So I guess anyone can just use anyone else's credit card...

[SSSnail]

Its nothing to do with my thought patterns its more to do with your inability to understand and follow simple instructions.

The card issuer tells you to sign the card and use a matching signature on the receipt, they tell the merchant to check that the two signatures match.

Now the merchant could follow your personal scheme to validate the purchase and if anything goes wrong I'm sure that you'll be volunteering to cover any losses that the merchant suffers. Or the merchant could just stick with the scheme made by the card vendor and have the confidence that they'll get paid.

I'm just curious how would any vendor lose money by verifying matching name on ID and cards and signature on ID? I'm sure the CC companies have my signature on file. Do you know of ANY merchant that have lost revenues by verifying signature on an ID card?

 

[WelshBloke]

I'm just curious how would any vendor lose money by verifying matching name on ID and cards and signature on ID? I'm sure the CC companies have my signature on file. Do you know of ANY merchant that have lost revenues by verifying signature on an ID card?

If the signature on the card doesnt match the one on the receipt and you argue that you didnt make that purchase you could conceivably rip off the merchant. The card company isnt going to eat the loss because the merchant didnt follow the procedures set down by the card company.

It really doesn't matter though, if you're a merchant wanting to get paid with minimal fuss you follow the rules set by the card vendor not the rules set by random members of the public.

 

[SSSnail]

If the signature on the card doesnt match the one on the receipt and you argue that you didnt make that purchase you could conceivably rip off the merchant. The card company isnt going to eat the loss because the merchant didnt follow the procedures set down by the card company.

It really doesn't matter though, if you're a merchant wanting to get paid with minimal fuss you follow the rules set by the card vendor not the rules set by random members of the public.

Of the years I've used cards, and not having signature on any of the cards, I've never had any problems except for the idiotic Ingapopreansay. And possibly you, if you were a merchant. But if that was the case, you'd lose my business instead of having to worry about a valid signature on my IDs.

It's the same process with one change, and that's if the signature is not on the card, it cannot be easily forged. The normal process is sign the receipt, vendor verify signature on card; if they verify the signature on ID, that will force them to look at the names on the ID and the card as well, which is more secured.

As is, you can actually refuse to show your ID, because all that's required is a signature, which can be easily forged because it's on the cards.

I'm all for security, but if it's just security theater and if idiots cannot comprehend why checking signature on IDs is a much more secure and valid method of authentication, then they don't deserve my business.

Furthermore, you really think you can dispute a charge with your signature on it? Even if your card says "See ID" where the signature should be? Baaawwaaahahahahahahahahahahahahaaaaaa.

Inconceivable!

 

[WelshBloke]

...

What you think doesn't matter at all.

The card issuer sets some rules. If you can't follow those (extremely simple) rules there's no point whinging when things don't go your way.

I'm not seeing how you have a problem understanding this.

Agree rules. Get card. Follow rules.

 

[SSSnail]

What you think doesn't matter at all.

The card issuer sets some rules. If you can't follow those (extremely simple) rules there's no point whinging when things don't go your way.

I'm not seeing how you have a problem understanding this.

Agree rules. Get card. Follow rules.

Nah, I'm OK. I have no problem understanding their rules, I just think they're flawed, and most intelligent people have no problems seeing that as well. The VERY small percentage of anally retentive idiots that insist on those idiotic rules don't deserve my business.

Your mind would be blown if I tell you I don't even sign some of my cards. Shhh... don't tell anyone.

Like I said, so far, there are only two idiots that have problems with my method in the whole world that I get to interact with. You're the third. The funny thing is, if I were to sign "See ID" on the receipt, it would have been perfectly OK with those idiots, because that's how they think.

 

[WelshBloke]

The VERY small percentage of anally retentive idiots that insist on those idiotic rules don't deserve my business.

So you don't use any cards at all then? Because all the card issuers insist on those "idiotic rules".

Tell you what, next time you apply for a card tell them that their rules are idiotic and that you aren't going to abide by them. Then ask them to issue you a card.

Report back how it goes.

 

[SSSnail]

Since you're so hell bent on rules, I guess I'll take the time to tell you another story that illustrates perfectly the robotic thinking of those idiotic Ingaporeansay.

So my wife went shoes shopping, she tried on a pair of shoes size 5 1/2. She liked it and decided to purchase it. I went to pay for it. While I was paying, and the transaction hasn't even completed, my wife thought that a size 5 would fit her better and asked to get a size 5 pair instead. The girl behind the counter said "Sir, no return or exchange".

I really didn't know what to tell her as I was trying to decide if I should yell at her, or laugh uncontrollably. But, being the cool guy that I am, I gently reminded her that I still haven't paid for the shoes, yet. She insisted on the shop's rules of "No return or exchanges". At this point, I was getting a bit irate so I asked to speak to a manager, and the manager said the same thing about their rules.

I told her that I could just not pay for the shoes and leave, then it dawned on her that we haven't actually bought the shoes, nor left the store. We got the shoes my wife wanted, while the cashier begrudgingly rung us up. It was hilarious.

That's the mentality of those Ingaporeansay, and I suspect you're somewhat not far away...

 

[SSSnail]

So you don't use any cards at all then? Because all the card issuers insist on those "idiotic rules".

Tell you what, next time you apply for a card tell them that their rules are idiotic and that you aren't going to abide by them. Then ask them to issue you a card.

Report back how it goes.

Have you been reading, at all?

 

[WelshBloke]

Have you been reading, at all?

Yep.

Unfortunately I have. And I feel dumber for reading your "I know there's rules that we all agreed to but I'll whinge like hell if anyone sticks to them" rant.

You agreed to some rules. A transaction went down exactly as those rules stated. You're whinging about it.

That's it pretty much?

 

[WelshBloke]

Since you're so hell bent on rules, I guess I'll take the time to tell you another story that illustrates perfectly the robotic thinking of those idiotic Ingaporeansay.

So my wife went shoes shopping, she tried on a pair of shoes size 5 1/2. She liked it and decided to purchase it. I went to pay for it. While I was paying, and the transaction hasn't even completed, my wife thought that a size 5 would fit her better and asked to get a size 5 pair instead. The girl behind the counter said "Sir, no return or exchange".

I really didn't know what to tell her as I was trying to decide if I should yell at her, or laugh uncontrollably. But, being the cool guy that I am, I gently reminded her that I still haven't paid for the shoes, yet. She insisted on the shop's rules of "No return or exchanges". At this point, I was getting a bit irate so I asked to speak to a manager, and the manager said the same thing about their rules.

I told her that I could just not pay for the shoes and leave, then it dawned on her that we haven't actually bought the shoes, nor left the store. We got the shoes my wife wanted, while the cashier begrudgingly rung us up. It was hilarious.

That's the mentality of those Ingaporeansay, and I suspect you're somewhat not far away...

So the teller girl is a dumbass for trying to push her unilateral rules that no one else agreed to but you're not a dumbass for trying to push your unilateral rules that no one else agreed to?

 

[SSSnail]

Yep.

Unfortunately I have. And I feel dumber for reading your "I know there's rules that we all agreed to but I'll whinge like hell if anyone sticks to them" rant.

You agreed to some rules. A transaction went down exactly as those rules stated. You're whinging about it.

That's it pretty much?

No, you're just failing to understand that there's always a human element in any transactions, or established "rules". And if you're so robotic and idiotic to understand that there are more than one, and better ways to verify with certainty of the person that you're performing that transaction with, then you're just a lost cause.

I just hope that if you're working for somebody, you're not in charge of anything important.

You obviously have a problem with reading comprehension, or understanding context of the conversation.

I will now stop wasting any more time on you.

 

[WelshBloke]

No, you're just failing to understand that there's always a human element in any transactions, or established "rules". And if you're so robotic and idiotic to understand that there are more than one, and better ways to verify with certainty of the person that you're performing that transaction with, then you're just a lost cause.

So you explain this to your credit card company when you apply for a card then?
I'd quite like to listen to that conversation.

 

[midnight growler]

Why does nobody verify signatures anymore? Because nobody really signs anymore.

Why does nobody really sign anymore? "Because my signature never looks real on these machines with the fake pens"

The mass majority of card fraud involves hacked / copied card information. Whether you sign your card or not has absolutely no difference when Bob the criminal zaps your card information from an ATM skimmer. He prints off hundreds of cards encoded with your info and stamps the card with his name. Even if the cashier asks for ID and compares signatures it makes no difference because Bob the criminal can use his own.

Yes Chip AND Pin would be the best solution (and many stores will do that with their own cards). The problem why banks and credit companies are hesitant to do this?

"I've got too many Pins to memorize, let's just put everything back and I'll come back tomorrow" followed shortly by "I have to wait to get a new Pin sent to me by mail!?" with a shot of "it was never this complicated before I hate you!"

 

[matricks]

That's all the banks want: easy prevention of card cloning. They don't want PIN because it will cause people to use their cards less.

This has me completely dumbfounded. I've heard it from several places, so I don't doubt it's the truth, but still. Cards have always been PIN only over here, at least as long as I am aware (I got my first card 14 years ago, and PIN wasn't new at that time). Magnet stripe or chip, this bank or that bank, credit or debit, Visa/MC/Amex, makes no difference.

People are still buying things they can't afford so Visa makes money, everyone who has any amount of money has at least two cards, lots of people carry a full deck of cards to get every conceivable benefit, and no one complains about PINs. And yes, people use their cards all the time. Two years ago security guards were on strike, people responsible for refilling ATMs and moving larger amounts of cash. ATMs went dry across the country, but the society as a whole didn't really notice. People got their food, diapers and everything they needed. There wasn't a single story for media to tell about some poor innocent family affected by the strike. I'm not saying I support the idea, but we're certainly prepared for a society without cash.

How come American consumers will all of a sudden cease to spend money when PINs are introduced?

 

[ViRGE]

How come American consumers will all of a sudden cease to spend money when PINs are introduced?

To be sure, it's not as if spending will fall off of the face of the Earth. There is some segment of the population who would have trouble with (or outright opposition to) PINs, which means they would curtail their credit card use if a PIN was required. People dislike change, and credit card policies are outright designed to minimize friction in order to maximize spending, which is why ID checking isn't allowed (to bring this back to the original topic).

Really we'd be talking about a sub-10% drop at the worst. However the banks have run their simulations, and they believe that the drop in spending would be more than the drop in fraud. Hence chip & sig.

 

[Eug]

Furthermore, you really think you can dispute a charge with your signature on it? Even if your card says "See ID" where the signature should be? Baaawwaaahahahahahahahahahahahahaaaaaa.

Inconceivable!

My father disputed a signed receipt and that charge was cancelled. Turned out the card had been counterfeited and was being used as the same time my father was using his.

To be sure, it's not as if spending will fall off of the face of the Earth. There is some segment of the population who would have trouble with (or outright opposition to) PINs, which means they would curtail their credit card use if a PIN was required. People dislike change, and credit card policies are outright designed to minimize friction in order to maximize spending, which is why ID checking isn't allowed (to bring this back to the original topic).

Really we'd be talking about a sub-10% drop at the worst. However the banks have run their simulations, and they believe that the drop in spending would be more than the drop in fraud. Hence chip & sig.

As Canada and Europe have already demonstrated, that concern doesn't really have good support. Initially chip and pin was a problem, because the banks sent out the PINs far too early, so people would lose or forget the PINs before they could actually even use the card, but now that's been corrected.

I think one of the problems in the US is that the banks have no clear mandate, and there is no clear over-riding plan. There is a perception by some that chip and signature is easier (even though it really isn't and it does have disadvantages too) so there are different routes to take, which has been distilled down to chip and signature vs chip and pin depending upon the issuers. Ironically, many if not most retailers actually prefer chip and pin.

The lack of government oversight strikes again in the US. What you get is a confusing and inconsistent system, and one that decreases compatibility for the rest of the world. For example, just try to use one of those chip and signature cards in a European vending machine or parking meter. It often won't work, which is a major problem if there is no way to use cash at that site. Same is true in Canada.

In contrast, the US federal government only issues chip and pin payment cards to federal employees for security reasons. Too bad their trying to lead now by example is years too late.

 

[Exterous]

The lack of government oversight strikes again in the US. What you get is a confusing and inconsistent system, and one that decreases compatibility for the rest of the world.

Well its not like its as cheap to convert the US to chip & pin as the rest of the world. Americans have more Credit Cards than any other country (5.6 Billion) and lose them at a faster rate (17% of cards per year). Given that C&P cards cost at least 13x more you are talking about over $1.4bn extra spent per year in credit card replacements alone. Not to mention the one time cost of almost $7bn just to replace the existing cards and this hasn't even gotten to infrastructure change costs yet.

http://www.washingtonpost.com/news/volokh-conspiracy/wp/2014/01/21/the-economics-of-credit-card-security/

For example, just try to use one of those chip and signature cards in a European vending machine or parking meter. It often won't work, which is a major problem if there is no way to use cash at that site. Same is true in Canada.

Surprisingly enough the last couple of times I've been in Europe I only had problems with parking\subway in two places: Middle of no where Iceland and the metro stations in Brussels. (That said the metro stations were a bit old and wouldn't even accept Euro bills - only coins)

 

[Eug]

Surprisingly enough the last couple of times I've been in Europe I only had problems with parking\subway in two places: Middle of no where Iceland and the metro stations in Brussels. (That said the metro stations were a bit old and wouldn't even accept Euro bills - only coins)

It's gotten better for people from the US who travel without chip-and-pin cards.

How? The card issuers in places like the US have pressured the manufacturers and retailers to accept such cards by requiring no authentication.

IOW, the US has implemented security measures (chip-and-signature), but then push companies and retailers in other countries to ignore those security measures, because they think their customers are too stupid to use chip-and-pin.

 

[JoeBleed]

We have the terminal BoA and a lot of banks in the US put in stores. There's no pin option, dunno if they're going to release a firmware update to fix this. But as it stands you shove the card in and that's all. Since by law I can't ask for ID, I have no idea if it's the persons card or not. In it's current state it's stupid, I know not all retailers use the FD100 terminals, but many do. I dunno how other machines work.

That's because the US isn't getting chip/pin, we get/have chip/sign. the only security increase is it's harder to duplicate the cards. If possible at all; I haven't looked lately. But the chip/pin system is flawed. the pin is embedded in the chip but the terminal doesn't check the pin code against a bank/card database, it's just based off of if the terminal can read it or not with the correct encryption. Thus hardware and software were developed to allow the use of physically stolen cards until they get reported and deactivated. You don't need to know the pin to use them when you have the hardware/software. It's basically a physical man in the middle attack/device.

 

[Eug]

Basically one of the main reasons why the US is getting (mostly) chip-and-signature is because the banks think Americans are too stupid to use chip-and-pin. Some even have said as much.

http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/

“We don’t really think we can teach Americans to do two things at once. So we’re going to start with teaching them how to dip, and if we have another watershed event like the Target breach and consumers start clamoring for PIN, then we’ll adjust.”

 

[Red Squirrel]

Basically one of the main reasons why the US is getting (mostly) chip-and-signature is because the banks think Americans are too stupid to use chip-and-pin. Some even have said as much.

http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/

“We don’t really think we can teach Americans to do two things at once. So we’re going to start with teaching them how to dip, and if we have another watershed event like the Target breach and consumers start clamoring for PIN, then we’ll adjust.”

lol that's hilarious.

 

[BoberFett]

I still prefer Fish and Chip.

 

[BoberFett]

Also, just to say something on topic, chip and pin is not invulnerable. Just read the security blogs. Give it enough time and the hacks will start showing up in greater numbers.

 

[WelshBloke]

Also, just to say something on topic, chip and pin is not invulnerable.

Indeed. Its just orders of magnitude less insecure than the available alternatives.

 

[BoberFett]

Indeed. Its just orders of magnitude less insecure than the available alternatives.

Maybe. Maybe not.

http://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/

0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions).

Chip and pin just shifts the vulnerability up the chain a little further.