Skip to content

Comment on X-Ray Scans Expose Chip-And-Pin Card Hackparent

Comments

The lesson from your story is that "See ID" doesn't work. Indeed, these are the merchant guidelines from Visa:

In the US, some customers write “See ID” or “Ask for ID” in the signature panel, thinking that this is a deterrent against fraud or forgery; that is, if their signature is not on the card, a fraudster will not be able to forge it. In reality, criminals often don’t take the time to practice signatures. They use cards as quickly as possible after a theft and prior to the accounts being blocked. They are actually counting on you not to look at the back of the card and compare signatures; they may even have access to counterfeit identification with a signature in their own handwriting. In this situation, follow recommended steps listed above under Unsigned Cards.

It makes even more sense given this guideline, from the same handbook:

When should you ask a cardholder for an official government ID? [M]erchants cannot make an ID a condition of acceptance. Therefore, merchants cannot as part of their regular card acceptance procedures refuse to complete a purchase transaction because a cardholder refuses to provide ID.

(Source, PDF: https://usa.visa.com/dam/VCOM/download/merchants/VBS-06-APR-...)

I struggle to understand the security rationale behind that advice - what is more likely - Thief spends 60-90 seconds practicing the signature on the card, or Thief acquires government ID that matches name on the card.

Regardless - any time I'm making a large purchase (even with a signed card), you can be certain they scrutinize my government ID - I've never seen a retailer who has ever paid attention to the rules that stipulate you cannot make an ID a condition of acceptance.

If it were a meaningful amount of money, it's more likely the criminal would clone the card onto one with their own name on it.

It's purely a branding rationale. For some people, being "grilled like a potential criminal" by a checker would be enough for them to stop using the card or not shop at that store. Either way, it's a negative association between that merchant and that card for that kind of customer. Card networks have fantastic anti-fraud algorithms that are way more reliable than a bored teen checker.

Are many people like that?

Whenever a checker takes care to examine my credit card I make a point of thanking them for their diligence, as long as its within reason they're doing everyone a favor but the criminals.

I worked retail thru high school and college. Although some people were thankful I'd checked their ID, the majority were annoyed. N=1 and all that, but I imagine this was well-studied by the credit card companies - they're not in the business of losing money.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.