Hacker News Reader

Comment by cbm-vic-20 | Hacker News Reader

American here- most retail terminals here support NFC and chip- I haven't used magstrip in a retail environment for years- even mom-and-pop shops support NFC. Most gas stations accept chip, but not many accept NFC yet, though I'm seeing it more and more. Some gas stations still only accept magstrip.

We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about.

View on HN

>>which is something that a lot of foreigners freak out about.

Well yes, we're being told by our banks specifically that if you give anyone your card and they walk away with it, they won't cover you for fraud. The card has to stay in your sight at all times. In fact if you are in EU and you find a business that does this, you can report them to Visa/Mastercard and they will get a warning if not outright lose their terminal.

> We still have the stupid policy in restaurants where you hand your card to the server and they walk away with it (their terminals are usually chip), which is something that a lot of foreigners freak out about.

And rightfully so! What is stopping them from copying the PAN, expiry date and CVV2? I wouldn't give my card to anyone - that's what portable (wifi/BT) terminals are for.

What stops a server with a good memory from looking at your card as they put it in their terminal and remembering it for the 30 seconds it takes to walk away and note it down? They already reliably remember fairly complicated table orders which have got to have more bits of entropy than a credit card number.

Credit cards handle risk very differently than we do for account passwords. They expect numbers to leak regularly, but the downside of a leak is bounded in a way that password leaks often aren't, and the issuers and merchants eat those losses as a cost of business.

Nothing stops them. It's just harder, so fewer people could do it.

Here in Canada, servers never touch your payment cards. They hand you the wireless card terminal and you insert it yourself. Or you pay on your way out at the front counter at a standard terminal.

Even at drive-through restaurants, the cashier hands you the entire corded terminal through the window (well, most of the time contactless payments are used, in which case they simply hold it out for you to tap your card until they hear a beeeep). During Covid, most places mounted them on the end of a stick, and that practice has continued even once social distancing requirements were lifted.

I use my phone it doesn't even show the number, but you can cover the number in case of random servers who can remember 16 digits effortlessly in 2 second

No security is perfect but that's no reason to skip basic easy precautions

I always scratch away cvv2 code from a card.

Reply on news.ycombinator.com