Hacker News new | past | comments | ask | show | jobs | submit login

In the US if your credit card number is compromised you are legally out at most $50 (I haven't checked in 20 years so this may have changed, my comment is at least partially historical). In almost all cases the bank will just wave that $50 as they are already paying the rest. If your debit card is compromised the money comes from your account and legally they don't have to return it to you, instead you need to figure out who defrauded you and collect (my info is 20 years out of date so this is almost certainly wrong), though in practice the banks will probably return your money and collect on your behalf but this takes a month.

Note that the above is about the number, which is not secure in any situation. You don't need to have someones credit card, you just need to know the numbers. If you compromise an insecure website and get these details (bank rules don't allow storing the numbers, but if the website doesn't follow the rules). You can also take a picture of a card as someone is scanning it.

Europe went to the chip and pin system, plus a system where they bring cards readers to each table because they did not have the above protection for credit cards. Thus in Europe you would be a fool to let your waiter take your credit card to a backroom to pay for a meal because the waiter can then copy the numbers and/or the magstripe, and then use your credit card after returning the physical one to you (again, this is 20 years out of date, laws have changed but I don't know how!). Since the US has (20 years ago) better consumer protection laws around credit cards, people didn't care that chip+pin was more secure as practically it didn't make any difference, and for a while banks figured it wasn't worth caring. Once banks started caring everyone switched to the chip in the US - but we mostly don't use a PIN as the annoyance of needing to remember a PIN isn't worth putting on consumers here. (also Europe has made the portable terminals cheap so you find a lot of portable terminals here as well so cards are less likely to leave the owners hands thus making the PIN less important)




In EU law all payments get pretty much the same protections as USA credit card payments, even for debit cards the customer is legally out at most 50 EUR, so there is no advantage in it being a credit card.

The motivation of Chip&PIN in EU is driven by the fact that banks are forced to cover most of the fraud costs (as opposed to USA, where much of stolen card fraud is forced upon merchants), so they have a motivation to actually prevent it; and the inconvenience of PIN is mitigated by highly prevalent contactless (and PIN-less) chip payments for small transactions.




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: