AARP Article on Smart Cards with Chips in Europe - reason for concern?
 

The recent AARP magazine had an article about how many credit card companies in Europe are going to the Smart Cards with the embedded chips. The article stated that the "swipe and go" is quickly becoming a thing of the past and that Americans are going to have increasign problems making purchased with their credit cards in Europe. Apparently it does not impact ATM transactions but many businesses now only accept the credit cards issued in their country. Have any recent travelers to Europe had problems with this? We are leaving for Italy in a few weeks and wondering if we should be at all concerned.

I go everyweek to Europe and don't have problems. However, you should always call your credit card people along with your bank(ATM) and let them know where you are going overseas so that your cards work properly.

No, not at all. The only problem that I encountered was an unattended gas station where you had to either put in "cash" or use a smart card with a pin.

In Zurich I ran into an attended gas station that only took credit cards. Since I didn't have one with a chip, the attendant asked me if I had an Amex card. She said that that was the only card that would work in the gas machine without using a pin -- Yes, it did work.

I noticed that just about every vendor I encountered always matched signatures with the card -- that made me feel much better in case for some chance I lost the card.

Now, for my Amex story, I don't know if it was just for that particular station, stations in Zurich, or whatever. I am curious to know if it works at all unattended gas stations through Europe, as there were numerous unattended stations in Italy -- I used cash. ((b))

Well we discussed this earlier and I wonder how knowledgeable the author of the article was.....

1. Yes chip and pin as the smart cards are called is becoming more and more the standard in Europe and as a matter of fact, I believe the eu is requiring banks in Europe to make these cards mandatory for their cardholders in the near future.

2. Canadian banks are in the process of joining this parade.

3. US banks, as always things are contrary minded in the USA, have decided that they don't want to go in this direction at this point. Probably, knowing the mentality of US commerce, they have done a study and decided their losses for fraud will be less than the cost of issuing the chip and pin cards.

4. Because obviously visa and mastercard don't want to lose the American market so as long as American banks do not issue chip and pin cards, the cards with traditional magnetic stripes will remain valid.

5. However, in many rural areas, some of the clerks are not used to seeing non chip and pin cards. While, for example, US credit cards are valid in the UK, all the terminals that were devised when the UK introduced chip and pin cards all had provisions to accept the traditional magnetic striped cards. However, in many rural areas of the UK, I have run into nearly illiterate clerks who don't have a clue and some of them try to tell me my card is no good.....when they insert the card into the chip and pin terminal (I don't like when they do that as it damages the signature panel on my card), their terminal clearly tells them the card is to be swiped. On a couple of occasions, I have had to ask for the manager to get them to take the card.

6. Yes it is very true that in London, at least, the clerk always checks the signature on the card...of course what real good that does is problematic as often times a card can be cloned from the numbers and a different signature put on the signature panel. And yes, in the USA, I almost never have the signature checked as I basically swipe the card and put it in my pocket. Again not that I think the signature is much of a security aide.

8. Finally, as I have noted earlier, it is absolutely illegal for a merchant to ask for id when using a credit card. Whenever I am asked for ID when using a credit card, I take out a notice from mastercard indicating it is illegal for them to ask for id and that they are supposed to check the signature. Why should you never show any additional id..it seems a harmless enough thing to protect a cardholder? Well, if your credit card number is compromised, while it is a bit disconcerting, a phone call and letter will resolve the matter and that will be the end of it...while if an identity thief gets additional information (address, drivers license number), that could help them get further information about you and lead to identity theft which is infinitely more difficult to resolve. Tell any merchant who asks for id when using your credit card NO.

I don't agree with you, that's just your opinion. And some places won't allow you to use the card to buy something if you refuse to show ID. I don't see the whole identify theft thing, and some retailers do ask for ID with a credit card, at least in Paris. FNAC does and some other big store did, also, when I was just there. Sure, they can check the signature, but people can forge them with a little practice (and frankly, my signature in that teensy space on the back doesn't hardly even look like my real one).

When they check ID with a card, they have never retained the information anywhere, they just look at your photo and name on your driver's license or whatever, and then say okay. That's no different than lots of other places your ID may be checked. They don't write the info down.

As for the original question, don't know about Italy, but I just got back from two weeks in Europe in Switzerland and France, and never had a problem with a merchant not accepting my American credit cards without chips.

Again Christina...

You're entitled to your opinion but I repeat according to mastercard regulatons in the USA, merchants are not permitted to ask for additional identification when using a credit card and I do understand the possibility (remote as it may be) of using the information for identity theft..most identity thefts start with the clerks who either use a portable card reader or simply have the ability to memorize the number.....

I did not know it was "absolutely illegal" to be asked for ID when using a CC, and have lately been asked a couple times to show ID to compare sigs; I will force myself to read those little inserts they send almost every week to educate myself.

The clerk literally put the two cards next to each other and when satisfied handed them right back to me. I hadn't considered that in that exchange the Clerk/Identity Stealer was memorizing my address. Which any Professional Identity Stealer could get in about 30 seconds on the internet in the privacy of their Identity Stealing Batcave. But please do provide a cite for the assertion that *most* identity thefts are done by Clerks.

And yah, travel columns and articles are usually about a year behind this forum.

I can only say that having returned from a little over 6 weeks this summer in Europe and using no chip credit cards about 200 times, the ONLY problem I had with using the card was that it won't work in ticket machines in the Amsterdam train station. Never once was there a problem with using it anywhere else in UK, Italy, France, or the Netherlands. (I did not drive and didn't use it as self serve gas stations, however, where I know it usually won't work. )

I had absolutely no problem with a chipless credit card except at one toll booth where I got into the wrong lane.

Since many Europeans still have swipe type credit cards it is nonsense to say that they are not accepted. I will only get a chip and pin card when my card is replaced - which is not yet for quite a while, and until all major countries switch to the chip and pin system they will conitue to be useable. The clerks may be less used to dealing with them, but with patience it can be explained and you can use your card.
The ticket machines at Dutch railway stations do not accept credit cards, no matter where they are issued.
Many unmanned petrol stations only accept credit card issued in the "home" country, so a Dutch machine may not accept a British card.
I have no problem with providing a piece of photo ID for retailers who request it - they never note down the details on my drivers license - just check the name on the card an the icnese match, and that the face on me matches that on the photo.

>according to mastercard regulatons in the USA, merchants are not permitted to ask for additional identification when using a credit card

Well, it might be true in the USA but in many European countries the clerks have the right to (and partly are required to) make sure that you are what the CC says you are.

As to this identity theft thing - if the US had reasonable data protection legislation, it would greatly cut down on this fraud.
(Of course if you are too stupid to give all your data somewhere on the net, no legislation is going to help.)

Hi B,

Your US CC will work almost everywhere except:

Gas stations on Sunday - no staff only smart cards

Automatic ticket machines at some train stations, again only smart cards.

((I))

By the way, this is not the first article in an AARP publication that has been WAY off base.
I remember a rather recent article there about the best ways in Europe to exchange currency and much high praise for using TC's which will be "accepted everywhere" and not a mention of ATM's, except "they can be very expensive to use".

I have a related question regarding chips: I understand (sorry, second hand) that U.S. passports with chips are being phased in. There has been some speculation that information from these passports can be gathered remotely with the proper wireless devices. Is this true of the credit cards and passports with chips? I am technology-challenged and don't know if this is anything to worry about or not.

Thanks for all the responses. One less thing to worry about. NeoPatrick, I agree with you about AARP. I remember reading the article recommending traveler's checks and thinking how behind the times they were.

The "chip" in the chip and pin card is a Radio Frequency Identification Device, or RFID. Although RFID has not yet reached a point of standardization, in general companies understand that important information transmitted by RFID must be encrypted. I have not heard of any RFID payment cards that are not encrypted. This does not prevent someone with a payment device from gathering unauthorized charges from the cards in wallets around him/her in, say, a crowded train. I assume this is part of the reason for requiring a PIN with chip cards. This situation is not a major danger, as the thief will have to convince Visa/MC/AmEx or whomever that he is a legitimate merchant in order to participate in the payment system. And even if he does convince them, the game will not last long, only until the first charges are disputed.

The US passport RFID chips will be encrypted. They are also to be issued (from my understanding; I work for the government in a similar area but not for DHS or State) with a sleeve that will supposedly prevent transmission or special covers that will do same, so the passport will be kept in the sleeve/closed except when being examined by passport control. They are also supposed to be very limited range transmissions of 10 cm (RFID devices have varying signal strengths with the strongest signal strengths transmitting up to about 200 feet or so, the weakest just a few cm). Even with these precautions, there is very widespread public opposition to the plan and its implementation has been delayed, from my understanding.

<<it is absolutely illegal for a merchant to ask for id when using a credit card>>

This is untrue. Rather, for a merchant to ask for ID is in violation of their agreement with their credit card processor.

Merchants are also not to accept cards with "See ID" in the signature panel rather than a signature. But that doesn't stop folks who have read articles from insisting on doing it anyway. This was so prevalent that credit cards are now issued with "Not valid unless signed" above or next to the signature panel.

One reason people oppose it is the government's history of lying a bit about how secure the technology is. It's actually trivially easy to hack into, and is readable from much further away than they say. Especially when you realize that the "snooper" can relay it using plain old wireless - so you could have someone snooping your passport with a small device from ten feet away, and then relaying from that device to a laptop computer 200 feet away, and so on. When you consider that passports tend to cluster together in certain places -- everybody in a crowded international air terminal security line has one, for instance -- you can see the problem is serious. It's already been demonstrated under real-world conditions.

Data security systems that rely on the government being smarter about technology than hackers are not secure at all. The hackers are always ahead.

Also, for a certain kind of snooper -- a terrorist or a foreign spy, for instance -- being able to read your passport's details is less important than just being able to identify that you're an American passport holder.

The only kind of data security that works relies on two components -- something that you HAVE (a credit card, a fingerprint) and something that you KNOW (a PIN, a signature, a password). Either by itself is often worse than nothing.

I know I always get nervous when I'm around the increasing number of card swipe readers that never ask for a signature OR a pin -- at gas stations, McDonalds, etc. Ask any cop and he'll tell you the first thing crooks do when they steal your card is fill up the tank.

What if your signature is 'CID'? :)

Actually, I both sign the card AND write 'See ID' on the back, so they will look at both. I get asked for ID about 10% of the time in the US.

I'm not sure that credit cards do use RFIDs as they require contact with the reader. As far as I can find out they do not use RFIDs but are "smart cards".
New Dutch passports have RFIDs fitted to them - to meet the demands of the US government.

>I'm not sure that credit cards do use RFIDs as they require contact with the reader.

As far as I know the CC's never use RFID. Just a "smart" chip with direct contacts.

Smart cards are superior as they provide security by (as Fnarf says) something you know and something you have. Signatures are neither.
A third level of security includes fingerprints, retinal scans, signatures, photo scans as something you are and only if verifiable (and not by a clerk looking at the back of your card)). However most people are resistant to these as they feel they are invasions of some sort.
A great advantage of smart cards is they are not removed from you (like in restaurants).

"See ID" or "CID" is just silly, even with a signature. Merchants are NOT required to ask for ID and are supposed not to.

Hi Leburta.

>...I understand .. that U.S. passports with chips are being phased in. There has been some speculation that information from these passports can be gathered remotely with the proper wireless devices. Is this true of the credit cards and passports with chips?<

A reasonable question.

It is less likely than a thief will be able to read the chips in your wallet than that you will be hit by lightening.

If it bothers you, wrap your cards and passports in aluminum foil. That will block the transmission.

((I))
Former engineering professor and person who used to be interested in such things.

>"See ID" or "CID" is just silly, even with a signature. <

So some guy mugs my mother and runs up a bill of $350 before she can report it to the CC company.

Wouldn't asking ID from a male person using a CC in a definitely female name have prevented this fraud?

I completely reject the argument that it is safer not to ask for ID.

((I))

Sorry, but none of my employees will take a CC without ID & the bank we deal with insists on it. We won't accept a signature by a wife using her husband's card either. He has to sign it. If the customer balks, they may use cash or traveler's checks.

And the reason for the husband/wife thing is because of the number of people who will go back home & protest the charge & naturally the signature will not match.

The number of crooks traveling around is astounding & we're on a low enough margin as it is. It has come to the point we have to check even $20.00 bills for counterfeits, not to mention a DVD player displaying souvenir DVDs of scenic sites here in the VI was stolen from the counter by a tourist.

I have a Mastercard & an Amex & have never received notices that it's illegal to ask for ID. Most people are grateful that we DO ask.

From VISA's official rules, at http://tinyurl.com/353h46:

"When should you ask a cardholder for an official government ID? Although Visa rules do not preclude merchants from asking for cardholder ID, merchants cannot make an ID a condition of acceptance. Therefore, merchants cannot refuse to complete a purchase transaction because a cardholder refuses to provide ID. Visa believes merchants should not ask for ID as part of their regular card acceptance procedures."

Also:

"Some customers write “See ID” or “Ask for ID” in the signature panel, thinking that this is a deterrent against fraud or forgery; that is, if their signature is not on the card, a fraudster will not be able to forge it. In reality, criminals don’t take the time to practice signatures: they use cards as quickly as possible after a theft and prior to the accounts being blocked. They are actually counting on you not to look at the back of the card and compare signatures—they may even have access to counterfeit identification with a signature in their own handwriting.

"“See ID” or “Ask for ID” is not a valid substitute for a signature. The customer must sign the card in your presence, as stated above."

Merchants also cannot add a credit card surcharge, nor can they set a card minimum. A merchant who accepts Mastercard or VISA at all MUST accept a charge for ten cents if it's offered.

People who've actually read their card agreements (both merchants and consumers) are rarer than hens' teeth, but not having read it doesn't mean it's not a contract.

Thanks, Ira. I guess I'm a worry wart. It's just that it's clearer every day that the crooks are smarter than us. And woe if we run into those who don't just want to steal information, but want to do us harm!

There are many wonderful moments on the Fodors Europe board, but high among them has to be Ira advising travelers to wrap their credit cards and passports in tinfoil to thwart transmissions. Thanks Ira.

My credit card did not work in the luggage storage machine at Schiphol, but it worked everywhere else. I did encounter a merchant in Cesky Krumlov, CZ who said the shop did not accept credit cards. Since they sold artwork for upwards of hundreds of dollars, I thought that to be strange.

One time in a clothing store in Amsterdam, my card did not work, but my ATM card (which is also a credit card) did work. It doesn't have a chip, either, so I don't know what happened.

I always travel with my credit card, ATM, and back-up cash. Have always made out OK with those options.

fnarf999

Be aware that these consumer protections only apply to merchant agreements in the USA....some unenlightened countries do permit these things such as minimums for purchases, surcharging use of a card and allow merchants to refuse a sale if customer does not have ID.

But many merchants in the USA routinely try to violate their merchant agreements and if they pull that garbage on me, I reach into my wallet and pull out the notice from visa noted above....if they still don't accept the card I tell them politely I don't walk around with enough cash to pay for the transaction and if they still won't follow their merchant agreement, I indeed report them to visa. I would hope visa follows up and prevents them from pulling this garbage again.

I'd like to see what the European VISA rules are. I'll bet they're the same. It doesn't really have anything to do with law, but with private contracts.

The tinfoil is completely unnecessary if you wear the standard aluminum colander on your head. Unless it rains.

MasterCard also does not allow merchants to require a minimum purchase. Many places however, will tell their customers that a minimum is required. I generally call my Master Card provider and report them. I find that the next time I go to the store where it had been a problem they have "corrected" their "Minimum Policy."
I don't call MC if it is a small mom and pop neighborhood store.

...the difficulty is government laws and rules supersede those of the credit card companies...I believe in the UK by law credit card companies cannot prohibit merchants from surcharging credit card sales or setting minimums...but it's just bad policy to have minimums....cash sometimes disappears into the arms of crooked employees or the wrong change is made or wahtever...a credit card transaction is 100% secure!

American Express in France has recently notified merchants to ask for ID when the card is used. Most are still not doing so, preferring to shoulder the risk themselves.

Although I'm old enough for AARP's magazine (wink, wink), I don't subscribe but read a similar article in National Geographic Traveler and posted a summary thread. The warnings in NGT sounded the same as those BoulderCo mentioned.

I think the gist of both articles is that, although this hasn't been an issue in the past, tourists using the antiquated U.S.-issued cards will increasingly encounter problems in the future.

...do you think for one second MC/visa are gong to allow their humongeous US market to be left out in the cold...

All the new terminals have provisions for "old fashioned" swipe magnetic stripe cards...even when the illiterate clerk (and I have run into some in London...and they keep inserting my non chip card into their chip terminal and I keep telling them they're not supposed to...result...the signature panel is being rubbed off but you can't help if some people are idiots) they are told to swipe the card.....yes I understand that sometimes you run into clerks who don't seem to understand but then you request to see the manager

No matter what the jerks who write these articles say, the US credit cards with magnetic stripes will remain valid indefinitely or until the US banks are convinced that it is in their customers' best interests to have a chip and pin; right now the studies they have done show that loses due to fraud are less than the cost of replacing all the payment cards in the USA.

Besides which, much of the fraud in this day and age comes off the internet not at merchants much anymore and all the chips and pins in the world are not going to stop this vermin from stealing credit cards and identities to make a quick buck for themselves (which some British cardholders discovered about 15 months ago when a scam operating at Shell stations stole their numbers despite the chip and pin and the cards were suddenly turning up being used in Thailand.

Certainly here in Holland the same reader is used for ATM/debit cards which are swiped and pinned, and credit cards which may be swiped or chipped and signed for or pinned, and our own "Chipcard" electronic wallet system. So I see no problem for US vistors here - they will not be getting rid of the swipe system.
You do however have to realise that apart from in retail outlets not every machine which accepts a card accepts a credit card also such as ticket machines and lockers.
BTW next year (maybe)we get the OVchip card instead of tickets for trains buses etc, so ticket machines will become obsolete.

Mastercard DOES have specific rules changes for Europe. In particular merchants ARE allowed to apply surcharges for card use as long as the surcharge is clearly displayed.

Merchants are NOT permitted to set a minimum charge in the Europe area. If you see a merchant doing this, report them to Mastercard.

See 9.2 and 18.A in this document:
http://www.mastercard.com/uk/wce/PDF...ire_Manual.pdf

Also see 9.11.2 Cardholder Identification:
"A merchant must not refuse to complete a MasterCard card transaction solely because a cardholder who has complied with the conditions for presentment of a card at the POI refuses to provide additional identification information".

Again, if they do this to you, report them. This is true in Belgium, Czech Republic, Cyprus, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, and United Kingdom (18.2 Definitions).

Hi Leb,

>...it's clearer every day that the crooks are smarter than us.

No, they aren't. It's just that they spend a lot of time working on how to steal.

You are welcome, Fidel.
I didn't think of it first, however.

>Also see 9.11.2 Cardholder Identification:
"A merchant must not refuse to complete a MasterCard card transaction solely because a cardholder who has complied with the conditions for presentment of a card at the POI refuses to provide additional identification information".<

Maybe they have their reasons, but I find that an open invitation to theft and fraud.

((I))