1

I have never heard of credit card PINs being required for online purchases. Why is this? Wouldn't it drastically reduce online fraud? Physically stolen credit cards couldn't be used in online transactions either if a PIN was required.

  • With respect to EMV chip cards, the PIN is used in conjunction with the chip itself, which is not utilized in a CNP (card not present) transaction (such as an online purchase). – Nathan Osman Mar 12 '17 at 4:33
  • Websites get hacked all the time and when they do, this would just be giving up another piece of valuable information. Which can be used to cash out at the ATM assuming the attacker also has the track data. Something interesting I found out is some credit card companies allow you to setup a password for online purchases. – nd510 Mar 12 '17 at 6:32
  • 1
    credit cards don't have PINs, so that might be explain some of it... – dandavis Mar 12 '17 at 7:51
  • In my country, I've to enter PIN for shopping and for online purchases I enter PIN+OTP. – defalt Mar 12 '17 at 7:55
  • @dandavis, in Canada all credit cards have had pins for 5 years now. I think they are less common in the US. – Elias Mar 13 '17 at 1:50
1

Consider the threat model -- today, a rogue website (or one taken over by an attacker) can siphon off your credit card number and make fraudulent purchases.

Ok, so we implement a PIN, required for online purchases.

The same rogue website just asks you for your PIN too, and then uses those to make fraudulent purchases.

The method they use in Europe (IIRC) uses the PIN in conjunction with a chip on the card, which prevents the website from being able to give up that authorization to an attacker. I'm not sure of the actual method, but I'd imagine the PIN unlocks a certificate on the chip, and the certificate is used to sign the transaction.

  • 1
    That's not the only way cards get stolen, though; there are also the more pedestrian physical attacks like card skimmers at gas stations. – Xiong Chiamiov Mar 12 '17 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.