[Note -- it is hard to believe, but this is my 100th post! That's a lot of hot air! Thanks for listening.......]
Despite the title, this blog is actually another in my "Banker's Math" series. Or maybe a dual entry -- the other being my "Traveler's Woes" series.
My wife and I travel regularly to Western Europe. For example, a year ago last fall we returned for our fourth visit to Italy, that time to northern regions just in time for mushroom season. This spring we flew to Holland for tulip time, then continued down to southern France for three weeks.
Over the years it has become easier for us to travel independently in Europe, thanks in part to the availability of internet technology for booking hotels, finding restaurants and attractions, and obtaining information about the local region. Language problems have nearly disappeared as English has become the universal travel language (we often hear other travelers talking to locals in heavily accented English, then return to their native language among themselves). Navigation GPS devices make it easier to drive yourself through the maze of ancient streets and web of country roads, assuming you don't always believe the instructions (that will be another blog!). Europe has also become increasingly hi-tech in the sense of allowing (and even requiring) payment by credit card and providing access to local currency via ATMs.
Although we have thoroughly enjoyed all of our trips to Europe, we recently have encountered some problems due to our antiquated American financial technology. I'm referring to the "swipe and sign" credit card that has facilitated several high-profile hacker attacks recently, for example the infamous Target data breach. These attacks are the work of nefarious ne'er do wells, of course, but their efforts have been made much easier by the vulnerability of the credit cards issued by U.S. banks. The information on the magnetic strips is easy to hack, the cards are easy to counterfeit, and the information transmitted by data terminals at retail outlets is easy to intercept.
The weaknesses of "swipe and sign" credit cards have been known for some time, and most of Europe has moved to a much more secure system which involves embedding a small integrated circuit chip (called the EMV chip) in each card that encrypts the user's data and protects it with a pin number. Point of sale machines can read the chip (once the pin is supplied) and the data is then encrypted for transmission. Though there have been a few hacks of this kind of system, it is much less vulnerable than ours. As Tom Groenfeldt of Forbes magazine describes it:
As my wife and I discovered last month while exploring Holland and France, the issue isn't so much the insecurity of our cards -- they aren't more insecure when we use them in Europe as when we use them here in the U.S. Rather, the difficulty comes from the fact that Holland and France are very advanced countries, and credit/debit cards are used for nearly everything. For example, here in the U.S. getting cash from ATM is a matter of convenience. In Holland and France, only banks in the largest cities have human tellers who can dispense cash on demand, so using an ATM is nearly a necessity for getting currency.
The ubiquity of card transactions (and the weakness of our swipe and sign card) was brought home to us the very first night we were in Holland. We had driven to a restaurant for dinner and learned that nearly all parking in the town required payment -- not to a human being but to a central machine that only accepted coins or...you guessed it...cards with the EMV chip. Having just arrived we didn't have any coins and we were going to have to find a nearby store to get change -- not something most merchants are keen on doing, particularly since all we had were large bills. Plus unless one of us stayed with the car we ran the risk of getting a ticket. Fortunately a nice Dutch family waiting to pay gave us the minimum required in coins -- about $1.40. Of course, they then stepped up to the machine, stuck in their chip card, keyed in their pin and away they went.
Parking machines aren't the only places where our credit card failed us -- trying to buy train tickets went from a simple matter of interacting with a machine to having to stand in a long line to pay at a counter -- only to have the agent's machine refuse to read our magnetic strip. On another occasion we had a major hassle when we tried to use a Park and Ride system in Amsterdam. Without the EMV chip we were unable to buy a special discounted ticket for city transportation and were forced to locate the parking structure attendant and try to explain our predicament. Again, the helpfulness of locals (and maybe their pity) won the day, and the attendant unlocked the machine and manually forced the discounted fare somehow.
Getting gas for our rental car also proved to be a hassle without the EMV chip, as I discovered the first time I inserted my swipe card into a pump's pay terminal, thinking this would work like it does here in the U.S. The station attendant came on the intercom and said something in rapid fire French, which of course I couldn't understand. The tone, though was very clear. I tried to fill up anyway, but the pump didn't have any obvious way of allowing for filling and then paying inside. Soon the attendant came out of the kiosk and with more rapid fire French and a bit of charades she communicated that I had to move our car to the "penalty pump," which she would activate for filling and then paying inside. By the way, the security of the chip and pin cards allows many service stations in Europe to remain open 24/7 without any attendants at all after normal hours. We would have been out of luck -- and out of gas -- had this happened late at night.
Fortunately, most merchants, hotels, and restaurants in both Holland and France have machines that can (for the time being) process our cards -- in addition to the slot where the machines read an EMV chip, they also have a slit that allows swiping a card. In fact most of these European machines are portable -- in a restaurant the waiter brings the machine to your table when you are ready to pay your bill and the whole transaction takes place right there. Since your card never leaves your sight, this is another way in which the European system is more secure. Although we never had a problem with a merchant refusing our swipe and sign card, this isn't always the case. Tom Groenfeldt quotes one credit card vendor as saying that merchants, especially in France where they have had EMV the longest, are very resistant to taking a card that isn’t chip and PIN, and restaurants sometimes don’t want to accept cards with just a mag stripe. In other words, unless you want to wind up washing dishes for your delicious meal in Cannes or Monaco, take plenty of cash as a backup.
So why haven't American banks switched to the new cards?
According to an analysis posted on the Credit Card Forum there are several reasons:
To make things even more confusing, most of the chip cards now being made available to Americans are "chip and sign," not "chip and pin." (If a pin is issued with these cards, it is for obtaining cash advances at ATM's, not for point of sale purchases.) And a quick search of internet forums will reveal many reports of people being unable to use them in Europe, or finding that they will work in some instances and not others. Not a good solution but still better than the old system.
For now we have adopted a wait-and-see stance. But before our next trip abroad we will have one of the chip cards The front runners right now are Barclaycard Arrival Plus ($89) and the Chase Sapphire Preferred ($95). The Barclaycard is a true chip and pin card. The Chase Sapphire is chip and signature now and likely to have chip and pin later in the year. We'll keep you posted.
Happy travels, happy banking.........
Despite the title, this blog is actually another in my "Banker's Math" series. Or maybe a dual entry -- the other being my "Traveler's Woes" series.
My wife and I travel regularly to Western Europe. For example, a year ago last fall we returned for our fourth visit to Italy, that time to northern regions just in time for mushroom season. This spring we flew to Holland for tulip time, then continued down to southern France for three weeks.
Over the years it has become easier for us to travel independently in Europe, thanks in part to the availability of internet technology for booking hotels, finding restaurants and attractions, and obtaining information about the local region. Language problems have nearly disappeared as English has become the universal travel language (we often hear other travelers talking to locals in heavily accented English, then return to their native language among themselves). Navigation GPS devices make it easier to drive yourself through the maze of ancient streets and web of country roads, assuming you don't always believe the instructions (that will be another blog!). Europe has also become increasingly hi-tech in the sense of allowing (and even requiring) payment by credit card and providing access to local currency via ATMs.
Although we have thoroughly enjoyed all of our trips to Europe, we recently have encountered some problems due to our antiquated American financial technology. I'm referring to the "swipe and sign" credit card that has facilitated several high-profile hacker attacks recently, for example the infamous Target data breach. These attacks are the work of nefarious ne'er do wells, of course, but their efforts have been made much easier by the vulnerability of the credit cards issued by U.S. banks. The information on the magnetic strips is easy to hack, the cards are easy to counterfeit, and the information transmitted by data terminals at retail outlets is easy to intercept.
The weaknesses of "swipe and sign" credit cards have been known for some time, and most of Europe has moved to a much more secure system which involves embedding a small integrated circuit chip (called the EMV chip) in each card that encrypts the user's data and protects it with a pin number. Point of sale machines can read the chip (once the pin is supplied) and the data is then encrypted for transmission. Though there have been a few hacks of this kind of system, it is much less vulnerable than ours. As Tom Groenfeldt of Forbes magazine describes it:
Much of the rest of the world uses a small chip on the credit card to validate with a transaction. The chip employs cryptography and a range of other security features and measures that create a multi-layered defense against card fraud. When combined with a Personal Identification Number or PIN code (the sort used on ATM cards), it substantially raises security. Even with just a signature it makes a marked improvement over a simple magnetic stripe. (Groenfeldt, 2014).Now enter the hapless American traveler abroad, equipped with banking technology widely regarded as woefully insecure and antiquated.
As my wife and I discovered last month while exploring Holland and France, the issue isn't so much the insecurity of our cards -- they aren't more insecure when we use them in Europe as when we use them here in the U.S. Rather, the difficulty comes from the fact that Holland and France are very advanced countries, and credit/debit cards are used for nearly everything. For example, here in the U.S. getting cash from ATM is a matter of convenience. In Holland and France, only banks in the largest cities have human tellers who can dispense cash on demand, so using an ATM is nearly a necessity for getting currency.
The ubiquity of card transactions (and the weakness of our swipe and sign card) was brought home to us the very first night we were in Holland. We had driven to a restaurant for dinner and learned that nearly all parking in the town required payment -- not to a human being but to a central machine that only accepted coins or...you guessed it...cards with the EMV chip. Having just arrived we didn't have any coins and we were going to have to find a nearby store to get change -- not something most merchants are keen on doing, particularly since all we had were large bills. Plus unless one of us stayed with the car we ran the risk of getting a ticket. Fortunately a nice Dutch family waiting to pay gave us the minimum required in coins -- about $1.40. Of course, they then stepped up to the machine, stuck in their chip card, keyed in their pin and away they went.
Parking machines aren't the only places where our credit card failed us -- trying to buy train tickets went from a simple matter of interacting with a machine to having to stand in a long line to pay at a counter -- only to have the agent's machine refuse to read our magnetic strip. On another occasion we had a major hassle when we tried to use a Park and Ride system in Amsterdam. Without the EMV chip we were unable to buy a special discounted ticket for city transportation and were forced to locate the parking structure attendant and try to explain our predicament. Again, the helpfulness of locals (and maybe their pity) won the day, and the attendant unlocked the machine and manually forced the discounted fare somehow.
Getting gas for our rental car also proved to be a hassle without the EMV chip, as I discovered the first time I inserted my swipe card into a pump's pay terminal, thinking this would work like it does here in the U.S. The station attendant came on the intercom and said something in rapid fire French, which of course I couldn't understand. The tone, though was very clear. I tried to fill up anyway, but the pump didn't have any obvious way of allowing for filling and then paying inside. Soon the attendant came out of the kiosk and with more rapid fire French and a bit of charades she communicated that I had to move our car to the "penalty pump," which she would activate for filling and then paying inside. By the way, the security of the chip and pin cards allows many service stations in Europe to remain open 24/7 without any attendants at all after normal hours. We would have been out of luck -- and out of gas -- had this happened late at night.
Fortunately, most merchants, hotels, and restaurants in both Holland and France have machines that can (for the time being) process our cards -- in addition to the slot where the machines read an EMV chip, they also have a slit that allows swiping a card. In fact most of these European machines are portable -- in a restaurant the waiter brings the machine to your table when you are ready to pay your bill and the whole transaction takes place right there. Since your card never leaves your sight, this is another way in which the European system is more secure. Although we never had a problem with a merchant refusing our swipe and sign card, this isn't always the case. Tom Groenfeldt quotes one credit card vendor as saying that merchants, especially in France where they have had EMV the longest, are very resistant to taking a card that isn’t chip and PIN, and restaurants sometimes don’t want to accept cards with just a mag stripe. In other words, unless you want to wind up washing dishes for your delicious meal in Cannes or Monaco, take plenty of cash as a backup.
So why haven't American banks switched to the new cards?
According to an analysis posted on the Credit Card Forum there are several reasons:
Why? Well, there isn’t exactly a huge demand for them. Unless you’re traveling abroad, you don’t really have an everyday need for a chip card, as few merchants have upgraded to payment terminals that accept them. Add in the fact that chip cards a more expensive to produce, and you wind up with three parties (consumers, merchants and issuers) who haven’t been in a big hurry to make the switch.From a Banker's Math perspective the expense to card issuers of covering fraudulent charges is less than the cost and inconvenience of changing to the chip system. The public concern over identity theft and insecure credit card transactions may be changing that equation, however. Credit card issuers now see the chip technology as a possible competitive advantage in attracting new accounts and have begun to offer them in limited markets -- but almost always in connection with yearly fee cards and not necessarily with cards that have no foreign transaction fees. For current lists of who offers what, see posts by The Points Guy, Credit Card Forum and NerdWallet.
To make things even more confusing, most of the chip cards now being made available to Americans are "chip and sign," not "chip and pin." (If a pin is issued with these cards, it is for obtaining cash advances at ATM's, not for point of sale purchases.) And a quick search of internet forums will reveal many reports of people being unable to use them in Europe, or finding that they will work in some instances and not others. Not a good solution but still better than the old system.
For now we have adopted a wait-and-see stance. But before our next trip abroad we will have one of the chip cards The front runners right now are Barclaycard Arrival Plus ($89) and the Chase Sapphire Preferred ($95). The Barclaycard is a true chip and pin card. The Chase Sapphire is chip and signature now and likely to have chip and pin later in the year. We'll keep you posted.
Happy travels, happy banking.........
