Retailers Disable Chip Card Readers During Holidays For Being Too Slow

Megalith

Megalith

24-bit/48kHz
Staff member
Joined
Aug 20, 2006
Messages
13,000
Another tale of convenience over security. This is literally an anecdote that singles out a particular store, but I’m sure many other vendors were guilty of this.

…retailers are reacting to shoppers’ sentiments. One in five consumers names transaction time as their biggest concern when using an EMV-enabled credit or debit card, according to a recent survey by point-of-sale firm Harbortouch. It takes about seven to 10 seconds to process a chip card at the register versus two to three seconds to process a swipe.
 
What concerns me is, who the fuck exactly made this tech and how is it that they did not see this as a problem during the development & testing phase? The way people are willing to spend 10 minutes finding parking spots that save them 15 seconds of walking should say enough about how people view their time, so of course no one is going to want to wait 10 seconds for a chip to process. It seems pretty ridiculous for it to take that long in the first place... What exactly is it doing that can't be done instantly?
 
Used a chip card for the first time about a month ago. My main card has no chip USAA (though i hear they are moving to visa and will issue chipped cards early next year). I ran my BoA card which was chipped and they were like 'stick it in the thing'. 'OK' then i took it out. 'No it has to stay in there'. 'Um OK'. Put it back in then had to wait for the cashier to push some buttons. Wait a bit more. Then I could finally remove the card.

Literally barely a second (swipe) to 5+ (chip). Oh and to trigger the chip I have to swipe anyhow.

Apple Pay at the same place? At best faster than swipe. At worst same speed as swipe.

Now I was one person at a store that just opened at 8:00AM with no one behind me. I can't imagine full blown retail + Christmas rush.

As GotNoRice said "who the fuck exactly made this tech and how is it that they did not see this as a problem during the development & testing phase?"
 
GotNoRice said:
What concerns me is, who the fuck exactly made this tech and how is it that they did not see this as a problem during the development & testing phase? The way people are willing to spend 10 minutes finding parking spots that save them 15 seconds of walking should say enough about how people view their time, so of course no one is going to want to wait 10 seconds for a chip to process. It seems pretty ridiculous for it to take that long in the first place... What exactly is it doing that can't be done instantly?
Click to expand...

You guys don't have the NFC system that uses a 1 second tap for small purchases (max $100)? I swear the USA is 20 years behind the rest of the world in some ways, you're just implementing the chip and & system that everyone else has had since the late 90's and no NFC (some places don't even use pins either). That's generally the solution for the 5 seconds the pin transaction takes (once consumers get used to it). Processing time-wise I don't know that they're talking about, card readers that take only a second or two are available.

Visa and Mastercard don't care what the retailer uses, because they're liable for all fraudulent charges.
 
The chip readers are slow and completely useless anyway. They do absolutely nothing to stop stolen credit cards from being used physically. If anything it's worse now since they're slow, and still require a signature(useless). The cashier isn't going to ask to see the card or your id since that'll only take longer. Chip + pin makes a lot more sense, but with so many idiots out there, no bank or CC company wants to deal with all the pin reset requests they'll be faced with if they went to that system.
 
Geno750 said:
Chip + pin makes a lot more sense, but with so many idiots out there, no bank or CC company wants to deal with all the pin reset requests they'll be faced with if they went to that system.
Click to expand...

Everywhere else on the planet is using chip & pin now, contrary to popular belief Americans are no stupider than anyone else (there are stupid people everywhere).
 
Quix said:
You guys don't have the NFC system that uses a 1 second tap for small purchases (max $100)? I swear the USA is 20 years behind the rest of the world in some ways
Click to expand...

Were not too worried about it, we have some things we can drop from 15,000 feet that can take a country magically back 20 years. We are real good at it, some say the best.
 
I for one, don't understand where is the enhanced security.
No pin, and maybe a signature.. how is this a gain for security?
We could have just as well gone to swipe plus pin for all card (debit or not)
and be more secure than this half-ass implementation of the 'chip'.
I don't see the problem with pins.. they are common place for debit card.. why not credit cards?
 
Quix said:
You guys don't have the NFC system that uses a 1 second tap for small purchases (max $100)? I swear the USA is 20 years behind the rest of the world in some ways, you're just implementing the chip and & system that everyone else has had since the late 90's and no NFC (some places don't even use pins either). That's generally the solution for the 5 seconds the pin transaction takes (once consumers get used to it). Processing time-wise I don't know that they're talking about, card readers that take only a second or two are available.

Visa and Mastercard don't care what the retailer uses, because they're liable for all fraudulent charges.
Click to expand...
Not everyone has a smart phone let alone one that has NFC support. Even if you do have a smart phone that has NFC not every store accepts it. They either physically dont (dont have the hardware for it), refuse to accept specific NFC payment options ('we dont accept apple pay, but google is fine!'), or they are trying to reinvent the wheel and make their own "NFC" system (Target).
 
Quix said:
Everywhere else on the planet is using chip & pin now, contrary to popular belief Americans are no stupider than anyone else (there are stupid people everywhere).
Click to expand...

I was speaking for Americans. I firmly believe we've got a monopoly on stupid at the moment. Although all those idiots in Europe welcoming the terro...refugees aren't far behind.
 
Uvaman said:
I for one, don't understand where is the enhanced security.
No pin, and maybe a signature.. how is this a gain for security?
We could have just as well gone to swipe plus pin for all card (debit or not)
and be more secure than this half-ass implementation of the 'chip'.
I don't see the problem with pins.. they are common place for debit card.. why not credit cards?
Click to expand...

The big push for the chip in the US was after retailers got hacked and the banks said after 1 Oct, 2015 fraudulent charges are on you Mr. Retailer, not us. But physically, until they go to a two part authentication system it'll be useless. The signature doesn't count, so the one part is simply something you have (credit card). The second part could be either something you know (pin) or something you can produce (thumb print, etc.)
 
Uvaman said:
I for one, don't understand where is the enhanced security.
No pin, and maybe a signature.. how is this a gain for security?
We could have just as well gone to swipe plus pin for all card (debit or not)
and be more secure than this half-ass implementation of the 'chip'.
I don't see the problem with pins.. they are common place for debit card.. why not credit cards?
Click to expand...

The security has to do with the back end portion more than the physical portion. The current cards were designed around a system that was created in the 60s. You slide a card through a reader and it gets the information off the card and sends it off. If you can read a card you can easily make another one as there is nothing stopping you. The Chip cards have a one time handshake that has to occur to verify it's a valid card. This is why it takes longer than the old cards because they simply transmitted some numbers to verify if they worked.
 
bman212121 said:
The security has to do with the back end portion more than the physical portion. The current cards were designed around a system that was created in the 60s. You slide a card through a reader and it gets the information off the card and sends it off. If you can read a card you can easily make another one as there is nothing stopping you. The Chip cards have a one time handshake that has to occur to verify it's a valid card. This is why it takes longer than the old cards because they simply transmitted some numbers to verify if they worked.
Click to expand...

Correct, a very very simplistic analogy is http vs. https. There is not a difference in the user login per say, but the in transit connection is much more secure and there is an authentication of the server and client being who they say they are.
 
Quix said:
You guys don't have the NFC system that uses a 1 second tap for small purchases (max $100)? I swear the USA is 20 years behind the rest of the world in some ways, you're just implementing the chip and & system that everyone else has had since the late 90's and no NFC (some places don't even use pins either). That's generally the solution for the 5 seconds the pin transaction takes (once consumers get used to it). Processing time-wise I don't know that they're talking about, card readers that take only a second or two are available.

Visa and Mastercard don't care what the retailer uses, because they're liable for all fraudulent charges.
Click to expand...

NFC payment with cards was done in the US, but not very widely, and there were concerns over high powered systems stealing payment info in public spaces so it's quietly disappeared. Credit cards with PINs aren't likely to be accepted here either, we carry too many cards, it'll be inconvenient to remember all the PINs; besides, I don't want to type my PIN into a merchant's terminal, they might record it and do who knows what with it. I'm much happier to let the card network take the risk and I don't have to do anything other than check my statements.
 
I ran into this at several big name stores. They taped off the chip slot and put a little scribbled sign that says Swipe.
One of the stores that did this was also in the past headlines for being compromised. They never learn...
 
I would just leave my cart right there at the cashier and walk out. I've done it in the past when the store's chip reader doesn't work. There is always another retailer out there that takes security seriously, and they will be the ones to get my money.
 
westrock2000 said:
Were not too worried about it, we have some things we can drop from 15,000 feet that can take a country magically back 20 years. We are real good at it, some say the best.
Click to expand...

So does North Korea, China & Russia yet they all use Chip & Pin!

Some might say "the best" (only those that live in 'Murica) but that is the only way that America has ever won a war in the last century!!! Backfired in Vietnam though didn't it ;)
 
Daroller said:
I would just leave my cart right there at the cashier and walk out. I've done it in the past when the store's chip reader doesn't work. There is always another retailer out there that takes security seriously, and they will be the ones to get my money.
Click to expand...
Must have walked out of a ton of stores. Never saw card readers have the chip slots en masse till a week or two before the October 1st 2015 deadline.
 
This question will prove how stupid I am, but here it goes anyway.
My card has both a chip and a magnetic stripe. Some retailers want me to swipe the stripe; others want me to stick the chip. Half the time they give me a funny look when I ask in advance which is better. Are customers supposed to automatically know which one to do? The worst outcome is doing both for one transaction. Not only should cashiers not make people feel bad for asking, but there should be very clear instructions to prevent the customer from having to ask in the first place.
 
Geno750 said:
The chip readers are slow and completely useless anyway. They do absolutely nothing to stop stolen credit cards from being used physically. If anything it's worse now since they're slow, and still require a signature(useless). The cashier isn't going to ask to see the card or your id since that'll only take longer. Chip + pin makes a lot more sense, but with so many idiots out there, no bank or CC company wants to deal with all the pin reset requests they'll be faced with if they went to that system.
Click to expand...
It was left upto the card issuer to choose signature or pin many still left to signature because it's easier liability and easier system to implement to the card issuer going that route.
bloodypulp said:
I ran into this at several big name stores. They taped off the chip slot and put a little scribbled sign that says Swipe.
One of the stores that did this was also in the past headlines for being compromised. They never learn...
Click to expand...
The fun thing is the liability is shifted to them by doing that the card issuers liability for the safety of the card is effectively shifted to that retailer by doing that, meaning the retailer would be on the hook for the lost money if anything happens.
 
bman212121 said:
The security has to do with the back end portion more than the physical portion. The current cards were designed around a system that was created in the 60s. You slide a card through a reader and it gets the information off the card and sends it off. If you can read a card you can easily make another one as there is nothing stopping you. The Chip cards have a one time handshake that has to occur to verify it's a valid card. This is why it takes longer than the old cards because they simply transmitted some numbers to verify if they worked.
Click to expand...

I guess I get it, but would that end honey pot attacks?
I mean hasn't all the big hacks been honey pot attacks and not attacks to information in transit?
I mean, yeah it would end cloning a mag strip easy, but online purchases are still game if the numbers are still floating around..
Of the 3 times I had card numbers 'stolen' my cards never left my wallet, and the purchases were on-line, so it must have been taken from a database somewhere... actually the biggest purchase (1800$) was on a card I had used very little, like 2-3 times, after that it was just sitting at my closet for months (until I get a late payment notification)... I mean I guess pin at cashiers would not affect this online stuff either, unless they implement 'on-line' pins that are never saved by any retailer but created and provided by the bank like daily or per transaction or something
 
Well, one thing for sure, the banks have and will continue to find ways to avoid any liability. Chip+ PIN or signature. Who cares, as long as businesses store cc information on their computers there is always a chance for fraud. Most of the "big" problems have been form retail stores.
 
the_servicer said:
This question will prove how stupid I am, but here it goes anyway.
My card has both a chip and a magnetic stripe. Some retailers want me to swipe the stripe; others want me to stick the chip. Half the time they give me a funny look when I ask in advance which is better. Are customers supposed to automatically know which one to do? The worst outcome is doing both for one transaction. Not only should cashiers not make people feel bad for asking, but there should be very clear instructions to prevent the customer from having to ask in the first place.
Click to expand...

If the chip reader is enabled it will force you to use it. When you swipe your card through the magnet reader it will detect that it's a chip enabled card and tell you to put it into the chip slot. It won't process the transaction unless you do. The most confusing part is knowing whether or not a store has them enabled. I just end up asking if it is or not rather than having to guess.

@Uvaman: It depends upon what attacks we're talking about. The attacks that occurred at Target and Home Depot wouldn't have happened because even if they scraped the memory from the computers, they can't generate a valid one time use code to process a transaction on. For online I think that comes back to whether or not the site is using the CVE code on the back of the card. That is essentially a PIN that you are only using with online purchases, so I'm not sure if you can get that information off the card unless you are actually looking at it. (I'd hope not). If they had some type of authenticator system that would generate a rolling code that would obviously be better still, but that would be very difficult for the average person.

If I had to guess what happened with your cards is they were running the card at a place where you only needed to obtain the basic info like the number, expiration date, and name of the card holder. If they were doing a honey pot where you were putting your information into a false site, then that wouldn't protect you even with the CVE code or a pin because those do not change. So we'd still need to have a way to verify the authenticity of online purchases even with Chip + pin.
 
Bman has it right.

I was forced to change to the chip reader capable terminal at my store in October. Every retailer had to. Because if you didn't do it by the deadline, you were responsible for all card fraud. Obviously, everyone ponied up for the chip reader unless you run a business where losing a transaction to fraud here and there is no big deal.

Here's how it works:
------
Non-chipped cards get swiped. Works like it always did.

Chipped cards MUST be inserted in the chip slot. The terminal knows the difference and won't allow the retailer to swipe it if the terminal can use the chip instead.

There are two kinds of a chipped cards: those with a pin number and those without. If the card issuer requires a pin, then it MUST be entered or you can't finish the transaction. If the card doesn't have a pin, then it just finishes as normal, plugged into the chip slot.
------

What I have heard is, ultimately all the credit cards should have both the chip AND a pin number. That's kind of the whole point and the only way to truly secure the cards against most known forms of fraud. The problem is, a lot of card holders didn't get the memo and don't know their pin yet when they hand me the card.

For whatever reason, my chip terminal is fast as lightning. It's just as fast at processing as my old swipe terminal. Just a couple of seconds. It does, however, take 5 or 10 extra seconds to plug the card into and out of the chip reader, and a few more seconds if I have to hand them the terminal for a pin number.
 
Quix said:
You guys don't have the NFC system that uses a 1 second tap for small purchases (max $100)? I swear the USA is 20 years behind the rest of the world in some ways, you're just implementing the chip and & system that everyone else has had since the late 90's and no NFC (some places don't even use pins either). That's generally the solution for the 5 seconds the pin transaction takes (once consumers get used to it). Processing time-wise I don't know that they're talking about, card readers that take only a second or two are available.

Visa and Mastercard don't care what the retailer uses, because they're liable for all fraudulent charges.
Click to expand...

No, we didn't get chip+pin we got Chip+ swipe/sign and ewallet bullshit instead.

At this point the grocery store is literally the only "Retail" location I even go to anymore. Regular retail has made it such a giant pain in the ass to purchase anything that even if prices were the same I would still order from Amazon.
 
I've still only encountered one register that required me to use the chip. It didn't seem like the actual process took much longer, the biggest holdup was honestly me having to figure out that the chip reader meant leaving the card in instead of swiping it in and out.
 
Megalith said:
Another tale of convenience over security. This is literally an anecdote that singles out a particular store, but I’m sure many other vendors were guilty of this.

…retailers are reacting to shoppers’ sentiments. One in five consumers names transaction time as their biggest concern when using an EMV-enabled credit or debit card, according to a recent survey by point-of-sale firm Harbortouch. It takes about seven to 10 seconds to process a chip card at the register versus two to three seconds to process a swipe.
Click to expand...

I've only been in one store that used them (CVS) and if it was slower than swiping, it was no more than a second or 2. I expected it to be slower based on complaints on [H].
 
I have had numerous customers tell me it's amazing how fast I can run their chipped cards. Apparently, the larger retail chains are having massive issues. It's probably because I get away with one simple terminal and don't have an entire card processing network.

I've heard that Home Depot and other stores around me are taking a very, very long time to check out each customer right now.
 
Advil said:
I have had numerous customers tell me it's amazing how fast I can run their chipped cards. Apparently, the larger retail chains are having massive issues. It's probably because I get away with one simple terminal and don't have an entire card processing network.

I've heard that Home Depot and other stores around me are taking a very, very long time to check out each customer right now.
Click to expand...

Someone from Canada posted a month or so ago that it's probably the readers they bought, because up there they're allegedly fast. Kroger has chip readers, but I've yet to see one that has the chip reader enabled.
 
If it's taking too long, it's because people aren't doing it right. Every time I've used a chip card, there was no difference in checkout speed. I put my card in as soon as it prompts me, which is usually right when the cashier scans the first item. As soon as they are done on their end, it prompts me to remove the card, and I do. No difference in speed. I think it's just gonna take time for people to figure it out, especially older people that often still use checks and don't get technology. I'm sure there was a learning curve when first using credit cards over cash.

Regarding pin vs signature, I have no idea why they just didn't go pin from the start. Everyone knows how to do it already, it works identical to debit cards. Most of my cards are chip + signature. My Target card however is chip + pin. It doesn't even have a magnetic stripe which is awesome. I hope all cards eventually go that route after everyone is moved over to the new card readers.
 
i960 said:
If it's taking too long, it's because people aren't doing it right. Every time I've used a chip card, there was no difference in checkout speed. I put my card in as soon as it prompts me, which is usually right when the cashier scans the first item. As soon as they are done on their end, it prompts me to remove the card, and I do. No difference in speed. I think it's just gonna take time for people to figure it out, especially older people that often still use checks and don't get technology. I'm sure there was a learning curve when first using credit cards over cash.

Regarding pin vs signature, I have no idea why they just didn't go pin from the start. Everyone knows how to do it already, it works identical to debit cards. Most of my cards are chip + signature. My Target card however is chip + pin. It doesn't even have a magnetic stripe which is awesome. I hope all cards eventually go that route after everyone is moved over to the new card readers.
Click to expand...

Because they fear that people won't use their card if they have a pin for each card. Truth is it'd probably work best if we just put cards in our phone and had a pin to unlock it (or finger print if you do that).
 
i960 said:
If it's taking too long, it's because people aren't doing it right. Every time I've used a chip card, there was no difference in checkout speed. I put my card in as soon as it prompts me, which is usually right when the cashier scans the first item. As soon as they are done on their end, it prompts me to remove the card, and I do. No difference in speed. I think it's just gonna take time for people to figure it out, especially older people that often still use checks and don't get technology. I'm sure there was a learning curve when first using credit cards over cash.

Regarding pin vs signature, I have no idea why they just didn't go pin from the start. Everyone knows how to do it already, it works identical to debit cards. Most of my cards are chip + signature. My Target card however is chip + pin. It doesn't even have a magnetic stripe which is awesome. I hope all cards eventually go that route after everyone is moved over to the new card readers.
Click to expand...

It has nothing to do with people and everything to do with the machines processing. I can swipe, pin, go through all the prompts and have my regular card back in my wallet before the chip card finishes validating in every single store I've been in. The process is easy, it is all the retarded standing around waiting on the machine that irritates everyone.
 
Dekoth-E- said:
It has nothing to do with people and everything to do with the machines processing. I can swipe, pin, go through all the prompts and have my regular card back in my wallet before the chip card finishes validating in every single store I've been in. The process is easy, it is all the retarded standing around waiting on the machine that irritates everyone.
Click to expand...

What waiting around? Cashier scans first item, insert card, cashier finishes scanning, sign or enter pin, remove card. Zero time difference between swiping. It's done before they even have your items bagged. I have 3 different chip cards and I've used them in dozens of different stores, and there is never even 1 extra second of delay. The only time I've ever been delayed is at a gas station where they have a chip reader that isn't enabled, and it prompts you to swipe instead.

I think any concern with the processing speed difference is nonsense when the greatest amount of time spent at checkout is scanning and bagging. The only time there is ever a delay on the payment side is when someone can't figure it out. And that problem will correct itself with time.
 
nilepez said:
Because they fear that people won't use their card if they have a pin for each card. Truth is it'd probably work best if we just put cards in our phone and had a pin to unlock it (or finger print if you do that).
Click to expand...

I'm sure everyone will just use the same pin for all cards, probably the same one they use for their debit card. Not ideal, but certainly better than signature, which is worthless since no one checks it.
 
i960 said:
What waiting around? Cashier scans first item, insert card, cashier finishes scanning, sign or enter pin, remove card. Zero time difference between swiping. It's done before they even have your items bagged. I have 3 different chip cards and I've used them in dozens of different stores, and there is never even 1 extra second of delay. The only time I've ever been delayed is at a gas station where they have a chip reader that isn't enabled, and it prompts you to swipe instead.

I think any concern with the processing speed difference is nonsense when the greatest amount of time spent at checkout is scanning and bagging. The only time there is ever a delay on the payment side is when someone can't figure it out. And that problem will correct itself with time.
Click to expand...

This is LARGELY true most systems but I have paid attention and noticed that the systems in use at Target and Home Deport (for example) don't actually read the card until the cashier is done ringing items. In fact, if you insert the card early the system will tell you to remove it and wait until the cashier is done.

That said, I just noticed this weekend that the systems used by Walgreens are MUCH faster. It still has you wait but their entire chip transaction was near instantaneous -- just as fast as a swipe.

I would not be surprised AT ALL if this is a matter of retailers picking the "cheap" version of a system that is slower rather than spending more money on faster ones.
 
svet-am said:
I would not be surprised AT ALL if this is a matter of retailers picking the "cheap" version of a system that is slower rather than spending more money on faster ones.
Click to expand...
Have you been paying attention the past dozen years?!?!?!? The emphasis is to increase revenue and decrease costs. After all, managers at Home Depot turned down necessary IT updates and training stating “We sell hammers.” The Master BLEEP Artists and VP of something or other won't approve anything unless it directly affects them.

If the stores are worried about transaction time, why do they still accept checks written by grandmas who still believe in the "float time"? Why are they afraid of chip-and-pin when people have been using ATMs for thirty years? What major security breach will make them change their minds?
 
I know the UK is over the top on safely alot of the time but this is just stupid. Would never see this in the UK.
 
You must log in or register to reply here.
Back
Top