Given the signature is never checked they can just do whatever they want on the screen or not sign at all - I’m sure most (all?) merchants will understand, or again, Apple/Android Pay.
But as a merchant when I have to choose between 50£ or less for a nice little terminal with a beautiful UX or (at least) twice as much + rental fees + contract with legacy payment processor + slow & clunky-looking terminal you know which one I’m gonna choose. Happy to help disabled users but if someone is confrontational about the terminal I use they’re free to take their business elsewhere.
But again I think they do physical terminals for chip & PIN so this isn’t much of a problem.
I have not heard if the drafted revisions to the industry standards have been accepted or not. I would have thought that when they are we would hear about this…not least from Square but from journal write ups too.
I’m really surprised Square is supporting PIN in the UK market, they don’t in the US market. I’m not overly paranoid (plus I’d never enter my PIN on it, it supports contactless) but it does generally seem a bad idea.
That said, this also hits on the huge security benefit of contactless people rarely mention - PIN skimming prevention. Since you’re entering your PIN far less often you’re greatly reducing the chances for it to be skimmed. Due to this, it’s much safer actually to use contactless wherever you can.
Honestly though, while I don’t care since I’d always use contactless, I think Square should have shipped without PIN support in the UK (just like in the US). PIN on glass on untrusted hardware is an unnecessary risk. Not a hugely scary one, but unnecessary.
I think this is a pretty awful approach to inclusion and implies that those with visual impairment should expect to have to go through contortions and commit minor fraud just to make a simple purchase. Or be turned away because the merchant doesn’t have a PIN entry device that conforms to modern and well established accessibility standards.
As you know, there are various alternatives (mentioned ) which don’t suffer from these issues, but which do provide secure PIN entry devices which can be used by all.
Alternatives exist but it’s always a trade-off, sometimes it’s very good not to have a separate device and do the entire transaction directly on your phone - one less thing to charge, not worry about loosing it, etc.
As far as I know it’s not forbidden to refuse business to a rude customer, disabled or not. Again, happy to help, but if they instead prefer to rudely complain then they are free (and encouraged) to take their business elsewhere.
[quote=“jzw95, post:84, topic:8221”]
I think this is a pretty awful approach to inclusion and implies that those with visual impairment should expect to have to go through contortions and commit minor fraud just to make a simple purchase. Or be turned away because the merchant doesn’t have a PIN entry device that conforms to modern and well established accessibility standards.[/quote]
It isn’t ‘committing minor fraud’ - if it’s their scribble, it’s their signature. There’s no fraud in being unable to make a nice signature, sorry. Not signing at all isn’t fraud either.
I agree, but PIN is mostly getting phased out for POS anyway. Square should have simply done like in the US and not enabled PIN support at all. That said, I do agree - I’m opposed to PIN on glass type solutions. But it’s a minor concern. Contactless and chip and signature are accessible alternatives.
Rjevski said no such thing. They were referring to people who simply don’t like the terminal, not to those who need assistance.
I do actually agree that PIN on glass on untrusted hardware isn’t the greatest idea ever, but it’s not a major concern either.
Except then no one would have bought it, because PIN is in wide-spread use. If you can’t accept Chip+PIN transactions, you’ll loose a lot of business. I think what Square did is that they didn’t have appropriate hardware for the UK market, but couldn’t be bothered/didn’t want to spend the money to develop appropriate hardware, so they’re just trying to bodge it.
Please explain how they’d lose business. I don’t understand this at all? Would anyone really refuse to shop at a business because of the CVM selection?
For the same reason businesses accept cards at all. If someone wants to pay by card and for whatever reason can’t use contactless (amount, card doesn’t support it, etc.), they simply won’t shop there. And a business isn’t going to accept signature as the CVM because then they’re liable for any fraudulent chargebacks. So I can’t see much of a market for a card reader that forces you to either turn away customers or else accept fraud liability.
Yes, if a terminal doesn’t support offline PIN for MasterCard there is fraud liability for lost/stolen fraud if a contact chip transaction on a PIN preferring card is attempted. But that hasn’t caused Square any issue in the US, where the same liability shift is in place for MasterCard. I’ve never heard of a US merchant not getting Square because they’re worried about lost/stolen PIN-preferring MasterCard and American Express liability.
The bigger issue is Visa, which has very different rules between the US and Europe. In the US, Visa has no PIN liability shift (shops do not have to support PIN to avoid liability for lost/stolen fraud). In Europe, Visa simply doesn’t allow contact terminals without offline PIN support, period.
However, Square was able to get a waiver of the PCI PTS standards for entering the UK market. If they could do that, I can’t imagine it’d be any harder to get a waiver of the offline PIN support requirement (it should be easier, PIN on glass is arguably a higher risk to Visa than no PIN support at all).
That’s because the vast majority of card in the US aren’t PIN-preferring, they’re still signature. Different market. As I say, I think Square designed their hardware for the US market and couldn’t be bothered to develop something appropriate for Chip+PIN markets.
Correct, but the liability shift is still in place for the handful of PIN-preferring MasterCards there are, plus foreign MasterCards. Never heard of a merchant in the US worried. Lost/stolen fraud is just so rare.
It’s the cloned card (EMV) liability shift they all care about.
Presumably because it’s a very tiny minority of their transactions, so their risk is minimal. That’s a different market to the UK where the vast majority of chip cards prefer PIN, so a much larger risk.
That is a fair point. Given there’s no PIN liability shift for Visa (only for US market, also by far the biggest player in the US market), and maybe 10% of the MasterCards and American Expresses they’ll see are PIN-preferring (unless in a touristy area), there’s probably less reason for it to concern them.
Just to tie this up, Allie has posted about the recent release of the official PCI standards for PIN on glass, so any further discussion should take place there.
) which don’t suffer from these issues, but which do provide secure PIN entry devices which can be used by all.