Talk:EMV/Archives/2016

Reads like a sales pitch

Agreed with author of the "Too long" comment, but also want to add that this entire article reads like a sales pitch/promotion. — Preceding unsigned comment added by 23.28.103.28 (talk) 00:56, 19 February 2016 (UTC)

Misuse of source which isn't particularly useful anyway

As I explained in my original edit summary [1] which was partially cut off but still IMO contained sufficient info to establish the reasons for my removal there are serious problems with both the source and our reporting of it that I don't think there is anything redeemable from the removed content.

Firstly, the source doesn't even support the claim

whereas chip-and-PIN cards are more common in other European countries (e.g., the UK, Ireland, France and the Netherlands) as well as in Canada.

A cursory check of the source will easily confirm this. The UK, Ireland and France are not mentioned at all. Netherlands is only mentioned in relation to a manufacturer. Canada is only mentioned as having chip based cards without clarification on what kind. There is some mentioned of Netherlands, the UK, France but not Canada or Ireland in the comments, but as I said, comments to a page are not a reliable source and it isn't even clearly stated in the comments that any of these generally use chip and pin.

The claim

chip-and-signature cards are more common in the US, Australia, New Zealand and some European countries (such as Germany and Austria)

is only partially supported by the source and we are reporting the source is a highly misleading way.

The source does say

“ Spain, Portugal, Italy, Germany, Turkey, Mexico, Australia, New Zealand, China, India, Russia, and most of Southeast Asia – is based on chip-and-signature or online PIN technology. ”

First you'd notice Austria isn't in this list. Germany, Australia and New Zealand are. The rest of source does support the US bit. Next notice that even for Germany, Australia and New Zealand, we've missed out a key point the source mentioned, "chip-and-signature or online PIN technology". The part of my comment which was partially cut off illustrated why this is highly problematic.

While this is pure OR (although I suspect I could easily find sources at least as good as the source we are using if I looked hard enough which more or less supports my claims), signatures are very rarely used in NZ. A large percentage of NZ transactions are electronic and although a fair few of these are EFTPOS, there are also many credit card ones. I probably spend too much time in supermarkets and stuff than is good for me but the last time I saw anyone sign anything for a credit card transaction is a year or more ago.

New Zealand has been using PIN almost exclusively for a very long time long time (at least since I came to NZ over 12 years ago and I don't think it was new then) long before we had chipped cards which came here rather late compared to most of the world except the US. Surprisingly those few times I've seen someone sign, there doesn't seem to have been any problem, perhaps because they do have some experience, partially since they do often get people to sign something if getting cash out with EFTPOS. I do know at least one store who says they will only accept PIN.

Technically these cards may be considered card and signature by some since I don't know they support any offline pin verification which it sounds like is partially what the source is getting at. I believe online PIN must be what everyone is using here since most info I've seen suggest the reason why some terminals are so slow is because the location just has some crappy dial up connection. And as I mentioned, PIN here is somewhat of a legacy of the EFTpos system which continues to largely use magnetic stripe cards & for which I know a connection has generally been required. In fact, at least with my bank, I'm not sure they support offline PIN at all without getting the bank to do something since you don't need to visit the bank to activate the PIN in the first place. You can do it purely over the internet if you have 2 factor authentication. So unless ordinary POS terminals are able to add the PIN when you make a transaction (which seems a security risk), I don't see how the card ever gets an offline PIN stored.

However as I mentioned earlier, we don't discuss online pin at all in the sentence I removed. In fact earlier we say

Other EMV cards are either signature-only or prefer signature over PIN in their CVM list (i.e., signature at the POS, but PIN at unattended terminals or ATMs). These are often called "chip and signature" cards.

But as I've said this isn't the case in NZ, signature is not preferred over online PIN (whether this is because of the card or because of the terminal I don't know).

And actually I just found [2] which suggests signature may not even be accepted anymore for Visa (I was under the impression you could simply click okay without a PIN and it would ask for signature but it seems this may no longer be the case). Also whatever some others may call them, they aren't called chip and signature here as the source attests and isn't surprising considering no one uses signatures. I would add that think most of what I said applies to Australia as well but I don't have enough confidence to say that for sure.

And I don't see any way to simply reword the paragraph I removed. The trouble is failing to differentiate between chip and signature and online PIN is inherently confusing and since our source doesn't there's no way we can as long as we use it. (I mentioned this in my original edit summary but it was cut off.)

Also, although the source is used in several other places and I'm not planning to remove it, I think we should use it with care. I'm not convinced it cuts it as a WP:RS. Do the people behind it have a reputation for fact checking and accuracy? I'm not sure and it doesn't help that the source appears to be written from a US POV and is mostly intending to help US credit card users abroad rather than a general info source.

Nil Einne (talk) 13:35, 18 August 2014 (UTC)

If the IP is really so desperate for the sentence, I'd accept it being added back without any examples. I object to adding any of the examples for the reasons give above. Note that in any case, the only valid examples are Germany and the USA. New Zealand and Australia shouldn't be used because online PIN is (NZ) or is likely (Australia) used there, not signatures. Austria isn't source at all so we shouldn't be using it. And as I've established, we have no sourcing for any of the chip and pin countries. (From our article chip and PIN, I'm fairly sure chip and PIN is used in the UK but we still need sources.)

And we still don't know if they use online PIN or signature in Germany. The fact that the IP is from Germany and so desperate to keep this sentence seems to imply that they do use signature in Germany, but even if so, we still need a source which clearly establishes this is the case, not our current dubious source which only establishes Germany either uses online PIN or signatures.

As for the US, I'm not sure they belong at all. As the source itself establishes and our article somewhat discusses in other sections, chip and signature is actually not the norm in the US. It's apparently the norm for chip cards, but most cards still aren't chipped so it's confusing for us to say "chip-and-signature cards are more common in the US" without further clarification. We earlier mention "Chip-and-PIN cards have not been adopted in the US" which IMO is sufficient info about the US combined with the info for later.

Of course, if the IP is able to allay my concerns over the source and the examples, I'm willing to listen.

P.S. If you want further evidence of the problems with the source, it also mentions South-East Asia as a chip and signature place. While it's been a few years, my memory of the situation in Malaysia suggests this is misleading. While this was with a local Visa Debit rather than a CC, I'm pretty sure they are handled the same (attempts at local debit card systems never really seemed to succeed so debit cards are just the debit versions of CC). IIRC, it was in fact quite common for POS terminals to ask for the PIN but you'd also have to sign. I guess this was an offline PIN since verification seemed to happen quite fast and our article seems to suggest there's no such thing as online PIN with signature.

This example further illustrates the problem with the source. It's treating things as a binary when the CWM list itself illustrates there are multiple different options which seem to vary depending on a variety of local and historic issues.

Nil Einne (talk) 05:38, 20 August 2014 (UTC)

From discussion elsewhere, I came across [3] which suggests I was partially wrong about the situation in Australia. Actually signatures were much more common there (compared to in NZ) until recently, evidently representing about half of transactions. However as with here in NZ, this is being or has been phased out in favour of requiring signatures.

The situation in NZ is definitely different. It seems in Australia you were actually asked if you wanted PIN or signature there [4] before whereas here your asked for the PIN but I believe you are or were allowed to just push okay and the card will ask for signature. I found [5] which says it's only 4% or so of Visa transactions use signature and it sounds like that's including tourists which probably explains why any education and news on the change to PIN only is so limited compared to what it sounds like it is in Australia.

Either way though, my point stands, in both Australia and New Zealand, chip and signature is not the norm and has probably never been the norm. In Australia it was evidently generally the consumers choice whether to use signature or PIN with about half using each. In NZ, it may have also been the consumers choice, but PIN was the norm by far.

From the discussion elsewhere, it does sound like signature is the norm in Austria, but we still don't have a source for this claim as with Germany.

Nil Einne (talk) 14:54, 20 August 2014 (UTC)

Actually Austrian card issuers have pushed for chip and pin a lot in the past year. Since March 2016 all newly issued MasterCard cards and since April 2016 all newly issued Visa cards will only work with Chip+Pin in Austria. All existing cards will be switched over to Chip+Pin by the same time next year. Source: http://futurezone.at/digital-life/pin-code-statt-unterschrift-bei-kreditkartenzahlung/184.239.571

213.47.251.146 (talk) —Preceding undated comment added 21:53, 18 August 2016 (UTC)

Visa provided a list of chip and signature countries in a meeting with the Federal Reserve: http://www.federalreserve.gov/newsevents/rr-commpublic/visa-meeting-20140305.pdf. The presentation also has reasons why the US isn't adopting PIN at the present time.

Mind21 98 (talk) 19:53, 6 September 2014 (UTC)

Liability Shift #3

Liability SHift on US fuel statiosn get delayed to 2020 (https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/)

--MasterX244 (talk) 10:50, 3 December 2016 (UTC)