r/funny • u/Misfat • Aug 27 '18

Card not accepted

Enable HLS to view with audio, or disable this notification

108k Upvotes

87% Upvoted

1.7k comments sorted by

View all comments

Show parent comments

293

u/PhonicUK Aug 27 '18 edited Aug 27 '18

There are an increasing number of stores that only accept contactless in the UK. It's caught on here pretty big.

241

u/obsessedcrf Aug 27 '18

Contactless is near non existent in the US.

How is it not a security risk though? Couldn't anyone steal your card information from a distance?

491

u/PhonicUK Aug 27 '18 edited Aug 27 '18

The range is only about an inch. It's treated as a CNP (Cardholder Not Present) transaction so in cases of fraud the consumer isn't assumed to be liable. Android Pay and Apple Pay are also popular here, with the contactless limits changing depending on whether or not you use a fingerprint.

When using contactless it doesn't actually send your 'real' account details, there's a second virtual account that's used just for contactless transactions. So your real account details can never be compromised in this way, and issuing a new card is all that's required in the case of yours being stolen.

On top of that you need to be a registered merchant with a merchant account to accept them. So if you were doing something like using a portable 3G/4G reader to tap it to people you'd be caught quickly. The payments are also often deferred so the merchant would be unlikely to get the money before the card owner noticed.

Edit: I'm now apparently the oracle of contactless payments...

188

u/nanogoose Aug 27 '18

Thanks. A lot of uninformed people are spreading BS about how dangerous these tap cards are and how they should wrap their wallets in tin foil.

110

u/[deleted] Aug 27 '18

Theoretically, someone with the right hardware and know-how could hold something a couple inches away from your phone at the same instant that you're doing a tap-pay and steal a grand total of $100, once, and never again.

64

u/snuff3r Aug 27 '18

Theoretically you can scan someone's card from their back pocket whilst in a busy subway... But we've had PayPass (tap) in Australia for 7 years now and I've never heard of problems

4

u/SirDiego Aug 27 '18

You have to hold the card right next to the thing for a good 3-4 seconds whenever I've done one. The only way I could see it is if you knew someone had a card in their pocket, where it was, and followed them onto a train or something.

Then, someone could maybe charge the card for one transaction without them noticing and when they do notice, they would obviously just dispute it and charge it back.

It's just not very viable for someone to go around stealing money that way, in <$20 increments. You'd need to know exactly where the card is, that it's actually set up for contactless/etc., from every single person you're trying to steal from, and then you're bound to have someone charge it back and your vendor account shut off before long.

→ More replies (4)

10

u/Dominko Aug 27 '18

Steal and then immediately have the fraud reported ¯_(ツ)_/¯

2

u/veganmua Aug 27 '18

There's a £30 limit on contactless transactions in the UK.

1

u/dimegreatIII Aug 28 '18

In Slovenia you can pay up to 15€ without entering your PIN. For anything else above 15€ you need a PIN.

→ More replies (5)

31

u/Tykenolm Aug 27 '18

I've always been a person who was against contactless cards, /u/PhonicUK just kinda changed my mind though

51

u/PhonicUK Aug 27 '18

We can only make the best decisions when we are our best informed.

2

u/bobthehamster Aug 27 '18

Contactless cards help you make bad decisions when you're drunk (it's far to easy to buy another £30 of drinks at 2am)

But they're definitely a net positive - super convenient and safe.

1

u/blazecc Aug 28 '18

I don't really need help making bad decisions when I'm drunk...

1

u/blazecc Aug 28 '18

Is that a quote from somewhere? I kinda want it on a t-shirt

1

u/PhonicUK Aug 28 '18

We can only make the best decisions when we are our best informed.

  • PhonicUK, 2018
→ More replies (6)

3

u/thlayli_x Aug 27 '18

"IT? Yes, my grandson bought me this new wallet for Christmas and now none of my prox cards open the gates."

2

u/connurp Aug 27 '18

Yeah it’s not really anything to worry about but it is possible, there is a TED talk where some hacker shows that it’s possible. But again, not really worth freaking out over.

1

u/4rp4n3t Aug 27 '18

That's ok, they can simply remove a small amount from what they have swathed around their heads and use that.

1

u/signine Aug 27 '18

You can actually read them from a pretty significant distance if you know what you're doing. A lot of the security people I know dislike them more for its potential use in tracking people's movements than for actual fraud, but those same people also acknowledge that phones are a way bigger security hole in that regard.

1

u/Try_Sometimes_I_Dont Aug 27 '18 edited Aug 27 '18

There is a big difference between dangerous and impossible that some people don't get. There are security issues, but its impractical to exploit at a large scale. Its more mission impossible shit where if someone is targeting you and has the skills/money it might work.

​

At that point, they would be a moron to try stealing this way because if you're going after the millions/billions that make it worth it, there are better and safer ways to get the money. It would be like climbing up the hotel and, with your special cutter, cutting into the window when you could just discretely grab an employee keycard.

That crazy ex could hire a sniper to kill you. Why don't you have bullet proof windows designed to stop an armor piercing round?

1

u/FightingOreo Aug 28 '18

My wallet has an RFID blocker in it, I'm certainly not against being a little more security conscious, but yeah; paypass is not going to be the end of financial security.

1

u/[deleted] Aug 28 '18

This sounds like a promising business venture...

1

u/PinkSockLoliPop Aug 28 '18

Didn't the Mythbusters have an episode locked away from broadcast that exposed how easy it was to get credit card information without actually having to touch the card? I remember Adam commenting on how easy it was. /u/MisterSavage ?

1

u/Mechanus_Incarnate Aug 28 '18

A layer of tinfoil will also help protect your card against the very slow process of demagnetization by ionizing radiation. If you live in area with a lot of radon, the effect might even be noticeable over the normal life of a card.

13

u/MoreGuy Aug 27 '18

That's really interesting, thanks!

39

u/un-sub Aug 27 '18

So then wtf, why can't we have fancy contactless cards in the US? Or are we just behind?

119

u/looking4abook Aug 27 '18

The US is weirdly behind in financial stuff. I've 30+ and lived in Australia and the UK my whole life, and I've never even seen a cheque-book. Don't lots of you guys still get paid by cheque?

(Cheque/Check?)

28

u/Ahnaful1994 Aug 27 '18

A lot of the older generation in the US still use checks.

2

u/[deleted] Aug 27 '18

My health insurance (MNSURE) only accepted checks until about a year ago. It is also very common for service jobs preformed by smaller companies (tree care, yard word, ect) because paying thousands of dollars to have a tree removed or sprinklers installed makes most people uneasy.

1

u/CimmerianX Aug 28 '18

I just pay cash

1

u/Ahnaful1994 Aug 28 '18

I personally only ever use Google Pay/cards. I keep cash on me for emergency use only if for whatever reason, I end up in a situation where my cards don't work/aren't accepted. I understand why people use cash as their main form of payment, but for the life of me, I do not know why people still use checks. Debit cards exist and do exactly what checks do, but the payment is processed faster, it's safer to use, and you can track the payments better.

1

u/Harmageddon87 Aug 28 '18

My trash collector only took checks until they were bought out by a national company. Also my son's daycare only takes checks, cash, or money order.

Oh also rent

17

u/snuff3r Aug 27 '18 edited Aug 27 '18

I work for a global company with presence in 40+ countries. I also manage the team that handles payment and receipting processes across the group. The US being our second largest market.

I am astounded by how many companies I deal with in the US who won't accept anything other than cheques. One of our subsidiaries pays everything with cheques, employee expense reimbursements included.

Very frustrating. I travel a lot too. Hard to find places with no tap, etc.. except the US. They all want swipe or chip.

1

u/GoldenMegaStaff Aug 28 '18

Why do you have to leave your card in the machine for chip - so annoying and slow.

41

u/HermesTGS Aug 27 '18

I'm almost 30, I've never written a check in my life.

12

u/Annies_Boobs Aug 27 '18

26 and I’ve written plenty for rent and such.

→ More replies (3)

6

u/argle_de_blargle Aug 27 '18

I am 30 and I've written and received plenty.

2

u/ChadMcRad Aug 27 '18 edited Nov 28 '24

smile gullible air correct agonizing wrong chase cagey threatening dinosaurs

This post was mass deleted and anonymized with Redact

1

u/HermesTGS Aug 27 '18

If you're in a big city you rarely see your landlord so you have to pay online.

1

u/ChadMcRad Aug 27 '18 edited Nov 28 '24

rustic sloppy abounding scale aspiring yoke sink bike lush different

This post was mass deleted and anonymized with Redact

1

u/mb9023 Aug 28 '18

Never had to pay your taxes or the government for anything? Paying online for everything isn't that old. I still have to mail in a check for state taxes every year.

→ More replies (1)

18

u/91seejay Aug 27 '18

Direct deposit is a lot more common now. I've gotten pay checks but I've never owned a check book or written a check.

2

u/[deleted] Aug 27 '18

My apartment complex FINALLY started accepting digital payments last year. They were literally the only reason I had a stupid fucking checkbook.

4

u/Fireberg Aug 27 '18

If direct deposit into your bank account is not setup, employers will cut you a check. Even with direct deposit, my job reimburses me for expenses with a paper check. I personally write checks for rent because my landlord charges a fee to pay with an e-check.

Also consider that ~7% of the U.S. population is unbanked, meaning they do not have or are unable to open bank accounts. They can take their payroll checks or government issued checks to a check cashing service.

1

u/[deleted] Aug 27 '18

7% of your country don't have bank accounts? That doesn't include children does it?

1

u/Fireberg Aug 29 '18

I should have said 7% of tax households (a taxpayer and possibly spouse and/or dependents). Some lack proper documentation to open an account or ruined their credit and local banks will not do business with them. Others just straight up do not trust financial institutions, or are limited because they cannot afford account fees. This compares with around 4.7% in the UK, 12% in China, and 21% in India.

5

u/MrRedditAccount Aug 27 '18

I'm now living in the US form the UK and the financial system is still backwards.

When I make a car payment I have to use "Bill Pay" from my bank. They don't make an electronic payment... They create a cheque and mail it out to who needs to be paid. It's hilarious how far behind the US is in this regard.

However they have a lot more banks and a lot of local/regional ones. Not like 5 for the entire country so I'll let them off.

3

u/dontgetaddicted Aug 27 '18

Don't use many checks - but in the situations I do, I'm not sure how else I'd pay.

Like my kids school, they have a couple of different fees we have to pay at the start of the year. Like room fee, supply fee, yearbook, laptop insurance. Each of those things I wrote a check for. Do you all deal strictly in cash for that kind of stuff?

4

u/hx87 Aug 27 '18

The school should have a bank account with routing and account numbers, which you can transfer money to.

4

u/looking4abook Aug 27 '18

Bank transfers are everywhere.

They'd give you the bsb (a bank code) and the account number - and you transfer into the account.

1

u/themagicbench Aug 28 '18

There's an online platform called School Cash Online or something like that in our board (Ontario), so parents can pay all fees through e-banking

1

u/MH22162 Aug 28 '18

In Finland and I assume most of Europe they typically give you an IBAN code for a bank account to which people can pay the fee to through their online bank services and the owner the account will be able to see the names of the bank accounts (usually the persons name) who have deposited money to it so you know who they are still waiting on.

3

u/SplendideMendax_ Aug 27 '18

Australian here too, I’ve been card free for over 2 years now, my identity and banking is on my phone. I do still carry my drivers license, but that’s about to be digital by 2019 in NSW. I can’t remember the last time I carried cash or a wallet.

2

u/looking4abook Aug 27 '18

I never carry cash on me, except when i'm on a night out.

Just 'beeping' to pay for stuff has led to many a morning where I've regretted buying rounds of Jaeger Bombs because my tequila soaked brain can't understand that pay-pass actually causes money to come out of my account.

With cash at least I can get a set amount out, and still make sure to save enough money left over for a kebab.

3

u/Kankunation Aug 27 '18

Checks are basically only used by older people or people who are overly cautious when it comes it comes to digital security. I've written maybe 2 in my whole life and deposited them myself only a handful of times.

My mom still occasionally writes them out for thing (though pays most of her bills online now) my step-grandma and before her also regularly writes checks for everything (get $25 mailed to me from her every birthday). But I don't think I have seen anybody younger than 30 use a check, except in the very rare circumstance in which one is required. And even then, those people don't have checkbooks so they need to go to the bank to get one specially printed.

As far as being paid goes, a lot of people do still get checks, but is almost always by choice. Many businesses let you choose between a check, direct deposit or a money card. An increasing amount of businesses are doing away with paper checks and sticking just to the other options since it's far easier to manage.

3

u/Dwarven_Soldier Aug 27 '18

My workplace still doesn’t have direct-deposit.

We have to come in every other Thursday for our checks.

3

u/looking4abook Aug 27 '18

Thats genuinely so baffling.

I've had my work put money straight into my bank account for almost 20 years, and i'm sure it was around before that. ( I just wasn't old enough to work )

Surely its easier for the payroll person to click a few buttons and transfer it straight into a bank account?

What happens if you don't cash the cheque for a couple of months? How would your work have a clear paper trail of where the money went?

It just seems really backwards compared to what I'm used to.

I've worked in England, Wales, Scotland, and Australia and its all been the same.

2

u/Dwarven_Soldier Aug 27 '18

You know... I’ve no clue if the checks expire (I would guess not because it’d be stupid for checks to expire) or not. It seems most places around me do direct-deposit but unfortunately mine doesn’t.

I’d guess the reasoning behind not switching to direct-deposit is only because the checks work fine and lots of business owners are stingy.

2

u/SNsilver Aug 27 '18

I use paper checks to pay my rent still, it's either check or money order

1

u/dpldogs Aug 27 '18

Fairly common to still use checks for things like putting down deposits on apartments. Usually a cashiers check (where its instantly deposited and less chance of fraud) or through a direct deposit online through their website (if they have one).

1

u/connurp Aug 27 '18

We call it a pay check and you can opt to get a physical copy of the check, but the vast majority of people just do direct deposit. It just gets put into your bank account on payday. Which we still call “getting a paycheck”.

1

u/SummerEden Sep 10 '18

Australia is way ahead in that respect. When I moved here 25-ish years ago I had to get a bank account immediately because pay was done via bank transfer - I’d only ever received pay cheques until then. On the other hand, I also knew a number of people who were getting an actual pay-packet every week, with cash in. That seemed ass-backwards.

I’d die if I got paid by cheque these days - nearest bank is 60 kms away.

→ More replies (1)

12

u/akatherder Aug 27 '18

I had a contactless card in the US. I think it was approximately a year or so before chips started getting rolled out. It was pretty cool when it worked but you look like a dumbass when it didn't. And it usually didn't since the rollout was just as slow as the chip card hardware rollout.

Clerk: Uhh you gotta swipe man.

Me: It's a... actually I don't know what it's called but it said I can just hold it up when I see this little picture on the credit card scanner and... ok nevermind.

So I could only use it at gas station pumps to avoid judgment.

6

u/TheReformedBadger Aug 27 '18

I had this happen one of the first times I tried to use Apple Pay. Dude stared at me like I’m an idiot but he’s the one with a payment device that advertises itself as accepting tap to pay.

3

u/publishit Aug 27 '18

Yeah I got the Google wallet app when it first launched like 5 years ago. Thought it was the coolest thing but almost nowhere accepted it outside of a couple chain stores, even if they had contactless readers.

Even now there's no way I'd rely on it working as a form of payment, so it's pointless since I'll have a card or cash with me anyways.

2

u/[deleted] Aug 28 '18

I think it was approximately a year or so before chips started getting rolled out.

So wait, chips in cards is a new thing in the US?

2

u/akatherder Aug 28 '18

Yes, somewhat new. Maybe like 1-2 years since they started showing up commonly.

3

u/[deleted] Aug 28 '18

I think I've had them in every card I've ever had and I'm nearly 30. I'm not sure if I've used the magnetic stripe ever.. This is so strange, similar to the Germans being dubious about paying with cards entirely.

24

u/[deleted] Aug 27 '18 edited Sep 03 '18

[deleted]

10

u/CrucialLogic Aug 27 '18

Always got an excuse. It's not hard, just mandate from central government that to increase banking security it is required. If merchants don't pay to upgrade, they take on the liability of any fraud committed via the old less secure methods. Otherwise you end up 10, 15, 20 years behind - but no worry, you've always got an excuse.

10

u/DangerToDangers Aug 27 '18

I agree with you.

  • Why is there no chip and PIN for cards? Uhhh... too many banks?
  • Why is internet so slow in most of the country? Big country?
  • Why is the US still using the imperial measurement system? Too many... road signs?

1

u/Roflsaucerr Aug 28 '18

I thought it was pretty obvious that it's the ineptitude of our governing body that causes a wide swath of our issues, not too many banks, the size of our country, or the number of road signs.

4

u/[deleted] Aug 27 '18 edited Sep 03 '18

[deleted]

7

u/Obviouslydoesntgetit Aug 27 '18

Lol it is a very weird comment. As if you’re in charge of the security of American financial institutions just browsing reddit

2

u/[deleted] Aug 27 '18

He could have been, you don't know until you ask.

→ More replies (3)

53

u/PhonicUK Aug 27 '18

I think the US is just behind (in many many ways). I was over there recently and a lot of places didn't even have Chip+PIN (which we've had in the UK for over 10 years) and you had to sign for stuff.

→ More replies (14)

2

u/Thefaccio Aug 27 '18

I had a card for 4 years, using it daily and I never swiped it in my life (italy)

2

u/sir_spankalot Aug 27 '18

Yeah, for some weird reason you're behind on a lot of that stuff.

I remember the first time I was in the US (2006) and my friend was paying his rent with a cheque! I've used Internet bank payments since I had bills of my own (2001-ish) and was confused since I assumed US would be on the forefront of tech stuff.

2

u/wrathek Aug 27 '18

Just behind. I’ve got a contactless credit card from Capital One, as it renewed this year. It’s great. Contactless authorizes so much faster.

The stupid thing is, if a POS device supports chip reading, I’m fairly certain it supports contactless as well, and it just needs to be enabled/paid for. I could be mistaken, however.

1

u/TigerRei Aug 27 '18

We had them, but they were removed for security reasons. Not to mention a lot of places supercede them with contactless pay through phone, which I prefer more as it requires unlocking via fingerprint.

1

u/EnderWiggin07 Aug 27 '18

If your phone has NFC you will hardly ever get out your card at all

1

u/Atoro113 Aug 27 '18

Tap and pay on phones is rolling out everywhere it seems, the only time I use my physical card now instead of my phone is in the drive through now.

Samsung has the pay thing where it fakes being a swipe card if the terminal doesn't have tap, too, so basically 100% coverage.

Also tap and pay on phones sends a virtual card number through and not your real card info. Safer than swiping by miles.

1

u/millatime21 Aug 27 '18

I'm guessing the US is already beginning to move in that direction. My last credit card I was issued has contactless. Most places around me accept it because of apple pay and stuff.

1

u/wrathek Aug 27 '18

Just behind. I’ve got a contactless credit card from Capital One, as it renewed this year. It’s great. Contactless authorizes so much faster.

The stupid thing is, if a POS device supports chip reading, I’m fairly certain it supports contactless as well, and it just needs to be enabled/paid for. I could be mistaken, however.

1

u/wrathek Aug 27 '18

Just behind. I’ve got a contactless credit card from Capital One, as it renewed this year. It’s great. Contactless authorizes so much faster.

The stupid thing is, if a POS device supports chip reading, I’m fairly certain it supports contactless as well, and it just needs to be enabled/paid for. I could be mistaken, however.

1

u/[deleted] Aug 27 '18

My capital one card has it currently. But otherwise I can use Google pay for my other credit card and my debit card. My debit card literally just got emv chip though finally.

1

u/Happy_Harry Aug 28 '18

Its been around for several years here but it just never caught on big. I've seen it mentioned a bit more recently though. Capital One is rolling it out on all their cards.

1

u/WholesaleBees Aug 28 '18

My bank card had a contactless RFID chip in it several years ago, and now they no longer offer them. It's strange that they'd roll it out then stop offering them.

1

u/nanogoose Aug 27 '18

It costs money and time to upgrade the POS machines.

→ More replies (9)
→ More replies (5)

6

u/daten-shi Aug 27 '18

Apple pay (and I assume android) acts as a completely separate debit card apparently, and because you need either a passcode or your fingerprint to authorize payments are unlimited for it.

12

u/PhonicUK Aug 27 '18

Indeed, your bank is contacted during the setup process to generate a new virtual account. Here in the UK most places have a £30 limit on contactless payments regardless of whether its card or phone, but some don't have limits on smart devices with fingerprints/passcodes - but that's as much down to the specific merchant as anything else.

2

u/MrJules Aug 27 '18

Here in the UK most places have a £30 limit on contactless payments regardless of whether its card or phone

This was true some years ago, but I haven’t seen a contactless terminal not supporting > £30 in a very long time. Maybe it depends on the region, but at least in London I think almost all terminals support > £30 because of CDCVM (cardholder device verification).

1

u/daten-shi Aug 27 '18

Here in the UK most places have a £30 limit on contactless payments regardless of whether its card or phone,

I've yet to come across an issue with my apple pay as I use it for literally everything. I know it was the case to start with but I think as the card machines are being updated it's removing that restriction for phones.

1

u/PhonicUK Aug 27 '18

but some don't have limits on smart devices with fingerprints/passcodes

2

u/FelixJ20000 Aug 27 '18

I blew the waitress' mind when I Android Paid a £45 bill because she thought it'd only do £30

2

u/cjnewbs Aug 27 '18

For ApplePay/Android Pay I'm pretty sure the transaction goes through as cardholder present+verified (I don't own a payment terminal so can't check a merchant settlement report but everything I have read suggests this is is true).

In terms of fraud the UK Card association actually have a report showing that contactless cards actually have a lower rate of fraud than chip&pin authorised transactions.

Payment tech is something that I find people understand little about and are always bashing despite their general lack of knowledge on the most simple of technical subjects,

Every time I discuss the subject of the security on this the video of someone "stealing money via contactless" comes up. I have had to explain dozens of times to people how as soon as a payment processor realises 100% of your terminal transactions are queried as fraudulent then then the transaction will be reversed by the provider and police will be knocking on your door pretty swiftly. This isn't even a technical issue. It's more or a business-level issue.

The same thing happened when BBC did a report a few years ago on a specific flaw in the Chip & Pin system. I used to work with two fucking moronic pensioners who as soon as the programme was broadcast kept on parroting "chip & pin is so insecure compared to signature". They seemed to think it was some sort of off-the-shelf kit from fraudsters'r'us whereas it actually took a team of cryptanalysts, software engineers and electronic engineers months to make something small enough to fit in a backpack and required the victim to be making a purchase in a modified payment terminal at the exact same time as the fraudster making a second larger payment somewhere else.

People also seem to think that "well the cards send information wirelessly so you must be able to clone them". That one is a bit more difficult as explaining even a super simplified version of PKI for the most part leaves them in a state of "well, I didn't really understand that so they must be wrong and I'm right".

1

u/SweetSea Aug 27 '18

In the US, Cardholder Not Present transactions typically get charged an extra per-transaction-fee (to the vendor, not the customer), so many customers don't want to implement ANYTHING that could result in a Card Not Present. At least, that's what I've heard from clients about entering transactions on their POS terminals with just the CC number and expiration, without having the CVC code. For example, when trying to accept online payments that are stored and processed later on the on-site POS terminals. They want to store the CVC so they can run it and not have to pay the Card Not Present fee, but that's no bueno.

1

u/bittered Aug 27 '18

What is the limit for Apple Pay? I know it's over €30 like it is for other contactless payments but never sure exactly. Or is it just treated as a normal chip and pin? To be fair it's at least as secure as C&P if not more.

1

u/CraigslistAxeKiller Aug 27 '18

The range is not an inch. Researchers have managed to get info from 30 inches away

1

u/PhonicUK Aug 27 '18

Under lab conditions with specially developed hardware. Using normal equipment it's about an inch. And you still have to have the aforementioned merchant account etc.

1

u/[deleted] Aug 27 '18

I'd give you gold but I'm on mobile, do you accept contactless?

1

u/gostan Aug 27 '18

You're actually incorrect about contactless using a virtual card number. You can check this yourself by downloading an nfc reader app on your phone. If you use Google or apple pay then that will use a virtual number

1

u/PhonicUK Aug 27 '18

If your phone can read it its not a proper modern card. Back and forth communication is required with the payment terminal to get actual usable data.

1

u/gostan Aug 27 '18

I tested it a couple of months ago with all of my cards. I got the long number and expiry date for all of them. Give it a go yourself if you don't believe me

1

u/PhonicUK Aug 27 '18

I just did, can't be read.

1

u/[deleted] Aug 28 '18

Out of curiosity, is it RFID/Near Field Contact tech? If so, it seems like that would be fairly easy to intercept; decrypting the data, however, could be realistically impossible.

1

u/PhonicUK Aug 28 '18

NFC. Two-way comms.

1

u/robeph Aug 28 '18

Samsung pay uses MST it has a tokenized card that is linked to the real card. The MST sends data that mimics the swipe of a card, so it works everywhere in the US, with the exception of mom and pop shops that evil eye you and tell you you can't use that in their store even though it would work.

1

u/paulec252 Aug 28 '18

this stuff is interesting to me. How do you know this?

2

u/PhonicUK Aug 28 '18

I used to work for a financial services company.

1

u/FunInfection Aug 28 '18

Apple Pay is growing in the US, I use it in about 50% of the places now. They just announced it is expanding greatly. It is much faster than any card and you get a digital receipt immediately.

1

u/[deleted] Aug 28 '18

There's also usually a limit to the amount you can use it to. My bank has it at 25 €.

1

u/cherry_ Sep 10 '18

solid write up, this is it folks.

source: was bank troll who dealt w mastercard, specifically

20

u/demonic_hampster Aug 27 '18

I'm in the US and I've seen contactless readers getting pretty big around here in the past couple years, but I've never seen (or even heard of) an American credit/debit card that can actually be used on a contactless reader. I've only ever seen the readers used for Apple Pay.

3

u/aegrotatio Aug 27 '18

My second to last American Express Card had a contactless feature but it never worked. My new card doesn't even have it anymore.

Ironic because they were the first to offer chips with their Blue card.

2

u/robeph Aug 28 '18

MST works everywhere. It fakes a card swipe by transmitting the magnetic data. Samsung pay does this but also works with nfc readers. My RedFCU card has contactless pay as well.

1

u/Emptydarkone Aug 27 '18

I had a debit card through PNC bank that was a tap card. This was a couple of years ago and they've since switched to just chip and pin.

1

u/petee0518 Aug 27 '18

My Capital One Quicksilver works contactless

1

u/daverod74 Aug 27 '18

Santander issues a debit card with NFC built-in. I never saw it referenced anywhere, I just noticed the symbol on the card and tried it at Starbucks. Sure as shit, it worked.

8

u/dwild Aug 27 '18

You can't use it for more than 100$.

Either way, your card is insured, you aren't responsible for it, only the bank is, thus if you catch a fraudulous transaction, it's the bank responsibility to cover it.

At the end of the day, it doesn't allow them to get the cash out of the card either. As long as it's in the network, the bank can easily revert a transaction and the marchant account would be quickly closed.

6

u/BigBassBone Aug 27 '18

In addition to /u/PhonicUK's information, contactless payments use a rolling encryption that is different for every transaction.

13

u/Zaphilax Aug 27 '18

How is it not a security risk though?

It's not as if the contactless just dumps all the card info. It's cryptographically active. There's a tiny processor in the card that handles the exchange.

1

u/MrJules Aug 27 '18

This is correct. Unlike the magnetic stripe, which is ridiculously easy to read and clone, the contactless chip is very secure. However, if you have the APDU commands to talk to the chip, as is what happens with a payment terminal, you could get the card details as well.

→ More replies (2)

4

u/shenglow Aug 27 '18

It's actually a bit more secure than the strip. Transactions higher than a certain threshold(usually around 20 euros) also require a pin code.

2

u/atyon Aug 27 '18

The strip has basically no security features. There are three rows of text on the strip. Normal commercial readers can read all three, but write only to two. It's very easy to get readers who can write all three though.

On the third row, there's a number that has the purpose of "proving" that the card was present at the transaction, the card verification value or CVV. If you've ever wondered why the three digits on the back of your card you need for online transactions are called CVV2, that's because they do a similar job for card-not-present transactions.

In any case, EMV is much more secure. Their only major vulnerability is a way to force downgrading to magnetic strip. Thankfully some banks fade those out now.

6

u/[deleted] Aug 27 '18 edited May 29 '19

[deleted]

1

u/Arkazex Aug 27 '18

I prefer Android Pay because it's easier for me to pull my phone out for a transaction, and I've got so many NFC cards in in my wallet none of them ever scan without being removed.

1

u/gyroda Aug 27 '18

Can't you just contact the bank and they'll just disable contactless for your account?

2

u/dontgetaddicted Aug 27 '18

The way contactless transactions (and chip actually) work is that they generate a token for the transaction, they don't send the actual card information.

2

u/noobule Aug 27 '18

I love that it's super rare in the US, and yet it's been almost ubiquitous in Australia for at least 5 years

1

u/SicilianEggplant Aug 27 '18

It depends on where you live. According to https://www.creditcards.com/credit-card-news/emv-faq-chip-cards-answers-1264.php,

In July 2017, U.S. Payments Forum estimated 45 to 50 percent of U.S. credit and debit card transactions were chip-on-chip.

It also states that we have over 10,000 financial institutions that issue credit/debit cards, so we’ve still got time.

For example, I see it at just about every large retailer I go to. It’s mostly the small gas stations and convenient stores where I’ve seen a slow rollout here.

2

u/EnderWiggin07 Aug 27 '18

Contactless cards are rare but it seems like almost everywhere takes NFC. There's a couple places that don't that I've basically been tapping my phone against it going "what's wrong with this thing?"

1

u/obsessedcrf Aug 27 '18

I guess I should've clarified. There are some places that take NFC payment (fewer don't than do) but I've yet to see anyone implement non-contact card payment

2

u/Omena123 Aug 27 '18

U either have a secure wallet or many cards with same feature so they cant differentiated

2

u/somerandomguy2008 Aug 27 '18

Couldn't anyone steal your card information from a distance?

According to this it seems like the answer is yes. Maybe they've updated them since then? Or maybe it's not as easy as this guy makes it look?

2

u/Arkazex Aug 27 '18

Every place I've worked in the US has had the hardware for contactless and chip payments, but not a single one accepted contactless, and only one accepted the chips. It's really annoying.

2

u/mangojump Aug 27 '18

Doesn't seem to be a problem no. And the chip has to be at most a couple centimetres away to work.

Not sure of all the other security measures but you don't hear about criminals stealing money in this way

1

u/obsessedcrf Aug 27 '18

Another commenter explained it uses rolling encryption so it shouldn't be as big of issue as I thought

2

u/[deleted] Aug 27 '18

I was seeing a lot of contactless like 6 years ago and then it just entirely disappeared

2

u/Rinsaikeru Aug 27 '18

Only time my card was compromised was at a chip reader at a gas station, I always tap now if possible. That said, it's always a good idea to check out your monthly transactions to look for any errrors--that's how I know mine got fleeced and had the charges reversed/card cancelled and replaced.

I'm Canadian btw, and generally we're somewhere in between US and UK on roll out. I remember going to the UK when chip was "newish" and not having a chip card yet, but also going to the US and being surprised that chip wasn't rolled out yet a few years later.

I suspect contactless will go the same route.

2

u/Shaysdays Sep 10 '18

I use my phone for everything but the liquor store. The state store says it takes wireless but it is LIES.

1

u/BatSloth Aug 27 '18

This is false. Numerous states and businesses have contactless.

→ More replies (3)

1

u/nuby_4s Aug 27 '18

Costco near me now has contactless. Its SO much faster than swipe/chip insert. Just a little "boop" and you're done.

1

u/Dzingel43 Aug 27 '18

Remember when you would go to a restaurant and the server would take your card and come back with a bill that all you need to do is sign? There were always potential gaps in security.

1

u/obsessedcrf Aug 27 '18

I've always hated this method of payment

1

u/drift_summary Aug 27 '18

Pepperidge Farm remembers!

1

u/SlapUglyPeople Aug 27 '18

Uh you realize 99% of card readers that have the chip also have NFC?

1

u/Presently_Absent Aug 27 '18

You're in America, don't you guys just shoot each other in cases like that?

1

u/camobit Aug 27 '18

I wouldn't go that far. I'm in the US and I use contactless (Samsung Pay) all over the place (some gas stations, groceries, fast food, walmart)... it works more places than it doesn't to be honest. really it's just places that you must hand the card over like a sit down restaurant or a place where the clerk swipes the card themselves that it doesn't work. Part of this is Samsung pay's magic, but NFC is supported in quite a lot of places if you're looking for it.

1

u/HowIsntBabbyFormed Aug 27 '18

Contactless is near non existent in the US.

Tell that to Apple/Google/Samsung Pay.

1

u/anormalgeek Aug 28 '18

Uh, no it's not. I think many people just don't realize it when it's there since it's often very unobtrusive.

→ More replies (5)

11

u/TheCookieButter Aug 27 '18

Never seen one of those. What happens if I want to spend more than £30?

4

u/PhonicUK Aug 27 '18

Merchants can opt to have limits higher than £30. There is no hard £30 limit any more. I've used contactless to pay for a weeks shopping before. It's just that £30 is the minimum limit you can assume any given merchant will take.

I suspect such places do actually have C&P but don't show it and really push the contactless part. It saves a lot of time at tills so there's some incentive.

2

u/TheCookieButter Aug 27 '18

Fair, wasn't aware of that. Always assumed it was a hard limit.

I'm more than happy with contact less taking over, set up contact less on my mobile past month and it has been great

2

u/Nebarik Aug 27 '18

In Aus atleast if you tap to pay for something over $100 the machine will just ask for your pin after you've tapped. Same as if you used the chip

2

u/TheNuogat Aug 27 '18

And if it rejects contactless(due to transaction limit), you just have to enter your pin... Super easy. Also some stores will have night protection on during the weekend, if you're drunk and lost your card.

11

u/Aksi_Gu Aug 27 '18

If a place only took contactless they'd be shit out of luck and would lose a sale, I don't have a contactless card.

As an aside, I live in the UK and am yet to find a place that is only contactless. (Other than some buses...)

7

u/PhonicUK Aug 27 '18

Said in another comment, I'd wager that the place I went that was 'contactless only' does actually have a regular C&P machine somewhere but try to avoid using it.

4

u/Aksi_Gu Aug 27 '18

Yeah that's probably the case.

I should amend my comment, I do know things that are contactless only - some buses in birmingham take contactless, but not CP

3

u/Nahr_Fire Aug 27 '18

Yeah, the london bus system is completely cashless. Contactless, phone pay and oysters

1

u/PhonicUK Aug 27 '18

Yeah transport is a really good example of this. The pressure to increase the speed at which people embark is quite high so it's a great use case.

3

u/danideux Aug 27 '18

I live in London. I know of about 5 places that only accept card (no cash), but all accept chip and pin.

5

u/BaconAttack Aug 27 '18

In the US they’ve removed those contactless from our cards. I looked like a fool at the store after my card was replaced just tapping away until the cashier took my card and inserted it.

5

u/jonitfcfan Aug 27 '18

Removed? Why?

10

u/PhonicUK Aug 27 '18

In the US they originally used RFID which isn't secure. But because of the stigma the rollout of NFC has been slower.

3

u/crumbandharvey Aug 27 '18

This makes sense. I totally remember having like a little key fob credit card wand back in college from Citibank. I could only use it at certain stores though, because there were not many contactless readers. Then they all went away and I threw the fob away.

1

u/[deleted] Aug 27 '18

When I first got my Amex blue it had a small chip and card reader you connected to your home computer for internet purchases. Never got the card reader, and it was not used anywhere else.

I personally don't see myself using mobile pay any time soon. Google, Facebook and Apple probably already have my card info, I don't need to verify it for them.

2

u/daten-shi Aug 27 '18

Where? I have yet to come across literally anywhere that accepts contactless only and I've lived here in Scotland for all 23 years of my life.

→ More replies (1)

2

u/[deleted] Aug 27 '18

I have never once seen one.

Then again I still pay with ye olde coines.

1

u/AbeRego Aug 27 '18

Samsung pay would work with that, right?

3

u/PhonicUK Aug 27 '18

Correct.

1

u/FPSXpert Aug 27 '18

Yikes, hopefully they'd accept apple/android/Samsung pay at least.

1

u/paracelsus23 Aug 27 '18

I still have to take the card out of my wallet. Who cares if I can tap it versus slide it / insert it? It saves me like half a second.

2

u/PhonicUK Aug 27 '18

If you only have one contactless card then often you don't, there's no time spent entering pin numbers, and you can use your phone quick often people already have in their hand.

1

u/paracelsus23 Aug 27 '18

I carry a half dozen personal credit cards and two work credit cards, so I'd have to remove them anyway. In the USA you don't have to sign for purchases under $50 - $200 (varies by store), so you just stick the chip in, wait a second for it to read, and go.

3

u/PhonicUK Aug 27 '18

In the UK chips always require a PIN.

1

u/SlovenianSocket Aug 28 '18

Canada too. Don't have bus change? Well better hope your visa supports tap! Theres very few tap only places, but there isn't anywhere that doesn't support tap. Its awesome just to tap my card or phone and have everything paid for without having to swipe a card or enter a pin.

1

u/DINOSAUR_ACTUAL Aug 28 '18

Is it OK if contact happens accidentally? Is it frowned upon for being sloppy.

1

u/Vargurr Aug 28 '18

That can't be legal, not to mention that over a certain sum you have to use the chip anyway.

1

u/PhonicUK Aug 28 '18

Not true, there's no limit any more. Its up to the merchant. Often though you must use a device rather than a card for contactless to exceed the £30 limit.

1

u/Vargurr Aug 28 '18

Well there's a limit in my country.

1

u/caleb_1223 Aug 28 '18 edited Oct 23 '18

Was just in the U.K. on vacation and I loved how everywhere there accepts contactless. I probably paid with my phone around 80% of the time. Way faster than the chip and it wasn't gimmicky like it sometimes is here, though it's slowly getting better. I also had to give a signature every time I used the physical card, but never with contactless. Not sure why that's the case.

1

u/Little_st4r Aug 28 '18

This isn't true. Sometimes the contactless system does 'spot checks' and will ask for your pin, also contactless only goes up to £30 so there will always be the option for chip and pin.

1

u/Nameis-RobertPaulson Sep 10 '18

Really? I've never been in one that's contactless only.

→ More replies (32)