Credit Card Security

[imoldernu]

This may have been discussed before, but yesterday hit home with me. Old person's rant.

With the change from swipe to insert (chip), about 1/3 of our local busiesses have made the credit card conversion. The more security , the better, or so I thought.

Two days ago, I made a CC purchase with my "insert chip" card. The item I bought didn't work, so I returned it. "I have to put the credit back on your card" from the cashier. So I took out the card, and as I was going to insert it in the scanner, she said,"Oh, that's ok... you can take back your card. The machine brought up your account". And she gave me the "credit receipt." the card never got closer than 2 feet from the scanner.

Hmmm.. how handy, and how easy. Yeah... but what if the guy behind me had a scanner and could pick up my account by just being close to me.

Aha!... So that's why they're selling those "secure" wallets on TV. $19.95 for one and you get the second one free, (just pay postage and handling).

I don't like this. First, I've got enough to keep in my pockets... wallet, glasses, phone, car keys etc. Trouble enough keeping all of these items corralled, but now one more. Plus the open/close nuisance, and then putting it all away, for the next time.

It's already taking longer to go through the checkout lanes, as customers "insert card", "wait", and "remove card" process unfolds. Now, it appears that the scanner can read the card (probably just the magnetic strip) anyway... as, presumably, can the thief, just from being near the scanner.

As I get older, multitasking gets more difficult. One of the great fears is losing my wallet. Multiple credit cards, Social Security Id, Drivers license, Voter ID, Medical Emergency info, Medicare, Medicare D, Medicare Supplement, Auto Ins. card, and pics of the grand kids. The $100 cash is the least of the worries about replacement. Now the lead lined CC holder.

Progress?

So... did you know that the scanner can pick up your account info without either inserting or swiping the card?

 

[MichaelB]

So... did you know that the scanner can pick up your account info without either inserting or swiping the card?

Are you certain they didn't bring up the transaction record, which has all the detail for that sale, including your CC info? That is common.

 

[imoldernu]

Are you certain they didn't bring up the transaction record, which has all the detail for that sale, including your CC info? That is common.

Yeah... I suppose, but I don't know how that happened, since she didn't do any manual input, or scan the return receipt. Possible by scanning the item bar code, but how did that match up to my account? It happened quickly. I did ask how it happened, and she brushed it off with "Oh, it just works that way."

I found this, but don't think it answered the question.
How Do Thieves Scan Credit Cards in Your Purse? | The Classroom | Synonym

 

[easysurfer]

I know when returning stuff at Wally World I've in the past brought out my cc thinking I need to put the return on my cc but the customer service person said they don't need it. They just scan the return receipt. Menards is the same way.

 

[Gone4Good]

I wouldn't worry much. Most of the rest of the world has been using Chip & Pin cards for a couple of decades now. It's not like this is new and unproven technology we're experimenting with.

I'd wager one of the innocent explanations already listed above pretty well explains things.

 

[pb4uski]

^^^^^ What they said...the store had your credit card details on file from when you did the purchase.

 

[audreyh1]

So... did you know that the scanner can pick up your account info without either inserting or swiping the card?

No - it didn't pick up your card stuff over the air. That's not how chip cards work.

 

[imoldernu]

Am thinking this isn't as simple as it first seemed. The link below explains in some more detail.

As I read it, the chief benefit of the chip, is that it works on a single transaction, then changes the approval code for the next. This would mean that once the purchase is made, using the inserted chip card, that the chip changes so that if the card is scammed, it could not be duplicated to use somewhere else for purchase purposes, because the chip code would be changed.

As to the reading the info on the magnetic strip... (not including the chip code) it sounds as if the card info could be read on the basis of "proximity", thus it would not have to be inserted into the scanner. This would account for the match up to my account, but without the ability to copy the card's chip variable code in order to make a purchase.

See if that's what it looks like to you.
8 FAQs about EMV credit cards

In any case, still a work in progress, so what is today, may not be tomorrow.

 

[gauss]

What I think that you may wish to avoid is "contactless" technologies (NFC, RFID etc) with brand names such as Visa PayWave or MasterCard PayPass where your card information is indeed transferred over the air.

An EMV card is not required to have this feature.

Note the identifying icon on the cards at this link.

-gauss

 

[Chuckanut]

I wouldn't worry much. Most of the rest of the world has been using Chip & Pin cards for a couple of decades now. It's not like this is new and unproven technology we're experimenting with.
.

One problem is that for most of us in the USA it is not Chip&Pin, but Chip&Signature instead. When was the last time anybody really checked the signature on the back of your card? In fact, two of my chipped cards do not even offer me the option of having a Pin. The banks that issue these cards brag in their literature about the convenience of not having to memorize a pin.

Without the requirement that the card user enter the proper pin, a lot of security is missing. Still, it's better than the old fashioned swipe cards. At least intercepting one transaction does not give away the entire CC farm.

 

[braumeister]

When was the last time anybody really checked the signature on the back of your card?

Case in point:
DW has never signed her name on the signature line of a credit card. Instead, she has always printed ASK FOR ID in that space. She has done this for over a quarter of a century, and in all that time she has never actually been asked for ID.

 

[niven]

Case in point:
DW has never signed her name on the signature line of a credit card. Instead, she has always printed ASK FOR ID in that space. She has done this for over a quarter of a century, and in all that time she has never actually been asked for ID.

My DW is a smart woman but the one thing I never understood is she refuses to sign the back of the card and leaves it blank. It's so they can't get her signature, she tells me - then I say well, they wouldn't need it if they can just put their own signature on it if she loses the card. I don't press the point since no one ever looks anyway. We all have our quirks.

 

[calico1597]

I have 'ask for ID' on the back of my credit card. I am asked about half the time to show my drivers license, so it does work - on occasion

 

[niven]

I have 'ask for ID' on the back of my credit card. I am asked about half the time to show my drivers license, so it does work - on occasion

Possibly - it's also possible that it's normal procedure depending on where you live and how often fraud occurs. I've been on trips where they ask for ID frequently, even though I've signed the back of my card. Where I live, I don't think I've ever been asked.

 

[misanman]

A restaurant mixed up the credit cards for two couples that we know (both cards from the same bank). Both cards were signed, but it didn't matter. Neither couple noticed the exchange until they received their bills and didn't recognize the purchases (including a set of four tires). Since they live in different states they were able to pretty quickly figure out what happened once they had the bills in hand.

 

[M Paquette]

The store clerk likely scanned (or keyed in in a few places) a transaction code from your receipt. Scanning this just takes a fraction of a second. With a 'chipped' card, the store does not have all your credit card information. They do have the 'one shot' virtual credit card number that the chip generated while in the reader, and then can roll back part or all of that transaction. A thief in possession of the one shot virtual card number can't really do anything with it.

 

[Alan]

My DW is a smart woman but the one thing I never understood is she refuses to sign the back of the card and leaves it blank. It's so they can't get her signature, she tells me - then I say well, they wouldn't need it if they can just put their own signature on it if she loses the card. I don't press the point since no one ever looks anyway. We all have our quirks.

We were in Australia in 2013 and visiting a small historic site on the Great Ocean Road with only one cashier selling entrance tickets. At the front of the queue was an American lady who tried to pay with her unsigned credit card. The attendant refused to take it and also refused to allow her to sign the back of it. It took several minutes of digging in her purse before she was able to produce a picture id with signature that was deemed acceptable.

When we had arrived in July we saw many posters and TV ads advertising that from August 1st CHIP & PIN was the only type of acceptable card and that signatures would not be legally acceptable. In reality we only came across one issue with our CHIP and Signature card and that was in a gas station in "Nowhere", Queensland where the poor lady got pretty stressed and had me write a note to her boss explaining why I didn't have a CHIP & PIN card. (There wasn't even an ATM in the place for me to get enough cash to pay)

 

[Sunset]

One problem is that for most of us in the USA it is not Chip&Pin, but Chip&Signature instead. When was the last time anybody really checked the signature on the back of your card? In fact, two of my chipped cards do not even offer me the option of having a Pin. The banks that issue these cards brag in their literature about the convenience of not having to memorize a pin.

Without the requirement that the card user enter the proper pin, a lot of security is missing. Still, it's better than the old fashioned swipe cards. At least intercepting one transaction does not give away the entire CC farm.

A Pin would stop stolen CC from being used in nearly all places. As it stands if someone steals your cc , they can insert and spend to their hearts content.

I bet there will be more "stolen" CC as folks will forget them in the machine, vs the swipe where you never let go of it.

 

[Sunset]

We were in Australia in 2013 and visiting a small historic site on the Great Ocean Road with only one cashier selling entrance tickets. At the front of the queue was an American lady who tried to pay with her unsigned credit card. The attendant refused to take it and also refused to allow her to sign the back of it. It took several minutes of digging in her purse before she was able to produce a picture id with signature that was deemed acceptable...

I had that happen to me, I had forgotten to sign the back, and the clerk said "I can't take this card because it's not signed".
So I took the card back, signed it right there and handed it back, where she processed the purchase

 

[explanade]

I used Apple Pay a lot in New Zealand last month.

Far more than I've been able to use it here in Silicon Valley.

NFC is the technology used for wireless communications between a smart phone and a POS reader. It stands for Near Field Communications so it can't be picked up from the other side of the store or outside of it.

Plus, Apple Pay isn't sending your actual credit card number or even your name. So even if they intercepted the communications between the iPhone and the POS, that info. wouldn't be of any use to them. Also pretty sure the credit card, when it's authorized for use in Apple Pay, is tied to the device ID, which is unique to each device.

 

[audreyh1]

I've been to some places - more tourist areas in the US - that check ID for credit card purchases.

The whole signature on the back of the card thing is meaningless.

 

[niven]

I bet there will be more "stolen" CC as folks will forget them in the machine, vs the swipe where you never let go of it.

Most of the places I've used the chip reader so far make some kind of noise when done (sometimes very irritating) as well as tell you to take your darn card on the screen. My brother would probably be one of the ones that zones out and still walks off without it though.

 

[gauss]

Most of the places I've used the chip reader so far make some kind of noise when done (sometimes very irritating) as well as tell you to take your darn card on the screen. My brother would probably be one of the ones that zones out and still walks off without it though.

Slower and annoying loud - Progress, eh?

 

[misanman]

We just received new Target credit cards and they appear to be mandatory chip and pin. Apparently the "slide" option will no longer be available.

 

[gauss]

We just received new Target credit cards and they appear to be mandatory chip and pin. Apparently the "slide" option will no longer be available.

My understanding of this is that each Merchant, individually, will determine if they will accept an EMV card as a legacy Mag-Stripe slide transaction.

Target has converted over their stores to EMV capable so I believe if they sense an EMV capable card in the slide Mag-Stripe reader then indeed will redirect to the EMV slot.