Item — HN Reader

You're right, obviously, about having everything needed to clone a magstripe on the magstripe itself.

> Any sane issuer will decline transactions made with the magstripe at a chip-capable terminal, so this doesn't help much.

Regarding this... Where I live and use Chip-and-PIN cards every day (Canada), it's extremely common for a chip-capable terminal to fail on a chip card for a variety of reasons and immediately instruct the cardholder and/or merchant to "please swipe card". Customer swipes and places a signature-resembling mark on paper. Merchant and issuer accept this. And so it goes.

Anecdotal data: We've had Chip-and-PIN for years here. Currently, despite my Amex being Chip-and-PIN, more than 50% of terminals fail with the chip ("it's an Amex thing," we're told, years into this) and revert to swiping, and my Visa Chip-and-Pin still fails as a chip card and falls back to a swipe transaction approximately 10% of the time.

So the easy fraud vector is still there with magstripes even in a mature Chip-and-PIN environment.

1 comments

Actually, those "failures" are (here in Canada) caused by merchants who have upgraded their hardware to chip-and-pin, but haven't actually switched chip-and-pin processing on for their POS merchant account.

Or, more commonly, they're with a POS provider that bought, and then rolled out, chip-and-pin terminals as part of its standard four-year-replacement cycle, but who don't even support chip-and-pin yet.

Either way, usually the merchant knows ahead of time that their terminal won't accept your (or anyone's) chip, and could put up a sign to that effect.

What you say makes sense for Amex failures... I have heard merchants say "chips work with everything but Amex."

But for the Visa chip failures I experience, it's generally happening at my regular haunts where chip cards work (mine and others). The occasional chip failure is accompanied by the stock service industry script of, "oh, yeah, that terminal has been having problems all day -- just swipe it and sign, sorry."

I do wonder if the merchant is charged higher discount rates or fees on those transactions because of higher fraud likelihood.

> oh, yeah, that terminal has been having problems all day

There is a phenomenon related to this, that I would almost describe as being like an inorganic physical virus.

Sometimes plastic or lint from a wallet solidifies onto the chip on your card—and then rubs off on the contacts inside the POS terminal when you insert it. Now the terminal can't read the card, because there's goop in the way. So you take your card out (which is now slightly cleaner, and thus likely to work on the next terminal.)

Next, someone else puts theirs in. Now the gunk is on the terminal contacts, and gets rubbed onto that person's card, and once again, the card doesn't work. Now that person's card is dirty as well.

It seems that there's less card->terminal gunk transfer than terminal->card gunk transfer, but every once in a while you'll take your card out of one non-working terminal and then it won't work in any other terminal—until you notice there's a smudge on the chip, rub it off, and then it starts working again.

Perhaps they need "cleaning cards" for these terminals that are like the old VHS head cleaners.

Interesting. You know "too much" (or think too much) about these terminals! :) Cheers!

In the UK at least, if the card is swiped rather than chip & pin then the card company may refuse to cover fraud losses and the merchant must swallow it. If the same fraud happenned via chip & pin, the merchant would've been "insured". http://www.theukcardsassociation.org.uk/cards-transactions/c...

Or just chips failing to read? Their failure rates seem to be much higher than magstripe.

In my experience if you try to use a broken chip+pin card you will almost always be allowed to use the magstripe "bypass" instead.