# Did you know Oct 1 is the deadline to switch to chipped credit cards? **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [September 30, 2015, 11:38pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093 "2015-09-30T23:38:16Z")\ **Posts on this page:** 13\ **Page:** 4
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [October 3, 2015, 11:11pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/61 "2015-10-03T23:11:16Z")
> [@Claverhouse](#): > > You might want to read that letter that comes with your new card. Does the letter cite a particular law? Which one, exactly? ---
**Author:** ![guizot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guizot/32/3636_2.png) [@guizot](https://boards.straightdope.com/u/guizot)\ **Post date:** [October 4, 2015, 6:03am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/62 "2015-10-04T06:03:18Z")
> [@Alley\_Dweller](#): > > But in the US, the contactless cards that were available prior to EMV were a complete flop. About a year-and-a-half ago I got a new Bank of America credit card and when they sent it to me, they also sent, at the same time, in a separate envelope, an NFC-contactless chip, as _a separate little card_ that you snap out of a larger credit-card-sized card–like the way they sell SIMs. [Here it is](http://s12.postimg.org/mmg8b6ael/NFC_contacless_payment_2.jpg). Notice the instructions: “Snap-Out Tag & Attach to Mobile Device.” “What the hell? Why do I have to attach it to a mobile device?” Does it send data through your cell phone? I couldn’t figure out how that would work. The packet of paper instructions didn’t explain it at all. So I called them up and they seemed to be completely unaware that they were issuing these cards. They were confusing it with the EMV cards where a totally different kind of chip is in the credit card itself. I called various offices at Bank of America, and no one had any idea what I was talking about. Finally, I made clear to one manager that this was something different, and he guessed what it was, but said that they were no longer using that system. (Huh? They had just sent it to me.) He also guessed that the reason it says “Attach to Mobile Device” was just a suggestion, as a convenient place to keep the little card. But maybe not. He just didn’t know. And he _worked_ there. Ultimately he said, “Forget about that thing we sent you. We’ll send you a new card with the new chip”–meaning the EMV card. I was a little disappointed, because I wanted to at least try it out. It sounded so fast and easy. But the fact is that no one has readers for those cards anyway–not that I’ve seen. ---
**Author:** ![Canadjun](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Canadjun](https://boards.straightdope.com/u/Canadjun)\ **Post date:** [October 4, 2015, 12:46pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/63 "2015-10-04T12:46:53Z")
> [@Claverhouse](#): > > The Bank for one. > You might want to read that letter that comes with your new card. The fact that something is against the terms of a contract (e.g. the contract allowing you to use your credit card) does not make it against the law, i.e. illegal. Banks don’t make laws; governments do. ---
**Author:** ![Jake\_Jones](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jake\_Jones](https://boards.straightdope.com/u/Jake_Jones)\ **Post date:** [October 6, 2015, 6:10am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/64 "2015-10-06T06:10:04Z")
> [@Alley\_Dweller](#): > > Unfortunately, the way EMV is implemented today, the account number and expiration date are NOT encrypted. If any encryption is to be done, it needs to be done by the payment terminal after the card is read. > > Instead, the terminal presents the card with an “unpredictable number.” The chip has a key buried in its memory that cannot be read short of disassembling the chip and using some sophisticated techniques. After the terminal presents its request to the chip, the chip creates a digital signature using the account data, the unpredictable number, and the key in the card. The card number, expiration date, and the digital signature are then returned to the terminal. The approving authority (the issuer or their surrogate) then checks to make sure the digital signature is correct before approving the transaction. > > The purpose of the chip is solely to confirm the authenticity of the card. It does not help in any situations (such as online purchases) where the card is not used. > > Yes, you could build a skimmer to get the account number and expiration date. However, this information would not allow you to build a new card. You still need the key inside the card to duplicate the chip or to duplicate the function of the chip. This data will not allow you to create a fake magnetic stripe card because it does not contain the CVV value that is on the magnetic stripe. > > The chip is not a panacea for all credit card fraud. It is just a scheme to prevent people from making an unauthorized duplicate of a card. This is the best answer so far, but I’ll add a few things. I’m not an expert but this is what I know. There are actually three points of authentication in EMV. Those are between card/device to payment terminal, payment terminal to acquiring system (gateway) and gateway to card issuer (host). Magstripe tech is completely static, unencrypted, readable by a $50 magstripe reader and writable/re-writable onto another magstripe by a $200 magstripe read/write device. It’s all wide open and accessible to anyone with cheap readers, often covertly deployed (skimmers) in public terminals like ATMs or (more frequently, due to lower security) pay at the pump gas station terminals. The EMV standard (which covers both chip cards and NFC payments like Apple Pay and Google Wallet, which is why I specify card/device rather than chip) is different. That little chip on your new cards is actually a tiny integrated circuit with a processor and memory, capable of running even tinier little applications that interact with the EMV system in real time, sending and receiving and storing data in the process. That’s why with a magstripe, you swipe and put your card away. It’s static data that you send and wait for an approval. With EMV chip or NFC, you must keep your payment source connected. The transaction is challenged by the payment terminal, gateway and host, all having access (through private key or hidden public key encryption) to the data on your EMV card or device in real time. Chip and signature is kind of a half-assed bridge to real two-factor authentication like chip and PIN, but it does prevent card duplication as **Alley Dweller** mentioned. It’s not foolproof, and also as mentioned, it does nothing for “card not present” (CNP) transactions, such that CNP merchants like internet and phone merchants are likely to see an increase in fraud attempts, but it’s a step in the right direction. There is also an EMV protocol for offline transactions. What I described above in real time transaction of communication up and down the line from card/device to payment terminal to gateway to host and back can be avoided when necessary and agreed to by the host and payment terminal. The host can implement instructions and write those to the card/device so you can spend $x in offline mode (where $x is written to the card/device per transaction by separate payment terminals and affects the total available) until the next online reconciliation is available. Anyway, it’s cool technology that the US is way overdue for and more than worthwhile for the few extra seconds it takes at checkout. ---
**Author:** ![Alan\_Smithee](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Alan\_Smithee](https://boards.straightdope.com/u/Alan_Smithee)\ **Post date:** [October 6, 2015, 6:38am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/65 "2015-10-06T06:38:59Z")
Excellent addition to the thread, **Jake Jones**. Two things: First, it’s not even chip and signature in most cases, at least for low value purchases. It’s just chip. Second, given the expected increase in CNP fraud, how long until we’re required to use a cell phone linked to the account to authorize/confirm CNP transactions? It seems like the next logical step. ---
**Author:** ![ChockFullOfHeadyGoodness](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chockfullofheadygoodness/32/511_2.png) [@ChockFullOfHeadyGoodness](https://boards.straightdope.com/u/ChockFullOfHeadyGoodness)\ **Post date:** [October 7, 2015, 6:09pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/66 "2015-10-07T18:09:34Z")
Bank of America must not be too concerned. I just got a new VISA card the last week of September. No chip. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [October 8, 2015, 5:23am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/67 "2015-10-08T05:23:47Z")
> [@ChockFullOfHeadyGoodness](#): > > Bank of America must not be too concerned. I just got a new VISA card the last week of September. No chip. Were you due to get a new card about that time anyway? Maybe it was just in the pipeline. Maybe they’re just backlogged in getting all the new chipped cards out. I got a new BofA card at about the same time – mid September or so. With chip. Also, they changed it from Visa to MasterCard now. ---
**Author:** ![Bullitt](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bullitt/32/5725_2.png) [@Bullitt](https://boards.straightdope.com/u/Bullitt)\ **Post date:** [October 8, 2015, 8:38am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/68 "2015-10-08T08:38:16Z")
> [@Claverhouse](#): > > By another miracle of modern tech, one can change one’s PIN to whatever one desires, easiest at an ATM after inputting one’s current PIN. Not for all, not yet. For my credit union’s ATM cards, they randomly assign the PIN. For me to change the PIN (to match my other cards with the same PIN) they said they can do that but only at a branch office. I have to bring my card in. My CU is located in NC, and I live in CA and don’t have plans to be there anytime soon. So it ain’t happening. Not for a while anyway. ---
**Author:** ![Find\_Friends](https://avatars.discourse-cdn.com/v4/letter/f/c37758/32.png) [@Find\_Friends](https://boards.straightdope.com/u/Find_Friends)\ **Post date:** [October 8, 2015, 8:41am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/69 "2015-10-08T08:41:01Z")
My new credit card has a chip but not my old debit card. Problems? ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [October 8, 2015, 9:25am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/70 "2015-10-08T09:25:33Z")
> [@Find\_Friends](#): > > My new credit card has a chip but not my old debit card. > > Problems? Nah. As the OP implied, the target date didn’t happen. They can’t start phasing out mag strip yet. ---
**Author:** ![puzzlegal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/puzzlegal/32/3827_2.png) [@puzzlegal](https://boards.straightdope.com/u/puzzlegal)\ **Post date:** [October 8, 2015, 10:21am UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/71 "2015-10-08T10:21:05Z")
> [@Dewey\_Finn](#): > > And, technically, there are two types of EMV cards. The chip-and-signature cards we’re getting in the US and the chip-and-PIN cards used in Europe. Those are technologically the same. The card can tell the reader whether the bank requires a pin for this transaction or not. I took my new chipped card to Europe this summer. A few places, like unmanned train ticket machines, required me to enter the pin. To the obvious surprise of many merchants, the standard card readers told the merchant to collect my signature rather than my pin. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [October 8, 2015, 8:18pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/72 "2015-10-08T20:18:11Z")
As banks move more toward all-chip-and- **PIN** all-the-time, will they need to send us all new cards _again?_ Or can they upgrade the existing chip-and-sig cards (or the readers? or the message protocol between the bank and the readers?) to make this next transition? ---
**Author:** ![Dendarii\_Dame](https://avatars.discourse-cdn.com/v4/letter/d/bbce88/32.png) [@Dendarii\_Dame](https://boards.straightdope.com/u/Dendarii_Dame)\ **Post date:** [October 8, 2015, 8:57pm UTC](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093/73 "2015-10-08T20:57:36Z")
It’s October 8th, and my supermarket hasn’t changed yet. Last week, they had the equipment set up to do the insertion part, but not this week. (And it didn’t work last week.) [Previous page](https://boards.straightdope.com/t/did-you-know-oct-1-is-the-deadline-to-switch-to-chipped-credit-cards/733093.md?page=3)