Costco Visa Caution

[Passepartout]

DW's shiny new Costco Visa came in the mail the other day, complete with her photo- the same one that was on her Costco Amex. Apparently it can be used starting 6/20.

So I was looking it over and saw it is chipped AND has the logo (the little fan looking icon) denoting that it is an RFID card. It will go into a foil sleeve or RFID wallet.

I didn't note whether it requires a PIN, or is just chip/signature.

Maybe I'm making much ado over nothing, but there it is.

Jim

 

["Roger"]

No surprise. At the moment, the only credit card that I have that does not have a chip is the old AmEx Costco card. And, the credit card companies have said that if stores do not use a chipped card in the near future, they (the store) will be liable for any fraudulent use. Given that, what would you expect Costco to issue?

Are RDIF cards a real concern? Typical paragraph from a Slate article on the subject ...

While early versions of RFID payment systems may have transmitted sensitive data like the card number unencrypted, major credit card companies insist that’s no longer the case. Their RFID chips now send a one-time code for each transaction, so at best, a determined thief might be able to make a single purchase by recording and replicating the signal he picks up from a given card. Even if that were to happen, the cardholder would not be liable for the fraudulent purchase under most credit card companies’ policies. From the thief’s perspective, it’s a lot of work for relatively little gain.

By contrast, skimmers installed on ATM or point-of-sale machines allow thieves to pick up much more usable information from a far greater number of cards. Unlike RFID skimming, ATM skimming is a real and widespread problem both in the United States and elsewhere. But no wallet will protect you from that.​

Don't worry about it and throw the RDIF wallet away. IMHO

 

[isisdave]

Everyone in Europe is using "contactless" cards, where you just wave them close to the terminal. No PIN required. This is similar to Apple Pay and other systems, I guess. They really encourage these for use in the London transport system, where they total your usage during the day and make one charge that night.

If you lose the card, the thief can obviously use it until you notice and cancel. But, in England anyway, there is a limit on the amount you can buy this way ... £20 or £30 at a time ... but no daily cap. For higher amounts you must dip and enter your PIN.

I'm not sure this is a good idea. Are there any contactless systems in the US yet? They grin politely at my 20th century chip and signature card here.

 

[DaveNV]

Costco doesn't currently use the chip portion of cards like that. They aren't yet set up for it. Everything is still a swipe transaction. When Costco DOES go chip-card ready, then the card you're holding will be ready to go.

Keep in mind, too, that after the Costco cobranded Citi Visa card goes into effect, ANY Visa card can be used at Costco. And every one of those I have already has a chip in it. So this new card is just making itself useful at places other than Costco, where the chip part of the card is likely to be used.

It's a non-issue, in my mind.

Dave

 

[davidvel]

I've read a lot of threads about this, but haven't been able to understand why ALL credit cards don't require a pin like a debit card. Everyone is used to it with debit cards, and terminals support it. In combination with chips, it would seem to reduce the theft of stolen cards to near zero, and reduce a tweaker's urge to break in to cars and steal purses.

 

[Ken555]

I've read a lot of threads about this, but haven't been able to understand why ALL credit cards don't require a pin like a debit card. Everyone is used to it with debit cards, and terminals support it. In combination with chips, it would seem to reduce the theft of stolen cards to near zero, and reduce a tweaker's urge to break in to cars and steal purses.

Because the industry claimed the cost would outweigh the benefits, which of course is just nonsense. Chip and pin should have been implemented over a decade ago.

As for RFID concern...that's a total nonissue designed to sell products that protect you from this fear.

 

[davidvel]

Because the industry claimed the cost would outweigh the benefits, which of course is just nonsense. Chip and pin should have been implemented over a decade ago.

As for RFID concern...that's a total nonissue designed to sell products that protect you from this fear.

Yeah, exactly. Fees for debit cards are lower than CC, but using a pin is more expensive for the industry???

 

[Pardytime]

Costco doesn't currently use the chip portion of cards like that. They aren't yet set up for it. Everything is still a swipe transaction. When Costco DOES go chip-card ready, then the card you're holding will be ready to go.

I used the 'tap and go' feature in Costco in Ottawa, Canada this morning with a bank debit card. It is about 3-4 times faster than selecting the account, entering your PIN, etc, which makes a cumulative time savings at the register, to everyone's benefit.

 

[dsmrp]

This card has a 3% foreign transaction fee.
The card stock itself is fairly flexible like another newer chip card we have.
I think it'll get beat up in DH's wallet.
My cards are more sheltered in the wallet in the comfy handbag

 

[klpca]

We're in Ireland for one more day. Just received a text from Chase that our Sapphire card (chip) was compromised and the number was used at an auto parts store in Las Vegas today. So much for the chip card preventing theft. We've had this card for less than 6 months.

I agree, why don't they require a pin?

 

["Roger"]

We're in Ireland for one more day. Just received a text from Chase that our Sapphire card (chip) was compromised and the number was used at an auto parts store in Las Vegas today. So much for the chip card preventing theft. We've had this card for less than 6 months.

I agree, why don't they require a pin?

While I agree that the credit card companies should have gone with chip and pin, my bet is that the fake card used in Las Vegas was swiped. Very few small merchants have chip readers yet and it is much easier for thieves to produce a fake magnetic strip than chip. Why would they bother doing something difficult when there would be very few places that they could be rewarded for their efforts ?

 

[DaveNV]

I used the 'tap and go' feature in Costco in Ottawa, Canada this morning with a bank debit card. It is about 3-4 times faster than selecting the account, entering your PIN, etc, which makes a cumulative time savings at the register, to everyone's benefit.

Thanks for that info. The Canadian system is different than the USA version. Nice to know that.

Dave

 

[Ken555]

Thanks for that info. The Canadian system is different than the USA version. Nice to know that.



Dave

Basically, every other country on Earth is more advanced than we are in terms of credit card usage.

 

[davidvel]

We're in Ireland for one more day. Just received a text from Chase that our Sapphire card (chip) was compromised and the number was used at an auto parts store in Las Vegas today. So much for the chip card preventing theft. We've had this card for less than 6 months.

I agree, why don't they require a pin?

While I agree that the credit card companies should have gone with chip and pin, my bet is that the fake card used in Las Vegas was swiped. Very few small merchants have chip readers yet and it is much easier for thieves to produce a fake magnetic strip than chip. Why would they bother doing something difficult when there would be very few places that they could be rewarded for their efforts ?

My point exactly. Your pin is (should be) only stored in your brain. The Almighty chip only protects the card itself, which can be stolen (with the chip in it).

If someone steals your card (physically) or steals your card data (swipe), its worthless without a pin, only if a pin is required.

 

[klpca]

While I agree that the credit card companies should have gone with chip and pin, my bet is that the fake card used in Las Vegas was swiped. Very few small merchants have chip readers yet and it is much easier for thieves to produce a fake magnetic strip than chip. Why would they bother doing something difficult when there would be very few places that they could be rewarded for their efforts ?

Very true. At home, the only business consistently using the chip technology is Trader Joe's. Otherwise it's hit or miss. Here in Ireland they have used the chip reader 100%.

 

[isisdave]

I used the 'tap and go' feature in Costco in Ottawa, Canada this morning with a bank debit card. It is about 3-4 times faster than selecting the account, entering your PIN, etc, which makes a cumulative time savings at the register, to everyone's benefit.

In Canada, is there a maximum amount per transaction or per day on tap-and-go? How would that ever work at Costco??

PIN-less systems like this seem very insecure to me.

 

[dioxide45]

PIN transactions don't have to slow down things at the register. The problem is people always wait until after everything is rung to swipe their card and enter their PIN. People either don't realize or don't know that they can swipe their card while the checker is scanning items and enter their PIN, then all they have to do is confirm their amount. The only thing worse than waiting to scan your card at the end is waiting until the very end to dig a wallet out of a purse or pocket to write a check or even get cash, AFTER standing there while they ring everything up. Why not be doing that while they are in the process? You didn't actually think you would have to pay at the end? I also don't understand why a lot of people have to fill out the whole check at placed like Walmart even though they tell you you don't have to. They just scan the check and it all happens electronically now. The print the details on the check for you.

 

[lvhmbh]

Publix Supermarkets here in So. FL don't have the chip machines so, because of theft/scamming, I have to show them my card after the transaction goes through. They then check it against the register receipt (not sure for what). I use the chip feature at most other stores.

 

[DAman]

PIN transactions don't have to slow down things at the register. The problem is people always wait until after everything is rung to swipe their card and enter their PIN. People either don't realize or don't know that they can swipe their card while the checker is scanning items and enter their PIN, then all they have to do is confirm their amount. The only thing worse than waiting to scan your card at the end is waiting until the very end to dig a wallet out of a purse or pocket to write a check or even get cash, AFTER standing there while they ring everything up. Why not be doing that while they are in the process? You didn't actually think you would have to pay at the end? I also don't understand why a lot of people have to fill out the whole check at placed like Walmart even though they tell you you don't have to. They just scan the check and it all happens electronically now. The print the details on the check for you.

I might be one of those people only because of scanner errors.

I shop a lot at Target and Safeway due to location. At Target the last four times I have purchased items there has been an error in target's favor three times. Safeway is similar.

It is a waste of my time to have to review my receipt after purchase and wait in a customer service line due to overcharges. That is why I try to watch the scanning as it is done. Much easier for me to correct an error during the scanning process.

At Target I often take a photo of sale prices to show at register.

 

[presley]

Publix Supermarkets here in So. FL don't have the chip machines so, because of theft/scamming, I have to show them my card after the transaction goes through. They then check it against the register receipt (not sure for what). I use the chip feature at most other stores.

They do that at Von's here. They said they are making sure the last 4 digits of the card match what was scanned. I guess the strip doesn't match what is on the front of the card when skimmers make cards.

I find it annoying that they didn't switch to chip machines, yet. Everyone was supposed to change over in October. It's ridiculous that so many large merchants haven't done that, yet. They are allowing the skimming to continue.

 

[colatown]

Publix Supermarkets here in So. FL don't have the chip machines so, because of theft/scamming, I have to show them my card after the transaction goes through. They then check it against the register receipt (not sure for what). I use the chip feature at most other stores.

The Publix here do have chip readers and have had them for several months. They haven't started using them however and you still have to swipe your card on the reader.

 

["Roger"]

...

I find it annoying that they didn't switch to chip machines, yet. Everyone was supposed to change over in October. It's ridiculous that so many large merchants haven't done that, yet. They are allowing the skimming to continue.

If your area is like mine, a lot of merchants have the necessary readers, but can't use them until they are "certified." They want to do that, but can't because of a huge backlog. See this article.

Should this problem have been anticipated? It frustrates me when people always talk about how efficient private enterprise is.

 

[billymach4]

EMV uses PKI

This is going to be very technically esoteric. The Chip in these credit cards is using a technology similar to PKI. Public Key Infrastructure. Basically it is your private key certificate on the CC. It must be authenticated with the respective public key by a Certificate Authority. Both keys authenticate and the transaction is approved. My take on this is that it will take years for the hackers to figure out how to duplicate the contents of the embedded chips on these cards.

If you are a member of the military, or a DoD employee/contractor it is similar to your (Common Acess Card)CAC.

If you have noticed when using the Chip card the transaction takes a few moments longer to clear.

Regardless, as some others have noted my Marriott Rewards card was compromised recently. It had the chip but not all of the merchants have the chip readers. In any event I suspect that my last trip to NCV somewhere along the way my card was skimmed.

Chase reached out to my via text and email about a suspicious online jewelry charge that triggered me to shut it down with Chase. They immediately shipped out new cards in hand the next day.

I also notice that the new VISA branded cards with chips are not embossed. This must make it more difficult to make duplicate cards, since hackers can purchase machines that can emboss blank credit cards. Hmm I wonder where they buy these machines.

 

[Kal]

...I also notice that the new VISA branded cards with chips are not embossed. This must make it more difficult to make duplicate cards, since hackers can purchase machines that can emboss blank credit cards. Hmm I wonder where they buy these machines.

WalMart Aisle 476 :ignore:

 

[dioxide45]

I also notice that the new VISA branded cards with chips are not embossed. This must make it more difficult to make duplicate cards, since hackers can purchase machines that can emboss blank credit cards. Hmm I wonder where they buy these machines.

We have some Visa Chip based cards that are embossed and some others that aren't. Some just have the card information printed on the cards while others have it embossed on the card. Not sure if there is a rhyme or reason for it. In fact, my wife's Marriott Rewards Visa has the information just printed on the card and mine is embossed. We both got new cards within the last year. Though my card is the older non Premier card that only gets 3 points per dollar on Marriott spend where hers gets the 5 points per dollar.

Her United Mileage Plus card doesn't have the new chip yet but also doesn't have the information embossed on the card.