Safety of debit and credit cards with chips

October 6, 2017 8:29 AM

Are debit and credit cards with chips less safe than those without chips if they're lost or stolen?

I now have a new debit card with a chip as well as a credit card with a chip. Just today, at Walmart, I put the debit card in the reader. I wasn't asked for a PIN, nor previously at some other stores for a signature when I charged stuff to my credit card with a chip. (Some stores ask for pin numbers or signatures; some store card readers process the charges without pins or signatures.)

If these chip cards are lost or stolen, can't someone easily go charge up a storm by using these chip cards or buy something and get cash back at the registers? I thought debit and credit cards with chips were supposed to be safer, not less so than those without. What am I missing here?

posted by Elsie to Work & Money (11 answers total)

This has nothing to do with the chip, it has to do with whether your debit card has (usually) a Visa or Mastercard pinless payment option (basically the debit card works like a credit card). Also a lot of stores don't ask for signatures if the amount is below some amount, like $25 or $50.

Some banks will let you have a PIN-only card if you request it, others won't. It's worth calling!

I always try to get the PIN-only debit card, because you're right, someone can absolutely use up all the money in your checking account. It gets resolved eventually, but it's a much bigger pain in the ass than someone stealing your credit card.
posted by mskyle at 8:34 AM on October 6, 2017 [4 favorites]

Cards with chips are harder to "skim" and replicate; skimming meaning that an attacker sets up a swipe terminal to capture magnetic stripe info, then replicates those magnetic stripes onto blank cards and charges them. With chip cards, you have to replicate the logic in the chip itself to be able to make a replica and charge transactions to it.

The card itself is just as vulnerable when the original is lost, it's just that the chip feature makes duplication a bit harder.
posted by brocrastinator at 8:35 AM on October 6, 2017 [4 favorites]

Yes, it has nothing to do with the chip, but do note that chip credit cards are just as (in)secure as chipless credit cards, since the United States decided to implement "chip and sign", not "chip and PIN". The card is harder to clone, but the actual card is no more secure if used to buy something. It's dumb.
posted by Automocar at 8:39 AM on October 6, 2017 [2 favorites]

Some debit cards are chip and pin, but they are easily defeated since no bank I'm aware of refuses swipe transactions altogether. All "they" have to do is clone the mag stripe per usual onto a card with a fake/broken chip. The terminal will prompt you to swipe after it fails to communicate with the chip and communicates that fact to the bank, which authorizes the charge since the chip read was attempted.

I know this because my bank declines swipe-only transactions from retailers that have working chip machines, but my card's chip is going bad, so I've been prompted to swipe instead on several occasions. The authorization type printed on the receipt is different for each case.

The same general system is used on both the credit (signature) and ATM (PIN) networks in the US. Few banks will keep you from using an ATM or POS terminal without a chip reader, but most require its use be attempted if it is there.

I don't know of anyone doing pinless ATM transactions, so if your bank issues ATM-only cards, that's probably your best bet in terms of security. It should still work at many grocery stores or other places that give cash back. "Debit" usually means "processed over an ATM network," so most ATM cards will work like that.

If you're already choosing debit when it's available and not getting prompted for a PIN, then an ATM-only card probably won't make a difference, although it will limit the rate at which your account can be drained without a PIN.
posted by wierdo at 9:09 AM on October 6, 2017 [1 favorite]

Best answer: If you use a debit card (not a credit card) for a debit transaction with cash back, I believe you'll be asked for a PIN every time. If you use a debit or credit card for a purchase transaction using the Visa or MasterCard network for payment processing, and you are below a given dollar amount in a store that has chosen to do this, you may not be asked for a signature. The dollar amounts don't seem to be consistent in my experience, and not all stores choose to do this, so it's hard to predict whether you'll have to sign. We often get bonuses on grocery purchases on one of our credit cards, so I got used to using it here in DC where many stores have configured their systems not to require signatures below whatever threshold. I've almost run out on card transactions in grocery stores in other places because I wasn't expecting the signature thing to come up. The cashier at the one in Jackson Hole was NOT AMUSED.

Also as Automocar points out, the US banking system has settled on a less secure implementation of chip cards than the one the rest of the world uses, but it doesn't mean the cards themselves are less secure than stripe cards are. What the US implementation of chip cards (without PINs) has done is make it harder for thieves to obtain and use a copy of your card. A chip card is harder to clone than a stripe card is, but if somebody has your actual card the risk of theft is pretty much the same at that point. The extra no-signature-required-below-$X thing means they might be able to spend lots of small amounts of your money without having to forge your signature, but they'd still have to forge your signature to spend more than that, and they'd still need a PIN to take cash out using your debit card.
posted by fedward at 9:09 AM on October 6, 2017 [3 favorites]

but they'd still have to forge your signature to spend more than that

The signature is completely pointless these days. I just draw a squiggly line on the signature pad, and I can't member the last time a cashier actually tried to verify my signature was actually mine.
posted by COD at 9:43 AM on October 6, 2017 [1 favorite]

but they'd still have to forge your signature to spend more than that

I've only had a retailer scrutinize my signature once and that was 17 years ago and I was 24 years old American living in Belgium and I looked like ass because I had the flu but I wanted to buy some chocolates as Christmas presents before I flew home.
posted by mmascolino at 10:44 AM on October 6, 2017

That'll teach me to edit out parentheticals. But yes, signatures have been pointless for years, but that was also true before the switch to chip cards.
posted by fedward at 11:09 AM on October 6, 2017

The signature is completely pointless these days. I just draw a squiggly line on the signature pad, and I can't member the last time a cashier actually tried to verify my signature was actually mine.

I’m 37 and in the almost 20 years I’ve credit/debit cards, I have never signed the back of my cards. About 15 years ago a cashier at Ralphs tried to refuse card because I had not signed it, but I called her bluff and forced her to either sell me my groceries or have someone put all my stuff back. She caved I am still 100% signed-card free.
posted by sideshow at 3:18 PM on October 6, 2017

I thought the signature was for the bank to compare against its signature on file. My ex got a letter from the bank saying that his signature hadn't matched his transaction and they were alerting him in case he hadn't made the purchase in question. (He had, it was just poor penmanship.)
posted by AFABulous at 9:28 PM on October 6, 2017

On the back of my card in the signature field, with a bold sharpie I always write CHECK ID. This doesn't mean every person holding my card does it, but many of them do - whereas I don't think anyone actually compares signatures as aforementioned. ;)
posted by bitterkitten at 6:14 AM on October 11, 2017