Personal Finance & Money Stack Exchange is a question and answer site for people who want to be financially literate. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the U.S. finally making the transition to EMV technology, I am surprised that the major banks are going with Chip+Signature technology over Chip+PIN. I think it is far more convenient for the consumer to use Chip+PIN rather than signature. Why did the major banks decide to go with Chip+Signature over Chip+PIN?

I don't remember where I heard this but I believe Visa has stated it will support Chip+Signature only, and MasterCard will primarily issue Chip+Signature but could also process Chip+PIN.

share|improve this question
    
Can you explain why this is a question about personal finance? It's a little unclear at the moment. – ChrisInEdmonton Feb 24 at 14:49
7  
EMV and Chip+PIN questions have historically been asked: money.stackexchange.com/questions/54772/… Additionally, I personally want to know, as a consumer and not as an industry professional, why I cannot use Chip+PIN at a merchant terminal; why am I pigeonholed into Chip+Signature? – Jesse Feb 24 at 14:58
2  
Seems entirely on-topic to me. – Joe Feb 24 at 15:43
    
gaining? it's already here, and has been a mandate for years now. – sgroves Feb 24 at 23:54
    
Note that Chip & Pin method is not necessarily more secure as it has various problems. As customer I have more faith I will have less trouble – Maciej Piechotka Feb 25 at 2:39
up vote 23 down vote accepted

Krebs on Security had an excellent article on this subject in late 2014 (right as the US was starting to transition to chip-and-signature). A few initial details:

  1. US Point of Sale (POS) systems do generally support chip-and-pin. The issue isn't technology - that technology (PINs) has been in the US for years, allowing deibt cards to be used at POS systems. Adding the chip acceptance was the difficult technological step. If you're European, you may have to enter a PIN at the register.
  2. Chip and Pin versus Chip and Signature versus Signature priority are chosen by the issuing bank. US banks have all chosen Chip and Signature priority over Chip and PIN. A few banks do allow you to set up a PIN in case you travel to Europe and need to use a machine that is uses offline authentication (which likely will only accept a PIN).

Now - as far as why, Krebs' article notes a few reasons.

First off, Chip and PIN doesn't protect against a very common kind of fraud, nor a very expensive one. The only advantage a PIN gives you is the protection against physical theft. That doesn't happen very often, and when it does happen it often is reported quickly; so it's not very expensive to the banks. Attrition (people choosing to use a different card or no card at all) is a risk when moving to a different technology, and the attrition from requiring PINs may well cost the banks more than the fraud from stolen cards.

The PIN only addresses fraud when the card is lost or stolen, and in the U.S. market lost-and-stolen fraud is very small in comparison with counterfeit card fraud.

Second, Chip and PIN doesn't tend to protect against fraud for very long; criminals adjust their methods, and it ends up being equivalent to pre-Chip and PIN.

Also, as we looked at other geographies — and our research has substantiated this — as you see these geographies go chip-and-PIN, the lost-and-stolen fraud dips a little bit but then the criminals adjust. So in the UK, the lost-and-stolen fraud is now back above where was before the migration.

Third, adding PINs gives thieves another avenue to steal money: ATMs. While many cards have PINs now that allow you to withdraw money, most people don't use them - and so can't have their PINs stolen. Withdrawing money from an ATM can be a more significant loss for the bank. In addition, ATMs don't generally use Chips right now in the US, meaning if the PIN can be stolen (through social engineering, a hack, etc.) it can be combined with magnetic stripe data to steal money from ATMs.

Most card issuing banks and Visa don’t want PINs because the PINs can be stolen and used with the magnetic stripe data on the same cards (that also have a chip card) to withdraw cash from ATM machines. Banks eat the ATM fraud costs. This scenario has happened with the roll-out of chip cards with PIN – in Europe and in Canada.

Fourth, issuers don't want to change two things at once; they'd prefer to roll this out in steps. Some issues in Canada's rollout may have been informative to this.

“We don’t really think we can teach Americans to do two things at once. So we’re going to start with teaching them how to dip, and if we have another watershed event like the Target breach and consumers start clamoring for PIN, then we’ll adjust.” So the issuers I spoke with wanted to keep it simple: Go to market with plain vanilla, and once we get this working, we can evaluate adding some sprinkles and toppings later.

And Canada's issues:

There was a Canadian issuer that — when they did their migration to chip — really botched their chip-and-PIN roll out, and consumers were forgetting their PIN at the point-of-sale. That issuer saw a significant dip in transaction volume as a result. One of the missteps this issuer made was that they sent their PIN mailers out too soon before you could actually do PIN transactions at the point of sale, and consumers forgot. Also, at the time they sent out the cards, [the bank] didn’t have the capability at ATMs or IVRs (automated, phone-based customer service systems) for consumers to reset their PINs to something they could remember.


So there are many reasons - largely reasonable ones, at least from the merchants' point of view - that we haven't moved to Chip and PIN in the US yet. For all of the insulting remarks about Americans not being able to remember PINs (not true, we remember debit PINs fine), that is really quite a small part of it.

One of the analysts mentioned that we may eventually move to get away from the magnetic stripe once Chip and Signature is fully accepted; that would be the most helpful thing in terms of credit card security.

Once mag stripe goes away, chip-and-PIN will be a very strong solution. The estimates are now that by the end of 2015, 50 percent of the cards and terminals will be chip-enabled, but it’s going to be several years before we get closer to full compliance. So, we’re probably looking at about 2018 before we can start making plans to get rid of the magnetic stripe on these cards.

share|improve this answer
1  
"While many cards have PINs now that allow you to withdraw money, most people don't use them " How do they withdraw money? – CodesInChaos Feb 24 at 16:44
1  
@CodesInChaos: from a debit or ATM card – Jacob Krall Feb 24 at 16:49
    
Most people don't withdraw money using their credit cards; they only use debit cards (which may also work as credit cards). Therefore, while it's always been possible to steal those cards' stripe data and PINs, it's less common as they're used less frequently and often have lower balances available. – Joe Feb 24 at 16:58
1  
@BrianKnoblauch Now imagine how it is for many Germans, who are using their credit cards only a few weeks a year, namely during vacation. – Alexander Feb 25 at 11:01
1  
@sgroves That's because your chip cards have chip+signature as the primary method of authentication, of course. Offline machines are common at train stations and a few other specific use cases (vending machines, perhaps); those sometimes require PIN, sometimes allow no authentication. – Joe Feb 25 at 15:09

This seems to be the card-issuing banks' preference. My Visa chipcard came up as chip-and-sig most places, including overseas in places where chip-and-pin is more common. I suspect it's a matter of progressive rollout of software changes.

share|improve this answer

Chip and PIN has some basic flaws, probably more human than technological.

First, the PIN is too short, making it easy to eyeball whilst someone is entering it. Many PIN terminals are not adequately protected from line of sight. Next time you are bored in a queue, play the "spot the PIN" game, rules are you not allowed to shuffle about, but you score points from working the pin out from either the finger position or just seeing the number entered. Once you are armed with the PIN, see how many people don't take adequate care to put the card out of the reach of pickpockets. If you can remember your mobile telephone number (10 digits) you can remember a longer PIN.

Second, I know of at least one couple who regularly swap cards for shopping/petrol/cash and know each others PIN. This is against all the rules of card issue and for good reason.

A better method would be to have a photograph of the card owner engraved on the card along with the chip which stores a hash of a digitised signature. By forcing the retailer to have possession of the card and check that the picture matches the bearer and the signature on a digitiser matches the hash on the card, both these problems would be eliminated. Photographs do change over time, but clearly I don't change from a male to female and if the card bearer is clearly of a different race, suspicions should be aroused.

I raised these concerns with my card issuers when chip and pin was introduced, but none of them could be bothered to reply with anything more than a "we are satisfied with our security" generic letter. I'm not convinced they really do want a secure system, just one where blame and responsibility can be shifted to someone else.

share|improve this answer
    
How does Chip-and-Signature fix any of these problems that you see with Chip-and-PIN? – Ben Miller Feb 25 at 15:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.