Last year, Sheri and I went on vacation in the U.K. and France. Our previous trip to Europe together was back in 2010 to Italy and our credit cards worked fine. However, we had our share of difficulties back then with our ATM card, but that didn’t prepare me for the frustration I had in London and France last year.
We stayed with friends on the outskirts of London and took the commuter train into London one morning. After getting off the commuter train, we planned to take the underground to our tourist sites, but quickly found that our credit card didn’t work in the automated machines. There should have been someone there to help us, but nobody was around. So we went back up to the street and walked around until we found a place to exchange some U.S. dollars to British pounds sterling. Back underground, we finally got our subway tickets and were on our way. We were inconvenienced, but it wasn’t nearly as bad as what happened in France.
Driving in France is wonderful. The roads are smooth and well-maintained, even if the GPS does take you through some questionable routes. Using the toll roads is quick and efficient, unless you’re an American who gets into the wrong lane—the lane for credit cards only—and you have an American credit card. An antiquated American credit card that won’t work in the automated toll machines. It’s very embarrassing and presents an unflattering image of Americans when you need to ask the drivers of the three cars behind you to back up in the toll plaza so you can get into the correct lane. Later as we were driving through the rural areas, I noticed I needed gas, but all the gas stations in the smaller towns are unattended, so my credit card wouldn’t work. It was extremely stressful driving and hoping I would find a gas station before I ran out of gas.
Americans wouldn’t have these issues if not for the arrogance of U.S. banks who refuse to catch up with the rest of the world when it comes to credit cards. Most of the world moved to “chip and pin” over a decade ago while the U.S. continues to rely on magnetic stripe cards. From the consumer standpoint, chip and pin cards work similar to how we now use ATM cards—we insert the card, enter our 4-digit PIN, and perform our transaction. It’s quick, simple and we’ve been doing this for decades. It seems secure enough, because you don’t hear about ATM machines getting hacked like Home Depot or Target.
Chip and pin cards improve security by requiring the user to enter a 4-digit PIN stored on the card whenever they use it. The chip on the card generates a new random transaction number each time the card is used. Even if criminals were to hack into some merchant’s database of transactions, the numbers would be useless since they are one-time generated. It’s like getting a bunch of expired passwords. Hackers are persistent, and it’s not 100% effective, but it’s certainly better than our current system. So, why can’t we use the same technology as our ATM cards and the rest of the world, when it comes to our credit cards?
U.S. banks are just now starting to issue cards with the embedded chips on them, but these cards aren’t chip and pin. They’re actually chip and signature and don’t really work any differently than our existing mag stripe cards. We insert the card into the merchant reader and either sign on the screen or sign a paper receipt. How is that any more secure? It’s not. The whole push in the U.S. to chip and signature is driven by Visa and Mastercard pushing the responsibility of fraud onto either the banks or the merchants. By October 2015, the U.S. is supposed to have chip and signature in use. Those banks and merchants not complying will be held responsible for fraudulent charges. However, none of this really helps the consumer, especially if you’re a traveller going overseas.
I received an embedded chip card from Capital One a couple of weeks ago, but I got all excited over nothing. It turns out that the card is just chip and signature, even though the activation process asked for a PIN—a PIN that only works with ATM machines. Here’s the false sense of security that Capital One promotes on their website:
“Both Chip and PIN and Chip and Signature cards offer better fraud protection than traditional magnetic stripe cards. The only difference is that the Chip and PIN card requires you to enter a PIN at checkout while the Chip and Signature card only requires your signature. Good news! Capital One chip cards will be Chip and Signature cards, so there’s no additional PIN to remember.”
Seriously?! How is that good news and any more secure? A signature can be forged and how often do cashiers actually check the signatures. U.S. banks really should give us a little bit of credit (no pun intended). We’ve had to remember a PIN for our ATM cards for most of our lives and, suddenly, the banks don’t think we’re capable of remembering one for our credit cards? Most industry observers admit that chip and signature is only a half measure toward security, but things aren’t about to change anytime soon. Banks say it would be hard to migrate to a chip and pin system, because merchants don’t want to spend money upgrading their card readers, and banks are in no hurry to issue chip and pin cards without any way to use them. It’s much like how electric cars were slow to be introduced. Without charging stations who would buy an electric car, and without electric cars, why install charging stations.
Don’t even get me started on the online security of our credit card system. Unless a system such as the one used by Mastercard is implemented throughout the online world, our credit card information is easy prey. Mastercard uses an online system similar to the physical plastic card, where a random one-time card number is generated at the time of the transaction. For my other cards, I just know that once or twice a year, I will need to get a new card number when the old one is hacked.
There are a few banks and credit unions in the U.S. that offer a chip and pin credit card, but whether they actually work is still debatable. It has been reported by some early adopters that these “chip and pin” cards only work in bigger cities where the payment terminal is always connected online, but won’t work in more remote places where terminals are offline and batch process transactions. Some cards have chip and pin capability, but actually default to chip and signature. Many European automated machines, such as ones in subways or unattended gas stations, will try and use whatever the default method is on the card, but don’t have any way to accept a signature, and therefore, won’t work. Whether or not your supposed chip and pin card will work depends entirely on how the particular machine you’re using is programmed. And we know that nobody in France is going to change the programming on one of their machines just to accommodate an American.
Even if you do find a bank or credit union that has a true chip and pin credit card, you’ll often have to sacrifice service for the convenience of having that card. Barclaycard offers a true chip and pin card, but is notorious for their poor customer service, especially when you’re overseas, which is the whole reason you want their card to begin with. If not poor service, you might be paying a premium for services. Most cards charge an annual fee, anywhere from $45 to $450 or they’ll get you with their foreign transaction fees. So where does that leave us Americans who want to travel and not have huge hassles with our credit cards? Not in a very good position.
I’m not a big proponent of the government stepping in and imposing regulations, but this is one time I think the government would be helping to actually improve economic security by mandating that chip and pin cards be used in the U.S. At least then, we would be catching up to the rest of the world. In the meantime, write to your bank and ask them when they’ll have a true chip and pin, not chip and signature, credit card. Perhaps if they receive enough demand, they might actually move in that direction.
One thought on “American banking FAIL: chip and pin”