I have never heard of credit card PINs being required for online purchases. Why is this? Wouldn't it drastically reduce online fraud? Physically stolen credit cards couldn't be used in online transactions either if a PIN was required.
5
-
With respect to EMV chip cards, the PIN is used in conjunction with the chip itself, which is not utilized in a CNP (card not present) transaction (such as an online purchase).– Nathan OsmanMar 12, 2017 at 4:33
-
Websites get hacked all the time and when they do, this would just be giving up another piece of valuable information. Which can be used to cash out at the ATM assuming the attacker also has the track data. Something interesting I found out is some credit card companies allow you to setup a password for online purchases.– nd510Mar 12, 2017 at 6:32
-
1credit cards don't have PINs, so that might be explain some of it...– dandavisMar 12, 2017 at 7:51
-
In my country, I've to enter PIN for shopping and for online purchases I enter PIN+OTP.– defaltMar 12, 2017 at 7:55
-
@dandavis, in Canada all credit cards have had pins for 5 years now. I think they are less common in the US.– EliasMar 13, 2017 at 1:50
Add a comment
|
1 Answer
Consider the threat model -- today, a rogue website (or one taken over by an attacker) can siphon off your credit card number and make fraudulent purchases.
Ok, so we implement a PIN, required for online purchases.
The same rogue website just asks you for your PIN too, and then uses those to make fraudulent purchases.
The method they use in Europe (IIRC) uses the PIN in conjunction with a chip on the card, which prevents the website from being able to give up that authorization to an attacker. I'm not sure of the actual method, but I'd imagine the PIN unlocks a certificate on the chip, and the certificate is used to sign the transaction.
-
1That's not the only way cards get stolen, though; there are also the more pedestrian physical attacks like card skimmers at gas stations. Mar 12, 2017 at 15:44