Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the transaction. But this is more to held me accountable , if i denied the payment. It doesnt offer the security of a PIN since anyone obtaining my card can ran away with the money. The transaction was less than 100$. Moreover , i remember my father 10-15 years ago paying for bigger sums with just his signature, before the PIN arrived i guess. Does this means whoever has either my card / or photograph of my card (both sides with CCV code) can withdraw as much as he wants?

share|improve this question
3  
It is worth noting that in the US, we still only use a signature for transactions. It all depends on what your merchant bank (the bank that your account is with) will allow your card to be used for. You would have to ask them for details on their policies for what they approve. –  AJ Henderson Jan 2 at 15:06
1  
Related: An amusing prank involving credit card signatures, or lack thereof, from the now defunct zug.com –  scuzzy-delta Jan 2 at 17:59

4 Answers 4

up vote 7 down vote accepted

Payment protocols have many variants. However, they mostly boil down to the three following:

  1. The card number is just a reference, to be printed on paper. The owner signs with a pen on the paper. The paper may be printed with several technologies, some of them quite primitive (credit cards are embossed so that their number can be copied to paper efficiently with a purely mechanical device).

  2. The card number is obtained by a payment terminal (e.g. with a swipe of the magnetic strip); the payment terminal then talks to the bank. The PIN code is used to authenticate the user (it is sent to the bank for validation).

  3. The card is a smart card; the chip contains some secret value which is used to authenticate the transaction (with a MAC or a digital signature). The PIN is sent to the card and is used to convince the card that its true owner is indeed allowing the operation.

In any case, the point is not exactly to prevent fraud, but to reduce it to tolerable levels. The merchant does not really mind a fraudster running with the money, as long as he will be refunded by the bank. The bank sees the big picture and does not feel invested with the sacred mission of catching all thieves; the bank wants the total fraud cost to be as low as possible, and that's not the same thing.

Banks usually prefer it when the PIN code is used, because it lowers fraud level (by as much as a factor of ten, as I heard). However, this requires a PIN-aware terminal; with solution 2, a network connection must also be maintained with the bank; with solution 3, the card must have a chip (smart card deployment was long delayed in the Americas because banks waited for the 1986 French patent on smart cards to expire). Merchants are not usually cooperative for changes (they must pay for the new terminals) and card deployment is not fast (since each card is valid for several years), so the "first type" payment method (with a pen-based signature) is still possible in many shops. It should gradually disappear, though, because it allows for easier frauds, which makes banks uncomfortable.

Ultimately, this is a question of relative strength between banks (who want to enforce the systems which will ensure the least possible amount of total fraud) and merchants (who want to have the automatic refunding at the least cost for them). The card owner himself does not have much to say... however, legally speaking, the card owner is "protected" as long as he follows the official rules from his bank. As long as the bank does not forbid him to pay with a signature, the bank must refund the user if a fraud on his account occurred.

(Whether bank clerks will make the operation easy is another question.)

share|improve this answer
    
How is least possible amount of total fraud achieved when according to bbc.co.uk/news/technology-25398408 is so cheap to obtain credentials is the subsequent question then. –  blended Jan 2 at 17:59

It likely depends on what network is being used to process the card. If the network is EFTPOS-like, a PIN is typical. However, if the network is credit-like, a signature is typical (at least, before EMV existed).

A lot of cards are dual-branded, and how they are processed can depend on the configuration of the merchant's terminal. It's not likely to be a question of backup, though it's conceivably possible that a PIN might be required only if online authorization is being done.

A photograph of a card isn't often all that helpful, because usually a CVV code (different from the CVV2 code on the back) is stored on the magstripe and is not easily derived without a 128-bit DES key and knowledge of the card service code. Just having a picture of the card, even of both sides, will usually only enable you to use the card for card-not-present transactions.

Really, the specifics of the security features on some particular card are best asked of the card issuer.

share|improve this answer
    
Card-not-present transactions could be an online purchase for a big sum of money though, so where is the layer of security with CVV2 going –  blended Jan 2 at 12:17
    
Hmm? Nowhere? The point of a CVV2 is to provide a value that isn't normally stored alongside the card (so that magstripe cloning and pictures of the front of the card are not as useful). It can be used in card-present transactions but that use is less common. –  Falcon Momot Jan 2 at 12:56

What I think you'll find is that if you're in a country with Chip+PIN deployed, if a merchant takes a signature instead (usually because their Chip+PIN system is down) then the fraud liability moves from the customer to the merchant.

So if you have fraudulent transactions on your card where the merchant doesn't have the PIN you can just dispute them and the onus will be on the merchant to prove that they are legitimate, rather than on you to prove that they're not.

share|improve this answer

Signing for a credit card transaction is still quite common in countries where they use the magnetic strip on the side rather than the embedded smart card chip (which uses a PIN code). Note that this is a choice of the credit card company. A pin is indeed more secure, but for usability reasons not enforced everywhere (in Europe it is quite common these days).

The maximum sum is the same for your pin card as for the magnetic swipe. If they indeed have your CCV code then they can just use your card (although I know a lot of payment gateways check if the chip&pin is present for that card and they will require you to sign the transaction digitally).

If they find a gateway that does not do this check, then yes, they can withdraw money with your card (until its limit is reached). However most credit card companies will reimburse you for the damages suffered if fraud (malicious transactions) are discovered with your card.

share|improve this answer
    
I was talking about the very same card ,the card sometimes needs PIN and others not. Is like having a backup security method less secure than the primary one. E.g. setting a password in your tablet and having as backup mechanism face 'recognition' which is less secure. My question is why have the PIN anyway if you can still take money without using it –  blended Jan 2 at 11:42
    
Because it's not always supported, in Europe they are banning the magnetic strip and prefering the chip. However for backwards compability (so until everyone is using chip&pin) you will still have the magnetic strip available. –  Lucas Kauffman Jan 2 at 12:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.