Call to stop support for swipe payments

[Bismuth]

Cards in the US are actually far more advanced and complex than what is available in SA. The reason why it took the US so long to switch to chip is because so many different brand new things had to be developed to and millions of people needed to be retrained to accommodate the market in the US.

That does make sense, and am inclined to agree that their cards are far more advanced and complex. However, what then is the difference between swiping card here or in the US? Is their authentication a higher level, even when swiping?

 

[Bad Ballie]

Use what works and is available, tired of people pushing technology in a third world dustbowl, less then 1% of the population earns enough for this sort of thing to even be a blip on the radar.

 

[pstation]

how so? most of their banks don't support 3DS

Most cards do support 3ds in America, but it's not something that is mandated for the merchants or issuers. Our cards also typically support chip+pin as well too.

The thing that people in SA don't quite understand is that things like chip+pin and 3dsecure don't exist to protect cardholders. The exist to protect and shield the merchant and the bank from any liability in the case of fraud.

But in the US the law works differently. Cardholders are never liable for any fraudulent transactions regardless of whether they wrote a signature, entered a pin, confirmed an OTP or gave a blood sample. From a consumer perspective requiring pin offers no real added protection.

 

[Kornhub]

Rofl. I have been using my phone to pay since I left my bank card in Durban in the flat during December

 

[pstation]

That does make sense, and am inclined to agree that their cards are far more advanced and complex. However, what then is the difference between swiping card here or in the US? Is their authentication a higher level, even when swiping?

The US is a "Chip and Choice" market. Some banks issue cards that are Chip + Pin, Chip + Signature or Chip + Nothing depending on what their risk appetite is like.

Merchants also configure their authentication methods depending on what their risk appetite is like as well. Some US merchants do require 3dsecure as well for some risky transactions. If buying a last minute international plane ticket in the US for a 3rd party you likely will be prompted for a 3dsecure OTP.

Banks all employ their own strategies and algorithms to detect fraudulent transactions that is far better than any bank in SA. My card doesn't require a pin, but my bank uses things like my phone's GPS position, spending patterns and etc to decide whether to approve transactions or not. Depending on the amount and type I might have to enter in an OTP or take a selfie if its a really high amount. Most banks in SA wouldn't flinch at all if a pensioner spent their whole retirement at Louis Vuitton.

Cards in the US are also able to support several different networks outside of Visa/Mastercard to process transactions. The cards in the US had to be developed to support multiple applications, one for Visa/Mc and another for the different payment networks supported by the card such as STAR, Pulse and NYCE. If a transaction is processed on one of the alternative networks a pin is required, but if processed on visa or mastercard no authentication is necessary normally. (https://ingenico.com/us-en/newsroom/blogs/what-is-common-debit-aid-and-why-does-it-matter)

This regulation, among other things, requires debit card issuers to support at least two competing networks when consumers use their cards. These can include any of the global card brands or domestic U.S. debit networks. The regulation also grants merchants the right to choose the network to which the transaction will be sent. With magstripe cards, this was usually selected at the processing switch—the point where the processor sends the payment authorization request to the card-issuing bank.

With the introduction of EMV to the U.S. in 2015, payment processing for debit transactions became more complex. This is due to the presence of applications on the chip card and the corresponding AIDs in the chip card reader as opposed to the limited information on magstripe cards. During an EMV transaction, the terminal selects one of several AIDs that determine how the transaction is routed via one of the global payment networks. This designed flexibility in EMV solutions meant that terminals could possibly be configured with a very long list of AIDs, making configuration management very difficult and time consuming to update. Therefore, instead of crowding the terminals and cards with AIDs for each debit network, the concept of U.S. Common Debit AID was adopted.

The technology used with pins in the US and SA is not the same and not always 100% compatible either. The US uses "Online PIN" where the pin number is authenticated in real time with the bank and SA uses offline pin where the PIN number is stored and authenticated directly on the card. A US "Chip + PIN" card won't work at some merchants in SA and Europe because the terminal isn't able to go online and authenticate the pin.

Since Visa first announced its support for a U.S. migration to EMV cards, plenty of questions have cropped up. One of the most persistent is the question of the PIN number and especially the status of the off-line PIN that’s used in so many other countries. Last week, Visa released a clarifying set of guidelines that say the United States does not need such off-line PIN capability (link below). The distinction between offline and online PIN is an important one as the offline card requires significant added cost given the cryptographic capabilities the process requires. For the U.S. market, that cost is very hard to justify as the need for it is very very low, applicable only to travelers visiting other countries and in very specific situations.

 

[Ninja'd]

"Please swipe/insert card", proceeds to swipe

2 seconds later

"Please insert card"

Yeah, just get rid of kak that does not work

Every damn time at Pick n Pay.

 

[Nerfherder]

"Please swipe/insert card", proceeds to swipe

2 seconds later

"Please insert card"

Yeah, just get rid of kak that does not work

Because most Banks already refuse mag stripe. They get the fines if there is fraud.

The card processed are antiquated so the easiest way to enforce chip is to let you swipe and then force you to use the chip (fallback)

 

[Mystic Twilight]

Idea doesn't work for overseas, just came from japan and had to swipe for like 95% of transactions as local retailer card machines don't accept tap or chip from foreign cards, only the big name international companies like hotels do.

 

[Tim_vb]

Most cards do support 3ds in America, but it's not something that is mandated for the merchants or issuers. Our cards also typically support chip+pin as well too.

The thing that people in SA don't quite understand is that things like chip+pin and 3dsecure don't exist to protect cardholders. The exist to protect and shield the merchant and the bank from any liability in the case of fraud.

But in the US the law works differently. Cardholders are never liable for any fraudulent transactions regardless of whether they wrote a signature, entered a pin, confirmed an OTP or gave a blood sample. From a consumer perspective requiring pin offers no real added protection.

I have along list of card debits, all 3DS approved (?) by Chase for SA merchants, minutes apart on the same card. I would argue 3DS protects all parties in the card processing model, regardless of the liability shift - a payments systems rife with fraud is not a trustworthy payments system. I would also point out 3DS depends on the issuer and acquirer for implementation and has little to do with the EMV chip

 

[pstation]

I have along list of card debits, all 3DS approved (?) by Chase for SA merchants, minutes apart on the same card. I would argue 3DS protects all parties in the card processing model, regardless of the liability shift - a payments systems rife with fraud is not a trustworthy payments system. I would also point out 3DS depends on the issuer and acquirer for implementation and has little to do with the EMV chip

Most banks in the US will just send an "approve" message without ever prompting the user to enter in an OTP because they don't want to inconvenience and hassle customers with entering in a code. I have a SA card but I never use it online because I hate being hassled with having to grab my phone and entering OTP codes.

Fraud is such a common and normal thing in the US and people just consider it a minor headache. You just call your bank, they refund your money the same day and FedEx you another card overnight free of charge. Most Americans have several cards so they will just use another card in the meanwhile. The might happen to people once or twice a year.

I'd say the US is an overall more trustworthy environment because people never have to worry about losing money. In SA, despite all of the precautions fraud is still rife and when fraud happens people spend months fighting their bank, and often not ever being compensated.

Banks and merchants just consider fraud the cost of doing business and don't mind the cost. Adding friction and adding complexity would only dissuade people from buying things, costing more than the actual fraud losses.