8

I have been using my credit card in Asia. Vendors frequently commented that what I was doing was insecure because my card didn't require a PIN and was not contactless. I got a new card that is contactless (it's a debit card, but I don't think that makes a difference for this question). The debit card transactions haven't required a PIN either, but no one seems to think it's insecure like they do when I use the credit card.

Is there a difference in the amount of security between these two cards?

9
  • This is something of a cultural/religious argument. US credit cards have legal protections US debit cards may not. I would certainly continue using my credit card.
    – keshlam
    Commented Feb 15 at 17:16
  • There are also mostly-cultural differences in whether card alone, card-plus-pin, or card-plus-signature is accepted by the vendor and)or bank, though that has been slowly normalizing
    – keshlam
    Commented Feb 15 at 18:57
  • 2
    I'd say that any card without PIN is terribly insecure !? Commented Feb 16 at 9:19
  • 1
    @Peter-ReinstateMonica Not really. Your card would have to be either physically stolen or skimmed with a cloned card used at a magnetic stripe reader in order for having a PIN or not to make a security difference. U.S. banks prefer to accept that liability in lieu of requiring cardholders to use a PIN because they found cardholders are less likely to use the card if it requires use of a PIN, which costs them much more than the fraud, especially after the widespread adoption of EMV chip cards. It might be more problematic in places where pickpocketing is more common, though.
    – reirab
    Commented Feb 16 at 15:33
  • @reirab Exactly. Now I need 2FA to even look at my account statements but to anybody with my card my bank says "ah, sure, go ahead, take the money!" Commented Feb 16 at 16:39

3 Answers 3

7

tl;dr: Contactless payment without a PIN is not more secure than contact chip without a PIN unless you're making a purchase at an automated kiosk where a thief may have installed a skimmer on the card slot.


Long answer:

The primary (and probably only) security advantage of using contactless instead of the contacts to do a transaction is that it generally protects you against skimmers. At least in some parts of the U.S., skimmers have especially been a problem at gas stations (where payment is almost always done at the unattended pump.) While you can't gain much (or any) useful information with a man-in-the-middle attack against the chip contacts themselves, attackers would put skimmers on top of the slots where you insert your card. As you insert the card for the legitimate part of the machine to read the contacts, the skimmer (designed to look like part of the legitimate card slot) would read the data on the magnetic stripe, which, unlike the chip, is not secure. The card data could then be used to create a clone of the card for use with the magnetic strip.

Ironically, the very places where skimmers are most likely to happen seem to have been the slowest to adopt contactless payment in the U.S. I still sometimes encounter gas pumps that don't accept contactless, which seems insane to me.

Of course, U.S. credit cards almost always have little-to-no consumer liability in the event of fraudulent purchases (I think the legal maximum liability is something like $50, but, in practice, it's $0 for most U.S. credit cards that I'm familiar with.) U.S. banks will generally make you whole if fraudulent purchases happen on your debit card, too, but, since those directly hit your bank account, your bank balance will temporarily be affected by the fraudulent transactions until the bank reverses the charge. This could cause other charges to be declined, including checks bouncing or electronic funds transfers being rejected for insufficient funds (or ATM withdrawals failing, etc.) With a credit card, your bank balance is not affected until your pay off your credit card bill and you are not required to pay transactions that are under dispute, even if they remain in dispute when your statement due date occurs.

Since U.S. credit cards generally don't require a PIN, then skimming the card is sufficient to make transactions with a cloned card by using the magnetic stripe.

As far as the lack of a PIN itself is concerned, unless the merchant actually had a skimmer attached to their card reader, the only difference for PIN vs. non-PIN is 2-factor authentication. That is, needing something you have (the card) and something you know (the PIN) in order to make a transaction. 2FA means that even if someone actually stole your card (not just skimmed it,) they still wouldn't be able to use it to make purchases, even with the chip, unless they also watched/recorded you type in the PIN or otherwise obtained our PIN. In particular, tap + no PIN is not any more secure than contact chip + no PIN when the card reader is known to have no skimmer installed. Skimmers are mostly only a concern at unmanned automated kiosk vendors, not so much at manned merchants where a thief installing a skimmer on the card reader is typically not a practical attack vector.

As far as the reason for the difference, U.S. banks found long ago that requiring a PIN to be entered to use a card caused people to use their cards less often and/or prefer other cards that did not require a PIN. They found that the business they were losing a result of this well outweighed the additional loss due to fraud enabled by lack of 2FA. This became only more true for chip transactions, which cannot be made with skimmed cards. Thus, U.S. banks mostly opted to not require PINs for non-cash-advance transactions on their cards (almost universally for credit cards and eventually debit cards mostly moved that way, too.)

12
  • 5
    Over here in the EU, many banks now have a habit of issuing cards without the magnetic stripe (thus only contact chip + contactless). That seems to address most skimming concerns. Are magstripe transactions still a thing elsewhere?
    – TooTea
    Commented Feb 16 at 9:24
  • 1
    @TooTea Yes, magnetic stripe transactions are still very much a thing outside of Europe. The US in particular was slow adopting chip cards, and there were a number of reliability issues with the terminals used here for them, so most chip card terminals here also have support for magnetic stripe transactions, and it has become normalized to fall back (manually) to that if things don’t work. That’s hung on through the adoption of contactless payment as well (which has also been slow in most parts of the US). Commented Feb 16 at 15:07
  • 4
    @gerrit I said it's no more secure except in the specific case of automated kiosks where skimmers are a significant risk (such as gas pumps.) It's insane that the one case where it actually does significantly improve security was the last one to adopt it widely.
    – reirab
    Commented Feb 16 at 15:21
  • 1
    @TooTea Most U.S.-issued cards still have a mag stripe, despite nearly all vendors (except some gas pumps) having supported chips for many years. As Austin said, it's still available on most (though not all) card readers. Some merchants don't actually have it enabled, though.
    – reirab
    Commented Feb 16 at 15:27
  • 1
    @DavidJacobsen They didn't have PINs before the switch to EMV chip cards, either, for precisely the reason I already mentioned: requiring a PIN was determined to cost more in lost revenue than not having one did in fraud. In 2015, they started shifting the liability for fraudulent transactions to the merchant if they were presented with an EMV chip card, but the merchant was not equipped to process those. The banks still absorb the loss if an EMV card is stolen and used for fraudulent transactions at an EMV-equipped merchant, though.
    – reirab
    Commented Feb 16 at 21:31
4

There are very different protections afforded to you by the law and your cardholder agreement between credit cards and debit cards, and between PIN and PIN-less transactions (especially on debit).

Whether it's contactless or contact matters less (or doesn't at all) to your liability, but may affect the ease of cloning the card. Generally magnetic stripe and the embossed numbers are the most easiest to copy, and both of these methods have been phased out at this point universally. I haven't seen anyone "ironing" cards since the turn of the century and the modern cards aren't even embossed, and magnetic stripes are out of use (for most parts) even in the US.

The contactless wireless protocol and the contact chip-based protocols both are comparably secure.

2
  • 1
    Thanks for the good answer. My credit card is contact (chip-based), my debit card is contactless, yet the former is seen as insecure here. I thought because it doesn't have a PIN, but my debit card doesn't either. Commented Feb 15 at 20:06
  • @Ken-EnoughaboutMonica from technological perspective chip-based cards are the most secure. I honestly can't elaborate on other people's beliefs, especially when "here" is not well defined, or "seen as" is not exactly the same as "are".
    – littleadv
    Commented Feb 16 at 19:20
0

In sane jurisdictions, non-contactless use always requires a PIN, and contactless payments are capped at a relatively small amount (except via smartphones or smartwatches, which is the safest of all), plus after spending a somewhat larger but still fairly small amount using contactless, your PIN will be required the next time the card is used. That’s how you make it reasonably secure.

2
  • 1
    I've noticed there are two different systems in place. In the UK for example, if you go over your contactless limit, then you have to insert your card and enter the PIN. In Greece and other countries, you if you go over, you just enter your pin and don't need to insert your card. Commented Feb 16 at 18:55
  • 1
    That doesn't answer the question though. "That's how you make it reasonably secure" is not really true. You're describing a difference between PIN and PIN-less transaction, not contact and contactless. As mentioned in the comment above - these are orthogonal.
    – littleadv
    Commented Feb 16 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .