3

I'm a little concerned because I just payed to get access to Spotify Premium and it only asked for my card number and 2 other details that were on the card. Nothing like a PIN. Also I noticed that at an airport the ticket machine just asked you to put the card in and it never needed a PIN, yet a transaction was made. How is this possible. Surely then anyone who could steal my card can pay for things like this because all the details they need are on the card?

Spotify said it would do something with 1p to authorise it, but I don't see how that confirms that it's me using the card?

Improve this question
2
  • 1
    Is this a question for the US or Europe / the UK?
    – user296
    Jan 25, 2011 at 0:39
  • UK (spotify isn't in US)
    – Jonathan.
    Jan 25, 2011 at 8:28

6 Answers 6

Reset to default
3

There generally isn't much in the way of real identity verification, at least in the US and online. The protection you get is that with most credit cards you can report your card stolen (within some amount of time) and the fraudulent charges dropped.

The merchant is the one that usually ends up paying for it if it gets charged back so it's usually in the merchant's best interest to do verification. However the cost of doing so (inconvenience to the customer, or if it's an impulse buy, giving them more time to change their mind, etc) is often greater than the occasional fraudulent charge so they usually don't do too much about it unless they're in a business where it's a frequent problem.

Improve this answer
1

As far as I'm aware, PINs are only used for in-person transactions, not 'remote' (over the Internet or phone).

Improve this answer
1
  • In The Netherlands, we make online payments through iDeal. The payment website redirects us to the bank website, we insert our bank card in a card reader and enter the PIN code, along with another code this gives the verification code that we tell the bank. I did a similar thing when closing my Swedish bank account by phone. I believe Verified by Visa and 3DSecure have similar systems.
    – gerrit
    Jul 8, 2015 at 16:59
1

For the first part of your question;
Refer to related question Why do some online stores not ask for the 3-digit code on the back of my credit card?

The other case of Airport ticket machines, requires the physical presence of card. The assumption is that if you had the card before and after the transaction, it was you who used it for transaction. As the amounts are small its really easy by anyone [merchant, Banks] to write this off. The only way to misuse would be if you lost the card and someone used it. Also these ticket machines would have built in feature where by you cannot buy more than "X" tickets for the day. Ensuring max loss on a stolen card is limited to a small amount.

Improve this answer
5
  • I really do not see how another number on the back of your card is anymore secure than the one on the front?
    – Jonathan.
    Jan 25, 2011 at 8:29
  • @jonathan it isn't. but in the US they ask for it and merchants are not allowed to store it anywhere (so it should be less likely to be stolen) I don't think Dheer knew what you meant by PIN (as in Chip&Pin, not CVV) because we don't have Chip&Pin cards in the US.
    – Michael Pryor
    Jan 25, 2011 at 18:37
  • Well whatever, it raises a point. Ok it removes the possiblity of someone getting all the details neede to use my card from a company's database. But it doesn't remove the more likely event of someone stealing my card or me losing it. Just because a merchant doesn't store one of the numbers on my card, doesn't stop someone taking it out my pocket. I don't understand how seemingly noone can see that the system is quite insecure, when it comes to physical stealing.
    – Jonathan.
    Jan 25, 2011 at 19:35
  • @Jonathan Everyone knows it's insecure, but the banks almost never lose a lot due to this kind of theft so they don't care. It would probably cost them more in overhead to support a good security model than to just pay out these small losses.
    – Matthew Read
    Jan 26, 2011 at 4:20
  • The number on the back isn't stored on the magnetic stripe (or in the PIN chip or the contactless chip). This means that anyone cloning the card is unlikely to have the CVV number.
    – Richard Gadsden
    Jul 20, 2015 at 10:05
1

Chip and Pin cards are popular in Europe, however in the US we don't have them. Visa/MC and Amex can issue chip and pin cards but no merchants or machines are set up here to take them. Only certain countries in Europe use them and since you could possibly have a US visitor or a non-chip and pin person using your machine or eating at your restaurant they usually allow you to sign or just omit the pin if the card doesn't have a chip.

It is definitely less secure, but the entire credit card industry in the US is running right now without it, so I don't think the major credit card companies care too much (they just pass the fraud on to the merchants anyway).

Improve this answer
1

Security in the merchant services system is mainly handled in two ways: 1) Before transactions are done, the business itself must go through an application process similar (but not identical) to getting a loan. Some high risk businesses must pay higher fees due to the increased likelihood of customer complaints.

2) When a customer disputes a transaction, that's a mark against the business. Get too many of these disputes, and your priviledge of accepting credit cards will be revoked, meaning you won't be able to again.

It's in the merchant's best interest to verify customer's identity, because disputes cost them money directly. It's in the servicer's best interest to verify the businesses integrity, because fraud drives up the cost for everyone else.

As a whole, it's quite a reactionary system, yet in practice it works remarkably well.

Improve this answer
4
  • But no company has anything to do with someone stealing my card and using it on any site. Why should it count against say Spotify, if Joe Bloggs takes my card, reads the front and the back and enters the numbers?
    – Jonathan.
    Jan 25, 2011 at 19:29
  • If Joe takes your card and you dispute the charge, Spotify loses the money they charged on your card. They also get a black mark on their record. Too many black marks, and Spotify isn't allowed to take credit card payments anymore. That, combined with all the money they have to pay back, is an incentive for them to tighten up their client identification.
    – Benjamin Chambers
    Jan 25, 2011 at 21:50
  • So spotify would get a Mark for someone stealing my card which they have no control over. I knew the money system was twisted but not this twisted.
    – Jonathan.
    Jan 26, 2011 at 8:14
  • As I said, in theory the system is quite flawed, yet in practice it works remarkably well.
    – Benjamin Chambers
    Jan 27, 2011 at 17:22
0

Like email and spam, fighting creditcard fraud is a cat and mouse game, with technology and processes constantly being developed to reduce fraud. The CVV on the back of the card is just one more layer of security.

Requiring the CVV generally requires you to physically have access to the card. CVV should not be stored by any merchant. This frustrates card skimming fraud as the CVV is not present in the track data and fraud caused by database compromises.

You should never use your PIN online. MC/VISA both have implementations of 3D-Secure (SecureCode for MC and Verified by VISA) which require a password / code to confirm card ownership. Depends on both Issuer and Merchant implementing the standard.

Regarding not needing a PIN at the airport, some low value transactions no longer need PINs, depending on the Issuer and Scheme (VISA/MC). MasterCard PayPass or VISA PayWave enable low value contactless transactions without PIN. In Australia, the maximum value for a contactless transactions is $100 AUD. At some merchants (McDonalds for example) a PIN is not required for for meals purchased with VISA (at least, for the cheeseburger I bought there as a test). This makes sense - if you don't need a PIN for a contactless purchase, why do you need it for a chip based purchase?

So - why allow PIN free transactions? On average customers report stolen credit cards / wallet very quickly and the losses are correspondingly small. As card issuers are always online, cards can be cancelled very quickly after being reported lost / stolen.

Finally, by performing transactions for just a few cents or pennies, the merchant (Spotify) can likely validate you are the owner of the card as you'd need access to your online bank to confirm the transactions. PayPal do this with bank account to confirm ownership. (Unless I've misunderstood your statement).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .