. The receipt indicates the card was swiped (showing a constructed magnetic stripe data transaction) and there were no prompts hinting that contactless might be enabled. This tells me that someone left it enabled with no thought to it, and as they're an MCX member I can't imagine this lasting long.

Meanwhile, Barnes and Noble with the same terminals has contactless disabled.