Chip Credit Cards--the US Retailer Perspective

Pamela,

"Does the cancel (retailer is supposed to hit cancel when using chip and sign cards which then prints a receipt for signing) option work when you use the chip and pin?"

I've never heard of the "cancel option" but nothing like that is required when using a Chip & PIN card. The card is inserted into the reader (whether at an automated location or staffed location), the PIN is entered and the transaction completes very quickly.

Regarding your last question, it's hard to say whether you will be getting proper Chip & PIN cards in the U.S. (aside from the few places that offer them now) but I suspect those won't be coming anytime soon.

This where all the non Americans roll their eyes, give a knowing smile and think, ' not this issue again!'.

In the last 25 months my swipe card and my pin and signature card has worked with out exception in Turkey, Bulgaria, Serbia, Germany, Montenegro, Croatia, Slovakia and Hungary.

The one and only issue was with my chip and signature card in a train ticket kiosk in Hungary. It asked for a pin. I put in 4 random numbers and it worked.

The cancel option was told to me by a Chase banker regarding their chip and sign card. So that is my typo, iI will edit it to read chip and sign. It was probably wishful thinking. What she told me was that if you use your chip and sign card in a machine that takes chip and pin, if you hit cancel, it will print out a receipt for you to sign.

I can tell you our recent experience.

We have a USAA "true chip and PIN card" which worked just fine in 2013 and 2014----meaning we would insert the card in the machine and then enter our PIN. That was in the UK and Italy. We felt so cool!

This year ( last month) they sent us a new card before our trip, because the old one had expired. We arrived in London and were surprised to find that everywhere we used it, the machine would spit out a receipt for us to sign. We would protest---"we have a PIN and want to use it!" but the clerk would say the receipt was automatic. We did not have an opportunity to try it in automated machines in London. Then we went to Italy and the same thing happened---receipts for signature. We did buy some tickets from a machine ( vaporetto tix in Venice) and it just processed the transaction without either signature or PIN.

We did try to contact USAA from Europe to re-set the default to PIN instead of signature, but could not do it online and the phone thing did not go well--- we canceled the call after working thru the menu and then being on hold for 8 minutes.

The good news is that the card functioned fine as a chip-and -signature. Never had a problem with the transaction. But at the Saintsbury grocery in London, where they have self-checkout, we did need assistance from a clerk.

Pamela,

Thanks for the clarification. It seems odd that U.S. banks would adopt Chip & Sign when in all likelihood they will eventually have to go with Chip & PIN. Why bother spending money for that intermediate step?

I wanted to also mention that many of the ticket Kiosks I used in Italy this year appeared to accept only Chip & PIN cards, and many in unattended locations didn't accept cash.

Lola,

"and were surprised to find that everywhere we used it, the machine would spit out a receipt for us to sign."

That doesn't sound like a "true Chip & PIN card", but rather a Chip & Signature. I was also in London this year (and other places in Europe) and all of my credit card transactions were processed using Chip & PIN. While your card may in fact be C&P, It's possible that the POS terminals are programmed to print a receipt by default whenever they recognize a U.S.-based card. It seems very odd that the Vaporetto ticket was processed without either a PIN or a signature?

How are things right now? It depends country to country and place to place: Last month at a self checkout stand in London my friend tried his USA Visa card. It said "please wait for assistance" and a clerk brought over a sales slip for him to sign. In Amsterdam Centraal at similar setup, the kiosk printed a receipt and the screen showed instructions to sign and there was a little slot to place the signed slip. At about half the various machines his cards wouldn't work. If there was a long line for a person, I'd just cover it with my Norwegian bank card and then he'd pay me back later.

It seems that self-service machines when there are human cashier options available are the most likely to be places where we're likely to run into trouble using our US cards.

My guess is that someday one of the banks will get together with Visa or MasterCard and design a card specifically for travelers that will work really well internationally with all the various systems. As soon as there's one good card out there, other banks will want to stay competitive and there will be plenty of options.

Nordheim,

"My guess is that someday one of the banks will get together with Visa or MasterCard and design a card specifically for travelers that will work really well internationally with all the various systems."

I believe that was the intended purpose of Chip & PIN cards, which are officially called "Europay, MasterCard and Visa." The banks of most countries issue proper C & P cards which seem to work well everywhere. For the most part, the only banks that haven't gotten with the program are the U.S. banks.

I have one real Chip/Pin card and one I think "might" be (haven't really checked)

I have had my real one for long time and don't see any action by the other banks to actually step up so I am not sure that pressure is actually out there.

We have had the chip cards in Canada for years now. They have had them in Europe even longer so I'm not sure what all this uproar is in the US. Retailers just build in the credit card costs to their services or merchandise. We have never had any trouble using them in Europe in our last 3 trips there since they were introduced. So really, just get over it and accept it.

A bigger problem is having your card compromised by thieves who use those devices to capture your card without you knowing it and racking up huge bills. It happened to me at the West Palm Beach airport without me knowing until my credit card advised me. I now use those RDIF wallets and sleeves for all my credit cards and passports. To cover all the cards that are being compromised daily, the credit card companies need to keep the interest high. Can you imagine how much money they lose each year by theft?JMO

I read once here in this forum, the statistic that less than 10% of US citizens have ever traveled outside North America. Of that small number, an even tinier percentage travel more than once (excluding military). I am doubtful that US Banks and CC companies will see this as a market that needs to be addressed.

Most of the US retailers I've visited in last couple of months do not have chip-enabled readers, and where they do, customers complain about having to have a PIN, and bypass when they can.

I think c&p will be the norm here about same time as metric system takes over.

Most of the US retailers I've visited in last couple of months do not
have chip-enabled readers, and where they do, customers complain about
having to have a PIN, and bypass when they can.

That makes no sense to me. We've been using PINs in ATMs for years so what's the problem? I'd much rather have to enter a PIN at checkout than swipe and sign; that HAS to cut down on stolen card use.

Ken---this card from USAA was definitely a "true" chip and PIN card in 2013 and 2014 and we had no trouble at all on our two trips those years. It was "on the list" as one of the very few true C&P cards available in the US---that is why we got it.

That is why we were totally surprised this last trip when it failed to function that way. This was a new card because the previous one expired, but the same card number, logo, and affiliation (MasterCard). We were not notified of any changes in function. We need to call them and ask about it because it is very disappointing.

And I need to correct the statement about the vaporetto machine. I just asked my husband (it is his card) and he said that when he used it in ticket machines, where a PIN was asked for, it functioned properly---with the PIN. We also bought train tickets from machines in Switzerland and England with the card and PIN. But every time there was a person involved in the transaction, out came the receipt for a signature. So I think the card must now be set for signature as first priority, and we want to change that.

Pam---I believe that what you were told by a clerk about "hitting cancel" if you have a chip and signature card is correct. I have used my own Chase chip and signature card that way, after being told the same thing by a store clerk ( in Scotland). The machine will then spit out a receipt for signature.

Almost every single US credit card will be chip & signature. It even sounds like formerly chip & PIN cards are being newly issued as chip & signature. Some, and hopefully over time more, will have a PIN as a secondary verification when a signature cannot be sued (such as a kiosk). It is the card that controls that verification process, not you or the merchant. The machine will respond to the verification protocol of the card and automatically spit out a receipt if it reads that it is a chip & signature.

The article shows just how complex this issue is actually. Everyone is pointing fingers at the other party and complaining about things like transaction fees and liability exposure. It is not as simple as just saying the US is technologically behind. And it is complicated by the fact that these changes are almost completely voluntary by the industry. Unlike in other parts of the world, the US government has not mandated how to transition and so each industry is trying to look out for themselves. And the reality is that what the consumers want or need is largely ignored, in part because consumers don't directly pay for the fraud (indirectly we do pay for some of it in higher costs and fees).

I would guess, and industry officials have stated as much, that the US will transition to PIN verification over time. But it will take time as the transition is actually going to last well past October 2017. That is when both ATMs and gas station pumps are supposed to be able to accept chips. But given that half the major retail chains in Chicago have yet to accept chip transactions (based on my experience), it will be a lot longer than that. A chip card, whether with signature or PIN, is of no significant value if merchants aren't accepting them.

And lastly to the poster who got RFID protection for their cards, that actually offers no real protection. RFID is not a particularly vulnerable system (if your cards even are RFID enabled - many are not). The reality is that even chip & PIN cards still have some security gaps and fraud cannot be 100% eliminated.

Douglas, as usual, is spot on regarding the chip-and-PIN card situation. As for why the U.S. banks are so reluctant to adopt a PIN instead of a signature, I read an article that basically said they thought American consumers were too stupid to remember their PINs. The average American has four different credit cards, and the banks feared that they would get the PINs mixed up or forget one of them.

I have a Capital One Visa chip & sign card and used it to pay for my hotel in London, as well as 2 pairs of shoes in a Puma store. I inserted the card into the reader and when the employee prompted me to enter my PIN, I told him/her that I needed to sign. The employee pressed a button (I didn't see which one) and the machine printed a receipt for me to sign.

I didn't use any unmanned kiosks because I didn't think my card would work in them. The train ticket machines in Amsterdam's Schiphol airport had signs in English taped to them that said "chip & PIN only". I thought about trying my card but there were lines at each machine and I was reluctant to inconvenience people with my experiment, especially because of the signs.

Douglas,

Once again you've provided a very informative reply. If the US is eventually going to transition to PIN over time as you state, it's a bit puzzling on why they don't just dive in and get it done, as was the case here. Given the fact that they will need to spend the money eventually, all this messing about is just prolonging the agony.

I read an article that basically said they thought American consumers
were too stupid to remember their PINs.

That's hilarious. They all require PASSWORDS to get to online account information but they don't think we're too stupid to remember those? Heck, we have umpty more passwords than PINs to have to keep track of. They also require PINS for cash advances, if desired.

I don't think there is a lot of cost repetition from starting with signature cards and moving on to PINs later. The cards are the same and the readers are the same. As I understand it, there are costs to retailers on setting up networks for validation, but those may be the same as the networks already being adopted for the chip & signature cards. Restaurant chains, for example, may balk at the added cost of purchasing multiple readers for tableside processing. I think the transition will happen during/after everyone switches to EMV capable readers, which is not until at least October 2017. At the very least, the ATM machines need to accept EMV cards (Oct 2016) so that card holders can use them to change passwords.

As I have read, the main reason chip & signature is the standard in the US is that the credit card issuers really are worried that Americans won't remember PINs. While this may be somewhat overblown, I do think it has a lot of validity. Other rollouts, like in Canada, did have problems with people not knowing their PINs and therefore not being able to use their cards. PINs are assigned to an EMV card, rather than user-selected as with most ATM/debit cards (or pre-assigned but easily changed). The transition is incremental so many people were given their EMV card months ago, months before they could even use the chip transaction. Even now many major retailers haven't activated their chip readers. To expect that people would then remember a PIN they got 3 months ago and haven't used yet, then suddenly need it to make a purchase is a valid concern. The lack of a government regulated standard lets each card issuer choose whether to have signature or PIN as validation. They believe that many customers would navigate to the easier and more familiar signature and so a PIN card would sit in the wallet unused. And the US is much more of a credit card oriented society. Most Americans have multiple credit cards, along with at least one debit/ATM card and maybe some retailer cards. That is a lot of PINs to remember. It won't do anyone any good if people can't remember the PINs or have to write them down on a slip in their wallet.

The thing that I can't understand is why all card issuers haven't set up PINs as secondary validations. It would make it much easier for foreign travelers and for merchants that want to use PIN validation. My own hope is that this will quickly become the norm and essentially make the signature-PIN debate moot for us.

They all require PASSWORDS to get to online account information but they don't think we're too stupid to remember those? Heck, we have umpty more passwords than PINs to have to keep track of. They also require PINS for cash advances, if desired.

It's not really the same thing. Most websites will store an access password if you log in on the same computer or device. And most people probably repeat passwords over and over (not good security but helps to remember them). And people set their own passwords so they are less likely to forget them (PINs are initially assigned). I doubt many people know their CC cash advance PIN as - hopefully - people don't actually use it very often if at all.

And besides, even if 90% of people have no problems with their PINs, that 10% will cause havoc with retailers in lost sales and add up to tens of millions of dollars of lost money for credit card issuers. The US has the largest credit card industry by far, so even small percentages mean huge costs.

Douglas,

I'm still having a difficult time understanding the reasoning behind introducing Chip & Sign now and eventually transitioning to Chip & PIN. The bottom line is that all those who can't remember multiple PIN's now will eventually have to deal with the problem. Are the PIN's going to be any easier for them to remember in 2017 or beyond than they are now?

While there may have been a few problems when the EMV cards were introduced here, remember PIN's doesn't seem to be an issue now. I routinely see people of all ages using C&P cards (including people who are well into their senior years) and none of them seem to be having difficulty remembering the numbers.

When I've received renewals for my EMV credit cards lately, they've all been shipped with my existing PIN so nothing new to remember. As you stated, PIN's can be easily changed even at ATM's so it's not a problem to choose a PIN that the card holder can easily remember.

This reluctance to get with the program is still a real "head scratcher" for me.

PIN's can be easily changed

Right. I set my own versus using the one sent with the card.

Ken, Douglas, and All,

My understanding of the issue in the USA is that the fraud we see with credit cards isn't from stolen credit cards, but from stolen credit card data that is then encoded into fake credit cards.

Most USA transactions are verified immediately. So if my card is stolen and I call it in, it's immediately worthless with or without a PIN.

The only reason we're switching from magnetic stripe cards to the new chip cards is that thieves have found ways to get ahold of people's account information and create fake cards without us knowing. They make up these cards, like hundreds of them, have them match their fake ID and try to buy things.

I saw this multiple times a month at the store that I managed because some thieves fall into certain identifiable behaviors. That being said, some transactions would get by us from time to time.

Upgrading the backend systems and the cards are going to supposedly make the data more difficult to steal and fake cards more difficult to produce.

Adding PINs to the cards and machines to type PIN codes into solves a problem that doesn't exist with cards in the USA.

For whatever reason, I suspect that the case of the USAA cards now prompting for signatures may be related to the US rollout of Chip and Signature cards, basically a reordering of the priority of the validation methods to align with what most people see.

However, on the opposite note, I have a Corporate Card issued by CITI that is a chip and PIN, but always operates as a chip and signature in the US and about half the time as chip and signature in Europe. However, last month, in Idaho, at a KFC, I used it and was asked for a PIN. I was shocked, almost did not remember my PIN.

Point being, do not be concerned whether you are asked for a PIN or signature (well maybe asked for a PIN if you have no idea if you have one) as long as the transaction goes through.

If you read the article the chip and sign solves the fraud that the banks are frustrated by, the retailers claim that they do have problems with the other type of fraud. And, yes, yes, the banks say that they refund, but the article indicates that not all of it is refunded. Then there is the whole issue of retailer fees.

Someone commented--probably Doug!--that the reason that this is happening in this manner is that none of this has been government mandated so no one is really thinking about the whole picture.

BTW if anyone wants the number on US travel abroad, check out this article for the 2014 stats.

As you stated, PIN's can be easily changed even at ATM's so it's not a problem to choose a PIN that the card holder can easily remember.

Actually I didn't say that because the US ATMs won't be chip-compatible until October of 2016 (and very likely many not even then). So it's not easy to change the PIN.

And it's not that people won't eventually remember their PINs once they are using them all the time, it's that the roll out is happening in phases. As someone else noted, if you don't use your PIN for awhile, you start to forget it (some people at least). So if you get your shiny new EMV card with a PIN assigned and you don't get to use it for months, there is a higher likelihood that you won't remember it when the time finally comes to need it. At least that seems to be the overall thinking of the banks.

And another poster is correct, the counterfeit card fraud is a much more massive problem than stolen cards. With computer tracking now, most banks will know your card is stolen before you do and will put a lock on it. The days of stealing a card and going on a wild spending spree are largely over.

Douglas,

Sorry, I must have misinterpreted your earlier statement. I find that remembering a few PIN numbers isn't difficult as I'm using the cards on a regular basis. For those cards that I don't use often, the PIN's are recorded in a secure app in my phone. As long as I can remember the access code for that, I can retrieve any PIN's.

I'm a bit surprised that counterfeit cards are still a problem. Wasn't that the main reason chip cards were invented?

Thanks for the article, Pamela.

I'm a merchant with two locations. When we opened the second one less than two years ago, I made sure to get an EMV machine with a PIN pad. I still haven't upgraded at the first store, although it does have a PIN pad.

Right now, we're probably seeing 25-30% of cards with chips in them. Not a single one will process with a PIN. Not one. Some are debit cards and some are credit.You can try to select debit, but it prints out for a signature, asks if signature is OK, and then processes the chip. The transaction does take slightly longer.

There is a significant group of people out there that believe that if they run their card as a PIN transaction that it is less safe. That makes no sense at all, but they firmly believe it. Why? Because their banks have told them that for years. The banks and card issuers tell them that because they make more money from a signature transaction than from one with a PIN. Please note that I am talking about running a debit card. While there may have been some argument that a credit card was safer than a debit, since your account could be emptied, these people are using their debit cards. They just insist they shouldn't use a PIN.

We've gone one round with our bank's merchant processor, trying to find out if our fees for the EMV cards are as low as for a PIN debit transaction. He was unable to tell me. He thinks it's as low, but... So at this point, when I have a $200 sale, and a customer with an EMV card who wants to run it as a debit but can't, I am probably paying about $5 in fees, as opposed to under a dollar. That adds up.

I'm just a little merchant. We're talking serious money to the big retailers. Really, the government's going to have to do something, maybe amend the Frank-Dodd act to reduce fees, and require PINs. But I don't know how likely that is. Who has more pull in DC- the banks or retailers? And remember, whenever the retailer has to pay more, you, the consumer, will pay more. So that money goes from you, through the merchant who grumbles about it, right to the banks. That's the real reason you should care about this dispute. It's your money.

I'm a bit surprised that counterfeit cards are still a problem. Wasn't that the main reason chip cards were invented?

Counterfeit cards are still a problem in the US because we haven't switched over yet. Many of the big retailer data breaches were intended to steal CC data to make counterfeit cards.

Within the next year or so, once almost every card in the US is EMV, then counterfeiting should be significantly minimized as it has been in Europe.

Douglas,

Thanks for the explanation. I suspected that might be the situation, and that EMV cards will reduce the fraud problem.

Over half of the card fraud in the world is committed in the USA. The continuing weak point of sale security has imported card present fraud from around the world, where card details are stolen outside the USA, transferred into white label mag stripe cards, and then presented within the USA. International criminals tend to go for the weakest link, and that is clearly the USA at present. Elsewhere the weakest link is card not present usage. False positives on 'fraud detection' measures at the bank end for 'unusual' usage are so high that they are not really an answer.

Introducing chip and pin is not cheap - the estimate for the conversion in the UK 10-12 years ago was in excess of £1Bn then between bank and retailers. There was no government mandate involved although an agreement was brokered to reduce retailers' card fees to at least partially offset their capital costs.

Chip and pin is engrained into the processes in many parts of Europe, even where the amount is so low that no validation is required by the issuer. Contactless has ate into this somewhat, but supermarkets have been surprisingly reticent introducing this into self service tills. Hence chip and sig cards can have the inconvenience of needing someone to look at a signature for even low value purchases,

So PNC Bank is issuing these cards with chips in them, I just got one for one of my accounts yesterday. According to the directions you can either sign or use your PIN. We also just got one from Charles Schwab. I think more banks will be getting on board with it.

With regard to remembering PINs, when my credit card issuer sent me a chip & sign card, a line on the enclosed letter said something to the effect of "And there's no PIN to remember!" I wondered if they had done market research and decided most customers didn't want a PIN; they'd rather sign.

I used my chip & sign card in the U.S. for the first time yesterday at Macy's. I swiped it twice but it wouldn't take. Then I noticed the card-insert section glowed blue, so I inserted the card.

The cashier asked me for my zip code during the transaction. This was the first time a person asked for it, though this request has been in place for maybe a year now, at least in St. Louis, at automated machines like at gas stations. I guess it's intended to cut down on the use of stolen credit cards. Would most thieves know the card owner's zip code?

" I think more banks will be getting on board with it. "

The banks are one part of the equation. It's also going to require a replacement of all the POS terminals, and larger firms that process their card transactions through a central location may also have to reconfigure their software. That was the case here. Smaller "Mom & Pop" operations with one POS terminal were converted very quickly, while larger chain stores took much longer. I assume staff training in the new system will also be a component.

Oddly my new Target card requires a pin. I was impressed that they went with that additional layer of security. I wish that there was a pin option on the other cards, that way if people don't want to remember pins they don't have to, but it provides the extra layer of security for those of us that do. The first time I used my other C/P card in the US I was so confused that I had to sign. The poor Wal-Mart cashier got an earful about it.

I finally had a merchant in NYC want to use the chip--Duane Reade, of course! It worked fine. It may have taken a half second longer, but I doubt.

This has been a great discussion. I'm sure we'll continue it for a while to come.

Just an update:
We used our new chip-and-pin Mastercards today in the self check-out line at Target, and the machine spit out a receipt without asking for a PIN. We could have been anyone with a stolen card. Sort of defeats the purpose, IMHO.

In a recent conversation with a local small business owner, he explained the reasoning behind switching from the old swipe technology to the new credit card chip machine. If he doesn't, he will be penalized $25/month. The new machine costs $350 and the processing fees remain the same.

So, interesting tidbit regarding my Chase Debit Card. Evidently, they charge a flat $5 for every withdrawal. So, since I have credit card that doesn't have foreign transactions fees, my motivation shifts from cash to credit, which is going to be an adjustment.

Pam

Target stores just issued chip and PIN Mastercard cards to replace the old Target Visa swipe cards. I now have to put a PIN in instead of signing for purchases. Much better! I have not had it long enough to try it in Europe yet though. My new Barclays LL Bean card is also supposed to be true chip and PIN. The literature that came with the card said when activating the card you'll be prompted to create a PIN which will enable using the card overseas. The only problem was in order to activate the PIN I needed to actually use the card and the PIN. I tried it in Target since they have the proper card reader but it didn't ask for my PIN. So unfortunately when I tried to use it at a gas pump in France, it did not work:(
I feel that signing for a purchase is useless for security purposes. Anyone can sign your name, and with the way your signature looks using those signing pads??? Who can tell who actually did the signing. Give me a PIN for security any day.

Pamela,

There are options for Chase debit. Just ask. I had one that charged the flat $5 plus the international exchange fee of around 4%. After remarking to my banker that I would use the card more if the fees would not be there, I was "upgraded" to a new debit card that charges none of those fees outside the US. My last withdrawal from an ATM in Rome was exactly at the quoted Google rate for the day.

Thanks Mark. I am going to try and get my company to pay for it this time, but I will look into it for my next trip.