For Americans, Plastic Buys Less Abroad [Telecom]

Practical Traveler For Americans, Plastic Buys Less Abroad

By MICHELLE HIGGINS The New York Times October 4, 2009

BETTER pack some cash on your next trip abroad. Americans are finding that their credit and bank cards aren't as convenient as they once were while traveling overseas.

The problem: American cards lack a special chip, now commonly used in many foreign countries, causing the cards to be rejected by some merchants and kiosks.

That's what Nancy Elkind, a lawyer from Denver, discovered in Paris when she wanted to use the popular V=E9lib' bicycle rental system on a weeklong vacation with her husband last spring. They tried to swipe various cards at the rental kiosk, which doesn't take cash, and all the cards were rejected.

Then, thinking the problem might be with the kiosk and not their cards, they tried other V=E9lib' locations around the city. But each time, their cards were not accepted.

"We gave up, and kept walking around Paris, commenting occasionally on how much fun it would be to do some exploring by bike," Ms. Elkind said.

The couple's cards, which rely on magnetic-stripe technology for transactions, lacked an embedded microprocessor chip, which stores and processes data and is now commonly used in Europe. Such chip-based cards - commonly referred to as chip-and-PIN cards because users punch in a personal identification number instead of signing for the purchase - offer an extra layer of protection against the theft of cardholder data and counterfeiting, and they are designed to replace magnetic stripe technology and signature payments.

The chip-and-PIN technology usually isn't much of an issue when making purchases at a store, or paying for a meal in a restaurant, as most of those merchants still have credit card terminals that can read the magnetic stripes. Likewise, A.T.M.'s typically recognize and accept many cards whether they have a chip or a magnetic stripe.

But American cardholders have had their cards rejected by automated ticket kiosks at train stations, gas pumps, parking garages and other places where there are no cashiers.

formatting link

***** Moderator's Note *****

This is related to telecom in a way that might not be obvious: it's an indication that society has (or is about to) come full circle, and do the things necessary to *prevent* electronic commerce without authority of the person who owns the funds.

The telegraph and (of course) the telephone, were the first technical advances to allow information to travel more quickly than the paperwork associated with it: before the telegraph, the postal system was the fastest way to get an order for goods from place to place(1), and also the only commonly available alternative to messengers - but the order would, by custom, be accompanied by some kind of financial instrument which could either be verified on sight at the destination, or used as evidence of good intent in banking transactions.

Electronic commerce - it's nothing new, by the way - created entire industries dedicated to managing the risks associated with providing goods and services without paper-based financial instruments changing hands. Codes, ciphers, and passwords - also nothing new - had to be improved and made easier to use so that average men could use them effectively to assure the identity and good intent of those whom they were dealing with. When there's no way to verify the bona fides of a person who initiates a commercial transaction - such as when a credit card number and expiration date is traded on a pirate bulletin board - then the added risks of fraud must be covered by insurance, or the added costs must be born by all law-abiding users.

The information superhighway carries crooks and crazies at the same speed as civilians, and now - at least in Europe - society is putting on the brakes.

Bill Horne Moderator

1.) I leave aside Semaphore or similar systems, since they weren't commonly available and were too expensive for everyday use. The Pony Express is a special case of (very expensive) messenger service.
Reply to
Monty Solomon
Loading thread data ...

Tried to swipe an American credit card in a machine at Charles DeGaulle Airport to buy a ticket into Paris on the RER trains a year or so back (forget which brand of card, but it was one shown on the machine) and couldn't get it accepted. Maybe this was the problem. Had to go to a ticket booth and stand in line.

Reply to
AES

Gee, I could have told her that. When I was in Paris and Lyon, which has a similar system, earlier this year, my US cards didn't work, but my UK cards did.

[the article goes on to note that most places where there's a human cashier who can check your signature still takes swiped cards, and then quotes someone from Visa spouting nonsense that it's a "misunderstanding" rather than a feature to require a chip at unattended terminals.]

It's more directly related than that. European banks developed cards with embedded chips so they could be used offline in a reasonably secure way, since for a long time it wasn't practical to expect merchants across Europe to have a phone line they could semi-dedicate to a terminal with a modem. A card could have its withdrawal limit loaded into the chip at the bank, then each transaction decreases the limit in the chip so it knows when it's overdrawn. These days the terminals are all online and they use a sophisticated protocol that cryptographically signs the transaction to send it to the bank, which only the chip can do.

For a while American Express put a chip in their US Blue cards, but they don't any more.

R's, John

Reply to
John Levine

Yup. The ticket machines want a chip.

R's, John

Reply to
John Levine

Questions, if I may, please:

Is the "chip" in question an RF chip like those embedded in some Chase ATM cards, or gasoline company "just wave it at the pump" credit cards?

Or is it rather a little purpose-built computer-with-RAM-and-ROM, having six or eight metallic contacts like the contacts on a GSM SIM chip, such as were in use on certain older AmEx "Blue" cards?

And: Any US banks with plans for reissuing their cards in mag-strip-plus-chip (plus PIN) form?

TIA; and cheers, -- tlvp

-- Avant de repondre, jeter la poubelle, SVP

Reply to
tlvp

I work with retail EFTPOS/Card systems and there are still country boundary issues with a lot of the various card types/systems at the moment

- chip or no chip.

As an example, people can use Non-Australian Visa/MC at our shops via our electronic systems for credit purchases, but not for foreign debit transactions (apparently coming as soon as the gateway EFTPOS provides get agreements/links with the various institutions involved - and there are a lot of them.....)

Some of the issues (I believe) are for currency conversions/fees etc, and the whole situation sounds messy. Visa and MasterCard are pushing their Debit card options hard in the marketplace here just because of this situation.

With the Internet and the ability to have secure comms virtually from anywhere to anywhere else now, you would think that this sort of thing would be sorted out by now but there are a lot of vested interests involved who are doing quite nicely out of the options available now that cost us consumers big fees for using cards in foreign countries (much like using phones in foreign places.......)

-- Regards, David.

David Clayton Melbourne, Victoria, Australia. Knowledge is a measure of how many answers you have, intelligence is a measure of how many questions you have.

Reply to
David Clayton
[snip]

As I always understood it, the impetus for adding the chip was ballooning fraud with stolen cards. It was never reasonable to expect a harried shop assistant on something near minimum wage to closely compare a customer's signature with the one on the card (which anyway was often stolen from the post before the owner ever saw it), let alone know what to look for.

Chip and PIN has almost eliminated these frauds but unfortunately has increased another one. Anyone who can capture the magstripe data and see the owner inputting their PIN can send the data to a confederate in another country where the ATMs don't read chip cards. They just write the magstripe data to a blank card and pop to a nearby ATM.

Previously, the PIN could only be captured at an ATM but now there are thousands of other places where this can happen.

Of course by controlling fraud, chip and PIN has made unattended terminals such as pay-at-pump much more practical.

Some banks also issue hand-held devices like pocket calculators which you slot the card into and enter the PIN for on-line banking transactions. I have one of these for one account but have never had to use it. Presumably it displays a one-time password or a response to a challenge.

France was first with a simple version of the technology. The chip is a contact type using the same pattern as on a GSM SIM. The banks then got together and agreed new international standards which were incompatible with the French system so they had to replace their cards (the contact pattern is still the same though). The new standards are very flexible and allow multiple applications on one card (e.g. debit and cash cards plus perhaps I.D., travel and supermarket loyalty functions) but I don't see this being used in practice. For one thing, the security (phishing) implications would scare the banks.

Recently, Barclays have done a lot of expensive advertising for a contactless card but I don't know why. How many merchants are going to install new terminals just for those?

Reply to
Steve Hayes

The latter. The card must be phyiscally inserted into a reader to activate the chip.

Several US banks issue contactless cards, Mastercard Paypass and Visa PayWave, which are logically but not electrically compatible with the chip used in European cards. (The technology is known as EMV.) There are also some contactless cards in Europe that also have the regular chip. I see no bank in North America planning to issue chip cards, but Maybe everyone will go contactless.

I have a contactless HSBC debit card, but I've never used it other than as an ATM card.

Reply to
John Levine

No.

Yes. I lived in Paris for a little over a year in 1993-1994 and my French bank issued Visa had a chip in it then. It was visible and had the contact pads on the surface of the chip. This is not new technology. It was well established in 1993 such that even a little bistro in some remote small town would have a hand-held credit card machine that would accept my pin and process the transaction off-line and print a receipt right at the table. A US type card would not work in those machines.

No idea, but one would hope so. I never had any trouble using my US bank's ATM card in most French (or German or Italian or British) bank machines to get cash, and that still worked as of 2 years ago when I went for a vacation. My US issued Visa worked fine at motels or similar places where a telephone connected machine was in use.

Bill Ranck Blacksburg, Va.

Reply to
ranck

It's the latter. In essence a SIM card.

Reply to
T

I'm really not one who generally criticizes his own country and I enjoy a heaping plate of "freedom fries" as much as the next guy. But sometimes I wonder why we're so technologically backward.

When Linus Torvalds first moved to the United States he commented on how shocked he was to learn how backwards our banking system was. I forget the exact details, but if I recall correctly consumers hardly used checks in Finland even back then. Everything from bill pay to statements were electronic.

Around 1990 or so I was in rural, eastern Tennessee. I stopped for gas. They didn't have pay at the pump, so I went into the store. It was a national chain and I had a credit card issued by this chain. I handed him my card and he wasn't sure what to do with it. He had what appeared to be a mechanical cash register, nothing he could use to run the card. He pulled the shoe box sized apparatus to make a carbon of my credit card, but had to pull out the manual to figure out how to use it. I hadn't seen one of these devices in many years. Even though I've never worked in a retail location that took credit cards, I knew how to adjust the levers to set the price, where to place the card, and how to slide the roller over it all. So I did it all for him. I could've ripped him off by setting the wrong price, but I didn't.

In 1997 I was near Valdosta, Georgia at another national chain. I went in to pay. She asked how much I had pumped. I sarcastically thought, didn't say, "Why not look it up on your fancy adding machine?". Their system was to use binoculars to read the pump.

Maybe because I'm a telecom and computer geek I have unreasonable expectations for our nation's technological advancement. But when I hear stories like those from Bill R. I think it's not just me.

John

-- John Mayson Austin, Texas, USA

***** Moderator's Note *****

My wife was vacuuming the rug when I came in tonight, and swearing at the machine because it wasn't doing a good job. I reached over and switched the vacuum line from "hose" to "floor", and after that it worked OK.

No, you're not alone.

Bill Horne Moderator

Reply to
John Mayson

The RFID in cards is not the same. It is like the AmEx cards or like the stored value phone cards used abroad (and for a while in the US in Nortel "Millennium" phones used first by US West/Qwest and by other carriers often in airports.) It's "smart cards" similar but not the same as SIM cards. They have "gold" contacts on one side. Smart credit cards have their "data" business on the opposite side as mag stripe cards.

Eventually I suppose those of us on the left side of the big pond will get the technology as well.

Reply to
Joseph Singer

On Tue, 06 Oct 2009 13:09:36 -0400, Steve Hayes wrote: .......

........

People should also be aware that these "chip" cards also have privacy (rather, lack of it) concerns for the individual card users. AFAIK they can store data about transactions so when used in an off-line mode the terminal can interrogate the card to determine if it should approve the transaction without direct confirmation from an on-line source (probably via algorithms on previous purchasing patterns, I would say - at a guess).

Currently only your card issuer has the sum total of all of your transactions, with individual transaction points only able to see specific transactions that pass through their systems - now with this data stored in a location accessible to ALL places that you use the card (the actual chip on the card itself) and actually used in the transaction process, who knows how much information individual retailers/vendors can now collect about your card use at other places?

-- Regards, David.

David Clayton Melbourne, Victoria, Australia. Knowledge is a measure of how many answers you have, intelligence is a measure of how many questions you have.

Reply to
David Clayton

Uh, it should be much simpler than that. Really, all the card needs to "remember" is how much has been used as a total, it doesn't need to store transaction details. I'm not saying they don't store those details, but they really should not need to, and the merchant's machine has no need to be able to query previous transactions. It only needs to query how much "money" is available. If I were designing such a card/chip system and wanted to store transactions on the card itself I'd encrypt those so merchants could not get the info and only report back a maximum allowable charge amount when queried. But why store them at all?

Do you know for a fact this info is stored on the card/chip? Do you have a reference to an article or technical description?

Bill Ranck Blacksburg, Va.

Reply to
ranck

None. There's a crypto protocol for transactions, the terminal doesn't get to poke around in the innards of the cards.

Last year I visited a lot of Cambridge University Computer Lab security seminars where they dissected the chip+pin system. They found a fair number of security issues, but that's not one of them.

R's, John

Reply to
John Levine

Many people still use checks. There are some things nothing else works for. Various local and national clubs and organizations are run by volunteers who have to training or desire to learn how to operate the machiney nor does the organization have any funds fot the equipment or fees, nor do they see any reason to, since they are interested in the purpose for which the club was organized, not being techie or devoting a bunch of time to side issues.

When I paid my tree trimmer, my plumber, etc., neither was set up to deal with electronic payments, so I wrote them a check. (I will note that several years ago I had work done by Roto-Rooter, a franchise of a national company. They took my credit card for $2,000+, the plumber read all the details over the phone to the local office, and they apparently entered it manually and got authorization before the plumbder left the premises.

You say a "national chain" but he was probably just a small operator who owned his business and had a contract with the "national chain."

A restaurant I frequent had a power failure and the cashier took everything down manually. They remembered how to do it from earlier employment but they didn't use the machine, just wrote everything down on the manual ticket by hand.

Such methods of reading the pump still exist. Low volume stations do not see a return on equity (except maybe negative) for the cost of installing a more automated system. The manual method is the most cost effective. Because a higher tech system exists it is often not economically effective. Because it's high tech does not necessarily make it cost effective. Wes Leatherock snipped-for-privacy@aol.com snipped-for-privacy@yahoo.com

Reply to
Wesrock

Unfortunately the simple "Is the transaction under the limit" test doesn't really work if the card number has also been used in a non-swipe mode, such as an Internet purchase, where the chip does not get (immediately) updated. Even using the card on non-chip EFTPOS terminals will not update that info.

Stolen cards can be quickly maxed out by on-line purchases, and if you then have a suspect card saying "Ok" to someone making a high value off-line purchase then the card issuers don't like this sort of thing - hence the pattern matching as an additional level of fraud protection.

I don't have any specifics at the moment, but I recall being told at an industry conference a year or so ago that one of the "features" of these chip cards was that they would hold sufficient information/ability to do off-line approvals of transactions based on previous use patterns - all in the name of improved security.

Currently a lot of the bank issuers' on-line systems here have monitoring software to generate alerts if card use is atypical (one system is called the "Falcon"), and I'm fairly sure that they can initially reject a suspect on-line transaction by requiring the shop to then ring up for a manual approval (at least we have those sort of codes in our list from our EFTPOS provider - I don't spend a lot of time at the counters so I haven't seen it happen myself).

I am basically going on a mix of the little titbits of info on these cards from my side of the industry and my (well earned) distrust of the sort of organisations that would love to get this sort of usage info if it became technically possible...... ;-)

I once made a submission to a government report (about 20 years ago, IIRC) here on PCS systems that cellphone use could be a potential privacy threat because of the ability to track someone's locations via the base station registration info. I recall at the time the general consensus was that it either couldn't or wouldn't be a problem (for so many reasons) and it wasn't worth more than a few lines in the final report.... but some of us never grow out of this sort of paranoia.....

-- Regards, David.

David Clayton Melbourne, Victoria, Australia. Knowledge is a measure of how many answers you have, intelligence is a measure of how many questions you have.

Reply to
David Clayton

But, none of that is mitigated by storing some transactions on the card/chip, so why bother?

That pattern matching could be done on the card/chip and result in a yes/no report back to the merchant's machine. Again, no need to allow merchant machines to query transaction information from the card. In fact, the credit card companies probably consider transaction and purchase pattern info as a valuable resource, so they are unlikely to allow a merchant system to query it. It would also be illegal in some situations I can think of.

I understand your concern. I just don't think any rational credit card company would allow any merchant to query transactions off a card.

Bill Ranck Blacksburg, Va.

Reply to
ranck

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.