Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why are signatures considered valid methods if identification when paying with a check or credit card? For that matter, what do those credit card readers do with my signature when I sign them? Are they validated or compared to my signature stored at the DMV?

Extra points for people who can point to ways that companies are trying to better validate that I am actually authorizing payment for something.

share|improve this question
add comment

2 Answers

Why are signatures considered valid methods if identification when paying with a check or credit card?

Historically, we didn't have anything better. In theory, signatures are very good authentication methods, since hand musculature is relatively unique and it's quite difficult to forge someone's signature accurately without a lot of analysis and practice.

However, in practice, the people who check these signatures work in high-street stores. They aren't security people - they just want to process your order as quickly as possible and move onto the next customer. As such, even if your signature is only vaguely reminiscent of the one on the card, they will likely accept it.

On the plus side, many stores do store the stub with your signature on it, or send the stubs off to the bank for archiving. This means that you can go back and look at the receipt later if fraud is claimed.

Is this acceptable? From a security perspective, it isn't. It's not very strong, and in practice can easily be exploited. From a business and cost perspective, it's good enough and saves them a lot of money in terms of buying new equipment. The cost of fraud to the retailers is less than the cost of rolling out a better system, so they don't do it.

For that matter, what do those credit card readers do with my signature when I sign them? Are they validated or compared to my signature stored at the DMV?

I can't say I've had any experience of the DMV, but I've used similar systems at the bank. From what I can tell, they display the signature on-screen for the cashier, with some kind of overlay of the stored signature. It looks like it tries to point-match the two for a better idea of whether or not it is genuine. Arguably it could be defeated, but it does seem to be a better solution than a purely human validation. Of course, I'm also relatively sure that the cashier could accept or reject the signature regardless of what the computer shows - it's simply a visual aid.

One thing I have seen done, which does increase the strength of a signature as an authentication method, is directional matching. When you write your signature down, you do so in a very precise order. The direction of the loops and changes in acceleration / deceleration as you write are very difficult to forge. Observing a signature on paper and attempting to forge the way in which it was written is much harder than just forging the final product.

Extra points for people who can point to ways that companies are trying to better validate that I am actually authorizing payment for something.

Most countries (especially in Europe) now use chip + pin, which is significantly more secure and, as a bonus, much more eco-friendly! Less pens, less paper, less waste. I'm personally surprised that it's taking so long for the USA to adopt it.

Another new technology that has come out recently is contactless payments, which a few banks have adopted in the UK. It's a balance between the security of chip + pin, and the convenience of just using your card without any authentication. Essentially the card contains a small NFC radio, and you can make payments of up to £10 without entering your pin just by holding them against a payment system. There is usually a limit of 3 transactions before you have to enter your pin again.

share|improve this answer
    
Just a small point about the NFC bit. The transaction limit of NFC is now £20 in the UK (€25 in Europe and up to A$100 in Australia). You can do 5 transactions before it asks you to go back to Chip & PIN, or at least that was the limit on all of the cards I've tested. –  Peanut Jun 21 '13 at 14:54
    
@Peanut It's dependent on the bank. You can also usually request that your transaction limit is reduced. –  Polynomial Jun 21 '13 at 14:56
    
Ah, I've never heard that. FYI I've just tested my new Barclay's card and I can only actually do 2 NFC transactions before I have to use Chip & PIN, but my old one had 5 as the limit. –  Peanut Jun 21 '13 at 15:07
    
@Peanut Barclay's are who I was referring to, primarily. I'm not with them, but a friend has one of their cards and asked them to reduce it to £10 per transaction, with 2 uses between requiring the pin. –  Polynomial Jun 21 '13 at 15:18
    
@Polynomial I mentioned chip and pin also but I didn't find that it proved you are who you say you are so much as it makes it harder to counterfit. –  Griffin Nowak Jun 21 '13 at 17:47
show 1 more comment

Well I got few answers.

First it's considered valid because a signature is almost like a finger print (for older people with consistent hand writing). There are certain ways you sign that make your signature unique. A good example is if you ever watch Pawn Stars when someone comes in with a rare signature the guy authenticating it will explain what makes it unique. Also your signature throughout history has been sort of symbolic of finalization or authentication.

Next the credit card readers most likely do one of two things. 1) They send that signature along with the order to the credit card company where the company then stores it on record in case it is disputed. 2) The store keeps the signature and the order goes to the credit card company. Not sure which and it may vary.

Are they validated or compared? Most likely not for every transaction. That'd take a lot of work and the computer would mess up too much. However for the few transactions that are disputed they are most likely retrieved and then compared if other proof is not found first.

Bonus points: Yes there are betters ways yet they are generally considered too costly to implement. Some of them are cool ideas like all your information being based on your eye using retinal scanners. A few are based on small chips put into the fingers or hand. And lastly there are really bad ideas about using finger prints (this method doesn't work well due to the overwhelming number of people using the device).

Honorable mention: You may of heard of Europe's method that's call chip and pin. You can read about it here. I didn't mention it in the main answer because it doesn't really do the same thing as a signature. I mean we (most people) have pins to our bank accounts yet those aren't very long and usually really bad. The big thing that people ohh and ahh about with them is the chip that is built into the credit card. It doesn't really act as a form of authenticating you are you. It simply makes it harder for people to counterfeit credit cards.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.