Hacker News Reader

Comment by dcw303 | Hacker News Reader

It's certainly convenient, but I find it a little scary that the PIN is not needed on purchases under $100. Granted, your phone is going to have its own security lock before you can run the app, but what about the smart chip debit cards in your wallet?

View on HN

There's really no issue. If your card is stolen and fraudulent charges made the bank will reverse them. Having used chip payments for years now, I couldn't imagine living without them.

What if the card is stolen alongside your pin? Will the charges not be reversed because the pin was stolen?

Yes. The whole point of FDIC insurance is that you will be reimbursed for any sort of theft. Even pin + card.

No, FDIC insurance is insurance against bank insolvency not theft.

No. And FDIC insurance has nothing to do with this. Most banks will in fact try to hold you fully liable for fraudulent transactions if your stolen card was used with its PIN. Their rationale is that if you gave your PIN to an unauthorized person, or used a weak PIN, or wrote it down and got the piece of paper stolen, then you should be liable. See for example: "If your Password or PIN is used in such a transaction, you will be liable for the full debt" http://www.scotiabank.com/ca/common/pdf/borrowing/revolving_...

The pin is not on the card. You're responsible yourself for keeping it safe.

The only way for a PIN to be stolen is if you wrote it on the card, or if it was forced out of you e.g. at gunpoint.

The latter is incredibly rare. The former is your own fault. That's why generally if a PIN was provided the liability is on the card holder.

Card skimmers.

Card Skimmers will only copy track1 and track2 of the magnetic strip. In order to get the pin you need an additional piece of equipment that records the pinpad, such as a well placed camera.

Many skimming devices do both... They even capture the CCV.

While this doesn't invalidate your point, I've seen recordings of people being coerced to give up their pin by someone acting like they are being helpful in getting an ATM to work. The guy of course has a skimmer and gets it later.

If you use Apple Pay there can be no fraud by hacking the retailer since Apple does not give the retailer your CC number but rather a token. Apple Pay is very quick and convenient and secure.

What damage will someone do? I guess you risk an occasional transaction you don't know about. Someone can hardly hit 100's of transactions quickly without flagging something. Also I'd be surprised if the banks don't already/shortly tie your location to the transaction as the swipe is increasing done from the phone (or they have your mobile banking app even if card based).

One thing I'm trying to change is get my partner to stop using a clone credit card they have of mine. It makes it hard for me to do my monthly scan of spending an know what what should/shouldn't be there.

Going forward I hope they get an e-ink screen on the card showing the last spend amount. I dislike when businesses swipe small transactions and you cant see the terminal amount. I generally ask for the receipt in these cases but having the most recent spend on the card would make things that little bit easier.

Couldn't the "PIN-required" threshold theoretically be a user preference encoded on the chip?

As far as I know that is the cards's choice. My card does unlimited via nfc but it prompts for a pin when over a limit or number of purchases.

Reply on news.ycombinator.com