Hacker News Reader

Comment by peapicker | Hacker News Reader

Interestingly, this last year, many businesses I frequent updated to new Verifone terminals. My credit card doesn't read on only that brand of terminal (works everywhere else i use it), unless I wrap it in a piece of receipt tape or plastic bag before sliding it thru, then it works after a try or two. Not sure why, but I haven't replaced the card yet simply because it is an interesting experiment.

View on HN

> before sliding it thru

The US are still using magnet stripes?

Yup, it's rather quaint at this point!

Yes. We're just now transitioning to chips. My cards are gradually being replaced with chip cards, starting last year. In October of this year, new rules will come into effect that basically require all cards and terminals to use chips, by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip. (In other words, merchants will foot the bill for fraud if they don't upgrade their terminals.)

We're taking our time, but we're finally moving there.

Edit: despite having chip cards, I've yet to be able to use the chip in the US. Many places now have chip-enabled terminals, but often not set up to use the chip part, and after a few failed attempts I just gave up on it.

This happened to me at Costco the other day. Chip capable terminal but it didn't do anything. The guy at the register had never seen anyone try to use it before. He didn't even know the new slot was there.

In October of this year, new rules will come into effect that basically require all cards and terminals to use chips

How does this affect Square and similar peripheral readers for mobile devices? Will users of those now be liable for fraud?

Good question. Looks like the answer is, yes, you will be liable just like anybody else, and just like other providers, Square will start providing chip readers. They have a page about it here:

https://squareup.com/emv

Interestingly, it looks like this may be the end of the model where the reader is so cheap they can give it away for free, as they list it for $29.

I do quite like their tiny reader, and I'm wondering if it uses some sort of modem for comms over the audio port...? Kinda cool.

I believe they've been using a modem sort of setup for a while, and this is probably the same sort of thing.

Their original reader was pretty much a magnetic reader head hooked straight to the microphone port, decoded by Square's software on the phone. You could record your card's stripe using a voice recorder program (I tried it for fun) and you'd get this fun squeaking noise from it.

Square's competitors eventually tried to discredit them by pointing out that this data was unencrypted, and that meant that Nefarious People could Steal your Precious Card Data using a Square reader. Square eventually responded by changing over to a reader that encrypted the magstripe data before communicating it to the phone, meaning there must be some sort of digital communication happening over the audio port.

OK, that's interesting, I had assumed that the older readers had simply transmitted the analogue signal generated by moving the mag strip through the reader, and was wondering if maybe the new one just attached to the mini-jack port and did its actual comms over bluetooth. But if they've already got a digital data transmission system in place then that's a whole different game.

Thanks for the insight!

here's Square's FAQ page for the liability shift. the short answer seems to be yes, starting in october if you're using square you're liable for any fraud.

https://squareup.com/townsquare/emv/

> by putting the liability for fraudulent magstrip transactions onto whatever party was responsible for not being able to use a chip.

What about tourists and alike?

No idea. There might be different rules for foreign cards. Otherwise, the card issuer which could have issued a chip card but didn't would be liable, as I understand it.

The first hard date for when liability for magstripe fraud starts switching from credit card companies to merchants is this October.

My understanding is that merchants are already liable in most cases. What happens in october is the possibility for the bank to be liable in case the merchant supports chip and pin but the bank does not.

I'll just add that starting in October, the merchants will be liable for magstripe transactions completed with counterfeit cards but not for those coming from other type of frauds (e.g lost/stolen cards) as long as the merchants have proper card acceptance procedures.

Yes, but we also don't have to pay for it when someone steals our card. (Well, not directly anyway.) Don't most countries with Chip & PIN place at least some liability for fraud on the consumer?

Nope.

Legally (in countries I know about, Europe mostly), the liability is with the bank. They might ask if you gave your PIN to anyone else (you should not do this!) but there's no consumer liability.

The liability shift with Chip & PIN is from the bank to the merchant. If the merchant accepts an old-fashioned stripe transaction they accept the risk for themselves.

The US is moving to Chip & Signature, rather than Chip & PIN, but the liability will still shift to the merchant, not the buyer.

http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur...

Well, it's a good start, and Chip & PIN is just a terminal capability flag and a CVM list alteration away...

Until 2009 the liability with chip and pin was with the consumer to prove that they had not told anyone their PIN as there seemed to be a legal assumption that the system was secure, only recently has the bank been forced to prove that the customer has been negligent, after Cambridge security researchers proved that chip and pin systems have exploitable vulnerabilities.

I'm interested in liabilty for what though.

I've been subject to fraud that could only have taken place because someone observed my PIN (or obtained it some other way). The actual fraud took place in another country where there is no EMV though.

I know the Cambridge research has turned up some interesting stuff - it's possible to use a man-in-the-middle between the card and the reader to convince the reader that a PIN has been entered and verified when no such thing has taken place - but I wasn't aware much of that had been seen in the wild.

--edit-- and it still involves a stolen card at that point doesn't it?

Someone could have man in the middled an online purchase and then used your card details that way. Buying online while using wifi or mobile can be hijacked with a fake router or base station.

>> Someone could have man in the middled an online purchase and then used your card details that way.

Not if they were using my PIN as that's never used online. Had to be a physical purchase to get that. As a workmate was subject to similar fraud at a similar time we figure it was probably a bar or restaurant we'd been to together, where our cards were skimmed and someone either watched or recorded us entering PIN details.

They shift the burden of proof to the consumer, but fraud is still covered in some cases. You're probably not covered if you give the pin to someone or if you transfer the money yourself. There are many cases of people losing tens of thousands of pounds this way.

>> There are many cases of people losing tens of thousands of pounds this way.

I frequently work in this area and have not heard these stories. Fraud is always covered on credit cards in the UK (for example), by law, and I'm pretty sure it is on debit as well.

I think it goes like this: If you gave someone your PIN you broke contract with the bank, but you also authorised the transaction. Similarly if you did the transaction you can't argue that you didn't authorise it - mistakes happen, but the bank isn't usually liable for your mistakes.

And how exactly do you PROVE you didn't give anyone your pin? If the only way they put the liability on you is if you admit you gave someone your pin, it seems stupid to even bother.

To me, knowing how things usually work in the US - they'll claim it's an on your honor system, and then suddenly it will be "well we think you gave someone your pin so we aren't covering the charges". Conveniently a lawsuit will be more expensive for you, the consumer, than just paying off the fraudulent charges.

In my experience in the UK you don't have to...

But then my (chip) card was cloned to a mag-swipe card and someone attempted to use the clone in an ATM in Canada. I don't really know what happens if someone manages to get your original card and your PIN. AFAICT there's not a lot of fraud that happens this way.

What about the courier fraud and the ringback fraud?

I think the bank could argue you didn't take reasonable care if you spoke the PIN but if you typed it in ... technically you didn't give it to a person? Everything I've read says the bank have to prove you didn't take reasonable care; I suppose that a convincing enough fraud would mean you were safe from that accusation whilst just "give me your PIN and I'll go to your bank for you" wouldn't. Not sure if there's any caselaw to follow none of the newspaper reports on fraud convictions like this seems to mention it??

>And how exactly do you PROVE you didn't give anyone your pin? //

In the cases I've heard of it's something like a conman comes to the door, wants money "for a building job" or just "for charity", whatever. Says they'll get you the money from the bank, you give them the card and PIN, the bank then isn't obliged to cover the loss.

The measure in the Lending Code (a UK financial institution code of practice) is that provided you've taken "reasonable care" then they cover frauds; giving someone your PIN or writing it down with your card constitute not taking reasonable care.

That seems quite fair to me.

http://www.choose.net/money/guide/faqs/credit-card-fraud-vic... gives good detail. The Lending Code website doesn't but the full code is at http://www.theukcardsassociation.org.uk/individual/lending-c... with additional info, again the UKCA is an association of credit/debit card issuers in the UK.

The majority of ATM fraud involves card skimmers. Sure, you gave the thief the PIN, but there is no way you meant to.

See http://krebsonsecurity.com/all-about-skimmers/ for more on how that happens.

And hopefully the chip effectively kills those... hopefully. I know a few flaws have been found.

The only time I've been subject to fraud in recent years, incidentally, was when my card was skimmed in London and then the clone used to attempt an ATM withdrawal in Canada. So clearly the skimmer had seen me enter a PIN, skimmed the magnetic stripe and then sold the details to someone who could use it in a country where those two things were enough.

Needless to say, I got the money back pretty quickly.

>Sure, you gave the thief the PIN, //

That's not giving it, it's having it taken. What constitutes giving your PIN is someone saying "give me your PIN" and you saying "it's XXXX"; similar provisions apply if you wrote the PIN on the card, or made the PIN available in an obvious place. Basically then you've subverted the potential protection of having a PIN.

In the UK being caught by a skimmer does _NOT_ mean you didn't take reasonable care, your maximum liability by law is £50. See eg http://news.bbc.co.uk/1/hi/business/3256799.stm.

Yes, you're right, sorry.

I was thinking of the courier fraud but that seems to be covered. The other version of that where they make the victim make a BACS transfer doesn't seem to be covered in the same way.

Reply on news.ycombinator.com