Credit Card Signatures Are About to Become Extinct in the U.S

Normally, I pay for everything with American Express. Would you recommend I get a different card for London? I wonder if there's a US card that support chip and pin?

I also found this Visa page explaining that PIN isn't used in the US because it's too expensive:

https://usa.visa.com/visa-everywhere/security/the-cost-of-pi...

For a long time after EMV chips were introduced, the liability was actually shifted back to the customer. EMV chips were initially a huge step backwards for customer protection, and it took some years before this was fixed in law across Europe.

Nowadays, if you see a merchant who can't accept EMV chips, it's likely their POS vendor who's liable. The merchant is liable in theory, but some vendors still don't provide EMV-capable terminals, so they've agreed to assume the risk until they do.

"The last fraud"? Are frauds so rare that it's meaningful to talk about the last one?!

The issuers. Of course, Mastercard has some influence over them... But they certainly can't unilaterally dictate conditions to them beyond whatever contract they signed.

There's also the fact that, even if issuers handed them out, the machines and merchant processors also have to support them. Which was something that still hasn't completely happened in the US, even with the networks pushing as hard as they could. (Moving fraud liability to the merchants is about the biggest move they could make.)

Anyone with some insight as to why want to chip in?

When I go to the U.S. I usually have to produce ID when using my credit card. Is this because I am from out of country or do they do this with everyone paying by credit card?

Everyone uses NFC credit cards now (and if the amount is over ~$40 or a daily limit has been reached, with pin).

For us, chip and pin is basically deprecated, and no one has used magnetic strips in a decade.

It's a bit of a prisoners-dilemma thing: new technology can only be adopted with sufficient coordination, but each individual party is only interested in cooperating if they think they will "win" from it more than their competitors.

The US seems to be a very bad place for consumer advocacy in general. Perhaps it's seen as "anticapitalist". I don't know if the patchwork regulatory environment of the states helps or hinders this?

Just what does the CC system offer over debit?

even in cases of fraud?

Well, the payee is also usually verified to match the destination account, and a few other elements are technically required for it to be a legal financial instrument (even if banks don't spend the time to check them every time). Legally, a check could be written on the back of a napkin and still be valid - as long as it has a few required details.

The thing I've come to learn about checks is that their security features are not necessarily intended to prevent fraud, but rather to legally prove fraud after it has occurred. So no, banks often will not check those things, but anyone with access to the ACH network can reach into anyone's account and move funds around if fraud is suspected (it's basically a shared database with surprisingly little security). It inherently relies on the legal system to sort things out after the fact, which is a completely different approach from what we see in modern information security (where preventing unauthorized access/behavior upfront is the primary concern).

The other info on the check isn’t meaningless. It will (should) be examined when there’s some kind of fraud or dispute about a check payment - but it effectively does nothing to prevent fraud or theft.

In the old days, they would print a computer-readable version of the amount on the bottom of the check, right-justified with the account number. Once that was there, most banks just processed that, and ignored the rest of the check.

As you say, none of this will prevent basically any amount of money from being withdrawn from your account however. But you do absolutely have routes available to you to get your money back. If your bank blamed you instead and didn't let you know what options you had then you had a shitty bank that rolled you, you should get a new bank (or a credit union).

YMMV. Simple won't let me deposit a check made out to "Me and Wife" in my personal account - I can only deposit it in our joint. They'll permit me to deposit "Me OR Wife".

My renter's for 1.5 years wrote me cheques with payee of wrong first name, and typo in last name.

No issues depositing any

Ha! Not even that. In the cheque clearing process, about the only thing that ever gets checked (even by automated processes) is the MICR line (account/transit and institution number).

Everything else (EVERYTHING ELSE) is just assumed to match whatever the person entered at the ATM/image capture app/teller window. The bank considers it your problem, as the cheque writer, to catch any issues on your next statement, and then they'll review the image of the cheque (in many jurisdictions now, the physical cheque is destroyed pretty early in the process). You should really never ever give a cheque to someone you don't trust. It's pretty silly, but that's the reality.

Although, fun fact, it's the cursive amount that is the 'official' one if there's a mismatch between that and the digits, since it's much more difficult to subtly adjust that.

Source: work for an institution that processes literally millions of cheques (I'm not in that area, but yeah).

http://www.wastedtalent.ca/comic/unavoidable-result

It also depends on the teller, how much of a hardass they are going to be about cashing it. I guess I don't know what the protocol is for for mobile deposit, they may or may not have manual review.

Unfortunately most US cards don't use a pin code at all. There are a few issuers that provide you with a pin code, but even in those cases there's typically a signature preference and the pin code is only used as fallback if the terminal doesn't support signatures. So if you're using a US card in Europe pretty much the only places where you can use the pin code are automated terminals (e.g., at train stations). At most other places you're going to have to use a signature.

There are a few US issuers that issue Chip & PIN cards with PIN preference - for example UNFCU and First Tech Credit Union. Those cards work great in Europe, but are sometimes a pain to use in the US. E.g., if you're paying at a restaurant and you have to go with the waiter to the terminal in some backroom, because the terminal asks for the pin. That's not an issue in Europe, as waiters usually carry mobile terminals with them.

I have one credit card that I mostly don't use anymore, and keep the account open only because it does chip + PIN so I can use it at train-station kiosks in Europe.

Don't feel so bad - remember that we invented the credit card.

Also the phone.

And the Internet.

I don’t give two shits what you put down as a signature, I just want a record that you consciously were present and signed something, so I don’t get accused of trying to pass off something quietly that you never agreed to.

If I have some scribble you made at a time and place, the onus is on you to prove it wasn’t you who did that.

Yeah, I know :'(

> thanks to the number of signatures required.

What!? You found that the hardest part?

One of the problems I came across was the number of things I had to send through the postal system. Apparently scanned documents (signed) weren't good, and using a fax machine wasn't an option either.

So I had to print forms, sign them, and then mail them - always with tight deadlines. Luckily only one piece of mail was lost en route, and it was skipped in the end.

(I also had to mail back the physical bundle of title-deeds, something I was told previously was all electronic these days. Fascinating documents though, I remember when we paid off the property we received them and there are copies of each sale contract/price details since the place was built in around 1890. First sale was for £400, then the next for £1200, and every 1, 5, 20 years it would sell for more. Went for £162,500 when I sold it. That's a huge jump from the starting price!)

The rest of the world does not tip (Europe & Asia). Only in North America is this awkward tipping practice still a thing.

Whilst there's no way I'd ever subscribe to current mentality of tipping 10% when unhappy and 15-20% when happy I'm not sure I'd want to remove tipping entirely. It should be exceptional times when one tips, i.e. really got above and beyond - not just doing their job.

I rarely remember to sign my cards and this tripped me up one time last year when trying to return something to a store which I'd bought online with my credit card.

I had to leave the store, buy a pen, sign the card and re-enter the store.

Fraud cause from in-person transactions is very low and hence our merchant fees are also very low. 10-20¢ for debit transactions and approx. 1.2% for credit transactions.

> Unsigned Cards

> While checking card security features, you should also make sure that the card is signed. An unsigned card is considered invalid and should not be accepted. If a customer gives you an unsigned card, the following steps must be taken:

> • Check the cardholder’s ID.

> Ask the cardholder for some form of official government identification, such as a driver’s license or passport. Where permissible by law, the ID serial number and expiration date should be written on the sales receipt before you complete the transaction.

> • Ask the customer to sign the card.

> The card should be signed within your full view, and the signature checked against the customer’s signature on the ID. A refusal to sign means the card is still invalid and cannot be accepted.

> • Ask the customer for a different signed Visa card

> “See ID”

> Some customers write “See ID” or “Ask for ID” in the signature panel, thinking that this is a deterrent against fraud or forgery; that is, if their signature is not on the card, a fraudster will not be able to forge it. In reality, criminals often don’t take the time to practice signatures. They use cards as quickly as possible after a theft and prior to the accounts being blocked. They are actually counting on you not to look at the back of the card and compare signatures; they may even have access to counterfeit identification with a signature in their own handwriting.

> In this situation, follow recommended steps listed above under Unsigned Cards.

https://usa.visa.com/dam/VCOM/download/merchants/card-accept...

In the US I have my real signature at the back of the card but I just draw a straight line when signing the receipt. No one ever complained about that.

In Europe I sign with my real signature (because I know that cashiers there are more strict) and even then sometimes hear complaints that the signature on the receipt doesn't exactly match the one on the card.

Most stores have an automatic system where they require pin if a payment has bounced before and in random intervals. But using the direct debit system instead of PIN is so much cheaper that even higher fraud rates don't matter much.

But in general you can't actually sign anymore, you have to either use PayWave or chip and pin.

This sounds like the old myth that "if you don't sign the back of your card, you can't be held liable for the debts you incur if you contest it later."

This is of course not true.

This is in fact the only reason for a signature, it does fuck all to identify somebody, even if merchants were to check it, which they never do.

But with the amount of CCTV nowadays, that's probably more reliable than a signature.

Also ironic that anybody would describe PINs as the next step, I can't remember a time before PINs were used. Even EMV contactless payments are pretty common now, and provide benefits to the banks (liability shift/less chance of PIN compromise) and customers (quicker).

It's not a tech problem, it's a cultural one. You don't realise how much less friction, less hassle it can be until you've lived it. From my time in the US, it seems like it isn't exposed to outside ideas that much, maybe due to it's size.

The EMV standard includes a purchase total verification step where the customer is shown the number and must press OK to confirm. But again speed has been considered more important. That OK? prompt is going away and Quick Chip will first authorize a dummy amount and send the real amount after the transaction is totaled up. It's not like USA market was using PINs for two factor authentication anyway. Restaurants are allowed to adjust purchase totals for tips and closing out tabs.

The thought process is that my UK drivers license has my picture, full name, and signature. The merchant looks at the ID and sees my photo next to my name, checks it with the name on the card to see if they match, then checks the signature against that on the ID. Unless a thief has the same name as me, they can't use the card as either the photo or the name won't match. The signature doesn't matter as it will be caught in fraud alerting / rejected by the bank.

Not so sure about that. If I use a different mouse then my "signature" using those metrics will fail, as I'm basically a completely different (inept) person using other mice. Just an example, but I don't think that e-signatures can be trusted by using machine learning techniques, at least not any that I know of today.

CC networks currently use previous purchasing patterns, location, time of day, etc.

It's the same reasons why biometrics is not a magic security solution. Authentication must be based of something that's hard to fake, cheap to verify, random, and easy to change. What threshold would you set to balance false negatives and false positives? In comparison the private key in your chip card meets all of the criteria.

Also, since developing a disability in my hands, that _can't_ be the case -- there _will_ be variations in stroke speed due to level of pain/stiffness at the time.

Your right, can we also remove that stupid bag tax in SF. It easily takes 20 - 30 seconds per transaction.

"Do you want a bag?"

"Ugh, yeah I do"

"Alright that's 50 cents"

"wait, could I get three bags, not two - I don't want my bag to rip"

"Sure, we can do that, 75 cents"

Every. single. time.

The USPS sadly still forces credit card users to have signatures on the back. They don't check signatures against the PIN pad / signed receipts, but the clerk will either yell at you or refuse the transaction if you have "Ask For Drivers License" on the back of the card. This has happened to me on more than one occasion.

Never once stopped me using them. I'm glad for it because my signature isn't exactly consistent.

In fact, I don't think the swipe and signature method is generally allowed in the UK.

During election years, I always tell myself I'm going to sign as the presidential candidates, but I never get around to it.

I believe the latter is the generic notification sound and vendors who customized their solutions post-chip swapped it. I just can't remember which is which right now.