# Is PIN entry with Square's new readers secure? **URL:** \ **Category:** Monzo Chat\ **Created:** [13 April 2017 12:32 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221 "2017-04-13T12:32:48Z")\ **Posts on this page:** 18\ **Page:** 5
**Author:** ![anon23935806](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@anon23935806](https://community.monzo.com/u/anon23935806)\ **Post date:** [27 November 2017 10:33 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/81 "2017-11-27T10:33:24Z")
Given the signature is never checked they can just do whatever they want on the screen or not sign at all - I’m sure most (all?) merchants will understand, or again, Apple/Android Pay. But as a merchant when I have to choose between 50£ or less for a nice little terminal with a beautiful UX or (at least) twice as much + rental fees + contract with legacy payment processor + slow & clunky-looking terminal you know which one I’m gonna choose. Happy to help disabled users but if someone is confrontational about the terminal I use they’re free to take their business elsewhere. But again I think they do physical terminals for chip & PIN so this isn’t much of a problem. 👍 ---
**Author:** ![anon44204028](https://avatars.discourse-cdn.com/v4/letter/a/ed655f/32.png) [@anon44204028](https://community.monzo.com/u/anon44204028)\ **Post date:** [27 November 2017 11:00 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/82 "2017-11-27T11:00:26Z")
I have not heard if the drafted revisions to the industry standards have been accepted or not. I would have thought that when they are we would hear about this…not least from Square but from journal write ups too. ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 11:15 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/83 "2017-11-27T11:15:42Z")
I’m really surprised Square is supporting PIN in the UK market, they don’t in the US market. I’m not overly paranoid (plus I’d never enter my PIN on it, it supports contactless) but it does generally seem a bad idea. That said, this also hits on the huge security benefit of contactless people rarely mention - PIN skimming prevention. Since you’re entering your PIN far less often you’re greatly reducing the chances for it to be skimmed. Due to this, it’s much safer actually to use contactless wherever you can. Honestly though, while I don’t care since I’d always use contactless, I think Square should have shipped without PIN support in the UK (just like in the US). PIN on glass on untrusted hardware is an unnecessary risk. Not a hugely scary one, but unnecessary. ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 11:27 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/84 "2017-11-27T11:27:26Z")
> [@anon23935806](#): > > Given the signature is never checked they can just do whatever they want on the screen or not sign at all - I’m sure most (all?) merchants will understand, or again, Apple/Android Pay. I think this is a pretty awful approach to inclusion and implies that those with visual impairment should expect to have to go through contortions and commit minor fraud just to make a simple purchase. Or be turned away because the merchant doesn’t have a PIN entry device that conforms to modern and well established accessibility standards. > [@anon23935806](#): > > But as a merchant when I have to choose between 50£ or less for a nice little terminal with a beautiful UX or (at least) twice as much + rental fees + contract with legacy payment processor + slow & clunky-looking terminal you know which one I’m gonna choose. As you know, there are various alternatives (mentioned ⬆) which don’t suffer from these issues, but which do provide secure PIN entry devices which can be used by all. ---
**Author:** ![Chalky](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/chalky/32/20366_2.png) [@Chalky](https://community.monzo.com/u/Chalky)\ **Post date:** [27 November 2017 11:38 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/85 "2017-11-27T11:38:19Z")
> [@anon23935806](#): > > Happy to help disabled users but if someone is confrontational about the terminal I use they’re free to take their business elsewhere. Or report you for discriminating against those with a disability. ---
**Author:** ![anon23935806](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@anon23935806](https://community.monzo.com/u/anon23935806)\ **Post date:** [27 November 2017 12:21 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/86 "2017-11-27T12:21:52Z")
Alternatives exist but it’s always a trade-off, sometimes it’s very good _not_ to have a separate device and do the entire transaction directly on your phone - one less thing to charge, not worry about loosing it, etc. As far as I know it’s not forbidden to refuse business to a rude customer, disabled or not. Again, happy to help, but if they instead prefer to rudely complain then they are free (and encouraged) to take their business elsewhere. 🙂 ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 12:32 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/87 "2017-11-27T12:32:00Z")
I’m not sure where the suggestion came about that a visually impaired customer would be rude?! ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 12:57 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/88 "2017-11-27T12:57:17Z")
[quote=“jzw95, post:84, topic:8221”] I think this is a pretty awful approach to inclusion and implies that those with visual impairment should expect to have to go through contortions and commit minor fraud just to make a simple purchase. Or be turned away because the merchant doesn’t have a PIN entry device that conforms to modern and well established accessibility standards.[/quote] It isn’t ‘committing minor fraud’ - if it’s their scribble, it’s _their_ signature. There’s no fraud in being unable to make a _nice_ signature, sorry. Not signing at all isn’t _fraud_ either. > [@jzw95](#): > > As you know, there are various alternatives (mentioned ⬆) which don’t suffer from these issues, but which do provide secure PIN entry devices which can be used by all. I agree, but PIN is mostly getting phased out for POS anyway. Square should have simply done like in the US and not enabled PIN support at all. That said, I do agree - I’m opposed to PIN on glass type solutions. But it’s a minor concern. Contactless and chip and signature are accessible alternatives. > [@Chalky](#): > > Or report you for discriminating against those with a disability. Rjevski said no such thing. They were referring to people who simply don’t like the terminal, not to those who need assistance. > [@anon23935806](#): > > Alternatives exist but it’s always a trade-off, sometimes it’s very good not to have a separate device and do the entire transaction directly on your phone - one less thing to charge, not worry about loosing it, etc. I do actually agree that PIN on glass on untrusted hardware isn’t the greatest idea ever, but it’s not a major concern either. ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 13:31 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/89 "2017-11-27T13:31:13Z")
> [@GalaxyMergirl](#): > > I agree, but PIN is mostly getting phased out for POS anyway. Square should have simply done like in the US and not enabled PIN support at all. Except then no one would have bought it, because PIN is in wide-spread use. If you can’t accept Chip+PIN transactions, you’ll loose a lot of business. I think what Square did is that they didn’t have appropriate hardware for the UK market, but couldn’t be bothered/didn’t want to spend the money to develop appropriate hardware, so they’re just trying to bodge it. ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 13:36 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/90 "2017-11-27T13:36:29Z")
> [@jzw95](#): > > If you can’t accept Chip+PIN transactions, you’ll loose a lot of business. Please explain how they’d lose business. I don’t understand this at all? Would anyone really refuse to shop at a business because of the CVM selection? ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 13:42 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/91 "2017-11-27T13:42:35Z")
For the same reason businesses accept cards at all. If someone wants to pay by card and for whatever reason can’t use contactless (amount, card doesn’t support it, etc.), they simply won’t shop there. And a business isn’t going to accept signature as the CVM because then they’re liable for any fraudulent chargebacks. So I can’t see much of a market for a card reader that forces you to either turn away customers or else accept fraud liability. ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 13:48 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/92 "2017-11-27T13:48:49Z")
> [@jzw95](#): > > And a business isn’t going to accept signature as the CVM because then they’re liable for any fraudulent chargebacks. So I can’t see much of a market for a card reader that forces you to either turn away customers or else accept fraud liability. Yes, if a terminal doesn’t support offline PIN for MasterCard there is fraud liability for lost/stolen fraud if a contact chip transaction on a PIN preferring card is attempted. But that hasn’t caused Square any issue in the US, where the same liability shift is in place for MasterCard. I’ve _never_ heard of a US merchant not getting Square because they’re worried about lost/stolen PIN-preferring MasterCard and American Express liability. The bigger issue is Visa, which has very different rules between the US and Europe. In the US, Visa has _no_ PIN liability shift (shops do not have to support PIN to avoid liability for lost/stolen fraud). In Europe, Visa simply doesn’t allow contact terminals without offline PIN support, period. However, Square was able to get a waiver of the PCI PTS standards for entering the UK market. If they could do that, I can’t imagine it’d be any harder to get a waiver of the offline PIN support requirement (it should be easier, PIN on glass is arguably a higher risk to Visa than no PIN support at all). ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 13:52 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/93 "2017-11-27T13:52:05Z")
> [@GalaxyMergirl](#): > > But that hasn’t caused Square any issue in the US, where the same liability shift is in place for MasterCard. I’ve never heard of a US merchant not getting Square because they’re worried about lost/stolen PIN-preferring MasterCard and American Express liability. That’s because the vast majority of card in the US aren’t PIN-preferring, they’re still signature. Different market. As I say, I think Square designed their hardware for the US market and couldn’t be bothered to develop something appropriate for Chip+PIN markets. ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 14:08 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/94 "2017-11-27T14:08:35Z")
Correct, but the liability shift is still in place for the handful of PIN-preferring MasterCards there are, plus foreign MasterCards. Never heard of a merchant in the US worried. Lost/stolen fraud is just so rare. It’s the cloned card (EMV) liability shift they all care about. ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [27 November 2017 14:12 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/95 "2017-11-27T14:12:44Z")
> [@GalaxyMergirl](#): > > Correct, but the liability shift is still in place for the handful of PIN-preferring MasterCards there are, plus foreign MasterCards. Never heard of a merchant in the US worried. Presumably because it’s a very tiny minority of their transactions, so their risk is minimal. That’s a different market to the UK where the vast majority of chip cards prefer PIN, so a much larger risk. ---
**Author:** ![GalaxyMergirl](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/galaxymergirl/32/15976_2.png) [@GalaxyMergirl](https://community.monzo.com/u/GalaxyMergirl)\ **Post date:** [27 November 2017 14:23 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/96 "2017-11-27T14:23:01Z")
> [@jzw95](#): > > Presumably because it’s a very tiny minority of their transactions, so their risk is minimal. That’s a different market to the UK where the vast majority of chip cards prefer PIN, so a much larger risk. That is a fair point. Given there’s no PIN liability shift for Visa (only for US market, also by far the biggest player in the US market), and maybe 10% of the MasterCards and American Expresses they’ll see are PIN-preferring (unless in a touristy area), there’s probably less reason for it to concern them. ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [26 January 2018 10:09 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/97 "2018-01-26T10:09:01Z")
Just to tie this up, Allie has posted about the recent release of the official PCI standards for PIN on glass, so any further discussion should take place there. > [@PCI standards for PIN on glass with COTS](https://community.monzo.com/t/pci-standards-for-pin-on-glass/31838): > > There are now [PCI standards for PIN on glass](https://www.businesswire.com/news/home/20180124005766/en/PCI-Security-Standards-Council-Publishes-Security-Requirements) with commercial off the shelf devices (i.e. Square in the UK and Aus). This could be a huge game-changer as it’s now an endorsed, fully accepted method of PIN entry. Will iZettle, etc embrace it? What does it mean for accessibility? Update - I edited to make this clear I’m referring to PIN on glass with COTS devices. There have been a few PIN on glass implementations on custom hardware complaint with the old standards - e.g. Clover Mini. ---
**Author:** ![Rika](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/rika/32/45582_2.png) [@Rika](https://community.monzo.com/u/Rika)\ **Post date:** [26 January 2018 10:10 UTC](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221/98 "2018-01-26T10:10:39Z")
Closing as requested by @jzw95. [Previous page](https://community.monzo.com/t/is-pin-entry-with-squares-new-readers-secure/8221.md?page=4)