Tales of a new credit card: chip-and-PIN arrives in the Toronto area.

[Sunspace]

In early December I got an application in the mail for a platinum credit card.

For a long time, even though I paid off my debt almost four years ago, I had believed that I was not credit-worthy. Last summer, however, on a whim, I requested my credit score, and to my surprise, it was better than average. So on a Monday night I filled out the application on the bank’s website and submitted it. The application mentioned that ‘if you do not qualify for a platinum card, we will consider you for a lesser card’, and that is pretty much what I expected to happen.

The following Saturday, I knew something was up. A link for a credit card account had appeared in my online banking screen. When I got home on Monday night, the new card had appeared in my mailbox!

It was a platinum card, with a much higher credit limit than I expected.

It also had an electronic chip embedded in the surface. There was a folder describing the new ‘chip and PIN’ system, where you shove the card into a point-of-sale (PoS) terminal, leave it there, and punch in a personal identification number (PIN) instead of signing a receipt. You take the card at the end. Apparently this is the up-and-coming thing in Canada, and all of our debit and credit cards will be converted in the next few years.

I asked about SDMB members’ experiences with chip-and-PIN in another thread, but googling revealed that the US is not changing to the new system.

As I headed out to use the new card, I wondered about this chip-and-PIN thing. I found that charges would often take some time to appear in the online record of my account, so I set up a little spreadsheet to keep track of my purchases, and I added a column to record how the transaction was performed.

So far I’ve spent around $975 on the card, and paid off around $675 of that.

But it was the types of sales transactions that were interesting. 6 sales transactions were online. 12 were the traditional ‘swipe the card and sign the receipt’. Two transactions were made through an ATM. One was swiped with no signature. And 6 were ‘shove and PIN’. (None were with the manual imprinter machine. Do people even use that any more?)

To my surprise, it wasn’t the big chain stores that used chip-and-PIN system at their point-of-sale terminals. It was mostly non-chain places, many smaller or independent: my gym, a craft store, the bus station in Toronto. The only two chains that used chip-and-PIN were Curry’s Art Supplies (a local chain in the Toronto area) and KFC. Even the brand-new Lowes hardware store up in Newmarket took a signature (though that was on an electronic pad).

I wonder whether this means that the chains have greater difficulties updating their systems. Are many of these companies running their own PoS systems rather than contracting it out to a third-party service like Moneris?

[Flutterby]

@Sunspace

(None were with the manual imprinter machine. Do people even use that any more?)

IME, the only time I’ve used these were either the system was down, or it was at a craft fair.

No chip and pin for me yet, I haven’t received my card with it. That won’t be for a year or so probably.

[Mindfield]

As I mentioned in that other thread I’ve got my chip-and-pin debit card already, and so far I’ve only had to use the chip part of it once, and that was at a Pharma Plus. Nowhere else that I’ve used it has had me do that.

Then again I tend not to pay for things with debit very often; I still prefer cash because it’s easier to keep track of how much money I’ve got left.

Oh and I’ve had to use the manual card machines a few times several years back when the credit card system was down at a time when I worked retail, so they still have some use still.

[Kythereia]

We’ve got Moneris at some of our local stores around here, but I think the bigger stores downtown still use their own systems. I think I’ve seen the chip-and-PIN thing maybe twice or three times in my life.

Is it worth it to get the card upgraded?

[Spezza]

I’m in Southern Ontario and everybody I knows has one of the newfangled Chip cards. Heck, they sent me one, which I promptly threw out, and then proceeded to cancel my existing card without any warning.

What bank are you with? Everybody with TD is stuck with the Chip. After a little exchange with an obstinate teller who was certain that the Chip provided me with increased security I acquiesced and have a VISA and debit card with the Chip (my student card also has a chip).

[Sunspace]

@Kythereia

Is it worth it to get the card upgraded?

I’m not sure that you can request a new card with chip and PIN; it’s more like they’ll send you one when your current card expires. I guess new customers get it by default.

(Hope you’re feeling better, Kyth!)

Mindfield, I think I won’t get a replacement debit card for some time. I do wear them out though. Then there was the incident last year where I lost my card, they issued a temporary, they sent me another permanent card, it didn’t work, I got another temporary, then another permanent. I’m now on my 11th debit card for the same account.

[Muffin]

So what did you buy for me?

[Sunspace]

@Muffin

So what did you buy for me?

Memories. They’re free.

[Casserole]

Actually, I’m surprised it’s taking so long for the chains to change to the chip-and-PIN system. When I was working at a small computer store (3 stores), a customer came up with a card with the chip/PIN. I had a grand ol’ time trying to figure out why the terminal kept saying “Insert Card” instead of “Swipe Card”.

Turns out our old Moneris Interac machine already had the feature built in, so stores have been inadvertently supporting it for years now.

My card expires 01/09, heh heh… I wonder if I’ll get one of them too…

[Muffin]

Given the sad state of my memory, that’s a pretty good gift. Thanks.

[Sunspace]

@Casserole

Actually, I’m surprised it’s taking so long for the chains to change to the chip-and-PIN system. When I was working at a small computer store (3 stores), a customer came up with a card with the chip/PIN. I had a grand ol’ time trying to figure out why the terminal kept saying “Insert Card” instead of “Swipe Card”.

Turns out our old Moneris Interac machine already had the feature built in, so stores have been inadvertently supporting it for years now.

I’m sure that I saw chip-card slots on the PoS terminals at the drugstore in South Common Mall when I was living in Oakville, and that was over seven years ago. Maybe it has to be enabled? Do changes have to be made to the register or anything, or is they all confined to the PoS terminal?

That terminal looks like the one in the brochures RBC sends out.

@Muffin

Given the sad state of my memory, that’s a pretty good gift. Thanks.

You haven’t inspected the memories yet, have you? They’re some of my old ones.

[Mindfield]

@Sunspace

Mindfield, I think I won’t get a replacement debit card for some time. I do wear them out though. Then there was the incident last year where I lost my card, they issued a temporary, they sent me another permanent card, it didn’t work, I got another temporary, then another permanent. I’m now on my 11th debit card for the same account.

It probably depends on who you bank with and when they are making (or if they have already made) the transition. I’m with BMO and they sent mine weeks ago – automatically. I wasn’t even aware they transitioned until the card turned up in my mail.

The only extra security I can see these things providing is the ability to verify that the card is the original, but that layer of security is going to be useless until everyone has transitioned and debit and bank machines no longer accept chipless cards, nor banks accept transactions made on cards without a chip. Until then, thieves can still steal your card data, make a dupe and use it without a chip anywhere that doesn’t use chip-and-pin verification – which right now seems to be most places.

After that, thieves will just have to create chip-and-pin readers and duplication machines, too, then we’re right back to square one. (It’ll happen.)

I’m not bothered by them though. While in the long run I see little benefit, but I don’t see any harm coming from it either so it doesn’t really matter to me one way or the other.

[Ike_Witt]

There are growing pains with the system that still need to be worked out. I have done several transactions with chip cards and they do seem to vary.

The end goal of the chip cards is that the customer will insert the card into the Moneris terminal themselves, enter their PIN and move on. Retailers, at some point, will not have to take the card from the customer. Even now on transactions with the PIN, the retailer still has to swipe the card before inserting it into the terminal.

[Muffin]

I don’t get it. Presently, the retailer does not always take my card – often I just swipe it, be it a chipless credit card, or a chipless debit card.

[GaryM]

@Mindfield

The only extra security I can see these things providing is the ability to verify that the card is the original, but that layer of security is going to be useless until everyone has transitioned and debit and bank machines no longer accept chipless cards, nor banks accept transactions made on cards without a chip. Until then, thieves can still steal your card data, make a dupe and use it without a chip anywhere that doesn’t use chip-and-pin verification – which right now seems to be most places.

So far as you mention merchants no longer accepting chipless cards, what about visitors whose banks have not converted, or don’t plan to convert? I’d imagine that chipless cards would be accepted for a long time yet, and I mean decades.

[Sunspace]

@Mindfield

The only extra security I can see these things providing is the ability to verify that the card is the original, but that layer of security is going to be useless until everyone has transitioned and debit and bank machines no longer accept chipless cards, nor banks accept transactions made on cards without a chip. Until then, thieves can still steal your card data, make a dupe and use it without a chip anywhere that doesn’t use chip-and-pin verification – which right now seems to be most places.

:: nods ::

@Mindfield

After that, thieves will just have to create chip-and-pin readers and duplication machines, too, then we’re right back to square one. (It’ll happen.)

I think it will be a lot more difficult for fraudsters to get blank chip cards, though, and almost impossible for them to manufacture new chip cards. They’d need state-level support for a for a full-scale factory, almost. I have a feeling that blank magstripe cards are fairly easy to obtain; I’ve seen magstripe writers advertised in consumer electronics magazines.

@Ike_Witt

There are growing pains with the system that still need to be worked out. I have done several transactions with chip cards and they do seem to vary.

The end goal of the chip cards is that the customer will insert the card into the Moneris terminal themselves, enter their PIN and move on. Retailers, at some point, will not have to take the card from the customer. Even now on transactions with the PIN, the retailer still has to swipe the card before inserting it into the terminal.

I noticed this. On my second in-person transaction with the new card, the merchant swiped the card and apparently got an instruction to insert the card instead, as Casserole mentioned upthread.

@GaryM

So far as you mention merchants no longer accepting chipless cards, what about visitors whose banks have not converted, or don’t plan to convert? I’d imagine that chipless cards would be accepted for a long time yet, and I mean decades.

I’m wondering about this. Interac, Visa, and MasterCard have said on their websites that magstripe transactions won’t be accepted at merchants or ATMs after the end of, I think, 2015, but I imagine that applies only to Canadian-issued cards. I can’t see them ceasing to accept US magstripe cards; too much business to lose.

And for ATMs, you won’t use many of them any differently anyways. Only the ones where you dip the card in or swipe it will need to change on the outside; the larger ones where the card is pulled in may change on the inside, but the method of operation won’t change.

@Muffin

I don’t get it. Presently, the retailer does not always take my card – often I just swipe it, be it a chipless credit card, or a chipless debit card.

I’m trying to think of a time when I handled an entire card-present purchase without giving the card to the merchant. Buying gas and paying at the pump? I’ve only used debit for that (haven’t driven much since 2001–this new credit card means I can now rent a car again).

[NineToTheSky]

I’m very surprised by this. We’ve had chip and pin here in the UK for several years. Everyone - from major chains to tiny independents - uses it. There is an option to over ride chip and pin so overseas visitors can use their cards. It’s become second nature to insert my card into the terminal.

[Sunspace]

@NineToTheSky

I’m very surprised by this. We’ve had chip and pin here in the UK for several years. Everyone - from major chains to tiny independents - uses it. There is an option to over ride chip and pin so overseas visitors can use their cards. It’s become second nature to insert my card into the terminal.

What was it like at the beginning of your transition to chip and PIN?

[NineToTheSky]

@Sunspace

What was it like at the beginning of your transition to chip and PIN?

I was working in retail when it came out, so I’ve seen it from both sides. A lot of people had difficulty in remembering their pins, and there was a huge amount of paranioa about not disclosing your pin when keying it in. Cashiers made exaggerated efforts to not overlook - they’d turn their backs on the keyer, or stare at the ceiling. People used to cup their hands around the pad, which made their lives difficult because they’d need one hand to key in the number. We’ve all become a lot more relaxed now.

In the beginning, nearly all cards were handed to the cashier to be swiped, and when we started to educate the public to put their cards in the terminals themselves, people were confused as to which way up to insert them. You’d have to tell them when to enter their pin and to

“Press the ‘enter’ key. No the ‘enter’: the *green *one. That’s it. No, don’t take your card out yet. OK, you can take it out now…” and so on. It’s now become automatic for everyone to bung them in and follow the instructions themselves.

We (in retail) noticed fraud being reduced quite significantly. Obviously, with chip and pin, the thief needs to not only steal the card, but somehow find out the pin number, as opposed to only needing to copy out the signature on the card.

[Mindfield]

@GaryM

So far as you mention merchants no longer accepting chipless cards, what about visitors whose banks have not converted, or don’t plan to convert? I’d imagine that chipless cards would be accepted for a long time yet, and I mean decades.

That’s kind of my point though. One of the major security features of chip-and-pin is its verification that the card is genuine through the chip, which doesn’t offer any added security at retailers who haven’t made the transition to debit/credit machines that use it. Once they have it will work a lot better though.

@Sunspace

:: nods :: I think it will be a lot more difficult for fraudsters to get blank chip cards, though, and almost impossible for them to manufacture new chip cards. They’d need state-level support for a for a full-scale factory, almost. I have a feeling that blank magstripe cards are fairly easy to obtain; I’ve seen magstripe writers advertised in consumer electronics magazines.

For a while anyway, there would certainly be an interstitial period where counterfeiters/identity thieves will be unable to use the old technology to commit fraud and unable to duplicate the new. However, it won’t take terribly long before a more sophisticated operation pops up that’s able to reverse-engineer and produce their own blank chip-and-pin cards to be duplicated. It’s impossible to say how long, but it’s more or less a foregone conclusion that it will happen eventually. It always does.